首页
社区
课程
招聘
注册机挑战游戏(A Keygen Challenge for Android)第一第二第三关攻略
发表于: 2014-5-29 19:11 14947

注册机挑战游戏(A Keygen Challenge for Android)第一第二第三关攻略

2014-5-29 19:11
14947

今天找到肖大前段时间推荐的一个链接,关于Android的一个apk,详见:

import java.io.IOException;
import java.util.Scanner;

//xbalien 78388
public class Challenge1Verifier {

	public static void main(String[] args) throws IOException{
		Scanner in = new Scanner(System.in);
		String userName = in.next();
		key(userName);
	}
	public static void key(String paramString1){
	    int i = 0;
	    for (int j = 0; j < paramString1.length(); j++){
	      int m = paramString1.charAt(j);
	      i = m ^ i + m * m;
	    }
	    System.out.println(i);

	}
}
import java.io.IOException;
import java.util.Scanner;

//xbalien AIECIE
public class Challenge2Verifier {

	public static void main(String[] args) throws IOException{
		Scanner in = new Scanner(System.in);
		String userName = in.next();
		key(userName);
	}

	public static void key(String paramString1)
	{
		if (paramString1.length() >= 4){
			String str1 = paramString1.toUpperCase();
			long l = 0L;
			for (int i = 0; i < str1.length(); i++)
				l = 3L * (l + str1.charAt(i)) - 64L;
			String str2 = Long.toString(l);
			System.out.println(str2);
			byte keyByte[] = new byte[str2.length()];
			for (int k = 0; k < str2.length(); k++){
				keyByte[k] = (byte) (str2.charAt(k) + 16);
			}
			System.out.println(new String(keyByte));
		}
	     
	}
}
CODE:00002880                 Method 68 (0x44):
CODE:00002880                 public boolean
CODE:00002880                 com.me.keygen.verifiers.challenge.Challenge3Verifier.isValid(
CODE:00002880                   java.lang.String p0,
CODE:00002880                   java.lang.String p1)
CODE:00002880 this = v12
CODE:00002880 p0 = v13
CODE:00002880 p1 = v14
CODE:00002880                 const/16                        v11, 0x30
CODE:00002884                 const/4                         v8, 0
CODE:00002886                 const-string                    v9, asc_3BC2 # "-"
CODE:0000288A                 invoke-virtual                  {p1, v9}, <ref String.split(ref) imp. @ _def_String_split@LL> # ;输入的序列号需要有-作为分隔符
CODE:00002890                 move-result-object              v5 # ;分割后的每一段存放在v5
CODE:00002892                 array-length                    v9, v5
CODE:00002894                 const/16                        v10, 8
CODE:00002898                 if-eq                           v9, v10, loc_289E # ;前提必须有8段,7个-的输入序列才能通过
CODE:0000289C
CODE:0000289C locret:                                 # CODE XREF: Challenge3Verifier_isValid@ZLL+36j
CODE:0000289C                                         # Challenge3Verifier_isValid@ZLL+F0j ...
CODE:0000289C                 return                          v8
CODE:0000289E # ---------------------------------------------------------------------------
CODE:0000289E
CODE:0000289E loc_289E:                               # CODE XREF: Challenge3Verifier_isValid@ZLL+18j
CODE:0000289E                 const/4                         v7, 0
CODE:000028A0
CODE:000028A0 loc_28A0:                               # CODE XREF: Challenge3Verifier_isValid@ZLL+3Ej
CODE:000028A0                 array-length                    v9, v5
CODE:000028A2                 if-ge                           v7, v9, loc_28C0
CODE:000028A6                 aget-object                     v9, v5, v7
CODE:000028AA                 const-string                    v10, a09aF09aF09aF09 # "[0-9A-F][0-9A-F][0-9A-F][0-9A-F]"
CODE:000028AE                 invoke-virtual                  {v9, v10}, <boolean String.matches(ref) imp. @ _def_String_matches@ZL> # ;匹配正则表达式(每一段为4个,且要满足)
CODE:000028B4                 move-result                     v9
CODE:000028B6                 if-eqz                          v9, locret
CODE:000028BA                 add-int/lit8                    v7, v7, 1
CODE:000028BE                 goto                            loc_28A0
CODE:000028C0 # ---------------------------------------------------------------------------
CODE:000028C0
CODE:000028C0 loc_28C0:                               # CODE XREF: Challenge3Verifier_isValid@ZLL+22j
CODE:000028C0                 new-instance                    v0, <t: ByteArrayOutputStream>
CODE:000028C4                 invoke-direct                   {v0}, <void ByteArrayOutputStream.<init>() imp. @ _def_ByteArrayOutputStream__init_@V> # ;新建字节数组输出流
CODE:000028CA                 const/16                        v9, 0x31
CODE:000028CE                 invoke-virtual                  {v0, v9}, <void ByteArrayOutputStream.write(int) imp. @ _def_ByteArrayOutputStream_write@VI> # ;49写入字节数组流中
CODE:000028D4                 const/4                         v7, 0
CODE:000028D6
CODE:000028D6 loc_28D6:                               # CODE XREF: Challenge3Verifier_isValid@ZLL+7Cj
CODE:000028D6                 iget-object                     v9, this, Challenge3Verifier_secretBytes # ;取出关键运算值,secretBytes,进行适当的算法,写入字节数组流
CODE:000028DA                 array-length                    v9, v9
CODE:000028DC                 if-ge                           v7, v9, loc_28FE
CODE:000028E0                 iget-object                     v9, this, Challenge3Verifier_secretBytes
CODE:000028E4                 aget-byte                       v9, v9, v7
CODE:000028E8                 invoke-virtual                  {v0, v9}, <void ByteArrayOutputStream.write(int) imp. @ _def_ByteArrayOutputStream_write@VI>
CODE:000028EE                 add-int/lit8                    v9, v7, 1
CODE:000028F2                 invoke-virtual                  {v0, v9}, <void ByteArrayOutputStream.write(int) imp. @ _def_ByteArrayOutputStream_write@VI>
CODE:000028F8                 add-int/lit8                    v7, v7, 2
CODE:000028FC                 goto                            loc_28D6 # ;取出关键运算值,secretBytes,进行适当的算法,写入字节数组流
CODE:000028FE # ---------------------------------------------------------------------------
CODE:000028FE
CODE:000028FE loc_28FE:                               # CODE XREF: Challenge3Verifier_isValid@ZLL+5Cj
CODE:000028FE                 const/4                         v7, 1
CODE:00002900
CODE:00002900 loc_2900:                               # CODE XREF: Challenge3Verifier_isValid@ZLL+A6j
CODE:00002900                 iget-object                     v9, this, Challenge3Verifier_secretBytes # ;再次取出关键运算值,secretBytes,进行适当的算法,写入字节数组流
CODE:00002904                 array-length                    v9, v9
CODE:00002906                 if-ge                           v7, v9, loc_2928
CODE:0000290A                 iget-object                     v9, this, Challenge3Verifier_secretBytes
CODE:0000290E                 aget-byte                       v9, v9, v7
CODE:00002912                 invoke-virtual                  {v0, v9}, <void ByteArrayOutputStream.write(int) imp. @ _def_ByteArrayOutputStream_write@VI>
CODE:00002918                 add-int/lit8                    v9, v7, 1
CODE:0000291C                 invoke-virtual                  {v0, v9}, <void ByteArrayOutputStream.write(int) imp. @ _def_ByteArrayOutputStream_write@VI>
CODE:00002922                 add-int/lit8                    v7, v7, 2
CODE:00002926                 goto                            loc_2900 # ;再次取出关键运算值,secretBytes,进行适当的算法,写入字节数组流
CODE:00002928 # ---------------------------------------------------------------------------
CODE:00002928
CODE:00002928 loc_2928:                               # CODE XREF: Challenge3Verifier_isValid@ZLL+86j
CODE:00002928                 invoke-virtual                  {v0, v11}, <void ByteArrayOutputStream.write(int) imp. @ _def_ByteArrayOutputStream_write@VI>
CODE:0000292E                 invoke-virtual                  {v0, v11}, <void ByteArrayOutputStream.write(int) imp. @ _def_ByteArrayOutputStream_write@VI> # ;写入两个48
CODE:00002934                 const/4                         v7, 0
CODE:00002936
CODE:00002936 loc_2936:                               # CODE XREF: Challenge3Verifier_isValid@ZLL+ECj
CODE:00002936                 array-length                    v9, v5 # ;取出输入序列中的前4段xxxx-xxxx-xxxx-xxxx-写入字节数组流
CODE:00002938                 div-int/lit8                    v9, v9, 2
CODE:0000293C                 if-ge                           v7, v9, loc_2972
CODE:00002940 # try 0x2940-0x2968:
CODE:00002940                 aget-object                     v9, v5, v7
CODE:00002944                 const-string                    v10, aUs_ascii # "US_ASCII"
CODE:00002948                 invoke-static                   {v10}, <ref Charset.forName(ref) imp. @ _def_Charset_forName@LL>
CODE:0000294E                 move-result-object              v10
CODE:00002950                 invoke-virtual                  {v9, v10}, <ref String.getBytes(ref) imp. @ _def_String_getBytes@LL>
CODE:00002956                 move-result-object              v9
CODE:00002958                 invoke-virtual                  {v0, v9}, <void ByteArrayOutputStream.write(ref) imp. @ _def_ByteArrayOutputStream_write@VL>
CODE:0000295E                 const/16                        v9, 0x2D
CODE:00002962                 invoke-virtual                  {v0, v9}, <void ByteArrayOutputStream.write(int) imp. @ _def_ByteArrayOutputStream_write@VI>
CODE:00002968                 add-int/lit8                    v7, v7, 1
CODE:0000296C                 goto                            loc_2936 # ;取出输入序列中的前4段xxxx-xxxx-xxxx-xxxx-写入字节数组流
CODE:0000296E # ---------------------------------------------------------------------------
CODE:0000296E # catch Exception:
CODE:0000296E                 move-exception                  v1
CODE:00002970                 goto                            locret
CODE:00002972 # ---------------------------------------------------------------------------
CODE:00002972 # try 0x2972-0x297C:
CODE:00002972
CODE:00002972 loc_2972:                               # CODE XREF: Challenge3Verifier_isValid@ZLL+BCj
CODE:00002972                 iget-object                     v9, this, Challenge3Verifier_secretBytes
CODE:00002976                 invoke-virtual                  {v0, v9}, <void ByteArrayOutputStream.write(ref) imp. @ _def_ByteArrayOutputStream_write@VL>

