-
-
[原创]第五题Writeup
-
发表于: 2018-12-10 13:28 2742
-
题目的结构很清晰,apk直接改成zip,解压获得 classes.dex, 再用dex2jar获得jar,再jd-gui反编译出java代码。
从CrackMe.c()里面知道输入至少8个字符,看起来像是年(4)月(2)日(2),
CrackMe.d()里面有一些输入的年、月、日的过滤条件
然后再 e(), f(), g(), h()函数里面分别对输入的年、月、日及后面的一串字符从全局数组中取出对应的值相加。
再根据CrackMe.b()函数里面初始化的值可知相加的和应该为34。 e, f, g函数很好理解,但是 jd-gui 反编译出来的h函数看起来总是很诡异。Android/Java的已经超出了我的理解范围,不打算理解了。全局变量不多,直接用C#尝试穷举试试:
using System; using System.Collections.Generic; using System.Linq; using System.Text; using System.Threading.Tasks; namespace ConsoleApp1 { class Program { int[] a = { 16, 6, 7, 10, 9, 16, 10, 8, 8, 9, 6, 6 }; int[] b = { 5, 10, 8, 15, 16, 15, 8, 16, 8, 16, 9, 17, 8, 17, 10, 8, 9, 18, 5, 15, 10, 9, 8, 9, 15, 18, 7, 8, 16, 6 }; int[] c = { 6, 7, 18, 9, 5, 16, 9, 15, 18, 8, 9, 5 }; int[] d = { 7, 7, 9, 12, 8, 7, 13, 5, 14, 5, 9, 17, 5, 7, 12, 8, 8, 6, 19, 6, 8, 16, 10, 6, 12, 9, 6, 7, 12, 5, 9, 8, 7, 8, 15, 9, 16, 8, 8, 19, 12, 6, 8, 7, 5, 15, 6, 16, 15, 7, 9, 12, 10, 7, 15, 6, 5, 14, 14, 9 }; String[] m = { "23to01", "01to03", "03to05", "05to07", "07to09", "09to11", "11to13", "13to15", "15to17", "17to19", "19to21", "21to23" }; static void Main(string[] args) { Program pro = new Program(); for (int ia = 0; ia < pro.a.Length; ia++) { for (int ib = 0; ib < pro.b.Length; ib++) { for(int ic = 0; ic < pro.c.Length; ic++) { for (int id = 0; id <pro.d.Length; id++) { if (34 == (pro.a[ia] + pro.b[ib] + pro.c[ic] + pro.d[id])) { int Years = id + 60 + 1900; int Month = ic + 1; int Days = ib + 1; if (Years <= 1983 || Years >= 2007) continue; if ((Years == 1989) || (Years == 2004)) { continue; } if ((Years == 1989 || Years == 2004) && Days == 31) { continue; } if ((Years <= 1994) && Month == 3) { continue; } if (Years >= 1996 && Month == 9) { continue; } if ((Years == 1995) && Month == 6) { continue; } if (Years != 1999 && (Month == 1 || Month == 4 || Month == 5 || Month == 7 || Month == 10 || Month == 11 || Month == 12)) { continue; } if ((Years <= 1994) && (Month == 2 || Month == 6 || Month == 8)) { continue; } if ((Years >= 1996) && ((Month == 2) || (Month == 6) || (Month == 8))) { continue; } if ((Years == 1995) && ((Days > Month + 2) || (Month == Days))) { continue; } string srets = Years.ToString("D4") + Month.ToString("D2") + Days.ToString("D2"); Console.WriteLine("May be: {0}{1}", srets, pro.m[ia]); } } } } } } } }
using System; using System.Collections.Generic; using System.Linq; using System.Text; using System.Threading.Tasks; namespace ConsoleApp1 { class Program { int[] a = { 16, 6, 7, 10, 9, 16, 10, 8, 8, 9, 6, 6 }; int[] b = { 5, 10, 8, 15, 16, 15, 8, 16, 8, 16, 9, 17, 8, 17, 10, 8, 9, 18, 5, 15, 10, 9, 8, 9, 15, 18, 7, 8, 16, 6 }; int[] c = { 6, 7, 18, 9, 5, 16, 9, 15, 18, 8, 9, 5 }; int[] d = { 7, 7, 9, 12, 8, 7, 13, 5, 14, 5, 9, 17, 5, 7, 12, 8, 8, 6, 19, 6, 8, 16, 10, 6, 12, 9, 6, 7, 12, 5, 9, 8, 7, 8, 15, 9, 16, 8, 8, 19, 12, 6, 8, 7, 5, 15, 6, 16, 15, 7, 9, 12, 10, 7, 15, 6, 5, 14, 14, 9 }; String[] m = { "23to01", "01to03", "03to05", "05to07", "07to09", "09to11", "11to13", "13to15", "15to17", "17to19", "19to21", "21to23" }; static void Main(string[] args) { Program pro = new Program(); for (int ia = 0; ia < pro.a.Length; ia++) { for (int ib = 0; ib < pro.b.Length; ib++) { for(int ic = 0; ic < pro.c.Length; ic++) { for (int id = 0; id <pro.d.Length; id++) { if (34 == (pro.a[ia] + pro.b[ib] + pro.c[ic] + pro.d[id])) { int Years = id + 60 + 1900; int Month = ic + 1; int Days = ib + 1; if (Years <= 1983 || Years >= 2007) continue; if ((Years == 1989) || (Years == 2004)) { continue; } if ((Years == 1989 || Years == 2004) && Days == 31) { continue; } if ((Years <= 1994) && Month == 3) { continue; } if (Years >= 1996 && Month == 9) { continue; } if ((Years == 1995) && Month == 6) { continue; } if (Years != 1999 && (Month == 1 || Month == 4 || Month == 5 || Month == 7 || Month == 10 || Month == 11 || Month == 12)) { continue; } if ((Years <= 1994) && (Month == 2 || Month == 6 || Month == 8)) { continue; } if ((Years >= 1996) && ((Month == 2) || (Month == 6) || (Month == 8))) { continue; } if ((Years == 1995) && ((Days > Month + 2) || (Month == Days))) { continue; } string srets = Years.ToString("D4") + Month.ToString("D2") + Days.ToString("D2"); Console.WriteLine("May be: {0}{1}", srets, pro.m[ia]); } } } } } } } }
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课
赞赏
他的文章
- [原创]CTF2018第十题writeup 4011
- [原创]CTF2018追凶Writeup 2869
- [原创]第五题Writeup 2743
- [原创]CTF2018第二题半加器 writeup 3722
- [原创]ctf2018初世纪 writup 2104
看原图
赞赏
雪币:
留言: