agent-bypass 2.16.0 → 2.17.0

package/scripts/origin_trace.py

@@ -0,0 +1,369 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""origin_trace — 源站溯源（绕 CDN/WAF）：DoH 真 IP + 证书透明度 + 漏质子域 + 直连指纹比对
+
+为什么需要：开了 TUN / fake-IP（iSH 常见 198.18.0.0/15）时，系统 DNS 拿不到真实 IP，
+历史解析、子域、CT 查询都会被污染；本工具统一走 DoH 拿真 IP，再逐个直连比对指纹。
+
+只读：仅做 DNS / HTTPS GET / CT 查询，不修改目标任何状态。授权范围内使用。
+
+用法:
+  python3 origin_trace.py example.com
+  python3 origin_trace.py example.com --json
+  python3 origin_trace.py example.com --max-candidates 60 --timeout 8
+  python3 origin_trace.py example.com --no-ct --max-candidates 8 --budget 60   # iSH/fake-IP：跳过 CT、限时防卡
+  DOH_PROVIDERS="https://1.1.1.1/dns-query" python3 origin_trace.py example.com
+
+输出: 候选源站表（ip / 分数 / 来源 / 标题 / Server / CDN 头），--json 输出机器可读结构。
+退出码: 0 正常（有候选）/ 1 无候选或全部失败 / 2 用法错误。
+"""
+import concurrent.futures
+import hashlib
+import json
+import re
+import socket
+import ssl
+import sys
+import time
+import urllib.parse
+import urllib.request
+
+try:
+    import netdns
+except Exception:                      # 单文件拷贝场景
+    netdns = None
+
+UA = "Mozilla/5.0 (compatible; origin-trace/1.0; +agent-bypass)"
+SUBS = [
+    "direct", "origin", "origin-www", "mail", "mx", "smtp", "pop", "imap",
+    "webmail", "autodiscover", "autoconfig", "cpanel", "whm", "ftp",
+    "dev", "test", "staging", "stage", "pre", "prod", "beta", "old",
+    "legacy", "backup", "admin", "api", "gateway", "vpn", "oa", "portal",
+    "m", "wap", "static", "img", "cdn", "assets", "uploads",
+]
+CDN_HEADERS = (
+    "cf-ray", "cf-cache-status", "x-cache", "via", "x-amz-cf-id", "x-amz-cf-pop",
+    "x-fastly-request-id", "x-akamai-transformed", "x-cdn", "x-served-by",
+    "x-cache-hits", "x-timer", "server-timing",
+)
+
+
+def _err(msg):
+    print(msg, file=sys.stderr)
+
+
+def is_ipv4(s):
+    if netdns is not None:
+        return netdns.is_ipv4(s)
+    return bool(re.match(r"^\d{1,3}(?:\.\d{1,3}){3}$", str(s)))
+
+
+def doh_resolve(name, timeout=6.0):
+    """DoH 真 IP；无 netdns 时退回系统解析。返回 [(ip, 'doh'|'system')]"""
+    if netdns is not None:
+        ips = netdns.doh_query(name, "A", timeout)
+        if ips:
+            return [(ip, "doh") for ip in ips]
+        ips = netdns.system_resolve(name, timeout)
+        return [(ip, "system") for ip in ips if not netdns.is_fake_ip(ip)]
+    try:
+        return [(socket.gethostbyname(name), "system")]
+    except OSError:
+        return []
+
+
+def fetch_ct_names(domain, timeout=8.0):
+    """证书透明度（crt.sh）里的 DNS 名；返回去重主机名列表。
+    crt.sh 偶发 502/超时：重试一次，仍失败则跳过（不阻塞主流程）。"""
+    url = "https://crt.sh/?q=" + urllib.parse.quote("%." + domain, safe="") + "&output=json"
+    last = None
+    for attempt in (1, 2):
+        try:
+            req = urllib.request.Request(url, headers={"user-agent": UA})
+            with urllib.request.urlopen(req, timeout=timeout) as r:
+                text = r.read(8 << 20).decode("utf-8", "ignore")
+            return parse_crtsh(text, domain)
+        except Exception as e:
+            last = e
+            if attempt == 1:
+                time.sleep(1.0)
+    _err("[crt.sh] 查询失败（已重试）: %s —— 跳过 CT，继续漏质子域" % last)
+    return []
+
+
+def parse_crtsh(text, domain):
+    """解析 crt.sh JSON → 该域名下的主机名（去通配符、去重、保序）。"""
+    try:
+        rows = json.loads(text)
+    except (ValueError, TypeError):
+        return []
+    if not isinstance(rows, list):
+        return []
+    out, seen = [], set()
+    for row in rows:
+        if not isinstance(row, dict):
+            continue
+        for raw in str(row.get("name_value") or "").split("\n"):
+            name = raw.strip().lower().lstrip("*.").rstrip(".")
+            if not name or name in seen:
+                continue
+            if name == domain or name.endswith("." + domain):
+                seen.add(name)
+                out.append(name)
+    return out
+
+
+def cdn_markers(headers):
+    return [h for h in CDN_HEADERS if h in headers]
+
+
+def extract_title(body):
+    m = re.search(r"<title[^>]*>(.*?)</title>", body, re.I | re.S)
+    if not m:
+        return ""
+    t = re.sub(r"\s+", " ", m.group(1)).strip()
+    return t[:120]
+
+
+def parse_response(data):
+    """原始 HTTP 响应 → dict(status/title/server/headers/cdn/location)。"""
+    head, _, body = data.partition(b"\r\n\r\n")
+    lines = head.decode("iso-8859-1", "ignore").split("\r\n")
+    status = lines[0].strip() if lines else ""
+    headers = {}
+    for line in lines[1:]:
+        if ":" in line:
+            k, v = line.split(":", 1)
+            headers[k.strip().lower()] = v.strip()
+    return {
+        "status": status,
+        "title": extract_title(body.decode("utf-8", "ignore")),
+        "server": headers.get("server", ""),
+        "location": headers.get("location", ""),
+        "headers": headers,
+        "cdn": cdn_markers(headers),
+        "body_sha1": hashlib.sha1(body).hexdigest()[:12] if body else "",
+    }
+
+
+def http_probe(ip, domain, timeout=8.0, method="GET"):
+    """直连 IP + 正确 SNI/Host 的 HTTPS 探测（不校验证书，仅采集指纹）。"""
+    ctx = ssl.create_default_context()
+    ctx.check_hostname = False
+    ctx.verify_mode = ssl.CERT_NONE
+    raw = socket.create_connection((ip, 443), timeout=timeout)
+    try:
+        sock = ctx.wrap_socket(raw, server_hostname=domain)   # SSLContext.wrap_socket 不接受 timeout 参数
+        sock.settimeout(timeout)
+        try:
+            cert = sock.getpeercert() or {}
+            sans = [v for k, v in cert.get("subjectAltName", ()) if k == "DNS"]
+            req = ("%s / HTTP/1.1\r\nHost: %s\r\nUser-Agent: %s\r\n"
+                   "Accept: */*\r\nConnection: close\r\n\r\n") % (method, domain, UA)
+            sock.sendall(req.encode("utf-8", "ignore"))
+            data = b""
+            end = time.monotonic() + max(timeout, 2.0)     # 读取总预算，防慢连接挂住
+            while len(data) < 131072 and time.monotonic() < end:
+                try:
+                    chunk = sock.recv(16384)
+                except (socket.timeout, OSError):
+                    break
+                if not chunk:
+                    break
+                data += chunk
+        finally:
+            sock.close()
+    finally:
+        try:
+            raw.close()
+        except Exception:
+            pass
+    info = parse_response(data)
+    info["cert_sans"] = sans
+    info["cert_domain_ok"] = any(
+        domain == x or domain.endswith("." + x.lstrip("*.")) for x in sans
+    )
+    return info
+
+
+def score_candidate(base, cand):
+    """候选 vs 基线指纹打分：同标题/同 Server/无 CDN 头/证书匹配加分。"""
+    score, reasons = 0, []
+    if base.get("title") and cand.get("title") and cand["title"] == base["title"]:
+        score += 3
+        reasons.append("title")
+    if base.get("status") and cand.get("status") == base.get("status"):
+        score += 1
+    if base.get("server") and cand.get("server") == base.get("server"):
+        score += 1
+        reasons.append("server")
+    if base.get("cdn") and not cand.get("cdn"):
+        score += 2
+        reasons.append("no-cdn-headers")
+    if cand.get("cert_domain_ok"):
+        score += 1
+        reasons.append("cert-san")
+    if cand.get("cdn"):
+        if base.get("cdn") and set(cand["cdn"]) & set(base["cdn"]):
+            score -= 2                       # 与基线同一 CDN = 还是 CDN 边缘，不是源站
+            reasons.append("same-cdn")
+        else:
+            score -= 1
+            reasons.append("cdn")
+    return score, reasons
+
+
+def collect_candidates(domain, max_candidates=40, timeout=8.0, use_ct=True):
+    """收集候选 (name, ip, sources)。"""
+    names = ["www." + domain, domain] + ["%s.%s" % (s, domain) for s in SUBS]
+    if use_ct:
+        ct = fetch_ct_names(domain, timeout)
+        if ct:
+            _err("[CT] crt.sh 返回 %d 个主机名" % len(ct))
+            names.extend(ct)
+    uniq, seen = [], set()
+    for n in names:
+        n = n.strip().lower().rstrip(".")
+        if n and n not in seen and (n == domain or n.endswith("." + domain)):
+            seen.add(n)
+            uniq.append(n)
+    uniq = uniq[:max_candidates]
+    _err("[候选] 解析 %d 个主机（DoH）" % len(uniq))
+
+    def one(name):
+        return name, doh_resolve(name, timeout)
+
+    by_ip = {}
+    with concurrent.futures.ThreadPoolExecutor(max_workers=8) as ex:
+        for name, pairs in ex.map(one, uniq):
+            for ip, src in pairs:
+                srcs = by_ip.setdefault(ip, {"ips": set(), "sources": set()})
+                srcs["sources"].add(name)
+    return by_ip
+
+
+def main(argv=None):
+    args = list(sys.argv[1:] if argv is None else argv)
+    domains, as_json, no_verify, no_ct = [], False, False, False
+    max_c, timeout, budget = 40, 8.0, 120.0
+    i = 0
+    while i < len(args):
+        a = args[i]
+        if a == "--json":
+            as_json = True
+        elif a == "--no-verify":
+            no_verify = True
+        elif a == "--no-ct":
+            no_ct = True
+        elif a in ("--max-candidates", "--timeout", "--budget"):
