X-Argus X-Gorgon X-Ladon ida反反调试&加密算法跟踪（六）

X-Argus X-Gorgon X-Ladon 交流2891590578

APP在每个请求的header中都加入了X-Ladon、X-Khronos、X-Gorgon、X-Argus四个安全参数，当url变动的时候，这几个参数也会跟着变化，下面是一个完整的请求报文：

{
    "GET": "https://api5-normal-c-hl.amemv.com/aweme/v1/life/mall/list/?cursor=0&request_tag_from=h5&backend_type_code=195679488&entry_atmosphere_id&count=10&city_code=350200&source=homepage_fresh&sort_code=7171691260363685932&atmosphere_id&has_deliverable=false&has_group=false&filter_type=0&enter_method=top_icon&need_filters=0&sort_session_id&location_permission=1&entry_type=3&distance_code=7171686102267346988&type_code=040000%7C080000%7C180000&iid=3644214056591579&device_id=1341841769250343&ac=wifi&channel=update&aid=1128&app_name=aweme&version_code=220900&version_name=22.9.0&device_platform=android&os=android&ssmix=a&device_type=MI+CC+9&device_brand=Xiaomi&language=zh&os_api=30&os_version=11&manifest_version_code=220901&resolution=1080*2221&dpi=440&update_version_code=22909900&_rticket=1682692605666&package=com.ss.android.ugc.aweme&cpu_support64=true&host_abi=armeabi-v7a&is_guest_mode=0&app_type=normal&minor_status=0&appTheme=light&need_personal_recommend=1&is_android_pad=0&ts=1682692459&cdid=d0cad09c-47ac-4535-84e5-9a78aebbb1fc HTTP/1.1",
    "Host": "api5-normal-c-hl.amemv.com",
    "Connection": "keep-alive",
    "Cookie": "store-region=cn-fj; store-region-src=did; install_id=3644214056591579; ttreq=1$b151171e30d2e26ac9a11d4f847d7142dd21273a; odin_tt=cf06edf9b99864210817aba1aa149a07be07a6fc38d27ff10db8202de931ed29454d1cd5385949e483c84532b61dc16356c2a8d114ab6ea05bac93e8186c7c968e474846c54a9ee86938e8f2c9ae8485; msToken=zyKDDKuz5TSNT_ebCpGyh3hSYx1E9UNR3b1imR5957Z-n09KvrAgxGT6LCg49EMt_pljWbZ1IB_LZp6XGROpnxuhMoEzniQs5A8PZ7VDM44=; ttwid=1%7Cq2Wty0B6qcpuBIx2y6F8pypBY-_yxHFvRJ0J3zJjDvE%7C1682690783%7C84649aed7763a7cace9c1df17eb2039fd3ceb3fa405b9d20ba35e02f1358521c",
    "Content-Type": "application/json",
    "x-tt-dt": "AAAT6MK6SUZ347JUGYUCTJV4QXCMSOJXJCZ65VATRGOAAFEORRO37DE3H5HKUS3MBQDSJFJTF4MR5VUOAQRP5VWXF6765UCGBRJOSZKPA2OLEPH2QFULWYNGHF6BI",
    "activity_now_client": "1682692460614",
    "X-SS-REQ-TICKET": "1682692605671",
    "x-vc-bdturing-sdk-version": "3.1.0.cn",
    "sdk-version": "2",
    "passport-sdk-version": "20374",
    "x-tt-request-tag": "s=-1;p=0",
    "X-SS-DP": "1128",
    "x-tt-trace-id": "00-c84b88790d4c465e2003e272986a0468-c84b88790d4c465e-01",
    "User-Agent": "com.ss.android.ugc.aweme/220901 (Linux; U; Android 11; zh_CN; MI CC 9; Build/RKQ1.200826.002; Cronet/TTNetVersion:4b3ac0f8 2022-07-22 QuicVersion:6fe86402 2022-05-31)",
    "Accept-Encoding": "gzip, deflate, br",
    "X-Argus": "UM74XbmndN9dA2L2z1WMA5FHJ27h+rKYDtOCetv9VUpvc9dl3w5vac0HlCnmrOo/IA+xI35PfOs6Kir2Tfnmbeu05bCARa5AQhJhjPoekyz02LlFP5lS5HHBHLKUHw5qmIc55QQJ46UFybBEUG2UHYsqOk8tlXpqQ3qn+F7vk1nU4Cb0BpiTX6UFbZkVMIoMRzSflS6qHGPjvS2LaE5pLsW6rQnPfAxrkdNqmOuF2xulKUD+QlOz5muILontcLmV7GQMWwIoX4w+5LNoUIUEQhb8",
    "X-Gorgon": "0404e07b1001a83125daee3eb6fe7d3cc7974a1f529e4eeac890",
    "X-Khronos": "1682692751",
    "X-Ladon": "ICFwaWJx+V+nDNveBwsdW7abZudpRYFNMoyCYF+i5NPrPUYZ"
}

上周用ida调试x音的时候遇到了大量的弹窗，要是一不小心选择了“pass to app”，结果大概率直接崩掉......... 弹窗这个问题困扰我好久了，如果不解决，后面的trace就没法做了，该怎么解决了？这就要从弹窗的原理说起了！近期用ida调试时遇到的弹窗提示整理如下：

3B745B60: got SIGSEGV signal (Segmentation violation) (exc.code b, tid 17222)
3B745B60: got SIGSEGV signal (Segmentation violation) (exc.code b