没搭出调试环境，现搭来不及啊。。。

apk的代码作了混淆，很有迷惑性，那个check是空的，完全没思路，怎么回事呢？

后来偶然反了一下so文件，原来check在这里啊，是arm代码，并不熟悉，纯静态并没有帮助，可搭动态调试环境并不容易，等攻略吧。。。

验证点（前面还有一堆验证，静态看不明白），R0为1就是成功

.text:000038D0 loc_38D0                                ; CODE XREF: sub_391A+2Aj
.text:000038D0                 LDRB    R2, [R1,R4]
.text:000038D2                 LDRB    R3, [R0,R4]
.text:000038D4                 CMP     R3, R2
.text:000038D6                 BNE.W   sub_39B0
.text:000038DA                 ADDS    R4, #1
.text:00003942                 CMP     R4, #0x18
.text:00003944                 BNE     loc_38D0
.text:000039AC                 MOVS    R0, #1      ;set reg flag
.text:000039AE                 B       loc_3C28

去花指令idc，然而去了花指令，跳转标号还存在啊，去不掉

#include <idc.idc>
 static main()
 {        
         auto i,j,from,size,fromend,address; 
         from=0x1a00; //起始地址
        fromend=0x1b000;//结束地址
        while (from<fromend)
         { 
                 if ((Dword(from)==0x47f0e92d)&&(Dword(from+4)==0x47f0e8bd)) 
                 {
                                  for (i = 0;i<5;i++)
                                 {
                                         PatchWord(from,0xbf00);
                                         from=from+2;        
                                 }
                          continue;
                 }
                 if ((Dword(from)==0x47f0e8bd)&&(Dword(from+4)==0xf100e005)&&(Dword(from+8)==0xe00a0001)&&(Dword(from+0x2e)==0x40b1e8bd)&&(Word(from+0x32)==0xe7ed)) 
                 {
                                  for (i = 0;i<0x1a;i++)
                                 {
                                         PatchWord(from,0xbf00);
                                         from=from+2;        
                                 }
                          continue;
                 }
                 if ((Dword(from)==0xb082b5b1)&&(Dword(from+0x10)==0xe8bd461b)) 
                 {
                                  for (i = 0;i<0xf;i++)
                                 {
                                         PatchWord(from,0xbf00);
                                         from=from+2;        
                                 }
                          continue;
                 }
                 from=from+2; //
        }
         Message("\n" + "OK\n");
 }

[培训]二进制漏洞攻防（第3期）；满10人开班；模糊测试与工具使用二次开发；网络协议漏洞挖掘；Linux内核漏洞挖掘与利用；AOSP漏洞挖掘与利用；代码审计。