+            if i + 1 >= len(args):
+                _err("%s 缺少取值" % a)
+                return 2
+            try:
+                if a == "--max-candidates":
+                    max_c = max(1, int(args[i + 1]))
+                elif a == "--budget":
+                    budget = max(10.0, float(args[i + 1]))
+                else:
+                    timeout = max(1.0, min(float(args[i + 1]), 30.0))
+            except (TypeError, ValueError):
+                _err("%s 取值非法: %s" % (a, args[i + 1]))
+                return 2
+            i += 1
+        elif a.startswith("-"):
+            _err("未知参数: %s" % a)
+            return 2
+        else:
+            domains.append(a)
+        i += 1
+    if not domains:
+        _err(__doc__)
+        return 2
+
+    rc = 0
+    report = {}
+    for domain in domains:
+        _err("\n[*] %s" % domain)
+        root_ips = doh_resolve(domain, timeout)
+        real_root = [ip for ip, _s in root_ips]
+        if not real_root:
+            _err("[!] %s DoH 解析失败（检查出网/DoH 端点）" % domain)
+            rc = 1
+            continue
+        _err("[根] %s → %s" % (domain, ",".join(real_root)))
+
+        base = None
+        if not no_verify:
+            try:
+                base = http_probe(real_root[0], domain, timeout)
+                _err("[基线] %s | server=%s | cdn=%s | title=%r" % (
+                    base["status"], base["server"], ",".join(base["cdn"]) or "-", base["title"][:40]))
+            except Exception as e:
+                _err("[基线] 探测失败: %s（继续）" % e)
+
+        by_ip = collect_candidates(domain, max_c, timeout, use_ct=not no_ct)
+        for ip in real_root:                       # 根 IP 纳入候选
+            by_ip.setdefault(ip, {"sources": set()})["sources"].add(domain)
+
+        rows = []
+        end = time.monotonic() + budget
+        pending = [(ip, meta) for ip, meta in by_ip.items()]
+
+        def verify(item):
+            ip, meta = item
+            row = {"ip": ip, "sources": sorted(meta["sources"]),
+                   "score": 0, "reasons": [], "cdn": [], "title": "", "server": "",
+                   "status": "", "cert_sans": []}
+            if not no_verify and time.monotonic() < end:
+                try:
+                    cand = http_probe(ip, domain, timeout)
+                    row.update({k: cand.get(k) for k in
+                                ("status", "title", "server", "cdn", "cert_sans")})
+                    row["score"], row["reasons"] = score_candidate(base or {}, cand)
+                except Exception as e:
+                    row["error"] = str(e)[:80]
+            return row
+
+        if no_verify or not pending:
+            rows = [verify(it) for it in pending]
+        else:
+            with concurrent.futures.ThreadPoolExecutor(max_workers=6) as ex:
+                futs = {ex.submit(verify, it): it for it in pending}
+                try:
+                    for f in concurrent.futures.as_completed(futs, timeout=max(5.0, budget)):
+                        try:
+                            rows.append(f.result())
+                        except Exception:
+                            pass
+                except concurrent.futures.TimeoutError:
+                    _err("[预算] 验证超过 %.0fs，先返回已完成的候选" % budget)
+                finally:
+                    ex.shutdown(wait=False, cancel_futures=True)
+        rows.sort(key=lambda r: (-r["score"], r["ip"]))
+        report[domain] = rows
+
+        if as_json:
+            continue
+        print("\n%s 候选源站（分数高=更像源站）" % domain)
+        print("%-16s %5s  %-28s %-10s %s" % ("ip", "score", "sources", "server", "title"))
+        for r in rows[:max_c]:
+            print("%-16s %5d  %-28s %-10s %s%s" % (
+                r["ip"], r["score"], ",".join(r["sources"])[:27] or "-",
+                (r["server"] or "-")[:10], (r["title"] or "")[:40],
+                ("  [cdn:%s]" % ",".join(r["cdn"])) if r["cdn"] else ""))
+        strong = [r for r in rows if r["score"] >= 4 and not r["cdn"]]
+        if strong:
+            print("[结论] 高置信候选（无 CDN 头）: %s" % ", ".join(r["ip"] for r in strong[:5]))
+        elif rows:
+            print("[结论] 无高置信候选：可能源站未暴露/全站 CDN/TUN 干扰（用 --json 看细节）")
+            rc = rc or 1
+        else:
+            rc = 1
+
+    if as_json:
+        print(json.dumps(report, ensure_ascii=False, indent=2))
+    return rc
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/scripts/portscan.py

