# 解码一个input stream到Bitmap
.method private static a(Ljava/lang/String;I)Landroid/graphics/Bitmap;
    .locals 11
    .prologue
    const/4 v3, 0x1
    const/4 v9, -0x1
    const/high16 v6, 0x3f800000
    const/4 v8, 0x0
    .line 197
    .line 200
    :try_start_0
	# 新建一个自定义的InputStream对象
    new-instance v0, Lcom/ijinshan/mPrivacy/c/j;
	# 使用文件初始化InputStream
    invoke-direct {v0, p0}, Lcom/ijinshan/mPrivacy/c/j;-><init>(Ljava/lang/String;)V
    .line 201
    invoke-virtual {v0}, Lcom/ijinshan/mPrivacy/c/j;->available()I
    move-result v1
    if-ne v1, v9, :cond_0
    move-object v0, v8
    .line 264
    :goto_0
    return-object v0
    .line 205
    :cond_0
	# 新建一个BitmapFactory对象
    new-instance v1, Landroid/graphics/BitmapFactory$Options;
    invoke-direct {v1}, Landroid/graphics/BitmapFactory$Options;-><init>()V
    .line 208
    const/4 v2, 0x1
    iput-boolean v2, v1, Landroid/graphics/BitmapFactory$Options;->inJustDecodeBounds:Z
    .line 209
    const/4 v2, 0x0
	# 调用BitmapFactory的decodeStream方法，解码input stream到Bitmap
invoke-static {v0, v2, v1}, Landroid/graphics/BitmapFactory;->decodeStream(Ljava/io/InputStream;Landroid/graphics/Rect;Landroid/graphics/BitmapFactory$Options;)Landroid/graphics/Bitmap;

.method public final read([BII)I
    .locals 7
    .prologue
    const/4 v6, 0x0
    const/16 v5, 0x400
    .line 61
    iget-object v0, p0, Lcom/ijinshan/mPrivacy/c/j;->a:Ljava/io/FileInputStream;
	# p2（byteOffset），p3（byteCount）=0x10000
    invoke-virtual {v0, p1, p2, p3}, Ljava/io/FileInputStream;->read([BII)I
    move-result v0
    .line 63
    const/4 v1, -0x1
	# 判断返回值是否为-1，-1即读到文件末尾
    if-ne v0, v1, :cond_0
    .line 103
    :goto_0
    return v0
    .line 70
    :cond_0
	
	# f保存了已读的字节数
    iget-wide v1, p0, Lcom/ijinshan/mPrivacy/c/j;->f:J
    const-wide/16 v3, 0x400
    cmp-long v1, v1, v3
	# 判断已读的字节数是否大于或等于0x400字节
    if-gtz v1, :cond_5
	# 第一次读的话，执行如下代码
    .line 73
	# e是个bool值，判断是否已经解密了前面的0x400字节
    iget-boolean v1, p0, Lcom/ijinshan/mPrivacy/c/j;->e:Z
    if-nez v1, :cond_1
	# 第一次读取，未解密，执行如下代码
    .line 75
    iget-object v1, p0, Lcom/ijinshan/mPrivacy/c/j;->c:Lcom/ijinshan/mPrivacy/c/g;
	# b是个String类型的变量，其中保存了加密后文件的路径，例如/storage/sdcard0/.ksbox/6b2c357d	
    iget-object v1, p0, Lcom/ijinshan/mPrivacy/c/j;->b:Ljava/lang/String;
	# 调用g;->b方法，解密前面0x400字节
    invoke-static {v1}, Lcom/ijinshan/mPrivacy/c/g;->b(Ljava/lang/String;)[B
    move-result-object v1
	# 将解密出来的字节数组保存到d变量中
    iput-object v1, p0, Lcom/ijinshan/mPrivacy/c/j;->d:[B
    .line 76
    iget-object v1, p0, Lcom/ijinshan/mPrivacy/c/j;->d:[B
	# 判断字节数组是否为空
    if-eqz v1, :cond_1
    .line 77
    const/4 v1, 0x1
	# 返回不为空，那么设置变量e为true，即解密成功
    iput-boolean v1, p0, Lcom/ijinshan/mPrivacy/c/j;->e:Z
    .line 80
    :cond_1
	# v0寄存器保存了实际读取到的字节数，p3是想要读取的字节数，即0x10000
    if-ge v0, p3, :cond_3
    move v1, v0
    .line 82
    :goto_1
	# v2 = byteOffset + 实际读到的字节数
    add-int v2, p2, v1
	# 如果v2大于0x400，就跳到cond_4
    if-gt v2, v5, :cond_4
    .line 84
    iget-object v2, p0, Lcom/ijinshan/mPrivacy/c/j;->d:[B
    if-eqz v2, :cond_2
    .line 85
	# 将前面解密的数据赋给v2寄存器
    iget-object v2, p0, Lcom/ijinshan/mPrivacy/c/j;->d:[B
	# v2拷贝到p1，p2为srcOffset，v6是desOffset，v1为拷贝大小
    invoke-static {v2, p2, p1, v6, v1}, Ljava/lang/System;->arraycopy(Ljava/lang/Object;ILjava/lang/Object;II)V
    .line 100
    :cond_2
    :goto_2
	# 已经读取的字节数
    iget-wide v1, p0, Lcom/ijinshan/mPrivacy/c/j;->f:J
	# v0为实际读到的字节数，转成long，保存到v3
    int-to-long v3, v0
    add-long/2addr v1, v3
	# 本次实际读到的字节数 + 以前已经读取的字节数，保存到f变量
    iput-wide v1, p0, Lcom/ijinshan/mPrivacy/c/j;->f:J
    goto :goto_0
    :cond_3
    move v1, p3
    .line 80
    goto :goto_1
    .line 89
    :cond_4
    if-ge p2, v5, :cond_2
    .line 91
    iget-object v1, p0, Lcom/ijinshan/mPrivacy/c/j;->d:[B
    if-eqz v1, :cond_2
    .line 92
    iget-object v1, p0, Lcom/ijinshan/mPrivacy/c/j;->d:[B
    sub-int v2, v5, p2
	# 后面的数据不用解密，直接拷贝即可
    invoke-static {v1, p2, p1, v6, v2}, Ljava/lang/System;->arraycopy(Ljava/lang/Object;ILjava/lang/Object;II)V
    goto :goto_2
    .line 98
	# 如果已读的字节数大于0x400，就跳到这里执行
    :cond_5
    const/4 v1, 0x0
	# 清空d变量
    iput-object v1, p0, Lcom/ijinshan/mPrivacy/c/j;->d:[B
    goto :goto_2
.end method

# 解密文件
# p0: 加密后文件的路径，例如/storage/sdcard0/.ksbox/6b2c357d	
.method public static b(Ljava/lang/String;)[B
    .locals 2
    .prologue
    const/4 v1, 0x0
    .line 456
    :try_start_0
	# 判断是否是我们的加密文件，判断文件开头特征等等
    invoke-static {p0}, Lcom/ijinshan/mPrivacy/c/g;->h(Ljava/lang/String;)[B
    move-result-object v0
    .line 457
    if-nez v0, :cond_0
    move-object v0, v1
    .line 472
    :goto_0
    return-object v0
    .line 461
    :cond_0
	# 调用b(Ljava/lang/String;I)[B，读取_e文件的内容
    invoke-static {p0}, Lcom/ijinshan/mPrivacy/c/g;->i(Ljava/lang/String;)[B
	# v0即为_e文件的内容
    move-result-object v0
    .line 462
    if-eqz v0, :cond_1
    .line 464
	# 调用解密函数，解密v0
    invoke-static {v0}, Lcom/ijinshan/mPrivacy/c/g;->a([B)[B
    :try_end_0
    .catch Ljava/io/IOException; {:try_start_0 .. :try_end_0} :catch_0
    move-result-object v0
    goto :goto_0
    .line 467
    :catch_0
    move-exception v0
    invoke-virtual {v0}, Ljava/io/IOException;->printStackTrace()V
    :cond_1
    move-object v0, v1
    .line 472
    goto :goto_0
.end method

# 解密算法 
# buffer[i] = buffer[i] ^ 0x6b;
.method public static a([B)[B
    .locals 3
    .prologue
    .line 264
    array-length v0, p0
	# 判断传入参数的buffer是不是大于0
    .line 266
    const/4 v1, 0x0
	# 判断v1是否大于buffer的大小
    :goto_0
    if-ge v1, v0, :cond_0
	# 取一个字节保存到v2
    .line 267
    aget-byte v2, p0, v1
	# 与0x6b异或
    xor-int/lit8 v2, v2, 0x6b
    int-to-byte v2, v2
	# 把异或得到的值写回原来的buffer中
    aput-byte v2, p0, v1
	# v1 + 1
    .line 266
    add-int/lit8 v1, v1, 0x1
	# 继续循环
    goto :goto_0
    .line 270
    :cond_0
    return-object p0
.end method

#include "stdafx.h"
#include <Windows.h>

// szName - 加密文件的文件名
// szOriginName - 原始文件名
BOOL DecodeStream(WCHAR *szName, WCHAR *szOriginName)
{
	BOOL bRet = FALSE;
	
	if (!szName || !szOriginName)
	{
		return bRet;
	}

	HANDLE hFile = CreateFile(szName,
		FILE_ALL_ACCESS,
		FILE_SHARE_READ | FILE_SHARE_WRITE,
		NULL,
		OPEN_EXISTING,
		FILE_ATTRIBUTE_NORMAL,
		NULL);

	if (hFile == INVALID_HANDLE_VALUE)
	{
		return bRet;
	}

	DWORD dwHigh = 0;
	DWORD dwSize = GetFileSize(hFile, &dwHigh);
	if (dwSize < 0x400)
	{
		CloseHandle(hFile);
		return bRet;
	}
	
	PBYTE pBuffer = (PBYTE)malloc(dwSize);
	if (pBuffer == NULL)
	{
		CloseHandle(hFile);
		return bRet;
	}
	
	memset(pBuffer, 0, dwSize);

	HANDLE hSaveFile = CreateFile(szOriginName,
		FILE_ALL_ACCESS,
		FILE_SHARE_READ | FILE_SHARE_WRITE,
		NULL,
		CREATE_ALWAYS,
		FILE_ATTRIBUTE_NORMAL,
		NULL);

	if (hSaveFile == INVALID_HANDLE_VALUE)
	{
		CloseHandle(hFile);
		free(pBuffer);
		return bRet;
	}

	WCHAR szPath[MAX_PATH] = {0};
	wsprintf(szPath, L"%s%s", szName, L"_e");
	HANDLE hFile_e = CreateFile(szPath,
		FILE_ALL_ACCESS,
		FILE_SHARE_READ | FILE_SHARE_WRITE,
		NULL,
		OPEN_EXISTING,
		FILE_ATTRIBUTE_NORMAL,
		NULL);

	if (hFile_e == INVALID_HANDLE_VALUE)
	{
		CloseHandle(hFile);
		CloseHandle(hSaveFile);
		free(pBuffer);
		return bRet;
	}

	DWORD dwRet = 0;
	bRet = ReadFile(hFile_e, pBuffer, 0x400, &dwRet, NULL);
	if (!bRet)
	{
		CloseHandle(hFile);
		CloseHandle(hSaveFile);
		CloseHandle(hFile_e);
		free(pBuffer);
		return bRet;
	}

	SetFilePointer(hFile, 0x400, NULL, FILE_BEGIN);
	bRet = ReadFile(hFile, pBuffer+0x400, dwSize-0x400, &dwRet, NULL);
	if (!bRet)
	{
		CloseHandle(hFile);
		CloseHandle(hSaveFile);
		CloseHandle(hFile_e);
		free(pBuffer);
		return bRet;
	}

	for (int i = 0; i < 0x400; i++)
	{
		pBuffer[i] = pBuffer[i] ^ 0x6b;
	}
	
	WriteFile(hSaveFile, pBuffer, dwSize, &dwRet, NULL);

	CloseHandle(hFile);
	CloseHandle(hSaveFile);
	CloseHandle(hFile_e);
	free(pBuffer);

	return bRet;
}

int _tmain(int argc, _TCHAR* argv[])
{
	DecodeStream(L"C:\\Users\\Administrator\\Desktop\\98fca88", 
		L"C:\\Users\\Administrator\\Desktop\\1.jpg");
	return 0;
}

[CTF入门培训]顶尖高校博士及硕士团队亲授《30小时教你玩转CTF》，视频+靶场+题目！助力进入CTF世界