首页
社区
课程
招聘
问答 CTF 排行榜 知识库 工具下载 峰会 看雪商城 证书查询
  1. 社区
  2. CTF对抗
    3. 发新帖
1
看雪CTF2019Q1-第2题
发表于: 2019-3-18 21:38 3402

看雪CTF2019Q1-第2题

风间仁 活跃值
19
2019-3-18 21:38
3402

1. apk

 so里判断密码是否正确, 正确则解密flag, 需要提交的是密码, 因此直接看so
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
package com.zhuotong.crackme;
public class MainActivity extends AppCompiatActivity;
 
package android.support.v7.app;
public class AppCompiatActivity extends AppCompatActivity {
    static {
        System.loadLibrary("oo000oo");
    }
    protected native boolean eq(String arg1);
    protected void onStart() {
                ...
        this.login.setOnClickListener(new View$OnClickListener() {
            public void onClick(View arg5) {
                                    ...
                        if(AppCompiatActivity.this.eq(AppCompiatActivity.this.mPassword)) {
                            byte[] v5 = AppCompiatActivity.this.mPassword.getBytes();
                            int v3 = 24;
                            if(v5.length != v3) {
                                byte[] v2 = new byte[v3];
                                while(v1 < v2.length) {
                                    byte v3_1 = v1 < v5.length ? v5[v1] : ((byte)v1);
                                    v2[v1] = v3_1;
                                    ++v1;
                                }
 
                                v5 = v2;
                            }
                            v5 = AppCompiatActivity.dec(v5, "2ggdrsLgM7iPNYPQrD58Rg==".getBytes());
                            AppCompiatActivity v1_1 = AppCompiatActivity.this;
                            StringBuilder v2_1 = new StringBuilder();
                            v2_1.append("flag{");
                            v2_1.append(new String(v5));
                            v2_1.append("}");
                            Toast.makeText(((Context)v1_1), v2_1.toString(), 1).show();
                        }
                        ...
            }
        });
        this.name = this.findViewById(2131165265);
        this.name.setEnabled(false);
        this.password = this.findViewById(2131165277);
    } 
}

2. liboo000oo.so
解密用到的字符串
1
.init_array:00003E78                 DCD .datadiv_decode5009363700628197108+1

注册native函数android.support.v7.app.AppCompiatActivity.eq
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
int __fastcall JNI_OnLoad(JavaVM *a1)
{
  env = 0;
  if ( !(*a1)->GetEnv(a1, &env, 65540) )
    goto LABEL_4;
LABEL_2:
  result = -1;
  while ( _stack_chk_guard != v5 )
  {
LABEL_4:
    v2 = env;
    v3 = (*env)->FindClass(env, off_4010);
    dword_4110 = (*v2)->NewGlobalRef(v2, v3);
    if ( !v3 || (*v2)->RegisterNatives(v2, v3, &stru_4014, 1) <= -1 )
      goto LABEL_2;
    result = 65542;
  }
  return result;
}
 
.data:00004014 stru_4014       JNINativeMethod <aEq, aLjavaLangStrin, x_eq+1>

x_eq函数功能

字符串: 650f909c-7217-3647-9331-c82df8b98e98
去掉字符'-': 650f909c721736479331c82df8b98e98
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
package com.zhuotong.crackme;
public class MainActivity extends AppCompiatActivity;
 
package android.support.v7.app;
public class AppCompiatActivity extends AppCompatActivity {
    static {
        System.loadLibrary("oo000oo");
    }
    protected native boolean eq(String arg1);
    protected void onStart() {
                ...
        this.login.setOnClickListener(new View$OnClickListener() {
            public void onClick(View arg5) {
                                    ...
                        if(AppCompiatActivity.this.eq(AppCompiatActivity.this.mPassword)) {
                            byte[] v5 = AppCompiatActivity.this.mPassword.getBytes();
                            int v3 = 24;
                            if(v5.length != v3) {
                                byte[] v2 = new byte[v3];
                                while(v1 < v2.length) {
                                    byte v3_1 = v1 < v5.length ? v5[v1] : ((byte)v1);
                                    v2[v1] = v3_1;
                                    ++v1;
                                }
 
                                v5 = v2;
                            }
                            v5 = AppCompiatActivity.dec(v5, "2ggdrsLgM7iPNYPQrD58Rg==".getBytes());
                            AppCompiatActivity v1_1 = AppCompiatActivity.this;
                            StringBuilder v2_1 = new StringBuilder();
                            v2_1.append("flag{");
                            v2_1.append(new String(v5));
                            v2_1.append("}");
                            Toast.makeText(((Context)v1_1), v2_1.toString(), 1).show();
                        }
                        ...
            }
        });
        this.name = this.findViewById(2131165265);
        this.name.setEnabled(false);
        this.password = this.findViewById(2131165277);
    } 
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
package com.zhuotong.crackme;
public class MainActivity extends AppCompiatActivity;
 
package android.support.v7.app;
public class AppCompiatActivity extends AppCompatActivity {
    static {
        System.loadLibrary("oo000oo");
    }
    protected native boolean eq(String arg1);
    protected void onStart() {
                ...
        this.login.setOnClickListener(new View$OnClickListener() {
            public void onClick(View arg5) {
                                    ...
                        if(AppCompiatActivity.this.eq(AppCompiatActivity.this.mPassword)) {
                            byte[] v5 = AppCompiatActivity.this.mPassword.getBytes();
                            int v3 = 24;
                            if(v5.length != v3) {
                                byte[] v2 = new byte[v3];
                                while(v1 < v2.length) {
                                    byte v3_1 = v1 < v5.length ? v5[v1] : ((byte)v1);
                                    v2[v1] = v3_1;
                                    ++v1;
                                }
 
