http://xhslink.com/o/4IVKoZeuj0O

xhslink.com/o/4IVKoZeuj0O
  → 302 → xiaohongshu.com/discovery/item/6955f790000000001f0042e2?xsec_token=...&type=normal
    → 302 → /404?errorCode=-510001

a1, webId, websectiga, sec_poison_id, gid, web_session, acw_tc, abRequestId

MOBILE_UA = (
    "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) "
    "AppleWebKit/605.1.15 (KHTML, like Gecko) "
    "Version/17.0 Mobile/15E148 Safari/604.1"
)

async with aiohttp.ClientSession(
    timeout=aiohttp.ClientTimeout(total=30),
    headers={
        "User-Agent": MOBILE_UA,
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
        "Accept-Language": "zh-CN,zh;q=0.9",
    },
) as s:
    async with s.get(share_url, allow_redirects=True) as resp:
        final_url = str(resp.url)
        html = await resp.text(errors="replace")

if "/404" in final_url or "errorCode=" in final_url:
    raise RuntimeError("笔记可能已被删除或风控命中")

def cdn_strip_watermark(url: str) -> str:
    clean = url.split("!")[0] if "!" in url else url     # 去掉 !h5_1080jpg 这类后缀
    path = urlparse(clean).path
    parts = path.strip("/").split("/")
    if len(parts) >= 3:
        image_path = "/".join(parts[2:])                 # 跳过 DATE 和 SIGN，只留 image_id
        return f"https://sns-img-qc.xhscdn.com/{image_path}"
    return url

def _first(patterns, html: str) -> str:
    for p in patterns:
        for m in re.finditer(p, html, re.I | re.DOTALL):
            val = m.group(1).strip() if m.group(1) else ""
            if val and val not in ("小红书", "小红书 - 你的生活指南"):
                return val
    return ""

title = _first([
    r'<meta\s+property="og:title"\s+content="([^"]+)"',
    r'"title":"([^"]+)"',
    r"<title[^>]*>(.*?)</title>",
], html) or "小红书内容"

author_name = _first([r'"nickname":"([^"]+)"', r'"nickName":"([^"]+)"'], html)
author_id   = _first([r'"userId":"([^"]+)"',   r'"user_id":"([^"]+)"'],  html)

content_raw = _first([r'"desc":"([^"]+)"', r'"content":"([^"]+)"', r'"text":"([^"]+)"'], html)

stats = {
    "liked":   _first([r'"likedCount":"?(\d+)"?'],     html),
    "comment": _first([r'"commentCount":"?(\d+)"?'],   html),
    "collect": _first([r'"collectedCount":"?(\d+)"?'], html),
    "share":   _first([r'"shareCount":"?(\d+)"?'],     html),
}

pt_ms = _first([r'"time":(\d{13})'], html)                  # 毫秒时间戳

def _unescape_js_string(s: str) -> str:
    return (s.replace(r"\u002F", "/")
             .replace(r"\u0026", "&")
             .replace(r"\u003D", "=")
             .replace(r"\u003F", "?")
             .replace(r"\u003A", ":")
             .replace(r"\n", "\n").replace(r"\t", "\t")
             .replace(r"\"", '"'))

topics = []
m = re.search(r'"tagList":\s*\[(.{0,5000}?)\]', html, re.DOTALL)
if m:
    topics = re.findall(r'"name":"([^"]+)"', m.group(1))
if not topics:                                               # 兜底：去 HTML 里扫 #xxx[话题]
    topics = re.findall(r"#([^\s#\[]+)\[话题\]", html)
topics = list(dict.fromkeys(topics))[:20]                    # 去重保序，最多 20 个

carousel = re.findall(
    r'class="onix-carousel-item"[^>]*>.*?<img[^>]*src=["\']([^"\'\s]+)["\']',
    html, re.DOTALL,
)
images = [
    {"index": i, "id": image_id_from_url(u), "url": u, "raw_url": cdn_strip_watermark(u)}
    for i, u in enumerate(carousel, 1)
]

