Skip to content

README.md

Latest commit

 

History

History
191 lines (156 loc) · 10.3 KB

README.md

File metadata and controls

191 lines (156 loc) · 10.3 KB
Raw

🧩 Funcaptcha-Solve-RSA

Go Status Purpose License

📩 Contact: 💬 t.me/negtvn  ·  🌐 Telegram

⭐ Give this repo a star if it's useful to you! ⭐
🚀 If it gets enough attention, I'll update and improve the source code.

⚠️ Archived — for educational purposes only. This project once worked but is no longer operational.

A high-performance HTTP service that solves ArkoseLabs FunCaptcha challenges. It reproduces a real browser's TLS/JA3 fingerprint, encrypts the browser environment (BDA) exactly like the JS client, drives the full Arkose challenge flow, and answers the visual waves via a pluggable recognition provider.

Written in Go, single binary, no external runtime dependencies beyond an image-recognition API.

Features

  • Browser-accurate TLS/JA3 + HTTP/2/HTTP/3 fingerprints via bogdanfinn/tls-client
  • Native BDA encryption (RSA-OAEP + AES-GCM) matching the Arkose client
  • Automatic RSA public-key recovery from obfuscated api.js
  • Multithreaded proof-of-work (PoW) engine, solved locally or offloaded to the caller
  • Per-solve fingerprint rotation with proxy-geo timezone/locale syncing
  • Async task API with owner-token auth, plus a synchronous /solve endpoint

Architecture

                              ┌──────────────────────────────┐
   HTTP client                │        cmd/server/main.go     │
      │                       │   load rsa_keys.json → config │
      │ POST /createTask      │        start api.Server       │
      ▼                       └───────────────┬───────────────┘
┌───────────────┐                             │
│ internal/api  │  createTask / getTask       ▼
│  server.go    │  submitPow / abortPow  ┌──────────────┐
│ session_store │◄──────────────────────►│ solver/*     │
└───────┬───────┘   task + PoW handoff   │ orchestrator │
        │                                 └──────┬───────┘
        │                                        │
        ▼                                        ▼
┌─────────────────────────── solve pipeline ───────────────────────────┐
│                                                                       │
│  fingerprint/  ──►  arkcrypto/  ──►  transport/  ──►  Arkose endpoints │
│   pick + refresh     encrypt BDA     TLS/JA3/H3        api.js          │
│                                                        /fc/gt2/  token │
│                                                        /fc/gfct/ game  │
│                                                            │           │
│                       recognition/ ◄──────────────────────┘           │
│                        answer waves ──►  /fc/ca/  submit              │
│                                                                       │
│  pow/ (if required)  ──►  solve challenge  ──►  continue              │
└───────────────────────────────────────────────────────────────────────┘

Request lifecycle: a client posts a challenge to /createTask (async) or /solve (sync); the server picks a fingerprint, bootstraps api.js, mints a session token at /fc/gt2/, pulls game data from /fc/gfct/, answers each wave through the recognition provider, and (when PoW is required) either solves it locally or hands it back to the client via /submitPow. The final captcha token is returned.

File Reference

Entry points

File Responsibility
cmd/server/main.go Service entry point: seeds RSA keys into config and starts the HTTP API server.
cmd/probe/main.go CLI diagnostic that issues one request through the TLS transport to inspect the emitted fingerprint.

API layer (internal/api)

File Responsibility
server.go HTTP routes and handlers; orchestrates async solves, PoW hand-off, concurrency limits, and owner-token auth.
session_store.go In-memory task store with PoW hand-off channels and a background reaper that expires stale tasks.

Solver (internal/solver)

File Responsibility
solver.go Top-level orchestrator: validates the target, runs bootstrap, then the wave-answering loop.
funcaptcha.go Session engine: api.js parsing, fingerprint context build/encrypt, /fc/gt2/ token, /fc/gfct/ game data.
dapib.go Runs the optional dapib anti-bot script to produce the tguess answer array.
bio.go Generates synthetic human-like mouse/pointer biometrics.
harbio.go Supplies HAR-derived biometric templates for the bio payload.
pow_offload.go Bridges PoW between the local engine and the caller-offload callback.