                                v5 = v2;
                            }
                            v5 = AppCompiatActivity.dec(v5, "2ggdrsLgM7iPNYPQrD58Rg==".getBytes());
                            AppCompiatActivity v1_1 = AppCompiatActivity.this;
                            StringBuilder v2_1 = new StringBuilder();
                            v2_1.append("flag{");
                            v2_1.append(new String(v5));
                            v2_1.append("}");
                            Toast.makeText(((Context)v1_1), v2_1.toString(), 1).show();
                        }
                        ...
            }
        });
        this.name = this.findViewById(2131165265);
        this.name.setEnabled(false);
        this.password = this.findViewById(2131165277);
    } 
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
package com.zhuotong.crackme;
public class MainActivity extends AppCompiatActivity;
 
package android.support.v7.app;
public class AppCompiatActivity extends AppCompatActivity {
    static {
        System.loadLibrary("oo000oo");
    }
    protected native boolean eq(String arg1);
    protected void onStart() {
                ...
        this.login.setOnClickListener(new View$OnClickListener() {
            public void onClick(View arg5) {
                                    ...
                        if(AppCompiatActivity.this.eq(AppCompiatActivity.this.mPassword)) {
                            byte[] v5 = AppCompiatActivity.this.mPassword.getBytes();
                            int v3 = 24;
                            if(v5.length != v3) {
                                byte[] v2 = new byte[v3];
                                while(v1 < v2.length) {
                                    byte v3_1 = v1 < v5.length ? v5[v1] : ((byte)v1);
                                    v2[v1] = v3_1;
                                    ++v1;
                                }
 
                                v5 = v2;
                            }
                            v5 = AppCompiatActivity.dec(v5, "2ggdrsLgM7iPNYPQrD58Rg==".getBytes());
                            AppCompiatActivity v1_1 = AppCompiatActivity.this;
                            StringBuilder v2_1 = new StringBuilder();
                            v2_1.append("flag{");
                            v2_1.append(new String(v5));
                            v2_1.append("}");
                            Toast.makeText(((Context)v1_1), v2_1.toString(), 1).show();
                        }
                        ...
            }
        });
        this.name = this.findViewById(2131165265);
        this.name.setEnabled(false);
        this.password = this.findViewById(2131165277);
    } 
}

2. liboo000oo.so
解密用到的字符串
1
.init_array:00003E78                 DCD .datadiv_decode5009363700628197108+1

注册native函数android.support.v7.app.AppCompiatActivity.eq
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
int __fastcall JNI_OnLoad(JavaVM *a1)
{
  env = 0;
  if ( !(*a1)->GetEnv(a1, &env, 65540) )
    goto LABEL_4;
LABEL_2:
  result = -1;
  while ( _stack_chk_guard != v5 )
  {
LABEL_4:
    v2 = env;
    v3 = (*env)->FindClass(env, off_4010);
    dword_4110 = (*v2)->NewGlobalRef(v2, v3);
    if ( !v3 || (*v2)->RegisterNatives(v2, v3, &stru_4014, 1) <= -1 )
      goto LABEL_2;
    result = 65542;
  }
  return result;
}
 
.data:00004014 stru_4014       JNINativeMethod <aEq, aLjavaLangStrin, x_eq+1>

解密用到的字符串
1
.init_array:00003E78                 DCD .datadiv_decode5009363700628197108+1

1
.init_array:00003E78                 DCD .datadiv_decode5009363700628197108+1

注册native函数android.support.v7.app.AppCompiatActivity.eq
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
int __fastcall JNI_OnLoad(JavaVM *a1)
{
  env = 0;
  if ( !(*a1)->GetEnv(a1, &env, 65540) )
    goto LABEL_4;
LABEL_2:
  result = -1;
  while ( _stack_chk_guard != v5 )
  {
LABEL_4:
    v2 = env;
    v3 = (*env)->FindClass(env, off_4010);
    dword_4110 = (*v2)->NewGlobalRef(v2, v3);
    if ( !v3 || (*v2)->RegisterNatives(v2, v3, &stru_4014, 1) <= -1 )
      goto LABEL_2;
    result = 65542;
  }
  return result;
}
 
.data:00004014 stru_4014       JNINativeMethod <aEq, aLjavaLangStrin, x_eq+1>

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
int __fastcall JNI_OnLoad(JavaVM *a1)
{
  env = 0;
  if ( !(*a1)->GetEnv(a1, &env, 65540) )
    goto LABEL_4;
LABEL_2:
  result = -1;
  while ( _stack_chk_guard != v5 )
  {
LABEL_4:
    v2 = env;
    v3 = (*env)->FindClass(env, off_4010);
    dword_4110 = (*v2)->NewGlobalRef(v2, v3);
    if ( !v3 || (*v2)->RegisterNatives(v2, v3, &stru_4014, 1) <= -1 )
      goto LABEL_2;
    result = 65542;
  }
  return result;
}
 
.data:00004014 stru_4014       JNINativeMethod <aEq, aLjavaLangStrin, x_eq+1>

x_eq函数功能


[注意]看雪招聘，专注安全领域的专业人才平台！

收藏
免费 ・1
支持
分享
赞赏记录
参与人
雪币
留言
时间
PLEBFE
为你点赞~
2023-1-28 05:01
最新回复 (0)
游客
登录 | 注册 方可回帖
回帖 表情 雪币赚取及消费
高级回复
返回

账号登录
验证码登录

忘记密码？
没有账号？立即免费注册
我已同意 《看雪服务条款》 《看雪课程免责声明》 《看雪隐私政策》