[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课

上传的附件:
收藏
免费 3
支持
分享
最新回复 (17)
雪    币: 2664
活跃值: (3401)
能力值: ( LV13,RANK:1760 )
在线值:
发帖
回帖
粉丝
2
学习学习,不懂安卓...
2014-5-29 19:14
0
雪    币: 127
活跃值: (2803)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
肯定是精华帖 前排留名
2014-5-29 19:35
0
雪    币: 31
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
4
火钳刘明
2014-5-29 19:57
0
雪    币: 114
活跃值: (180)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
5
前排~~~能否提取个XX加速器出来。。
2014-5-29 20:33
0
雪    币: 1413
活跃值: (401)
能力值: (RANK:270 )
在线值:
发帖
回帖
粉丝
6
动态部分漂亮~
2014-5-29 22:19
0
雪    币: 250
活跃值: (251)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
7
也去玩玩,mark
2014-5-30 10:13
0
雪    币: 250
活跃值: (251)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
8
可以传下附件么,楼主
2014-5-30 10:14
0
雪    币: 1919
活跃值: (901)
能力值: ( LV9,RANK:490 )
在线值:
发帖
回帖
粉丝
9
附件无效啊!!!
2014-5-31 01:16
0
雪    币: 182
活跃值: (178)
能力值: ( LV12,RANK:210 )
在线值:
发帖
回帖
粉丝
10
附件已经上传
2014-5-31 10:42
0
雪    币: 182
活跃值: (178)
能力值: ( LV12,RANK:210 )
在线值:
发帖
回帖
粉丝
11
附件已经上传,精华都是破解大神来袭
2014-5-31 10:44
0
雪    币: 250
活跃值: (251)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
12
楼主好人 哈哈
2014-5-31 10:57
0
雪    币: 224
活跃值: (42)
能力值: ( LV3,RANK:20 )
在线值:
发帖
回帖
粉丝
13
无分析…

第四关 tastypear:35878448352175587328

第五关
搞了个矩阵……作者很贱地有一句测试,指定了一下id,Name,SN
1.deviceId = "mwahahaha" // 实际应是 getSystemService("phone").getDeviceId()
2.name = "Good"
3.serial = "Luck" // 假设识别码真是mwahahaha,那 serial 应是 1130451

木有 JNI,表示压力不大,碰到 JNI 直接两眼一黑 XD

-------------------------------------
补充:
卤煮赶紧抛弃JD-GUI吧,信JAD至少到最后才会出现无法还原的函数(makeKey()),也没看不到的字符
如果只要结果,把dex转成jar直接调,真要分析的话写成 java 大概 20 行
2014-6-1 04:02
0
雪    币: 182
活跃值: (178)
能力值: ( LV12,RANK:210 )
在线值:
发帖
回帖
粉丝
14
用VTS产生了会JAD,确实效果不错额,介绍的这几招涨姿势了
2014-6-1 11:03
0
雪    币: 58
活跃值: (72)
能力值: ( LV5,RANK:70 )
在线值:
发帖
回帖
粉丝
15
赞一个,对smali还不太理解,hard的以后再看。对于easy部分
一个为0x30一个为0x40,两者相差16,因此输入的序列要求与str2长度相同,并且每一位比str2都大0x10

这里应该没有要求输入序列要与str2长度相同吧,只是如果相同的话每一位都大0x10比较好算?
2014-6-2 11:47
0
雪    币: 68
活跃值: (11)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
16
进来涨知识了
2014-6-2 12:04
0
雪    币: 182
活跃值: (178)
能力值: ( LV12,RANK:210 )
在线值:
发帖
回帖
粉丝
17
是的,咋看一眼觉得相同才好算就说成相同了,确实不需要相同,谢谢指正
2014-6-2 14:48
0
雪    币: 246
活跃值: (26)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
18
dex转转成jar是源码级调试么?还是main调用?
2014-6-3 11:40
0
游客
登录 | 注册 方可回帖
返回
//