X-Argus X-Ladon X-Gorgon 算法还原（十七）

X-Argus X-Gorgon X-Ladon 交流2891590578

APP在每个请求的header中都加入了X-Ladon、X-Khronos、X-Gorgon、X-Argus四个安全参数，当url变动的时候，这几个参数也会跟着变化，下面是一个完整的请求报文：

{
    "GET": "https://api5-normal-c-hl.amemv.com/aweme/v1/life/mall/list/?cursor=0&request_tag_from=h5&backend_type_code=195679488&entry_atmosphere_id&count=10&city_code=350200&source=homepage_fresh&sort_code=7171691260363685932&atmosphere_id&has_deliverable=false&has_group=false&filter_type=0&enter_method=top_icon&need_filters=0&sort_session_id&location_permission=1&entry_type=3&distance_code=7171686102267346988&type_code=040000%7C080000%7C180000&iid=3644214056591579&device_id=1341841769250343&ac=wifi&channel=update&aid=1128&app_name=aweme&version_code=220900&version_name=22.9.0&device_platform=android&os=android&ssmix=a&device_type=MI+CC+9&device_brand=Xiaomi&language=zh&os_api=30&os_version=11&manifest_version_code=220901&resolution=1080*2221&dpi=440&update_version_code=22909900&_rticket=1682692605666&package=com.ss.android.ugc.aweme&cpu_support64=true&host_abi=armeabi-v7a&is_guest_mode=0&app_type=normal&minor_status=0&appTheme=light&need_personal_recommend=1&is_android_pad=0&ts=1682692459&cdid=d0cad09c-47ac-4535-84e5-9a78aebbb1fc HTTP/1.1",
    "Host": "api5-normal-c-hl.amemv.com",
    "Connection": "keep-alive",
    "Cookie": "store-region=cn-fj; store-region-src=did; install_id=3644214056591579; ttreq=1$b151171e30d2e26ac9a11d4f847d7142dd21273a; odin_tt=cf06edf9b99864210817aba1aa149a07be07a6fc38d27ff10db8202de931ed29454d1cd5385949e483c84532b61dc16356c2a8d114ab6ea05bac93e8186c7c968e474846c54a9ee86938e8f2c9ae8485; msToken=zyKDDKuz5TSNT_ebCpGyh3hSYx1E9UNR3b1imR5957Z-n09KvrAgxGT6LCg49EMt_pljWbZ1IB_LZp6XGROpnxuhMoEzniQs5A8PZ7VDM44=; ttwid=1%7Cq2Wty0B6qcpuBIx2y6F8pypBY-_yxHFvRJ0J3zJjDvE%7C1682690783%7C84649aed7763a7cace9c1df17eb2039fd3ceb3fa405b9d20ba35e02f1358521c",
    "Content-Type": "application/json",
    "x-tt-dt": "AAAT6MK6SUZ347JUGYUCTJV4QXCMSOJXJCZ65VATRGOAAFEORRO37DE3H5HKUS3MBQDSJFJTF4MR5VUOAQRP5VWXF6765UCGBRJOSZKPA2OLEPH2QFULWYNGHF6BI",
    "activity_now_client": "1682692460614",
    "X-SS-REQ-TICKET": "1682692605671",
    "x-vc-bdturing-sdk-version": "3.1.0.cn",
    "sdk-version": "2",
    "passport-sdk-version": "20374",
    "x-tt-request-tag": "s=-1;p=0",
    "X-SS-DP": "1128",
    "x-tt-trace-id": "00-c84b88790d4c465e2003e272986a0468-c84b88790d4c465e-01",
    "User-Agent": "com.ss.android.ugc.aweme/220901 (Linux; U; Android 11; zh_CN; MI CC 9; Build/RKQ1.200826.002; Cronet/TTNetVersion:4b3ac0f8 2022-07-22 QuicVersion:6fe86402 2022-05-31)",
    "Accept-Encoding": "gzip, deflate, br",
    "X-Argus": "UM74XbmndN9dA2L2z1WMA5FHJ27h+rKYDtOCetv9VUpvc9dl3w5vac0HlCnmrOo/IA+xI35PfOs6Kir2Tfnmbeu05bCARa5AQhJhjPoekyz02LlFP5lS5HHBHLKUHw5qmIc55QQJ46UFybBEUG2UHYsqOk8tlXpqQ3qn+F7vk1nU4Cb0BpiTX6UFbZkVMIoMRzSflS6qHGPjvS2LaE5pLsW6rQnPfAxrkdNqmOuF2xulKUD+QlOz5muILontcLmV7GQMWwIoX4w+5LNoUIUEQhb8",
    "X-Gorgon": "0404e07b1001a83125daee3eb6fe7d3cc7974a1f529e4eeac890",
    "X-Khronos": "1682692751",
    "X-Ladon": "ICFwaWJx+V+nDNveBwsdW7abZudpRYFNMoyCYF+i5NPrPUYZ"
}

xargus 还原

import base64
import hashlib
import json
import random
import struct
import time
from copy import deepcopy
from random import choice
import argus_protobuf_pb2
from Crypto.Cipher import AES
from pysmx.SM3 import SM3