video_urls = []
for pat in [
    r'"masterUrl":"([^"]+)"',
    r'"master_url":"([^"]+)"',
    r'"url":"(https://v\.xhscdn\.com[^"]+)"',
]:
    for m in re.finditer(pat, html):
        v = _unescape_js_string(m.group(1))
        if "_259.mp4" in v:                                  # 带水印视频变体，跳过
            continue
        if v not in video_urls:
            video_urls.append(v)

type_param = parse_qs(urlparse(final_url).query).get("type", [""])[0]

if type_param == "video" and video_urls:
    content_type = "video"
    videos = video_urls[:1]                                  # 主视频一条就够
elif video_urls:
    # 视频数跟图片数接近（比如都是 3 个），大概率是实况：每张静态图配一段 motion 视频
    content_type = "live_photo"
    live_photos = [
        {"index": i, "image_url": images[i-1]["raw_url"], "video_url": video_urls[i-1]}
        for i in range(1, min(len(images), len(video_urls)) + 1)
    ]
else:
    content_type = "image"

note_id      : 6955f790000000001f0042e2
title        : 𝐰𝐞𝐜𝐡𝐚𝐭｜情侣头像
author       : zhang / 5cd3f6730000000012033a83
content_type : image
images       : 12 张（全部换 CDN 域名拿无水印原图）
stats        : likes=857  comments=22  collects=290  shares=200
topics       : ['今天你换头像了吗', '情侣头像', 'cp', '头像分享', '今日头像分享',
               '可爱小猫', '猫猫是世界上最可爱的生物', '每日分享', '小动物头像', '头像']
publish      : 2026-01-01T12:26:56

note_id      : 69e3114b000000002202916e
title        : 仲夏可可很萌！
author       : 用眼泪把你复习一遍 / 6690bced000000000f0348e9
content_type : video
videos       : 1 条 master URL
stats        : likes=1209  comments=154  collects=160  shares=42
topics       : ['仲夏可可', '莓喵jk']
publish      : 2026-04-18T13:06:19

note_id      : 69e1594b000000000b010eaf
title        : 🇫🇷尼斯老城遇到杨超越董思成
author       : 喵了个汪 / 6161f5460000000002022ced
content_type : live_photo
images       : 3 张静态图 + 逐张配对的 motion 视频
stats        : likes=7  comments=3419  collects=5392  shares=5024
topics       : ['偶遇明星', '偶遇', '杨超越', '董思成', '法国', '尼斯', '尼斯老城区']
publish      : 2026-04-17T05:48:59

<script>
  window.__INITIAL_STATE__ = { "note": { "noteDetailMap": { "<note_id>": { "note": { ... } } } }, ... }
</script>

1. GET  /                                       载入首页
2. GET  /api/sec/v1/ds?appId=xhs-pc-web         预拉 JSVMP 解密脚本
3. POST /api/redcaptcha/v2/getconfig            验证码配置
4. POST /api/sec/v1/scripting  type=ds          scripting 通道预热
5. POST /api/sec/v1/sbtsource                   上报 sbt 源
6. POST /api/sec/v1/scripting  callback=seccallback   下发 websectiga / sec_poison_id
7. POST /api/sec/v1/shield/webprofile           上报指纹 → 下发 gid
8. POST /api/sns/web/v1/login/activate          游客激活 → 下发 web_session
9. runtime bootstrap: user/me, system/config, zones,
                      homefeed/category, global/config,
                      racing_get, racing_report

def gen_a1():
    hex_data = hex(int(time.time() * 1000))[2:]
    random_30 = ''.join(random.choices(
        "abcdefghijklmnopqrstuvwxyz1234567890", k=30))
    # GET_PLAT_FROM_CODE = 5（Windows 在前端 getPlatformCode 里走 other 分支返回 5）
    text = hex_data + random_30 + "5" + "0" + "000"
    crc32 = crc32_encode(text)
    return (text + str(crc32))[:52]                      # 52 字节定长

def gen_websectiga(js_text: str) -> str:
    b = re.search(r'"b":"(.*?)",', js_text).group(1)
    d = json.loads(re.search(r'"d":(.*?)\}\)', js_text).group(1))

