逆向案例七——中国天气质量参数搜不到加密,以及应对禁止打开开发者工具和反debuger技巧

本文主要是介绍逆向案例七——中国天气质量参数搜不到加密,以及应对禁止打开开发者工具和反debuger技巧,希望对大家解决编程问题提供一定的参考价值,需要的开发者们随着小编来一起学习吧!

进入相关城市数据页面,发现不能调试

应对方法,再另一个页面,打开开发者工具,选择取消停靠到单独页面

 

接着,复制链接在该页面打开。接着会遇到debugger

 

再debugger处打上断点,一律不在此处暂停。

 

然后点击继续执行脚本即 亮光处,然后刷新页面。点击其他的月份数据,在xhr中发现数据包,表单有加密参数,而且搜索会搜索不到。

此时,就需要借助启动器,点击启动器send进入js代码

 

 在l.send处打上断点,然后点击新的月份,使断点生效。

 然后再调用堆栈中按send-ajax-....的顺序逐个点击。

最后发现这个页面,发现加密参数由函数poPBVxzNuafY8Yu生成,将鼠标放在该函数上,可以浮现该函数的来源,点击进去。

 

 

进入新的js代码后复制函数到pycharm中,这个函数需要两个参数,可以在控制台打印输出并复制。

 

初步写成代码:

m0fhOhhGL = "GETDAYDATA"
oNLhNQ = {'city': '北京', 'month': '202308'}
var post_data = function(m0fhOhhGL, oNLhNQ){var aMFs = '3c9208efcfb2f5b843eec8d96de6d48a';var cVWG2 = 'WEB';var t5GECZQ = new Date().getTime();var pKmSFk8 = {appId: aMFs,method: m0fhOhhGL,timestamp: t5GECZQ,clienttype: cVWG2,object: oNLhNQ,secret: hex_md5(aMFs + m0fhOhhGL + t5GECZQ + cVWG2 + JSON.stringify(osZ34YC04S(oNLhNQ)))};pKmSFk8 = BASE64.encrypt(JSON.stringify(pKmSFk8));pKmSFk8 = AES.encrypt(pKmSFk8, acky6QolJSJi, acixHVhiNqmK);return pKmSFk8;
};console.log(post_data(m0fhOhhGL,oNLhNQ))

输出结果为:

 

推断这是一个md5加密,因此进一步改进代码。

const CryptoJS = require('crypto-js')
m0fhOhhGL = "GETDAYDATA"
oNLhNQ = {'city': '北京', 'month': '202308'}
var post_data = function(m0fhOhhGL, oNLhNQ){var aMFs = '3c9208efcfb2f5b843eec8d96de6d48a';var cVWG2 = 'WEB';var t5GECZQ = new Date().getTime();var pKmSFk8 = {appId: aMFs,method: m0fhOhhGL,timestamp: t5GECZQ,clienttype: cVWG2,object: oNLhNQ,secret: CryptoJS.MD5(aMFs + m0fhOhhGL + t5GECZQ + cVWG2 + JSON.stringify(osZ34YC04S(oNLhNQ))).toString()};pKmSFk8 = BASE64.encrypt(JSON.stringify(pKmSFk8));pKmSFk8 = AES.encrypt(pKmSFk8, acky6QolJSJi, acixHVhiNqmK);return pKmSFk8;
};console.log(post_data(m0fhOhhGL,oNLhNQ))

然后出现新的问题:

 

同理进入这个函数的js中,并复制

 

其实这个函数就在同一个页面的上方 

 

 

改进后代码:

const CryptoJS = require('crypto-js')
m0fhOhhGL = "GETDAYDATA"
oNLhNQ = {'city': '北京', 'month': '202308'}
function osZ34YC04S(obj) {var newObject = {};Object.keys(obj).sort().map(function(key){newObject[key] = obj[key];});return newObject;
}
var post_data = function(m0fhOhhGL, oNLhNQ){var aMFs = '3c9208efcfb2f5b843eec8d96de6d48a';var cVWG2 = 'WEB';var t5GECZQ = new Date().getTime();var pKmSFk8 = {appId: aMFs,method: m0fhOhhGL,timestamp: t5GECZQ,clienttype: cVWG2,object: oNLhNQ,secret: CryptoJS.MD5(aMFs + m0fhOhhGL + t5GECZQ + cVWG2 + JSON.stringify(osZ34YC04S(oNLhNQ))).toString()};pKmSFk8 = BASE64.encrypt(JSON.stringify(pKmSFk8));pKmSFk8 = AES.encrypt(pKmSFk8, acky6QolJSJi, acixHVhiNqmK);return pKmSFk8;
};console.log(post_data(m0fhOhhGL,oNLhNQ))