Recognition (internal/recognition)

File Responsibility
recognition.go Client for the external image-recognition provider that classifies each challenge wave.

Crypto (internal/arkcrypto, internal/rsakey)

File Responsibility
crypto.go BDA encryption: RSA-OAEP + AES-GCM and CryptoJS-compatible AES-CBC primitives.
json.go Compact, HTML-escape-free JSON and ordered-key blob builders matching the JS output.
murmur.go MurmurHash3 x64/128 implementation for fingerprint hashing.
rsakey/extract.go Recovers the RSA public key from obfuscated api.js via XOR brute-force against the SPKI prefix.

Proof of Work (internal/pow)

File Responsibility
pow.go Multithreaded PoW engine with deobfuscation and transform caching.
solve_local.go Local solver loop for the two PoW challenge types.
deobfuscate.go Deobfuscates the PoW challenge script before solving.

Fingerprint (internal/fingerprint)

File Responsibility
pool.go Loads browser fingerprint records from disk and picks one per scope.
refresh.go Per-solve mutation: jitters canvas, injects proxy timezone/locale, regenerates IDs and timestamps.
headers.go Derives client-hint headers, Accept-Language, and iPhone detection from the User-Agent.
fphash.go Computes the fingerprint f and ife hashes from the fe token list.
timezone.go Resolves proxy geolocation to a JS timezone offset and locale.

Transport (internal/transport)

File Responsibility
session.go HTTP session wrapper: proxy, cookies, ordered headers, and TLS profile management.
helpers.go Header-ordering and request-building helpers.
http3.go HTTP/3 (QUIC) transport support.
ja3profile.go Builds the JA3/TLS ClientHello profile per browser.

Config & Models

File Responsibility
config.go Central configuration loaded from environment variables and rsa_keys.json.
models.go Shared request/response and task/challenge structs.

Quick Start

# Build
go build -o solver ./cmd/server

# Run (defaults: HOST=127.0.0.1, PORT=2323)
RECOGNITION_PROVIDER=<provider> RECOGNITION_API_KEY=<key> ./solver

Endpoints

Method Path Purpose
POST /createTask Start an async solve; returns a task_id.
GET /getTask Poll task status/result.
POST /submitPow Submit a client-solved PoW for a pending task.
POST /abortPow Abort a pending PoW.
POST /solve Synchronous solve.
POST /solve/{id}/continue · /solve/{id}/abort Continue or abort a running solve.
GET /health Liveness check.

Configuration

Variable Description
HOST / PORT Listen address (default 127.0.0.1:2323).
RECOGNITION_PROVIDER / RECOGNITION_API_KEY Image-recognition backend and credentials.
NEGT_FP_PROFILE_SCOPE Fingerprint scope (e.g. desktop, iOS, random).
NEGT_FP_RANDOM_WEIGHTS Weights for random scope selection.
NEGT_ARID_SEED Seed for the x-ark-arid header.
NEGT_RSA_PUBLIC_KEY / NEGT_RSA_PUBLIC_KEY_HEX Override the RSA public key.

Security note: the server has no built-in authentication unless an owner token (X-API-Key) is supplied per task. Bind it to localhost or place it behind an authenticated gateway before exposing it.

Layout

cmd/          entry points (server, probe)
internal/     api · solver · recognition · arkcrypto · rsakey · pow · fingerprint · transport · config · models
fingerprint/  browser fingerprint records (per scope)
rsa_keys.json recovered/known Arkose RSA public keys

Disclaimer

This repository is published strictly for educational and research purposes — to document how browser fingerprinting, TLS/JA3 emulation, BDA encryption, and proof-of-work challenges work. The project was operational in the past and is no longer functional against current Arkose deployments.

It is shared as a reference for security researchers and learners. Do not use it to bypass protections on systems you do not own or are not authorized to test, or in any way that violates a service's terms of use or applicable law. The author accepts no liability for any misuse.

Made by @negtvn · t.me/negtvn