    # 1. base64 解码 b，按每 5 个字符一组拆列表，每个字符值取 ord(c) - 1
    padding = len(b) % 4
    if padding:
        b += '=' * (4 - padding)
    decoded = base64.b64decode(b).decode('utf-8')
    decode_list = []
    chunk = []
    for c in decoded:
        if len(chunk) == 5:
            decode_list.append(chunk)
            chunk = []
        chunk.append(ord(c) - 1)
    if chunk:
        decode_list.append(chunk)

    # 2. 按 d[92]:d[93]+1 切片，再按固定偏移二次查表得到 64 个整数
    target = decode_list[d[92]:d[93]+1]
    key = [d[target[675 + i][2]] for i in range(0, 128, 2)]

    # 3. 按 for i in range(56, -1, -8) for j in range(8) 的双重循环拼 64 字符
    return "".join(chr(key[i + j]) for i in range(56, -1, -8) for j in range(8))

def encrypt_profile_data(fp: dict) -> str:
    fp_json = json.dumps(fp, separators=(',', ':'), ensure_ascii=False)
    fp_b64 = base64.b64encode(fp_json.encode())
    cipher = DES.new(b"zbp30y86", DES.MODE_ECB)
    # 零填充到 8 字节倍数
    pad_len = 8 - len(fp_b64) % 8
    padded = fp_b64 + b'\x00' * pad_len
    return cipher.encrypt(padded).hex()

{"msg": "当前版本过低，请刷新页面或关闭后重新打开页面", "code": 300042}

html = requests.get("https://www.xiaohongshu.com/").text
m = re.search(r'/vendor-dynamic\.([a-f0-9]+)\.js', html)
js = requests.get(f"https://static-resource.xhscdn.com/.../vendor-dynamic.{m.group(1)}.js").text
artifact_version = re.search(r'artifactVersion.*?(\d+\.\d+\.\d+)', js).group(1)
language_version = re.search(r'languageVersion.*?(\d+\.\d+\.\d+)', js).group(1)

candidates = [
    f"https://www.xiaohongshu.com/discovery/item/{note_id}"
    f"?app_platform=ios&app_version=9.22.1&share_from_user_hidden=true"
    f"&xsec_source=app_share&type=normal&xsec_token={quote(xsec_token, safe='')}",
    f"https://www.xiaohongshu.com/explore/{note_id}"
    f"?xsec_token={quote(xsec_token, safe='')}&xsec_source=pc_feed",
]

doc_headers = {
    "accept": "text/html,application/xhtml+xml,application/xml;q=0.9,"
              "image/avif,image/webp,image/apng,*/*;q=0.8",
    "referer": "https://www.xiaohongshu.com/",
    "sec-fetch-dest": "document",
    "sec-fetch-mode": "navigate",
    "sec-fetch-site": "same-origin",
    "upgrade-insecure-requests": "1",
}

def extract_assigned_json_object(html: str, var_name: str) -> str:
    m = re.search(rf"{re.escape(var_name)}\s*=\s*", html, flags=re.IGNORECASE)
    if not m:
        return ""
    # 跳过等号后的空白，定位第一个 '{'
    i = m.end()
    while i < len(html) and html[i].isspace():
        i += 1
    if i >= len(html) or html[i] != "{":
        return ""

    depth, in_string, quote_char, escaped = 0, False, "", False
    start = i
    for cursor in range(i, len(html)):
        ch = html[cursor]
        if in_string:
            if escaped:
                escaped = False
            elif ch == "\\":
                escaped = True
            elif ch == quote_char:
                in_string = False
            continue
        if ch in ('"', "'"):
            in_string, quote_char = True, ch
        elif ch == "{":
            depth += 1
        elif ch == "}":
            depth -= 1
            if depth == 0:
                return html[start : cursor + 1]
    return ""