@@ -1,19 +1,32 @@
 #!/usr/bin/env python3
 # -*- coding: utf-8 -*-
 """
-并发端口扫描（无需 nmap）
+并发端口扫描（无需 nmap）——iSH / TUN / fake-IP 友好版
 
 提示: 手机环境（iSH/Termux）优先用 fastrecon.py scan —— selectors 并发实测快 5-45 倍
 
+iSH + TUN（Clash/mihomo/sing-box）常见问题：系统 DNS 被劫持成 fake-IP（198.18.0.0/15），
+直接扫域名会得到不可路由假地址 → 全部超时/误判。本脚本默认自动检测并用 DoH 拿真实 IP。
+
 用法:
   python3 portscan.py <host> [--ports 1-65535] [--conc 500] [--timeout 2]
   python3 portscan.py 1.2.3.4 --ports top100
-  python3 portscan.py 1.2.3.4 --ports 22,80,443,3306,6379
+  python3 portscan.py example.com --resolve doh        # 强制 DoH 解析
+  python3 portscan.py example.com --resolve none       # 只扫 IP，不解析
+  python3 portscan.py example.com --allow-fake         # 允许扫 fake-IP（一般不要）
 
-输出: jsonl（每行一个开放端口）
+输出: jsonl（每行一个开放端口，含 ip / host / port / service）
+退出码: 0 正常 / 2 参数错误 / 3 目标解析失败或只剩 fake-IP
 """
 import argsmini as argparse
-import asyncio, json, re, sys
+import asyncio, json, os, re, sys, time
+
+try:                       # 共享 DNS 工具（同目录 scripts/netdns.py）
+    import netdns
+except Exception:          # 单文件拷贝场景：退化为基础 socket 解析
+    netdns = None
+
+ISH = os.path.isdir('/var/minis') or bool(os.environ.get('MINIS_ROOT'))
 