 结果发现:

可以看出最开始的函数中,不仅缺少BASE64,还缺少AES。

这两个函数也在同页面的上方。

改进代码:

const CryptoJS = require('crypto-js')
m0fhOhhGL = "GETDAYDATA"
oNLhNQ = {'city': '北京', 'month': '202308'}
var BASE64 = {encrypt: function(text) {var b = new Base64();return b.encode(text);},decrypt: function(text) {var b = new Base64();return b.decode(text);}
};
function osZ34YC04S(obj) {var newObject = {};Object.keys(obj).sort().map(function(key){newObject[key] = obj[key];});return newObject;
}
var post_data = function(m0fhOhhGL, oNLhNQ){var aMFs = '3c9208efcfb2f5b843eec8d96de6d48a';var cVWG2 = 'WEB';var t5GECZQ = new Date().getTime();var pKmSFk8 = {appId: aMFs,method: m0fhOhhGL,timestamp: t5GECZQ,clienttype: cVWG2,object: oNLhNQ,secret: CryptoJS.MD5(aMFs + m0fhOhhGL + t5GECZQ + cVWG2 + JSON.stringify(osZ34YC04S(oNLhNQ))).toString()};pKmSFk8 = BASE64.encrypt(JSON.stringify(pKmSFk8));pKmSFk8 = AES.encrypt(pKmSFk8, acky6QolJSJi, acixHVhiNqmK);return pKmSFk8;
};console.log(post_data(m0fhOhhGL,oNLhNQ))

运行后发现:

 

缺少new Base

用同样的方法跳转,复制这个函数(很长,可以点击左侧折叠复制完整)

 

得到改进代码 

const CryptoJS = require('crypto-js')
m0fhOhhGL = "GETDAYDATA"
oNLhNQ = {'city': '北京', 'month': '202308'}
function Base64() {_keyStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",this.encode = function(a) {var c, d, e, f, g, h, i, b = "", j = 0;for (a = _utf8_encode(a); j < a.length; )c = a.charCodeAt(j++),d = a.charCodeAt(j++),e = a.charCodeAt(j++),f = c >> 2,g = (3 & c) << 4 | d >> 4,h = (15 & d) << 2 | e >> 6,i = 63 & e,isNaN(d) ? h = i = 64 : isNaN(e) && (i = 64),b = b + _keyStr.charAt(f) + _keyStr.charAt(g) + _keyStr.charAt(h) + _keyStr.charAt(i);return b},this.decode = function(a) {var c, d, e, f, g, h, i, b = "", j = 0;for (a = a.replace(/[^A-Za-z0-9\+\/\=]/g, ""); j < a.length; )f = _keyStr.indexOf(a.charAt(j++)),g = _keyStr.indexOf(a.charAt(j++)),h = _keyStr.indexOf(a.charAt(j++)),i = _keyStr.indexOf(a.charAt(j++)),c = f << 2 | g >> 4,d = (15 & g) << 4 | h >> 2,e = (3 & h) << 6 | i,b += String.fromCharCode(c),64 != h && (b += String.fromCharCode(d)),64 != i && (b += String.fromCharCode(e));return b = _utf8_decode(b)},_utf8_encode = function(a) {var b, c, d;for (a = a.replace(/\r\n/g, "\n"),b = "",c = 0; c < a.length; c++)d = a.charCodeAt(c),128 > d ? b += String.fromCharCode(d) : d > 127 && 2048 > d ? (b += String.fromCharCode(192 | d >> 6),b += String.fromCharCode(128 | 63 & d)) : (b += String.fromCharCode(224 | d >> 12),b += String.fromCharCode(128 | 63 & d >> 6),b += String.fromCharCode(128 | 63 & d));return b},_utf8_decode = function(a) {for (var b = "", c = 0, d = c1 = c2 = 0; c < a.length; )d = a.charCodeAt(c),128 > d ? (b += String.fromCharCode(d),c++) : d > 191 && 224 > d ? (c2 = a.charCodeAt(c + 1),b += String.fromCharCode((31 & d) << 6 | 63 & c2),c += 2) : (c2 = a.charCodeAt(c + 1),c3 = a.charCodeAt(c + 2),b += String.fromCharCode((15 & d) << 12 | (63 & c2) << 6 | 63 & c3),c += 3);return b}
}
var BASE64 = {encrypt: function(text) {var b = new Base64();return b.encode(text);},decrypt: function(text) {var b = new Base64();return b.decode(text);}
};
function osZ34YC04S(obj) {var newObject = {};Object.keys(obj).sort().map(function(key){newObject[key] = obj[key];});return newObject;
}
var post_data = function(m0fhOhhGL, oNLhNQ){var aMFs = '3c9208efcfb2f5b843eec8d96de6d48a';var cVWG2 = 'WEB';var t5GECZQ = new Date().getTime();var pKmSFk8 = {appId: aMFs,method: m0fhOhhGL,timestamp: t5GECZQ,clienttype: cVWG2,object: oNLhNQ,secret: CryptoJS.MD5(aMFs + m0fhOhhGL + t5GECZQ + cVWG2 + JSON.stringify(osZ34YC04S(oNLhNQ))).toString()};pKmSFk8 = BASE64.encrypt(JSON.stringify(pKmSFk8));pKmSFk8 = AES.encrypt(pKmSFk8, acky6QolJSJi, acixHVhiNqmK);return pKmSFk8;
};console.log(post_data(m0fhOhhGL,oNLhNQ))