"someField": undefined,
"someArray": [undefined]

def sanitize_initial_state(raw: str) -> str:
    s = re.sub(r":\s*undefined(?=[,}])", ": null", raw)
    s = re.sub(r"\[\s*undefined\s*\]", "[null]", s)
    return s

state = json.loads(sanitize_initial_state(extract_assigned_json_object(html, "window.__INITIAL_STATE__")))

def choose_note_payload(state: dict, note_id: str) -> dict:
    detail_map = (state.get("note") or {}).get("noteDetailMap") or {}
    if note_id and note_id in detail_map:
        return (detail_map[note_id] or {}).get("note") or {}
    for key, value in detail_map.items():
        if key != "undefined" and isinstance(value, dict):
            return value.get("note") or {}
    return {}

def _encrypt_headers_x3(a1, loadts, uri, params=None, data=None):
    # 把 query/body 拼到 uri 后面一起算签名
    if params:
        uri = f"{uri}?{urlencode(params).replace('%2C', ',')}"
    if data is not None:
        uri = uri + json.dumps(data, separators=(',', ':'))

    md5_url = hashlib.md5(uri.encode()).hexdigest()
    random_num = int(random.random() * 4294967295)
    timestamp = int(time.time() * 1000)

    # 11 段字节流 = 4+4+8+8+4+4+4+8+53+11+16 = 124 字节
    part1  = [119, 104, 96, 41]                                      # 固定 magic
    part2  = list(random_num.to_bytes(4, 'little'))
    # timestamp 8 字节 LE，第 0 字节改成 sum(b[1:5])+sum(b[5:8]) 低 8 位，全字节 XOR 41
    b = list(timestamp.to_bytes(8, 'little'))
    b[0] = (sum(b[1:5]) & 255) + sum(b[5:8]) & 0xFF
    part3  = [x ^ 41 for x in b]
    part4  = list(loadts.to_bytes(8, 'little'))
    part5  = list((int(random.random() * 99) + 1).to_bytes(4, 'little'))
    part6  = list((1293).to_bytes(4, 'little'))                       # window 属性数
    part7  = list(len(uri.encode()).to_bytes(4, 'little'))
    part8  = [b ^ (random_num & 255) for b in bytes.fromhex(md5_url)][:8]
    part9  = [len(a1)] + list(a1.encode())                             # 53
    part10 = [len('xhs-pc-web')] + list(b'xhs-pc-web')                 # 11
    part11 = [1, (random_num & 255) ^ 115,
              249, 83, 103, 103, 201, 181, 131, 99, 94, 7, 68, 250, 132, 21]

    raw = part1 + part2 + part3 + part4 + part5 + part6 + part7 \
        + part8 + part9 + part10 + part11
    encrypted = [i ^ j for i, j in zip(raw, XOR_KEY_124)]               # 固定 key
    return "mns0101_" + base58_encode(bytes(encrypted), CUSTOM_BASE58_TABLE)

p = {
    'x0': LANGUAGE_VERSION, 'x1': 'xhs-pc-web', 'x2': 'Windows',
    'x3': _encrypt_headers_x3(...),
    'x4': '' if data is None else 'object',
}
payload = url_quote(json.dumps(p, separators=(',', ':')))
return "XYS_" + custom_base64(utf8_to_bytes(payload), CUSTOM_BASE64_TABLE)

