几道Android逆向题(持续更新...)

2017 湖湘杯–re2.apk

直接反编译一下。。。

2017 DDCTF – Android_easy

题目很简单,这里是判定条件,相等即可

代码跑一下:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
public class flag {
static byte[] p = new byte[]{-40, -62, 107, 66, -126, 103, -56, 77, 122, -107, -24, -127, 72, -63, -98, 64, -24, -5, -49, -26, 79, -70, -26, -81, 120, 25, 111, -100, -23, -9, 122, -35, 66, -50, -116, 3, -72, 102, -45, -85, 0, 126, -34, 62, 83, -34, 48, -111, 61, -9, -51, 114, 20, 81, -126, -18, 27, -115, -76, -116, -48, -118, -10, -102, -106, 113, -104, 98, -109, 74, 48, 47, -100, -88, 121, 22, -63, -32, -20, -41, -27, -20, -118, 100, -76, 70, -49, -39, -27, -106, -13, -108, 115, -87, -1, -22, -53, 21, -100, 124, -95, -40, 62, -69, 29, 56, -53, 85, -48, 25, 37, -78, 11, -110, -24, -120, -82, 6, -94, -101};
static byte[] q = new byte[]{-57, -90, 53, -71, -117, 98, 62, 98, 101, -96, 36, 110, 77, -83, -121, 2, -48, 94, -106, -56, -49, -80, -1, 83, 75, 66, -44, 74, 2, -36, -42, -103, 6, -115, -40, 69, -107, 3, -73, -101, 99, 70, -21, 6, 106, -18, 86, -87, 10, -61, -8, 20, 44, 48, -77, -36, 44, -17, -48, -66, -77, -78, -60, -93, -94, 65, -83, 86, -14, 10, 84, 70, -8, -63, 26, 126, -76, -104, -123, -71, -126, -62, -23, 11, -39, 70, 14, 59, -101, -39, -124, 91, -109, 102, -49, 21, 105, 0, 37, -128, -57, 117, 110, -115, -86, 56, 25, -46, -55, 7, -125, 109, 76, 104, -15, 82, -53, 18, -28, -24};

private static String i() {
int v1 = 0;
byte[] v2 = new byte[p.length];
int v0;
for(v0 = 0; v0 < v2.length; ++v0) {
v2[v0] = ((byte)(p[v0] ^ q[v0]));
}

int v3 = v2[0];
for(v0 = 0; v2[v3 + v0] != 0; ++v0) {
}

byte[] v4 = new byte[v0];
while(v1 < v0) {
v4[v1] = v2[v3 + v1];
++v1;
}

return new String(v4);
}

public static void main(String[] args)
{
System.out.println(i());
}
}

2017 DDCTF – Android Normal

关键处:

直接分析so文件:

这里有好几处地方可以下断点

第一处,在生成完key然后拷贝的时候下断:

断下来后运行,然后随意输入字符串,会断在端点处,然后f8一下,查看返回值(R0中的值)

第二个断点可以下在调用NewStringUTF处,此处会将key转换为jni下的字符串

断下来后运行,查看R5寄存器即可:

最后其实还有一种办法就是反编译后修改smali代码,利用log插桩输出key

emmmmm,后来看了下,硬刚算法好像也可行