有手就行系列——大众点评 mtgsig 构造（微信小程序 wx-jsguard 纯算）

MURMUR_MAGIC = 0x5BD1E995

def murmur2_jsguard(data: bytes, seed: int) -> int:
    n = len(data)
    h = (seed ^ n) & 0xFFFFFFFF
    i = 0
    while n >= 4:
        k = data[i] | (data[i+1] << 8) | (data[i+2] << 16) | (data[i+3] << 24)
        k = (k * MURMUR_MAGIC) & 0xFFFFFFFF
        k ^= k >> 24
        k = (k * MURMUR_MAGIC) & 0xFFFFFFFF
        h = (h * MURMUR_MAGIC) & 0xFFFFFFFF
        h ^= k
        h &= 0xFFFFFFFF
        i += 4
        n -= 4
    # 尾部 1~3 字节按小端拼进 h（与常见 Murmur2 一致）
    if n >= 3: h ^= data[i+2] << 16
    if n >= 2: h ^= data[i+1] << 8
    if n >= 1:
        h ^= data[i]
        h = (h * MURMUR_MAGIC) & 0xFFFFFFFF
    h ^= h >> 13
    h = (h * MURMUR_MAGIC) & 0xFFFFFFFF
    h ^= h >> 15
    return (h ^ MURMUR_MAGIC) & 0xFFFFFFFF   # ← 多这一下

def custom_crc32(data: bytes) -> int:
    r = 0xFFFFFFFF
    for b in data:
        r = CRC_TABLE[(r ^ b) & 0xFF] ^ (r >> 8)
    return (0x12477CDF ^ r) & 0xFFFFFFFF

CUSTOM = "ZmserbBoHQtNP+wOcza/LpngG8yJq42KWYj0DSfdikx3VT16IlUAFM97hECvuRX5"
STD    = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"

def decode_a5(s: str) -> bytes:
    return base64.b64decode(s.translate(str.maketrans(CUSTOM, STD)))

def encode_a5(b: bytes) -> str:
    return base64.b64encode(b).decode().translate(str.maketrans(STD, CUSTOM))

def build_z(method: str, url: str, body: str = "") -> bytes:
    p = urllib.parse.urlparse(url)
    pairs = []
    for part in (p.query or "").split("&"):
        if not part:
            continue
        k, _, v = part.partition("=")
        k = urllib.parse.unquote(k.replace("+", " "))
        v = urllib.parse.unquote(v.replace("+", " "))
        pairs.append((fe(k), fe(v)))
    pairs.sort(key=lambda kv: (kv[0], kv[1]))
    w = "&".join(f"{k}={v}" for k, v in pairs)
    z = f"{method.upper()} {p.path} {w}".encode()
    if method.upper() != "GET" and body:
        z += body.encode()[:16200]
    return z

def build_a5(a6: str, ts_ms: int, env_flag: int, vm_out: bytes) -> str:
    o = ts_ms & 0xFFFFFFFF
    l = struct.pack(">I", o)                       # ie(o)
    md5_hex = hashlib.md5(a6.encode() + l).hexdigest()
    y = bytearray(int(md5_hex[i:i+2], 16) for i in range(0, 14, 2))  # 7 bytes
    y.append((env_flag ^ (custom_crc32(l) & 0xFF)) & 0xFF)
    y.extend(l)                                    # +4 → 12 bytes
    y.extend(struct.pack(">I", custom_crc32(bytes(y))))  # +4 → 16
    y.extend(vm_out)
    return encode_a5(bytes(y))

a5_bytes = decode_a5(captured["a5"])
vm_out   = bytes(a5_bytes[16:])
o        = captured["a2"] & 0xFFFFFFFF
l        = struct.pack(">I", o)
env_flag = a5_bytes[7] ^ (custom_crc32(l) & 0xFF)

x = murmur2_jsguard(z, s)
u = murmur2_jsguard(a5.encode(), s)
o = s & 0xFFFFFFFF
A = bytes.fromhex(
    le_hex_u32(x) + le_hex_u32(u) + le_hex_u32(x ^ o) + le_hex_u32(x ^ u ^ o)
)
a4 = (ie(x) + ie(u) + A).hex()

f = u & 0xFFFFFFFF
v = hashlib.md5(a6.encode() + ie(o)).hexdigest()   # 32 hex
M = f"{a1}{a2}{a3}{a4}{f}{v}{a7}"                  # 字符串拼接，f 是十进制
B = list(struct.unpack("<IIII", hashlib.md5(M.encode()).digest()))  # 4 个小端 u32

j = ((o << x0) | (o << (32 - x0))) & 0xFFFFFFFF    # 循环左移 x0 位
B[0] ^= j
B[1] ^= f
B[2] ^= f ^ j
B[3] ^= B[0]                                       # 注意依赖更新后的 B[0]

d1 = "".join(le_hex_u32(x) for x in B)             # 32 hex

@dataclass
class Seed:
    a1: str
    a3: str
    a6: str
    a7: str
    x0: int
    env_flag: int
    vm_out: bytes
    # 可选：抓包时的 a2，风控时间窗紧时优先复用

def forge(seed: Seed, method: str, url: str, body: str = "", ts_ms: int | None = None) -> dict:
    s = ts_ms if ts_ms is not None else int(time.time() * 1000)
    z = build_z(method, url, body)
    a5 = build_a5(seed.a6, s, seed.env_flag, seed.vm_out)

    x = murmur2_jsguard(z, s)
    u = murmur2_jsguard(a5.encode(), s)
    o = s & 0xFFFFFFFF
    A = bytes.fromhex(
        le_hex_u32(x) + le_hex_u32(u) + le_hex_u32(x ^ o) + le_hex_u32(x ^ u ^ o)
    )
    a4 = (ie(x) + ie(u) + A).hex()

    f = u & 0xFFFFFFFF
    v = hashlib.md5(seed.a6.encode() + ie(o)).hexdigest()
    M = f"{seed.a1}{s}{seed.a3}{a4}{f}{v}{seed.a7}"
    B = list(struct.unpack("<IIII", hashlib.md5(M.encode()).digest()))
    j = ((o << seed.x0) | (o << (32 - seed.x0))) & 0xFFFFFFFF
    B[0] = (B[0] ^ j) & 0xFFFFFFFF
    B[1] = (B[1] ^ f) & 0xFFFFFFFF
    B[2] = (B[2] ^ f ^ j) & 0xFFFFFFFF
    B[3] = (B[3] ^ B[0]) & 0xFFFFFFFF
    d1 = "".join(le_hex_u32(w) for w in B)

    return {
        "a1": seed.a1, "a2": s, "a3": seed.a3, "a4": a4,
        "a5": a5, "a6": seed.a6, "a7": seed.a7,
        "x0": seed.x0, "d1": d1,
    }

# 使用
headers["mtgsig"] = json.dumps(forge(seed, "GET", url), separators=(",", ":"))