def _encrypt_b1(fp):
    # 从 80+ 字段指纹里挑 18 个（x33~x39 + x42~x46 + x48~x52 + x82）
    subset = {k: fp[k] for k in (
        'x33','x34','x35','x36','x37','x38','x39',
        'x42','x43','x44','x45','x46','x48','x49','x50','x51','x52','x82',
    )}
    raw = json.dumps(subset, separators=(',', ':'), ensure_ascii=False).encode()
    cipher = ARC4.new(b'xhswebmplfbt')
    ct = cipher.encrypt(raw).decode('latin1')
    # URL 编码后再手动拆百分号序列，目的是把非 ASCII 拆成单字节
    encoded = url_quote(ct, safe="!*'()~_-")
    b = []
    for c in encoded.split('%')[1:]:
        chars = list(c)
        b.append(int(''.join(chars[:2]), 16))
        [b.append(ord(j)) for j in chars[2:]]
    return custom_base64(bytes(b), CUSTOM_BASE64_TABLE)

source = {
    's0': 5,                       # GET_PLAT_FROM_CODE（Windows 走 other 分支 = 5）
    's1': '',
    'x0': '1',                     # localStorage.getItem("b1b1")，写死
    'x1': LANGUAGE_VERSION,        # 4.3.5
    'x2': 'Windows',
    'x3': 'xhs-pc-web',
    'x4': ARTIFACT_VERSION,        # 6.7.0
    'x5': cookie_a1,
    'x6': '', 'x7': '',            # 旧版是 XS / XT，现在写死
    'x8': b1,
    'x9': diy_mrc('' + '' + b1),   # 自实现 CRC32，校验 b1
    'x10': fp['x39'],              # 调用计数器，写死也能过
    'x11': 'normal',
}
return custom_base64(utf8_bytes(url_quote(json.dumps(source, separators=(',', ':'), ensure_ascii=False))),
                     CUSTOM_BASE64_TABLE)

x_b3_traceid   = ''.join(random.choices('abcdef0123456789', k=16))
x_t            = str(int(time.time() * 1000))

# x-xray 里有个 seq，每次调用自增——怀疑跟 x-s-common 里的 x10 是一类行为计数
seq = initial_seq + call_count
part1 = hex(int(time.time() * 1000) << 23 | seq)[2:].zfill(16)
part2 = hex((random_u32() << 32) | random_u32())[2:].zfill(16)
x_xray_traceid = part1 + part2

def normalize_page_context(ctx: dict | None) -> dict:
    out = {
        "location": "https://www.xiaohongshu.com/explore",
        "referer": "https://www.xiaohongshu.com/",
        "page_type": "explore",
    }
    if ctx:
        out.update({k: v for k, v in ctx.items() if v is not None})
    path = urlparse(out["location"]).path or "/"
    if "/search_result" in path:
        out["page_type"] = "search"
    elif "/user/profile" in path:
        out["page_type"] = "user_profile"
    elif "/explore/" in path or "noteId=" in out["location"]:
        out["page_type"] = "note_detail"
    else:
        out["page_type"] = "explore"
    return out

# 关键：受请求变化的字段
fp["x39"] = str(storage["sc"])                       # session counter，每请求 +1
fp["x44"] = str(int(time.time()*1000))               # 当前毫秒
fp["x57"] = "; ".join(f"{k}={v}" for k, v in cookies.items())  # 当前 cookie 快照
fp["x58"] = str(div_count)                           # 当前 page_type 下的 DOM div 数
fp["x59"] = str(resource_count)
fp["x61"] = str(window_props)
fp["x66"] = {"referer": ctx["referer"], "location": ctx["location"], "frame": 0}
fp["x69"] = f"{prefix}|{window_props}|{script_count}"
fp["x73"] = str(dom_count)

data = {
    "source_note_id": note_id,
    "image_formats": ["jpg", "webp", "avif"],
    "extra": {"need_body_topic": "1"},
    "xsec_source": "pc_feed",               # 从分享 URL 的 query 取
    "xsec_token": xsec_token,
}