 # 100 端口 = 40 高价值服务 + 60 经典（对齐 nmap top100 覆盖面）
 TOP100 = [21,22,23,25,53,80,110,111,135,139,143,443,445,993,995,1433,1521,1723,
@@ -40,6 +53,11 @@ COMMON = {
     50000:"db2"
 }
 
+FAKE_HINT = ("[fake-IP] 目标解析到 fake-IP（TUN 劫持 DNS），该地址不可信：\n"
+             "  1) 用 DoH 真 IP：python3 portscan.py <真实IP>  或 --resolve doh\n"
+             "  2) 关掉代理的 TUN 全局/DNS 劫持，或把目标加 DIRECT/fake-ip-filter\n"
+             "  3) 溯源同理：先 DoH 拿真 IP，再扫 IP（nmap -n -Pn <ip>）")
+
 
 def parse_ports(s):
     s = (s or "").strip().lower()
@@ -74,6 +92,53 @@ def parse_ports(s):
     return sorted(out)
 
 
+def split_host(raw):
+    """'https://example.com:8443/x' / 'example.com' / '1.2.3.4' → ('example.com', 8443|None)"""
+    s = (raw or "").strip()
+    s = re.sub(r'^[a-zA-Z][a-zA-Z0-9+.-]*://', '', s)
+    s = s.split('/', 1)[0]
+    m = re.match(r'^(\[[^\]]+\]|[^:\s/]+)(?::(\d{1,5}))?$', s)
+    if not m:
+        return None, None
+    host = m.group(1).strip('[]')
+    port = int(m.group(2)) if m.group(2) else None
+    if port is not None and not (1 <= port <= 65535):
+        return None, None
+    return host, port
+
+
+def is_ipv4_literal(s):
+    if netdns is not None:
+        return netdns.is_ipv4(s)
+    return bool(re.match(r'^\d{1,3}(?:\.\d{1,3}){3}$', str(s)))
+
+
+def is_fake_ip(ip):
+    if netdns is not None:
+        return netdns.is_fake_ip(ip)
+    return str(ip).startswith(('198.18.', '198.19.', '240.', '198.51.100.', '203.0.113.'))
+
+
+def resolve_target(host, mode="auto", timeout=6.0):
+    """返回 (ip, source, fake_list)。mode: auto/system/doh/none。"""
+    if is_ipv4_literal(host):
+        return host, "ip", []
+    if mode == "none":
+        return None, "none", []
+    if netdns is not None:
+        ips, source = netdns.resolve_real(host, prefer=("system" if mode == "system" else "doh" if mode == "doh" else "auto"),
+                                          timeout=timeout)
+    else:
+        try:
+            import socket as _s
+            ips, source = [_s.gethostbyname(host)], "system"
+        except Exception:
+            ips, source = [], "fail"
+    fake = [ip for ip in ips if is_fake_ip(ip)]
+    real = [ip for ip in ips if not is_fake_ip(ip)]
+    return (real[0] if real else (ips[0] if ips else None)), source, fake
+
+
 async def probe(host, port, timeout=2.0):
     try:
         r, w = await asyncio.wait_for(
@@ -88,31 +153,45 @@ async def probe(host, port, timeout=2.0):
         return None
 
 
-async def scan(host, ports, conc=500, timeout=2.0):
+async def scan(host, ports, conc=500, timeout=2.0, deadline=None):
+    """deadline（time.monotonic 秒）用于总时限：到点停发新探测，返回已扫到的部分结果。
+    返回 (open_ports, timed_out)。"""
     sem = asyncio.Semaphore(conc)
     open_ports = []
+    timed_out = False
 
     async def one(p):
+        nonlocal timed_out
+        if deadline is not None and time.monotonic() > deadline:
+            timed_out = True
+            return
         async with sem:
             r = await probe(host, p, timeout)
             if r:
                 open_ports.append(r)
 
     await asyncio.gather(*[one(p) for p in ports])
-    return sorted(open_ports)
+    return sorted(open_ports), timed_out
 