这时候发现AES为定义:

 

用同样的方法复制AES

const CryptoJS = require('crypto-js')
m0fhOhhGL = "GETDAYDATA"
oNLhNQ = {'city': '北京', 'month': '202308'}var AES = {encrypt: function(text, key, iv) {var secretkey = (CryptoJS.MD5(key).toString()).substr(16, 16);var secretiv = (CryptoJS.MD5(iv).toString()).substr(0, 16);// console.log('real key:', secretkey);// console.log('real iv:', secretiv);secretkey = CryptoJS.enc.Utf8.parse(secretkey);secretiv = CryptoJS.enc.Utf8.parse(secretiv);var result = CryptoJS.AES.encrypt(text, secretkey, {iv: secretiv,mode: CryptoJS.mode.CBC,padding: CryptoJS.pad.Pkcs7});return result.toString();},decrypt: function(text, key, iv) {var secretkey = (CryptoJS.MD5(key).toString()).substr(16, 16);var secretiv = (CryptoJS.MD5(iv).toString()).substr(0, 16);secretkey = CryptoJS.enc.Utf8.parse(secretkey);secretiv = CryptoJS.enc.Utf8.parse(secretiv);var result = CryptoJS.AES.decrypt(text, secretkey, {iv: secretiv,mode: CryptoJS.mode.CBC,padding: CryptoJS.pad.Pkcs7});return result.toString(CryptoJS.enc.Utf8);}
};
function Base64() {_keyStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",this.encode = function(a) {var c, d, e, f, g, h, i, b = "", j = 0;for (a = _utf8_encode(a); j < a.length; )c = a.charCodeAt(j++),d = a.charCodeAt(j++),e = a.charCodeAt(j++),f = c >> 2,g = (3 & c) << 4 | d >> 4,h = (15 & d) << 2 | e >> 6,i = 63 & e,isNaN(d) ? h = i = 64 : isNaN(e) && (i = 64),b = b + _keyStr.charAt(f) + _keyStr.charAt(g) + _keyStr.charAt(h) + _keyStr.charAt(i);return b},this.decode = function(a) {var c, d, e, f, g, h, i, b = "", j = 0;for (a = a.replace(/[^A-Za-z0-9\+\/\=]/g, ""); j < a.length; )f = _keyStr.indexOf(a.charAt(j++)),g = _keyStr.indexOf(a.charAt(j++)),h = _keyStr.indexOf(a.charAt(j++)),i = _keyStr.indexOf(a.charAt(j++)),c = f << 2 | g >> 4,d = (15 & g) << 4 | h >> 2,e = (3 & h) << 6 | i,b += String.fromCharCode(c),64 != h && (b += String.fromCharCode(d)),64 != i && (b += String.fromCharCode(e));return b = _utf8_decode(b)},_utf8_encode = function(a) {var b, c, d;for (a = a.replace(/\r\n/g, "\n"),b = "",c = 0; c < a.length; c++)d = a.charCodeAt(c),128 > d ? b += String.fromCharCode(d) : d > 127 && 2048 > d ? (b += String.fromCharCode(192 | d >> 6),b += String.fromCharCode(128 | 63 & d)) : (b += String.fromCharCode(224 | d >> 12),b += String.fromCharCode(128 | 63 & d >> 6),b += String.fromCharCode(128 | 63 & d));return b},_utf8_decode = function(a) {for (var b = "", c = 0, d = c1 = c2 = 0; c < a.length; )d = a.charCodeAt(c),128 > d ? (b += String.fromCharCode(d),c++) : d > 191 && 224 > d ? (c2 = a.charCodeAt(c + 1),b += String.fromCharCode((31 & d) << 6 | 63 & c2),c += 2) : (c2 = a.charCodeAt(c + 1),c3 = a.charCodeAt(c + 2),b += String.fromCharCode((15 & d) << 12 | (63 & c2) << 6 | 63 & c3),c += 3);return b}
}
var BASE64 = {encrypt: function(text) {var b = new Base64();return b.encode(text);},decrypt: function(text) {var b = new Base64();return b.decode(text);}
};
function osZ34YC04S(obj) {var newObject = {};Object.keys(obj).sort().map(function(key){newObject[key] = obj[key];});return newObject;
}
var post_data = function(m0fhOhhGL, oNLhNQ){var aMFs = '3c9208efcfb2f5b843eec8d96de6d48a';var cVWG2 = 'WEB';var t5GECZQ = new Date().getTime();var pKmSFk8 = {appId: aMFs,method: m0fhOhhGL,timestamp: t5GECZQ,clienttype: cVWG2,object: oNLhNQ,secret: CryptoJS.MD5(aMFs + m0fhOhhGL + t5GECZQ + cVWG2 + JSON.stringify(osZ34YC04S(oNLhNQ))).toString()};pKmSFk8 = BASE64.encrypt(JSON.stringify(pKmSFk8));pKmSFk8 = AES.encrypt(pKmSFk8, acky6QolJSJi, acixHVhiNqmK);return pKmSFk8;
};console.log(post_data(m0fhOhhGL,oNLhNQ))

出现问题:有两个参数还未赋值,在该页面最顶部有赋值

 

 

也可以在最开始函数中,将鼠标放在这两个参数上得到值 

改进代码:

