agent-bypass 2.11.5 → 2.11.7

package/scripts/fastrecon.py

@@ -0,0 +1,980 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""fastrecon — 手机环境快速侦察（iSH / Termux 优化）
+
+实测基准（iSH on iOS）：
+  scan  50 端口超时场景：串行 40s → selectors 并发 0.9s（45x）
+  dns   批量 30 域名：串行 0.2s → UDP 并发 0.1s；缓存命中 0ms（DoH 1102ms 不可用）
+  http  10 URL：串行 15.2s → curl -Z 并行 2.7s（5.6x）
+
+用法：
+  fastrecon.py dns example.com github.com          # 批量解析（UDP 并发 + 缓存）
+  fastrecon.py dns subs.txt -w 50                  # 文件批量（每行一个域名）
+  fastrecon.py scan 192.168.1.1 -p top100          # 端口扫描（selectors 并发）
+  fastrecon.py scan 10.0.0.0/24 -p 22,80,443 -t 0.6
+  fastrecon.py http urls.txt -b 48                 # HTTP 批量探测（curl -Z 并行）
+  fastrecon.py http https://a.com,https://b.com --code
+
+纯标准库（socket/selectors/struct/subprocess/urllib）；无 root 依赖；Termux/iSH 通用。
+Python 3.8+。退出码：0 正常 / 1 用法错误 / 2 参数或目标非法。
+
+健壮性要点（2026-09 审查修订）：
+  * 域名先做合法性/IDNA 校验（尾部点、空标签、>63 字节标签、>253 字节全名 → 明确报错）
+  * DNS 应答按事务 ID 校验、按 RCODE 判定终局（NOERROR/NXDOMAIN 为终局；SERVFAIL 换下一台）
+  * 带 EDNS0(4096)，服务器返回 FORMERR/NOTIMP 时自动去掉 OPT 重试
+  * TC 截断且未取到 A 记录 → 自动 TCP 重发；仍失败则保留 UDP 已解析出的部分结果
+  * 端口/workers/timeout/batch 全部夹取到合法区间（0/负数不再死循环或抛栈）
+  * scan_host 任何异常路径都保证 close 全部 socket 与 selector；EMFILE 时优雅降级
+  * 缓存文件容忍损坏行/多余列/CRLF，写入用单次 O_APPEND write 降低并发交错
+  * http 走 --url 传参（URL 前导 '-' 不会被当选项）、URL 规范化转义空格与非 ASCII
+  * -w 输出按行解析并与期望条数比对，不一致时告警
+"""
+import argsmini as argparse
+import ipaddress, os, random, re, selectors, socket, struct, sys, time
+import platf
+
+# 懒加载：iSH 上 concurrent.futures/subprocess import 各耗 2-3s，仅首次使用时载入
+_cf_mod = None
+def _get_cf():
+    global _cf_mod
+    if _cf_mod is None:
+        import concurrent.futures as _c
+        _cf_mod = _c
+    return _cf_mod
+
+def _sp():
+    import subprocess
+    return subprocess
+_SH_OK = None
+def _curl_ok():
+    global _SH_OK
+    if _SH_OK is None:
+        _SH_OK = bool(os.popen("curl --version 2>/dev/null").read().strip())
+    return _SH_OK
+_SAFE = frozenset("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@%_+=:,./-")
+def _shq(s):
+    if s and all(c in _SAFE for c in s): return s
+    return "'%s'" % s.replace("'", "'" + chr(92) + "'" + "'")
+def _run_curl(cargs):
+    p = os.popen(" ".join(_shq(a) for a in cargs) + " 2>/dev/null")
+    out = p.read(); p.close(); return out
+import urllib.parse
+
+CACHE_FILE = os.path.expanduser('~/.fastrecon_cache.txt')
+FALLBACK_RESOLVERS = ['1.1.1.1', '8.8.8.8']
+MAX_DNS_WORKERS = 256
+MAX_SCAN_WORKERS = 1024
+MAX_HTTP_BATCH = 256
+DNS_UDP_BUF = 4096
+TOP100 = [21, 22, 23, 25, 53, 80, 81, 88, 110, 111, 135, 139, 143, 161, 389, 443, 445, 465, 502, 554,
+          587, 631, 636, 873, 902, 993, 995, 1025, 1080, 1099, 1433, 1521, 1723, 1883, 2049, 2082,
+          2083, 2181, 2222, 2375, 2376, 3000, 3128, 3260, 3306, 3389, 3690, 4000, 4369, 4443, 4848,
+          5000, 5222, 5432, 5555, 5601, 5672, 5900, 5901, 5984, 6000, 6379, 6443, 6667, 7001, 7443,
+          7474, 8000, 8008, 8080, 8081, 8088, 8443, 8880, 8888, 9000, 9001, 9042, 9090, 9092, 9200,
+          9300, 9443, 9999, 10000, 10250, 11211, 15672, 16379, 27017, 27018, 30000, 50000, 50070,
+          50090, 55555, 61616, 8086, 8883, 9093]
+
+
+# ============ 通用 ============
+
+def _warn(msg):
+    print(f'[警告] {msg}', file=sys.stderr)
+
+
+def _err(msg):
+    print(f'[错误] {msg}', file=sys.stderr)
+
+
+def _clamp_int(v, lo, hi, default):
+    """整数参数夹取到 [lo, hi]；非法/不可转换时用 default"""
+    try:
+        v = int(v)
+    except (TypeError, ValueError):
+        return default
+    return max(lo, min(v, hi))
+
+
+def _clamp_float(v, lo, hi, default):
+    """浮点参数夹取到 [lo, hi]；NaN/非法时用 default（NaN 会让 settimeout 抛栈）"""
+    try:
+        v = float(v)
+    except (TypeError, ValueError):
+        return default
+    if v != v:
+        return default
+    return max(lo, min(v, hi))
+
+
+def _dedup(seq):
+    """保序去重"""
+    seen, out = set(), []
+    for x in seq:
+        if x not in seen:
+            seen.add(x)
+            out.append(x)
+    return out
+
+
+def _is_ipv4(s):
+    if not isinstance(s, str):
+        return False
+    try:
+        return ipaddress.ip_address(s.strip()).version == 4
+    except ValueError:
+        return False
+
+
+def _is_addr_list(v):
+    """缓存值合法性：逗号分隔的 IP 列表"""
+    parts = [x for x in v.split(',') if x]
+    if not parts:
+        return False
+    try:
+        for p in parts:
+            ipaddress.ip_address(p)
+    except ValueError:
+        return False
+    return True
+
+
+def read_targets(t):
+    """目标：文件（每行一项，支持 # 注释）或逗号/空格分隔列表；空输入返回 []"""
+    if not t:
+        return []
+    if os.path.isfile(t):
+        try:
+            with open(t, encoding='utf-8', errors='ignore') as f:
+                return [l.strip() for l in f if l.strip() and not l.strip().startswith('#')]
+        except OSError:
+            return []
+    return [x for x in re.split(r'[,\s]+', t) if x]
+
+
+def load_resolvers(override=None):
+    """resolver 列表；只接受 IPv4 字面量（UDP 查询走 AF_INET），去重保序"""
+    if override:
+        o = override.strip().strip('[]').split('%')[0]
+        return [o] if _is_ipv4(o) else []
+    rs = []
+    try:
+        with open('/etc/resolv.conf', encoding='utf-8', errors='ignore') as f:
+            for line in f:
+                m = re.match(r'\s*nameserver\s+(\S+)', line)
+                if not m:
+                    continue
+                a = m.group(1).strip('[]').split('%')[0]
+                if _is_ipv4(a) and a not in rs:
+                    rs.append(a)
+    except OSError:
+        pass
+    return rs or list(FALLBACK_RESOLVERS)
+
+
+# ============ DNS ============
+
+def _encode_qname(name):
+    """域名 → DNS 线格式；非法域名返回 None（不抛异常）"""
+    if not name or not isinstance(name, str):
+        return None
+    n = name.strip().rstrip('.')            # 容忍 FQDN 尾部点
+    if not n or len(n) > 253:
+        return None
+    out = b''
+    for part in n.split('.'):
+        if not part:                        # 空标签（a..b / 首尾点）
+            return None
+        try:
+            pb = part.encode('ascii') if part.isascii() else part.encode('idna')
+        except (UnicodeError, ValueError):
+            return None
+        if not 0 < len(pb) < 64:            # 标签长度 1..63
+            return None
+        out += bytes([len(pb)]) + pb
+    return out + b'\x00'
+
+
+def _skip_name(d, o):
+    """跳过域名，返回新偏移；越界/异常结构抛 IndexError"""
+    n = len(d)
+    hops = 0
+    while True:
+        if o >= n:
+            raise IndexError('truncated name')
+        l = d[o]
+        if l == 0:
+            return o + 1
+        if l & 0xC0 == 0xC0:                # 压缩指针
+            if o + 1 >= n:
+                raise IndexError('truncated pointer')
+            return o + 2
+        o += 1 + l
+        hops += 1
+        if hops > 128:                      # 防御畸形报文导致的长循环
+            raise IndexError('too many labels')
+
+
+def _parse_answers(data):
+    """从应答中提取 ANSWER 段的 A 记录（其余类型跳过）；异常报文返回已解析部分"""
+    ips = []
+    if len(data) < 12:
+        return ips
+    ancount = struct.unpack('>H', data[6:8])[0]
+    o = 12
+    try:
+        o = _skip_name(data, o) + 4         # 跳过 question（name + qtype + qclass）
+        for _ in range(min(ancount, 128)):
+            o = _skip_name(data, o)
+            if o + 10 > len(data):
+                break
+            t, _cl, _ttl, ln = struct.unpack('>HHIH', data[o:o + 10])
+            o += 10
+            if o + ln > len(data):
+                break
+            if t == 1 and ln == 4:
+                ips.append('.'.join(str(b) for b in data[o:o + 4]))
+            o += ln
+    except (IndexError, struct.error):
+        pass
+    return ips
+
+
+def _recv_exact(s, want):
+    buf = b''
+    while len(buf) < want:
+        try:
+            chunk = s.recv(want - len(buf))
+        except OSError:
+            break
+        if not chunk:
+            break
+        buf += chunk
+    return buf
+
+
+def _dns_tcp_query(q, srv, timeout):
+    """UDP 应答被截断（TC 位）时的 TCP 重发；失败返回 []（调用方保留部分结果）"""
+    try:
+        with socket.create_connection((srv, 53), timeout=timeout) as s:
+            s.settimeout(timeout)
+            s.sendall(struct.pack('>H', len(q)) + q)
+            hdr = _recv_exact(s, 2)
+            if len(hdr) < 2:
+                return []
+            n = struct.unpack('>H', hdr)[0]
+            if not 0 < n <= 65535:
+                return []
+            body = _recv_exact(s, n)
+            if len(body) < 12:
+                return []
+            return _parse_answers(body)
+    except OSError:
+        return []
+
+
+def _dns_dot_query(q, srv, timeout):
+    """DNS over TLS（RFC 7858）：TCP 853 + TLS 包装，帧格式同 TCP。失败返回 []。"""
+    try:
+        import ssl
+        ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+        ctx.check_hostname = False
+        ctx.verify_mode = ssl.CERT_NONE
+        with socket.create_connection((srv, 853), timeout=timeout) as raw:
+            with ctx.wrap_socket(raw, server_hostname=srv) as s:
+                s.settimeout(timeout)
+                s.sendall(struct.pack('>H', len(q)) + q)
+                hdr = _recv_exact(s, 2)
+                if len(hdr) < 2:
+                    return []
+                n = struct.unpack('>H', hdr)[0]
+                if not 0 < n <= 65535:
+                    return []
+                body = _recv_exact(s, n)
+                if len(body) < 12:
+                    return []
+                return _parse_answers(body)
+    except OSError:
+        return []
+
+
+def _dns_exchange(sock, q, qidb, srv, timeout):
+    """发送一次查询并等待 ID 匹配的应答；超时/无应答返回 None"""
+    # 先清掉上一步可能残留的迟到报文，避免串包
+    try:
+        sock.settimeout(0)
+        while True:
+            sock.recvfrom(DNS_UDP_BUF)
+    except OSError:
+        pass
+    try:
+        sock.sendto(q, (srv, 53))
+    except OSError:
+        return None
+    deadline = time.time() + timeout
+    while True:
+        remain = deadline - time.time()
+        if remain <= 0:
+            return None
+        try:
+            sock.settimeout(remain)
+            resp, _src = sock.recvfrom(DNS_UDP_BUF)
+        except (socket.timeout, OSError):
+            return None
+        if len(resp) >= 12 and resp[:2] == qidb:
+            return resp
+        # ID 不匹配 → 丢弃并继续等（防串包）
+
+
+def dns_query(name, servers, timeout=4.0, via="udp"):
+    """查询 A 记录。
+
+    返回 None：域名非法（未发查询）；返回 []：查询失败或确无 A 记录。
+    """
+    qn = _encode_qname(name)
+    if qn is None:
+        return None
+    timeout = _clamp_float(timeout, 0.2, 60.0, 4.0)
+    servers = [s for s in (servers or []) if _is_ipv4(s)] or list(FALLBACK_RESOLVERS)
+    qid = random.randint(0, 65535)
+    qidb = struct.pack('>H', qid)
+    head = struct.pack('>HHHHHH', qid, 0x0100, 1, 0, 0, 0) + qn + struct.pack('>HH', 1, 1)
+    # EDNS0：通告 4096 字节 UDP 缓冲，显著降低 TC 截断概率
+    q_edns = (struct.pack('>HHHHHH', qid, 0x0100, 1, 0, 0, 1) + qn + struct.pack('>HH', 1, 1)
+              + b'\x00' + struct.pack('>HHIH', 41, DNS_UDP_BUF, 0, 0))
+    if via == 'dot':
+        for srv in servers:
+            r = _dns_dot_query(head, srv, timeout)
+            if r:
+                return r
+        return []
+    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    try:
+        for srv in servers:
+            for q in (q_edns, head):        # EDNS0 被拒（FORMERR/NOTIMP）时去掉 OPT 重试
+                data = _dns_exchange(sock, q, qidb, srv, timeout)
+                if data is None:
+                    break                   # 该 resolver 超时/无应答 → 换下一台
+                rcode = data[3] & 0x0F
+                if rcode in (1, 4) and q is q_edns:
+                    continue
+                ips = _parse_answers(data)
+                if (data[2] & 0x02) and not ips:            # TC 截断且没拿到 A → TCP
+                    tcp = _dns_tcp_query(q, srv, timeout)
+                    if tcp:
+                        return tcp
+                if rcode in (0, 3) or ips:                  # NOERROR / NXDOMAIN / 有 A
+                    return ips
+                break                   # SERVFAIL / REFUSED → 换下一台
+    finally:
+        sock.close()
+    if via == 'auto':
+        for srv in servers:                 # UDP 全挂 → DoT 853 兜底
