X-Argus X-Gorgon X-Ladon findcrypt和findhash查找疑似加密函数（五）

X-Argus X-Gorgon X-Ladon 交流2891590578

APP在每个请求的header中都加入了X-Ladon、X-Khronos、X-Gorgon、X-Argus四个安全参数，当url变动的时候，这几个参数也会跟着变化，下面是一个完整的请求报文：

{
    "GET": "https://api5-normal-c-hl.amemv.com/aweme/v1/life/mall/list/?cursor=0&request_tag_from=h5&backend_type_code=195679488&entry_atmosphere_id&count=10&city_code=350200&source=homepage_fresh&sort_code=7171691260363685932&atmosphere_id&has_deliverable=false&has_group=false&filter_type=0&enter_method=top_icon&need_filters=0&sort_session_id&location_permission=1&entry_type=3&distance_code=7171686102267346988&type_code=040000%7C080000%7C180000&iid=3644214056591579&device_id=1341841769250343&ac=wifi&channel=update&aid=1128&app_name=aweme&version_code=220900&version_name=22.9.0&device_platform=android&os=android&ssmix=a&device_type=MI+CC+9&device_brand=Xiaomi&language=zh&os_api=30&os_version=11&manifest_version_code=220901&resolution=1080*2221&dpi=440&update_version_code=22909900&_rticket=1682692605666&package=com.ss.android.ugc.aweme&cpu_support64=true&host_abi=armeabi-v7a&is_guest_mode=0&app_type=normal&minor_status=0&appTheme=light&need_personal_recommend=1&is_android_pad=0&ts=1682692459&cdid=d0cad09c-47ac-4535-84e5-9a78aebbb1fc HTTP/1.1",
    "Host": "api5-normal-c-hl.amemv.com",
    "Connection": "keep-alive",
    "Cookie": "store-region=cn-fj; store-region-src=did; install_id=3644214056591579; ttreq=1$b151171e30d2e26ac9a11d4f847d7142dd21273a; odin_tt=cf06edf9b99864210817aba1aa149a07be07a6fc38d27ff10db8202de931ed29454d1cd5385949e483c84532b61dc16356c2a8d114ab6ea05bac93e8186c7c968e474846c54a9ee86938e8f2c9ae8485; msToken=zyKDDKuz5TSNT_ebCpGyh3hSYx1E9UNR3b1imR5957Z-n09KvrAgxGT6LCg49EMt_pljWbZ1IB_LZp6XGROpnxuhMoEzniQs5A8PZ7VDM44=; ttwid=1%7Cq2Wty0B6qcpuBIx2y6F8pypBY-_yxHFvRJ0J3zJjDvE%7C1682690783%7C84649aed7763a7cace9c1df17eb2039fd3ceb3fa405b9d20ba35e02f1358521c",
    "Content-Type": "application/json",
    "x-tt-dt": "AAAT6MK6SUZ347JUGYUCTJV4QXCMSOJXJCZ65VATRGOAAFEORRO37DE3H5HKUS3MBQDSJFJTF4MR5VUOAQRP5VWXF6765UCGBRJOSZKPA2OLEPH2QFULWYNGHF6BI",
    "activity_now_client": "1682692460614",
    "X-SS-REQ-TICKET": "1682692605671",
    "x-vc-bdturing-sdk-version": "3.1.0.cn",
    "sdk-version": "2",
    "passport-sdk-version": "20374",
    "x-tt-request-tag": "s=-1;p=0",
    "X-SS-DP": "1128",
    "x-tt-trace-id": "00-c84b88790d4c465e2003e272986a0468-c84b88790d4c465e-01",
    "User-Agent": "com.ss.android.ugc.aweme/220901 (Linux; U; Android 11; zh_CN; MI CC 9; Build/RKQ1.200826.002; Cronet/TTNetVersion:4b3ac0f8 2022-07-22 QuicVersion:6fe86402 2022-05-31)",
    "Accept-Encoding": "gzip, deflate, br",
    "X-Argus": "UM74XbmndN9dA2L2z1WMA5FHJ27h+rKYDtOCetv9VUpvc9dl3w5vac0HlCnmrOo/IA+xI35PfOs6Kir2Tfnmbeu05bCARa5AQhJhjPoekyz02LlFP5lS5HHBHLKUHw5qmIc55QQJ46UFybBEUG2UHYsqOk8tlXpqQ3qn+F7vk1nU4Cb0BpiTX6UFbZkVMIoMRzSflS6qHGPjvS2LaE5pLsW6rQnPfAxrkdNqmOuF2xulKUD+QlOz5muILontcLmV7GQMWwIoX4w+5LNoUIUEQhb8",
    "X-Gorgon": "0404e07b1001a83125daee3eb6fe7d3cc7974a1f529e4eeac890",
    "X-Khronos": "1682692751",
    "X-Ladon": "ICFwaWJx+V+nDNveBwsdW7abZudpRYFNMoyCYF+i5NPrPUYZ"
}

上次用ida标记unidbg trace得到的指令时遇到如下报错：

　上次用ida标记unidbg trace得到的指令时遇到如下报错：

from PyQt5 import QtCore, QtWidgets, QtGui 
ImportError: DLL load failed: %1 不是有效的 Win32 应用程序。

　　当时就有好些小伙伴给我支招，我尝试后发现确实可以，这里感谢各位热心小伙伴的支持！具体做法如下：

（1）先把ida安装目录下有个python目录设置为环境变量

（2）再用pip install sark安装依赖包

　因为我装了好几个版本的python，用pip装的时候老是自动装到其他python的目录，所以每次用idapython执行脚本都报错；这次装的时候指定sark的安装目录：pip install --target=D:\xxxx\xxxx\xxxx\Lib\site-packages sark（注意：一定要在site-package目录下安装），装好后再用ida执行patch脚本就ok了！经过脚本的作色后，再静态分析代码，发现还是不对：作色（也就是执行过）的代码数量不多，目测不超过15%，感觉不对劲：就算有OLLVM混淆，也不至于才执行了这么一点代码呀！再去分析trace日志，特么发现后面又遇到了循环，只不过这次循环的范围要大一些，前后