const CryptoJS = require('crypto-js')
const  acky6QolJSJi = "dLRSzDrm8xkryEyL";//AESkey,可自定义
const  acixHVhiNqmK = "fex6AA4zRfVrSPmr";//密钥偏移量IV,可自定义
m0fhOhhGL = "GETDAYDATA"
oNLhNQ = {'city': '北京', 'month': '202308'}var AES = {encrypt: function(text, key, iv) {var secretkey = (CryptoJS.MD5(key).toString()).substr(16, 16);var secretiv = (CryptoJS.MD5(iv).toString()).substr(0, 16);// console.log('real key:', secretkey);// console.log('real iv:', secretiv);secretkey = CryptoJS.enc.Utf8.parse(secretkey);secretiv = CryptoJS.enc.Utf8.parse(secretiv);var result = CryptoJS.AES.encrypt(text, secretkey, {iv: secretiv,mode: CryptoJS.mode.CBC,padding: CryptoJS.pad.Pkcs7});return result.toString();},decrypt: function(text, key, iv) {var secretkey = (CryptoJS.MD5(key).toString()).substr(16, 16);var secretiv = (CryptoJS.MD5(iv).toString()).substr(0, 16);secretkey = CryptoJS.enc.Utf8.parse(secretkey);secretiv = CryptoJS.enc.Utf8.parse(secretiv);var result = CryptoJS.AES.decrypt(text, secretkey, {iv: secretiv,mode: CryptoJS.mode.CBC,padding: CryptoJS.pad.Pkcs7});return result.toString(CryptoJS.enc.Utf8);}
};
function Base64() {_keyStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",this.encode = function(a) {var c, d, e, f, g, h, i, b = "", j = 0;for (a = _utf8_encode(a); j < a.length; )c = a.charCodeAt(j++),d = a.charCodeAt(j++),e = a.charCodeAt(j++),f = c >> 2,g = (3 & c) << 4 | d >> 4,h = (15 & d) << 2 | e >> 6,i = 63 & e,isNaN(d) ? h = i = 64 : isNaN(e) && (i = 64),b = b + _keyStr.charAt(f) + _keyStr.charAt(g) + _keyStr.charAt(h) + _keyStr.charAt(i);return b},this.decode = function(a) {var c, d, e, f, g, h, i, b = "", j = 0;for (a = a.replace(/[^A-Za-z0-9\+\/\=]/g, ""); j < a.length; )f = _keyStr.indexOf(a.charAt(j++)),g = _keyStr.indexOf(a.charAt(j++)),h = _keyStr.indexOf(a.charAt(j++)),i = _keyStr.indexOf(a.charAt(j++)),c = f << 2 | g >> 4,d = (15 & g) << 4 | h >> 2,e = (3 & h) << 6 | i,b += String.fromCharCode(c),64 != h && (b += String.fromCharCode(d)),64 != i && (b += String.fromCharCode(e));return b = _utf8_decode(b)},_utf8_encode = function(a) {var b, c, d;for (a = a.replace(/\r\n/g, "\n"),b = "",c = 0; c < a.length; c++)d = a.charCodeAt(c),128 > d ? b += String.fromCharCode(d) : d > 127 && 2048 > d ? (b += String.fromCharCode(192 | d >> 6),b += String.fromCharCode(128 | 63 & d)) : (b += String.fromCharCode(224 | d >> 12),b += String.fromCharCode(128 | 63 & d >> 6),b += String.fromCharCode(128 | 63 & d));return b},_utf8_decode = function(a) {for (var b = "", c = 0, d = c1 = c2 = 0; c < a.length; )d = a.charCodeAt(c),128 > d ? (b += String.fromCharCode(d),c++) : d > 191 && 224 > d ? (c2 = a.charCodeAt(c + 1),b += String.fromCharCode((31 & d) << 6 | 63 & c2),c += 2) : (c2 = a.charCodeAt(c + 1),c3 = a.charCodeAt(c + 2),b += String.fromCharCode((15 & d) << 12 | (63 & c2) << 6 | 63 & c3),c += 3);return b}
}
var BASE64 = {encrypt: function(text) {var b = new Base64();return b.encode(text);},decrypt: function(text) {var b = new Base64();return b.decode(text);}
};
function osZ34YC04S(obj) {var newObject = {};Object.keys(obj).sort().map(function(key){newObject[key] = obj[key];});return newObject;
}
var post_data = function(m0fhOhhGL, oNLhNQ){var aMFs = '3c9208efcfb2f5b843eec8d96de6d48a';var cVWG2 = 'WEB';var t5GECZQ = new Date().getTime();var pKmSFk8 = {appId: aMFs,method: m0fhOhhGL,timestamp: t5GECZQ,clienttype: cVWG2,object: oNLhNQ,secret: CryptoJS.MD5(aMFs + m0fhOhhGL + t5GECZQ + cVWG2 + JSON.stringify(osZ34YC04S(oNLhNQ))).toString()};pKmSFk8 = BASE64.encrypt(JSON.stringify(pKmSFk8));pKmSFk8 = AES.encrypt(pKmSFk8, acky6QolJSJi, acixHVhiNqmK);return pKmSFk8;
};console.log(post_data(m0fhOhhGL,oNLhNQ))

运行结果:

 

得到加密参数。 

 

 

 

 

 

 

 

 

这篇关于逆向案例七——中国天气质量参数搜不到加密,以及应对禁止打开开发者工具和反debuger技巧的文章就介绍到这儿,希望我们推荐的文章对编程师们有所帮助!