{
  "code": 0, "success": true, "msg": "成功",
  "data": {
    "items": [{
      "id": "...", "model_type": "note",
      "note_card": {
        "note_id": "...", "type": "video",
        "title": "...", "desc": "...",
        "user": {"user_id": "...", "nickname": "..."},
        "interact_info": {"liked_count": "7.9万", "comment_count": "3419", ...},
        "image_list": [{"url_default": "...", "info_list": [...], "live_photo": true}],
        "video": {"media": {"stream": {"h264": [{"master_url": "...", "backup_urls": [...]}]}}},
        "tag_list": [{"id": "...", "name": "...", "type": "topic"}]
      }
    }]
  }
}

MAX_ATTEMPTS = 3
note_card = {}
for attempt in range(1, MAX_ATTEMPTS + 1):
    if attempt > 1:
        DEVICE_STATE_FILE.unlink(missing_ok=True)     # 删持久化设备状态
        session = await create_xhs_session()           # 重跑 9 步 bootstrap 换一套身份
    try:
        resp = await session.apis.note.note_detail(note_id, xsec_token)
        payload = await resp.json(content_type=None)
        items = (payload.get("data") or {}).get("items") or []
        if items and (items[0].get("note_card") or {}):
            note_card = items[0]["note_card"]
            break                                      # 成功
    except NeedCaptchaVerify as e:
        # 216 语义验证码 / 102 滑块验证；捕获后让下一轮重置身份重试
        last_err = f"attempt={attempt} verify={e.details.get('verifyType')}"
    finally:
        await session.close_session()

note_id      : 6955f790000000001f0042e2
title        : 𝐰𝐞𝐜𝐡𝐚𝐭｜情侣头像
author       : zhang / 5cd3f6730000000012033a83
content_type : image
images       : 12 张（每张带 infoList 多分辨率、url_pre、url_default、url）
stats        : liked=857  comment=22  collect=290  share=200
publish      : 2026-01-01T12:26:56
feed_attempts=2  feed_recovered_on_attempt=2   ← 本次首发抖动，第二轮捞回

note_id      : 69e3114b000000002202916e
title        : 仲夏可可很萌！
author       : 用眼泪把你复习一遍 / 6690bced000000000f0348e9
content_type : video
videos       : 6 条（master URL + 多条 CDN 备用）
stats        : liked=1209  comment=154  collect=160  share=42
publish      : 2026-04-18T13:06:19

note_id      : 69e1594b000000000b010eaf
title        : 🇫🇷尼斯老城遇到杨超越董思成
author       : 喵了个汪 / 6161f5460000000002022ced
content_type : live_photo
images       : 3 张静态图
videos       : 6 条（每张静态图配一段 motion，stream.h264 结构规整）
stats        : liked=7.9万  comment=3419  collect=5392  share=5024   ← 可读格式
publish      : 2026-04-17T05:48:59

step 1  /v1/feed + 自算 x-s / x-s-common        → source=feed_api         最干净
step 2  PC 会话打开分享页，读 __INITIAL_STATE__  → source=initial_state    完整笔记
step 3  读 <meta og:*> 标签                       → source=meta_fallback    只剩标题和封面

{
    "source": "mobile | html | api",
    "extract_source": "feed_api | initial_state | meta_fallback",
    "original_url": "...",
    "final_url": "...",
    "note_id": "...",
    "xsec_token": "...",
    "title": "...", "content": "...",
    "content_type": "image | video | live_photo",
    "author": {"name": "...", "user_id": "..."},
    "stats": {"liked": "...", "comment": "...", "collect": "...", "share": "..."},
    "topics": ["..."],
    "publish_time_ms": 0, "publish_time_iso": "...",
    "images": [{"index", "id", "url", "raw_url", "live_photo"}],
    "videos": ["..."],
    "live_photos": [{"index", "image_url", "video_url"}],
    "feed_attempts": 1,
    "feed_recovered_on_attempt": 1,
}