+            r = _dns_dot_query(head, srv, timeout)
+            if r:
+                return r
+    return []
+
+
+def cache_load():
+    """读取缓存：容忍损坏行、多余列、CRLF、空行、# 注释；同名后者覆盖前者"""
+    c = {}
+    try:
+        with open(CACHE_FILE, encoding='utf-8', errors='ignore') as f:
+            for line in f:
+                line = line.strip()
+                if not line or line.startswith('#'):
+                    continue
+                parts = line.split('\t')
+                if len(parts) < 2:
+                    continue
+                k, v = parts[0].strip(), parts[1].strip()
+                if k and v and _is_addr_list(v):
+                    c[k] = v
+    except OSError:
+        pass
+    return c
+
+
+def cache_append(entries):
+    """追加写缓存。单次 O_APPEND write：多进程并发时把交错窗口压到最小"""
+    if not entries:
+        return
+    payload = ''.join(f'{n}\t{v}\n' for n, v in entries)
+    try:
+        fd = os.open(CACHE_FILE, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o600)
+    except OSError:
+        return
+    try:
+        os.write(fd, payload.encode('utf-8'))
+    except OSError:
+        pass
+    finally:
+        os.close(fd)
+
+
+def _norm_addr(a):
+    """地址归一：::ffff:1.2.3.4 → 1.2.3.4，非法返回 None（UDP/TCP 与 getent 输出保持一致）"""
+    try:
+        ip = ipaddress.ip_address(a)
+    except (ValueError, TypeError):
+        return None
+    if ip.version == 6 and ip.ipv4_mapped is not None:
+        return str(ip.ipv4_mapped)
+    return str(ip)
+
+
+def _getent_one(n):
+    """兜底解析：系统 getent 优先（走 libc/TCP），失败再退回 getaddrinfo"""
+    addrs = []
+    try:
+        r = _sp().run(['getent', 'hosts', n], capture_output=True,
+                           encoding='utf-8', errors='replace', timeout=6)
+        for line in (r.stdout or '').splitlines():
+            p = line.split()
+            if not p:
+                continue
+            a = _norm_addr(p[0])
+            if a and a not in addrs:
+                addrs.append(a)
+    except Exception:
+        addrs = []
+    if not addrs:
+        try:
+            for info in socket.getaddrinfo(n, None):
+                a = _norm_addr(info[4][0])
+                if a and a not in addrs:
+                    addrs.append(a)
+        except Exception:
+            pass
+    return n, addrs
+
+
+def _cache_key(n):
+    return n.strip().rstrip('.').lower()
+
+
+def _run_pool(items, fn, workers):
+    items = list(items)
+    if len(items) <= 1:
+        return [fn(x) for x in items]
+    import threading
+    out = [None] * len(items)
+    nxt = [0]
+    lock = threading.Lock()
+    def worker():
+        while True:
+            with lock:
+                if nxt[0] >= len(items):
+                    return
+                i = nxt[0]
+                nxt[0] += 1
+            try:
+                out[i] = fn(items[i])
+            except Exception:
+                out[i] = (items[i], [])
+    ts = [threading.Thread(target=worker, daemon=True)
+          for _ in range(max(1, min(workers, len(items))))]
+    for t in ts:
+        t.start()
+    for t in ts:
+        t.join()
+    return out
+
+
+def cmd_dns(args):
+    names = _dedup(read_targets(args.target))
+    if not names:
+        _err('未提供有效域名')
+        return 2
+    workers = _clamp_int(args.workers, 1, MAX_DNS_WORKERS, 50)
+    timeout = _clamp_float(args.timeout, 0.2, 60.0, 4.0)
+    if workers != args.workers:
+        _warn(f'workers 越界，已调整为 {workers}')
+    if timeout != args.timeout:
+        _warn(f'timeout 越界，已调整为 {timeout}')
+    servers = load_resolvers(args.resolver)
+    if not servers:
+        _warn(f'resolver 非法（{args.resolver!r}），回退 {FALLBACK_RESOLVERS[0]}')
+        servers = list(FALLBACK_RESOLVERS)
+
+    cache = {} if args.no_cache else cache_load()
+    todo, keys = [], {}
+    for n in names:
+        k = _cache_key(n)
+        keys[n] = k
+        hit = cache.get(k)
+        if hit:
+            print(f'{n}\t{hit}\t[缓存]')
+        else:
+            todo.append(n)
+    if not todo:
+        return 0
+
+    def one(n):
+        try:
+            return n, dns_query(n, servers, timeout=timeout, via=args.via)
+        except Exception as e:              # 单点失败不影响整批
+            print(f'[警告] {n} 解析异常: {e}', file=sys.stderr)
+            return n, []
+
+    t0 = time.time()
+    results = {}
+    for n, ips in _run_pool(todo, one, workers):
+        results[n] = ips
+    # 兜底：UDP 大批失败（网络过滤 UDP:53）→ getent / getaddrinfo 并发重试
+    failed = [n for n in todo if results.get(n) == []]
+    if len(failed) >= 2 and len(failed) > 0.6 * len(todo):
+        print(f'[兜底] UDP 失败 {len(failed)}/{len(todo)}，切换 getent 并发重试', file=sys.stderr)
+        for n, ips in _run_pool(failed, _getent_one, _clamp_int(workers, 1, 20, 20)):
+            if ips:
+                results[n] = ips
+    new_cache, written = [], set()
+    for n in todo:
+        ips = results.get(n)
+        if ips is None:
+            print(f'{n}\t-\t[非法域名]')
+        elif ips:
+            print(f'{n}\t{",".join(ips)}')
+            k = keys[n]
+            val = ','.join(ips)
+            # 同名（含大小写/尾部点差异）只写一行，避免缓存重复行堆积
+            if not cache.get(k) and k not in written:
+                written.add(k)
+                new_cache.append((k, val))
+        else:
+            print(f'{n}\t-')
+    if not args.no_cache:
+        cache_append(new_cache)
+    print(f'[完成] {len(todo)} 个解析 / {time.time()-t0:.1f}s', file=sys.stderr)
+    return 0
+
+
+# ============ 端口扫描 ============
+
+TOP_CAM = [80, 81, 88, 443, 554, 8554, 8000, 8080, 8081, 8899, 34567, 37777,
+           9527, 2000, 2020, 1935, 5000, 5001, 5540, 7070, 7447, 4520, 8787]
+
+
+def parse_ports(spec):
+    """端口规格 → 升序去重列表。非端口语法抛 ValueError；越界端口忽略；空结果返回 []"""
+    if not spec or not spec.strip():
+        return []
+    if spec.strip().lower() == 'top100':
+        return sorted(set(TOP100))
+    if spec.strip().lower() == 'cam':
+        return sorted(set(TOP_CAM))
+    ports = set()
+    for part in spec.split(','):
+        part = part.strip()
+        if not part:
+            continue
+        if '-' in part:
+            a, b = part.split('-', 1)
+            a, b = a.strip(), b.strip()
+            if not (a.isdigit() and b.isdigit()):
+                raise ValueError(f'非法端口区间: {part!r}')
+            lo, hi = int(a), int(b)
+            if lo > hi:
+                lo, hi = hi, lo
+            lo = max(lo, 1)
+            hi = min(hi, 65535)
+            if lo > hi:
+                raise ValueError(f'端口区间越界(1-65535): {part!r}')
+            ports.update(range(lo, hi + 1))
+        else:
+            if not part.isdigit():
+                raise ValueError(f'非法端口: {part!r}')
+            p = int(part)
+            if 1 <= p <= 65535:
+                ports.add(p)
+            else:
+                _warn(f'端口越界已忽略: {p}')
+    return sorted(ports)
+
+
+def expand_hosts(spec, limit=256):
+    """目标 → IPv4 列表；非法网段/超大网段跳过并提示"""
+    hosts = []
+    for item in read_targets(spec):
+        if '/' in item:
+            try:
+                net = ipaddress.ip_network(item, strict=False)
+            except ValueError:
+                print(f'[跳过] 非法网段: {item}', file=sys.stderr)
+                continue
+            if net.version == 6:
+                print(f'[跳过] {item}: 暂不支持 IPv6', file=sys.stderr)
+                continue
+            if net.num_addresses > limit:
+                print(f'[跳过] {item} 超过 {limit} 台上限（请拆成更小网段）', file=sys.stderr)
+                continue
+            hs = [str(h) for h in net.hosts()] or [str(net.network_address)]
+            hosts += hs
+        else:
+            hosts.append(item)
+    return _dedup(hosts)
+
+
+def _unregister(sel, s):
+    try:
+        sel.unregister(s)
+    except (KeyError, ValueError, OSError):
+        pass
+
+
+def _fd_cap():
+    """按 RLIMIT_NOFILE 约束并发连接数（iSH/Termux 默认 1024 或更小）"""
+    try:
+        import resource
+        soft = resource.getrlimit(resource.RLIMIT_NOFILE)[0]
+        if isinstance(soft, int) and soft > 0:
+            return max(16, min(soft - 32, MAX_SCAN_WORKERS))
+    except Exception:
+        pass
+    return MAX_SCAN_WORKERS
+
+
+def scan_host(host, ports, timeout, workers, banner_mode):
+    """selectors 并发非阻塞 connect + 逐 sock 精确超时清理。
+
+    任何异常路径都会 close 所有已开 socket 与 selector。
+    返回 (open_ports, banners, skipped_ports)；skipped>0 表示 fd 资源不足未能扫完。
+    """
+    workers = max(1, int(workers))
+    timeout = max(0.05, float(timeout))
+    sel = selectors.DefaultSelector()
+    opened = {}                     # sock -> (port, connect_ts)
+    pending = list(ports)
+    found, banners = [], {}
+    exhausted = False               # socket() 失败（EMFILE/ENFILE）→ 停止新建
+
+    def launch():
+        nonlocal exhausted
+        if exhausted:
+            return
+        while pending and len(opened) < workers:
+            p = pending[0]
+            try:
+                s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+            except OSError as e:
+                _warn(f'创建 socket 失败({e})，剩余端口可能未扫描')
+                exhausted = True
+                return
+            s.setblocking(False)
+            try:
+                s.connect_ex((host, p))          # 非阻塞：立即返回 EINPROGRESS
+                sel.register(s, selectors.EVENT_WRITE)
+            except (OSError, ValueError):
+                try:
+                    s.close()
+                except OSError:
+                    pass
+                pending.pop(0)                   # 建连/注册失败 → 丢弃该端口，不留悬挂 sock
+                continue
+            pending.pop(0)
+            opened[s] = (p, time.time())
+
+    try:
+        launch()
+        while opened or pending:
+            now = time.time()
+            # 精确超时清理：非阻塞 connect 超时不会触发 select 事件，需逐 sock 计时
+            for s in [s for s, (_p, t) in opened.items() if now - t > timeout]:
+                opened.pop(s, None)
+                _unregister(sel, s)
+                try:
+                    s.close()
+                except OSError:
+                    pass
+            if not opened:
+                if pending and not exhausted:
+                    launch()
+                    continue
+                break
+            for key, _ev in sel.select(0.05):
+                s = key.fileobj
+                if s not in opened:
+                    continue
+                p, _t = opened.pop(s)
+                _unregister(sel, s)
+                try:
+                    err = s.getsockopt(socket.SOL_SOCKET, socket.SO_ERROR)
+                except OSError:
+                    err = 1
+                if err == 0:
+                    found.append(p)
+                    if banner_mode:
+                        try:
+                            s.settimeout(1.0)
+                            b = s.recv(160)
+                            if b:
+                                banners[p] = b.decode('utf-8', 'replace').strip().split('\n')[0][:80]
+                        except OSError:
+                            pass
+                try:
+                    s.close()
+                except OSError:
+                    pass
+            launch()
+        return sorted(set(found)), banners, len(pending)
+    finally:
+        for s in list(opened):
+            _unregister(sel, s)
+            try:
+                s.close()
+            except OSError:
+                pass
+        opened.clear()
+        try:
+            sel.close()
+        except Exception:
+            pass
+
+
+def scan_thread_fallback(host, ports, timeout, workers):
+    """兜底：线程池 connect_ex（selectors 不可用时）"""
+    timeout = max(0.05, float(timeout))
+    n = max(1, min(int(workers), 200))
+
+    def one(p):
+        try:
+            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        except OSError:
+            return None
+        s.settimeout(timeout)
+        try:
+            return p if s.connect_ex((host, p)) == 0 else None
+        except OSError:
+            return None
+        finally:
+            try:
+                s.close()
+            except OSError:
+                pass
+
+    found = []
+    for r in _run_pool(ports, one, n):
+        if r:
+            found.append(r)