http://www.chinasem.cn/article/803488

相关文章

基于Python开发Windows自动更新控制工具

《基于Python开发Windows自动更新控制工具》在当今数字化时代,操作系统更新已成为计算机维护的重要组成部分,本文介绍一款基于Python和PyQt5的Windows自动更新控制工具,有需要的可... 目录设计原理与技术实现系统架构概述数学建模工具界面完整代码实现技术深度分析多层级控制理论服务层控制注

C#中通过Response.Headers设置自定义参数的代码示例

《C#中通过Response.Headers设置自定义参数的代码示例》:本文主要介绍C#中通过Response.Headers设置自定义响应头的方法,涵盖基础添加、安全校验、生产实践及调试技巧,强... 目录一、基础设置方法1. 直接添加自定义头2. 批量设置模式二、高级配置技巧1. 安全校验机制2. 类型

Java中的分布式系统开发基于 Zookeeper 与 Dubbo 的应用案例解析

《Java中的分布式系统开发基于Zookeeper与Dubbo的应用案例解析》本文将通过实际案例,带你走进基于Zookeeper与Dubbo的分布式系统开发,本文通过实例代码给大家介绍的非常详... 目录Java 中的分布式系统开发基于 Zookeeper 与 Dubbo 的应用案例一、分布式系统中的挑战二

90%的人第一步就错了! 顺利登录wifi路由器后台的技巧

《90%的人第一步就错了!顺利登录wifi路由器后台的技巧》登录Wi-Fi路由器,其实就是进入它的后台管理页面,很多朋友不知道该怎么进入路由器后台设置,感兴趣的朋友可以花3分钟了解一下... 你是不是也遇到过这种情况:家里网速突然变慢、想改WiFi密码却不知道从哪进路由器、新装宽带后完全不知道怎么设置?别慌

Java 中的 equals 和 hashCode 方法关系与正确重写实践案例

《Java中的equals和hashCode方法关系与正确重写实践案例》在Java中,equals和hashCode方法是Object类的核心方法,广泛用于对象比较和哈希集合(如HashMa... 目录一、背景与需求分析1.1 equals 和 hashCode 的背景1.2 需求分析1.3 技术挑战1.4

Java中实现对象的拷贝案例讲解

《Java中实现对象的拷贝案例讲解》Java对象拷贝分为浅拷贝(复制值及引用地址)和深拷贝(递归复制所有引用对象),常用方法包括Object.clone()、序列化及JSON转换,需处理循环引用问题,... 目录对象的拷贝简介浅拷贝和深拷贝浅拷贝深拷贝深拷贝和循环引用总结对象的拷贝简介对象的拷贝,把一个

基于Go语言开发一个 IP 归属地查询接口工具

《基于Go语言开发一个IP归属地查询接口工具》在日常开发中,IP地址归属地查询是一个常见需求,本文将带大家使用Go语言快速开发一个IP归属地查询接口服务,有需要的小伙伴可以了解下... 目录功能目标技术栈项目结构核心代码(main.go)使用方法扩展功能总结在日常开发中,IP 地址归属地查询是一个常见需求:

Java中最全最基础的IO流概述和简介案例分析

《Java中最全最基础的IO流概述和简介案例分析》JavaIO流用于程序与外部设备的数据交互,分为字节流(InputStream/OutputStream)和字符流(Reader/Writer),处理... 目录IO流简介IO是什么应用场景IO流的分类流的超类类型字节文件流应用简介核心API文件输出流应用文

录音功能在哪里? 电脑手机等设备打开录音功能的技巧

《录音功能在哪里?电脑手机等设备打开录音功能的技巧》很多时候我们需要使用录音功能,电脑和手机这些常用设备怎么使用录音功能呢?下面我们就来看看详细的教程... 我们在会议讨论、采访记录、课堂学习、灵感创作、法律取证、重要对话时,都可能有录音需求,便于留存关键信息。下面分享一下如何在电脑端和手机端上找到录音功能

Python函数的基本用法、返回值特性、全局变量修改及异常处理技巧

《Python函数的基本用法、返回值特性、全局变量修改及异常处理技巧》本文将通过实际代码示例,深入讲解Python函数的基本用法、返回值特性、全局变量修改以及异常处理技巧,感兴趣的朋友跟随小编一起看看... 目录一、python函数定义与调用1.1 基本函数定义1.2 函数调用二、函数返回值详解2.1 有返