unpad = lambda s: s[: -ord(s[len(s) - 1 :])]
pad = lambda s: s + (chr((16 - (len(s) % 16))).encode() * (16 - (len(s) % 16)))


def calcProtobuf3(d):
   "关键代码2891590578",
    return high ^ (d >> 31)


def calc_sm3(data):
    sm3 = SM3()
    sm3.update(data)
    return sm3.digest()


def ror4(num, k):
    result = ""
    while num < 0:
        num += 0x10000000000000000
    if len(hex(num)[2:]) > 16:
        "关键代码2891590578",

    lst = bin(num)[2:]
    for i in range(0, 64):
        if i < len(lst):
            result = result + lst[i]
        else:
            result = "0" + result
    return int(result[-k:] + result[:-k], 2)


def enc_ts(ts):
    high = 0
    r3 = (ts << 1) & 0xFFFFFFFF
    low = r3 ^ (high >> 31)
    "关键代码2891590578",
    r0 = r3 | (ts >> 31)
    t = r0 ^ (high >> 31)
    return low | (t << 32)


def check_log(temp_list, label=""):
    tmp = []
    for item in temp_list:
        "关键代码2891590578",
    print(label, "长度:{}  内容:{}\n".format(len(tmp), tmp))


def RBIT(num):
    result = ""
    tmp_string = bin(num)[2:]
    while len(tmp_string) < 8:
        tmp_string = "0" + tmp_string
    for i in range(0, 8):
        result = result + tmp_string[7 - i]
    return int(result, 2)


def hex_string(num):
    tmp_string = hex(num)[2:]
    if len(tmp_string) < 2:
        tmp_string = "0" + tmp_string
    return tmp_string


def reverse(num):
    tmp_string = hex_string(num)
    "关键代码2891590578",


def aes_encrypt(ciphertext, key, iv):
    text = ciphertext
    text = pad(text)
    "关键代码2891590578",
    de_text = cipher.encrypt(text)
    return de_text


def aes_decrypt(ciphertext, key, iv):
    "关键代码2891590578",
    cipher = AES.new(key, AES.MODE_CBC, iv)
    "关键代码2891590578",
    return unpad(content)


def bfi(rd, rn, lsb, width):
    "关键代码2891590578",
    rn = (rn & ls) << lsb
    ls = ~(ls << lsb)
    rd = rd & ls
    "关键代码2891590578",
    return rd


def get_xargus(url, xkhronos, deviceid="", stub=""):
    xa = Xargus(url[url.index("?") + 1 :], int(xkhronos), deviceid, stub)
    return xa.mainEncrypt()


class Xargus:
    def __init__(self, data, khronos, device="", stub=""):
        self._data = data
        self._stub = stub
        self._argusVersion = 0x4020100
        self._appversion = "15.7.0"
        self._unknown8 = "v04.02.01-ml-android"
        self._device_id = device
        self._khronos = khronos
        self._unknown16 = "AbEP0QSeJStUszOoH-i5-Q7nE"
        self._signKey1 = [
            "关键代码2891590578",
        ]
        self._signKey2 = [
            "关键代码2891590578",
        ]
        self._aesKey = bytes(hashlib.md5(bytes(self._signKey1)).digest())
        self._aesIv = bytes(hashlib.md5(bytes(self._signKey2)).digest())
        self._rdm = random.randint(0x10000000, 0xFFFFFFFF)
        # self._rdm = 0x37076aa5
        self._apd = []

    def _encryptRandom(self, key):
        A = 0
        T = 0
        for i in range(0, len(key), 2):
            B = key[i] ^ A
            C = (T >> 0x3) & 0xFFFFFFFF
            D = C ^ B
            E = D ^ T
            F = (E >> 0x5) & 0xFFFFFFFF
            G = (E << 0xB) & 0xFFFFFFFF
            H = key[i + 1] | G
            I = F ^ H
            J = I ^ E
            T = ~J & 0xFFFFFFFF
            # A = (T << 7) & 0xFFFFFFFF
            return T

    def _gen_key(self):
        data = (
            self._signKey1
            + self._signKey2
            + list(struct.pack("<I", self._rdm))
            + self._signKey1
            + self._signKey2
        )
        sm3 = SM3()
        sm3.update(bytes(data))
        res = sm3.hexdigest()

        res_list = []
        for i in range(0, len(res), 2):
            res_list.append(int(res[i : i + 2], 16))
        sm3_list = []
        for i in range(0, len(res_list), 4):
            c = struct.unpack("<I", bytes(res_list[i : i + 4]))
            sm3_list.append(c[0])
        res_list = res_list[:8]
        for i in range(0x47):
            t = i % 0x3E
            off = (0x20 - t) & 0xFF
            "关键代码2891590578",
            "关键代码2891590578",
            off_1 = t - 0x20
            if off_1 >= 0:
                B = 0x3DC94C3A >> off_1
            H = (sm3_list[6] >> 3) & 0xFFFFFFFF
            H |= (sm3_list[7] << 29) & 0xFFFFFFFF
            C = H ^ sm3_list[2]
            bfi_v = bfi(B, 0x7FFFFFFE, 1, 0x1F)
            "关键代码2891590578",
            H = (sm3_list[7] >> 3) & 0xFFFFFFFF
            H |= (sm3_list[6] << 29) & 0xFFFFFFFF
            E = H ^ sm3_list[3]
            if E & 1:
                B = (C >> 1) | 0x80000000
            else:
                B = C >> 1
            "关键代码2891590578",
            F = (E >> 1) | H
            G = F ^ sm3_list[1] ^ E
            A = ~G & 0xFFFFFFFF
            F = D ^ B
            for j in range(6):
                sm3_list[j] = sm3_list[j + 2]
            sm3_list[6] = F
            sm3_list[7] = A
            for j in range(2):
                for d in list(struct.pack("<I", sm3_list[j])):
                    res_list.append(d)
        return res_list

    def _gen_protobuf(self):

        argus = argus_protobuf_pb2.Argus()
        argus.header = 1077940818
        argus.version = 2
        argus.random = 422182720
        argus.stub = "1128"
        argus.deviceId = self._device_id
        "关键代码2891590578",
        argus.appVersion = self._appversion
        argus.unknown8 = self._unknown8
        argus.argusVersion = calcProtobuf3(self._argusVersion)
        argus.unknown10 = b"\x00\x01\x00\x00\x00\x00\x00\x00"
        argus.khronosOne = enc_ts(self._khronos)

        if self._stub == "":
            sm3_data = (
                b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
            )
        else:
            sm3_data = self._stub.encode()
        stubSm3 = calc_sm3(sm3_data)
        urlSm3 = calc_sm3(self._data)

        self._apd.append(stubSm3[0])
        self._apd.append(urlSm3[0])
        argus.sm3One = stubSm3[:6]
        argus.sm3Two = urlSm3[:6]

        unknownStruct15 = argus_protobuf_pb2.UnknownStruct15()
        unknownStruct15.unknown1 = 0
        unknownStruct15.unknown2 = 0
        unknownStruct15.unknown3 = 0
        argus.unknown15.CopyFrom(unknownStruct15)

        argus.khronosTwo = enc_ts(self._khronos)
        argus.unknown20 = "none"
        argus.unknown21 = "738"
        return argus.SerializeToString()

    def encrypt(self, proto, key):
        sm3_list = []
        for i in range(0, len(key), 4):
            c = struct.unpack("<I", bytes(key[i : i + 4]))
            sm3_list.append(c[0])

        for i in range(len(sm3_list)):
            t = i % 4
            "关键代码2891590578",
            BB = ((proto[(2 + t) % 4] << 0x1) & 0xFFFFFFFF) | (proto[3 - t] >> 0x1F)
            CC = AA & BB
            DD = proto[t] ^ CC
            "关键代码2891590578",
            proto[t] = sm3_list[i] ^ DD ^ EE
        res_list = []
        for i in range(4):
            res_list += struct.pack("<I", proto[i])
        return res_list

    def decrypt(self, proto, key):
        sm3_list = []
        for i in range(0, len(key), 4):
            c = struct.unpack("<I", bytes(key[i : i + 4]))
            sm3_list.append(c[0])
        i = len(sm3_list) - 1
        while i >= 0:
            t = i % 4
            "关键代码2891590578",
            "关键代码2891590578",
            CC = AA & BB
            DD = proto[t] ^ CC
           "关键代码2891590578",
            proto[t] = sm3_list[i] ^ DD ^ EE
            i -= 1
        res_list = []
        for i in range(4):
            res_list += struct.pack("<I", proto[i])
        return res_list

    def _eor_data(self, key, data):
        rdm_list = self._encryptRandom(key)
        rdm_list = struct.pack(">I", rdm_list)
        for i in range(len(data)):
            data[i] ^= rdm_list[i % 4]
        return data

    def mainEncrypt(self):
        res = []
        enc_key = self._gen_key()
        self._proto = pad(self._gen_protobuf())

        for i in range(0, len(self._proto), 16):
            data = []
            for j in range(i, i + 16, 4):
                c = struct.unpack("<I", bytes(self._proto[j : j + 4]))
                data.append(c[0])
            res += self.encrypt(data, enc_key)
        random_arr = list(struct.pack("<I", self._rdm))
        key = random_arr[2:4]
        b64_header = random_arr[0:2]
        # 拼接eor数据
        res = res[::-1]
        res += [0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0][::-1]
        res = self._eor_data(key, res)
        res += key
        headers = [
            0x35,
            "关键代码2891590578",
            "关键代码2891590578",
            "关键代码2891590578",
            random.randint(0x10, 0xFF),
            0x00,
            self._apd[0] & 0x3F,
            0x02,
            0x18,
        ]
        headers += res

        res = aes_encrypt(bytes(headers), self._aesKey, self._aesIv)
        content = bytes(b64_header) + res
        return base64.b64encode(content).decode()