+    return sorted(set(found)), {}
+
+
+def cmd_scan(args):
+    hosts = expand_hosts(args.target)
+    if not hosts:
+        _err('未提供有效目标（主机 / CIDR / 文件）')
+        return 2
+    try:
+        ports = parse_ports(args.ports)
+    except ValueError as e:
+        _err(str(e))
+        return 2
+    if not ports:
+        _err(f'端口列表为空: {args.ports!r}（取值 1-65535 或 top100）')
+        return 2
+    workers = _clamp_int(args.workers, 1, min(MAX_SCAN_WORKERS, _fd_cap()), 500)
+    timeout = _clamp_float(args.timeout, 0.05, 60.0, 0.8)
+    if workers != args.workers:
+        _warn(f'workers 越界，已调整为 {workers}')
+    if timeout != args.timeout:
+        _warn(f'timeout 越界，已调整为 {timeout}')
+
+    rc = 0
+    for h in hosts:
+        try:
+            ip = str(ipaddress.IPv4Address(h))
+        except ValueError:
+            try:
+                ip = socket.gethostbyname(h)
+            except (OSError, UnicodeError):
+                print(f'{h}\tDNS 解析失败或非法地址')
+                rc = rc or 1
+                continue
+        t0 = time.time()
+        try:
+            found, banners, skipped = scan_host(ip, ports, timeout, workers, args.banner)
+        except Exception as e:
+            print(f'[兜底] selectors 异常（{e}），切换线程池扫描', file=sys.stderr)
+            try:
+                found, banners = scan_thread_fallback(ip, ports, timeout, workers)
+                skipped = 0
+            except Exception as e2:
+                _err(f'{h} 扫描失败: {e2}')
+                rc = 1
+                continue
+        dt = time.time() - t0
+        if found:
+            plist = ','.join(str(p) for p in found)
+            print(f'{h}\t{plist}\t({len(found)}/{len(ports)} 开放, {dt:.1f}s)')
+            for p in found:
+                if p in banners:
+                    print(f'  {p}\t{banners[p]}')
+        else:
+            print(f'{h}\t-\t(0/{len(ports)}, {dt:.1f}s)')
+        if skipped:
+            _warn(f'{h} 资源不足，{skipped} 个端口未扫描（可降低 -w）')
+    return rc
+
+
+# ============ HTTP 探测 ============
+
+def _normalize_url(u):
+    """补全 scheme + 转义空格/非 ASCII（避免 curl 把带空格的 URL 拆成两条）；
+    非法 URL 返回 ''。保留已存在的 %XX 转义（不二次编码）。"""
+    if not u or not isinstance(u, str):
+        return ''
+    u = u.strip()
+    if not u:
+        return ''
+    if not re.match(r'^[a-zA-Z][a-zA-Z0-9+.\-]*://', u):
+        u = 'https://' + u
+    try:
+        sp = urllib.parse.urlsplit(u)
+    except ValueError:
+        return ''
+    host = sp.hostname or ''
+    if not host or any(c.isspace() for c in host):
+        return ''
+    netloc = sp.netloc
+    if not host.isascii():
+        try:
+            netloc = netloc.replace(host, host.encode('idna').decode('ascii'), 1)
+        except (UnicodeError, ValueError):
+            return ''
+    path = urllib.parse.quote(sp.path, safe="/%:@!$&'()*+,;=~-._")
+    query = urllib.parse.quote(sp.query, safe="=&%:?#[]@!$'()*+,;~-._/")
+    frag = urllib.parse.quote(sp.fragment, safe="%:@!$&'()*+,;=~-._/?")
+    return urllib.parse.urlunsplit((sp.scheme.lower(), netloc, path, query, frag))
+
+
+def _http_py(urls, timeout, workers=16):
+    """兜底：纯 Python 并发 HTTP 探测（无 curl 或 curl 整批失败时）。
+    TLS 行为与 curl 默认一致（校验证书），保证两条路径结论一致。"""
+    import urllib.request, urllib.error, ssl as _ssl
+    timeout = _clamp_int(timeout, 1, 600, 8)
+    workers = _clamp_int(workers, 1, 64, 16)
+    ctx = _ssl.create_default_context()
+
+    def one(u):
+        t0 = time.time()
+        try:
+            req = urllib.request.Request(u, headers={'User-Agent': 'Mozilla/5.0'})
+            with urllib.request.urlopen(req, timeout=timeout, context=ctx) as r:
+                code = getattr(r, 'status', None) or 0
+                return f'{u} {code} {time.time()-t0:.3f}'
+        except urllib.error.HTTPError as e:
+            return f'{u} {e.code} {time.time()-t0:.3f}'
+        except Exception:
+            return f'{u} 0 {time.time()-t0:.3f}'
+
+    for line in _run_pool(urls, one, workers):
+        print(line)
+
+
+def cmd_http(args):
+    urls = read_targets(args.target)
+    if not urls:
+        _err('未提供有效 URL')