 
 def main():
-    ap = argparse.ArgumentParser(description="并发端口扫描（无需 nmap）")
+    ap = argparse.ArgumentParser(description="并发端口扫描（无需 nmap；自动绕 fake-IP）")
     ap.add_argument("host")
     ap.add_argument("--ports", default="top20",
                     help="1-65535 / top100 / top20 / 22,80,443")
     ap.add_argument("--conc", type=int, default=500, help="并发数")
     ap.add_argument("--timeout", type=float, default=2.0)
     ap.add_argument("--json", action="store_true", help="只输出 JSONL")
+    ap.add_argument("--resolve", choices=["auto", "system", "doh", "none"], default="auto",
+                    help="DNS 解析方式: auto(系统→DoH) / system / doh / none(只接受 IP)")
+    ap.add_argument("--allow-fake", action="store_true",
+                    help="允许扫描 fake-IP 地址（默认拒绝，防误判）")
+    ap.add_argument("--deadline", type=float, default=0,
+                    help="总时限秒（0=自动：按端口数/并发估算，最长 600s；到点返回部分结果）")
     a = ap.parse_args()
 
-    if not a.host or re.search(r"[\s/]", a.host):
+    name, inline_port = split_host(a.host)
+    if not name:
         print("[错误] host 只接受域名或 IP（可带 :端口）", file=sys.stderr)
         sys.exit(2)
     try:
@@ -124,20 +203,47 @@ def main():
     if conc != a.conc:
         print(f"[提示] 并发钳制为 {conc}（允许 1-2000）", file=sys.stderr)
     timeout = max(0.1, min(a.timeout, 30.0))
-    if timeout != a.timeout:
-        print(f"[提示] 超时钳制为 {timeout}s（允许 0.1-30）", file=sys.stderr)
+    if ISH and conc > 200:
+        conc = 200
+        print("[提示] iSH 环境并发降至 200（CPU 模拟 + 弱网更稳）", file=sys.stderr)
+    if ISH and timeout <= 2.0:
+        timeout = 3.0
+        print("[提示] iSH 环境超时上调至 3.0s", file=sys.stderr)
+    if inline_port and inline_port not in ports:
+        ports = sorted(set(ports) | {inline_port})
+
+    ip, source, fake = resolve_target(name, mode=a.resolve, timeout=max(timeout, 6.0))
+    if not ip:
+        print(f"[错误] 无法解析 {name}（--resolve {a.resolve}）", file=sys.stderr)
+        print(FAKE_HINT, file=sys.stderr)
+        sys.exit(3)
+    if fake and not any(not is_fake_ip(x) for x in [ip]):
+        if not a.allow_fake:
+            print(f"[错误] {name} 只解析到 fake-IP：{','.join(fake)}", file=sys.stderr)
+            print(FAKE_HINT, file=sys.stderr)
+            sys.exit(3)
+        print(f"[警告] 正在扫描 fake-IP（--allow-fake）：{ip}（结果不可信）", file=sys.stderr)
+    elif source == "doh":
+        print(f"[提示] 系统解析为 fake/IP 不可信，已用 DoH 真 IP: {ip}", file=sys.stderr)
+
     if not a.json:
-        print(f"# 扫描 {a.host} 共 {len(ports)} 端口 (并发 {conc})",
+        print(f"# 扫描 {name} → {ip}（{source}）共 {len(ports)} 端口 (并发 {conc})",
               file=sys.stderr)
 
-    open_ports = asyncio.run(scan(a.host, ports, conc, timeout))
+    overall = a.deadline if a.deadline > 0 else min(600.0, max(20.0, len(ports) * timeout / conc * 3 + 10))
+    deadline = time.monotonic() + max(5.0, min(overall, 3600.0))
+    open_ports, timed_out = asyncio.run(scan(ip, ports, conc, timeout, deadline))
+    if timed_out:
+        print(f"# 达到总时限 {overall:.0f}s：返回部分结果（可加大 --deadline 或降低端口数）", file=sys.stderr)
 
     for p in open_ports:
-        rec = {"host": a.host, "port": p, "service": COMMON.get(p, "?")}
+        rec = {"host": name, "ip": ip, "port": p, "service": COMMON.get(p, "?")}
         print(json.dumps(rec, ensure_ascii=False))
 
     if not a.json:
         print(f"# 开放 {len(open_ports)} 个: {open_ports}", file=sys.stderr)
+        if ISH:
+            print("# iSH 提示：并发已限制、超时已上调；长扫描用 --deadline 控制，配合 nohup 后台跑", file=sys.stderr)
 
 
 if __name__ == "__main__":