+        return 2
+    batch = _clamp_int(args.batch, 1, MAX_HTTP_BATCH, 48)
+    timeout = _clamp_int(args.timeout, 1, 600, 8)
+    if batch != args.batch:
+        _warn(f'batch 越界（1-{MAX_HTTP_BATCH}），已调整为 {batch}')
+    if timeout != args.timeout:
+        _warn(f'timeout 越界（1-600），已调整为 {timeout}')
+
+    targets = []
+    for u in urls:
+        nu = _normalize_url(u)
+        if nu:
+            targets.append(nu)
+        else:
+            _warn(f'跳过非法 URL: {u!r}')
+    if not targets:
+        _err('没有可用的 URL')
+        return 2
+
+    fmt = ('%{url_effective} %{http_code} %{time_total}\n' if not args.code
+           else '%{url_effective} %{http_code}\n')
+    use_py = False
+    done = 0
+    for i in range(0, len(targets), batch):
+        chunk = targets[i:i + batch]
+        if use_py:
+            _http_py(chunk, timeout, min(len(chunk), 32))
+            done += len(chunk)
+            continue
+        # --url 传参：URL 以 '-' 开头时不会被当成 curl 选项
+        cargs = ['curl', '-sS', '-Z', '--parallel-max', str(min(batch, len(chunk))),
+                 '-m', str(timeout), '-w', fmt]
+        for u in chunk:
+            cargs += ['-o', os.devnull, '--url', u]
+        out = _run_curl(cargs)
+        lines = [l for l in (out or '').splitlines() if l.strip()]
+        if not lines and not _curl_ok():
+            print('[兜底] 未找到 curl，切换 Python urllib 并发', file=sys.stderr)
+            use_py = True
+            _http_py(chunk, timeout, min(len(chunk), 32))
+            done += len(chunk)
+            continue
+        if not lines:
+            _warn(f'批 {i // batch} 无输出（curl 被拒或网络不通）')
+        if len(lines) != len(chunk):
+            _warn(f'批 {i // batch} 输出 {len(lines)} 条 != 请求 {len(chunk)} 条'
+                  f'（部分 URL 可能被 curl 直接拒绝）')
+        if lines:
+            sys.stdout.write('\n'.join(lines) + '\n')
+        done += len(chunk)
+    print(f'[完成] {done} 个 URL', file=sys.stderr)
+    return 0
+
+
+# ============ 入口 ============
+
+def main():
+    ap = argparse.ArgumentParser(prog='fastrecon', description='手机环境快速侦察（iSH/Termux）')
+    sub = ap.add_subparsers(dest='cmd')
+
+    d = sub.add_parser('dns', help='批量 DNS 解析（UDP 并发 + 本地缓存）')
+    d.add_argument('target', help='域名 / 逗号列表 / 文件')
+    d.add_argument('--resolver', help='指定 resolver（默认读 /etc/resolv.conf）')
+    d.add_argument('-w', '--workers', type=int, default=platf.env()['dns_workers'])
+    d.add_argument('--via', choices=['udp', 'dot', 'auto'], default='udp',
+                    help='解析通道: udp(默认) / dot(DoT 853) / auto(UDP 失败自动 DoT)')
+    d.add_argument('-t', '--timeout', type=float, default=4)
+    d.add_argument('--no-cache', action='store_true')
+
+    s = sub.add_parser('scan', help='端口扫描（selectors 并发）')
+    s.add_argument('target', help='主机 / CIDR / 文件')
+    s.add_argument('-p', '--ports', default='top100',
+                    help='top100 | cam(摄像头组) | 22,80 | 1-1000')
+    s.add_argument('-t', '--timeout', type=float, default=0.8, help='单个连接超时（默认 0.8s）')
+    s.add_argument('-w', '--workers', type=int, default=platf.env()['scan_workers'],
+                      help='并发连接数（按平台自动适配）')
+    s.add_argument('-b', '--banner', action='store_true', help='抓取服务横幅')
+
+    h = sub.add_parser('http', help='HTTP 批量探测（curl -Z 并行）')
+    h.add_argument('target', help='URL / 逗号列表 / 文件')
+    h.add_argument('-b', '--batch', type=int, default=platf.env()['http_workers'],
+                      help='并行数（按平台自动适配）')
+    h.add_argument('-t', '--timeout', type=int, default=8)
+    h.add_argument('--code', action='store_true', help='只输出 URL 和状态码')
+
+    args = ap.parse_args()
+    if not args.cmd:
+        ap.print_help()
+        return 1
+    return {'dns': cmd_dns, 'scan': cmd_scan, 'http': cmd_http}[args.cmd](args)
+
+
+if __name__ == '__main__':
+    try:
+        sys.exit(main())
+    except KeyboardInterrupt:
+        sys.stderr.write('\n[中断]\n')
+        sys.exit(130)
+    except BrokenPipeError:
+        try:
+            sys.stdout.close()
+        except Exception:
+            pass
+        sys.exit(0)