-
-
[原创]KCTF2019 变形金刚
-
发表于: 2025-1-10 09:31
-
本题是我2023年做过加密步骤最繁杂的题目，写一篇wp记录一下
涉及知识点
文件是安卓的apk文件，我们选择jadx进行分析
程序具有登录功能，接受用户名和密码，并检查反转后的密码是否与用户名相同。如果相同，将返回一个包含flag的Toast消息。
分析完毕，但是没得出什么有用的东西，我们先开文件看一手。
看到已经有账户名了，上面分析发现如果账号反转等于密码的话就会输出flag，我们将账号反转尝试一下。
发现输出“error”，可是我们在代码中并未发现给出error提示的代码，使用字符串搜索也没有该字符串，查看主函数是发现其继承了一个AppCompiatActivity类，仔细一看好家伙，这玩意多了一个i。是个自写类。我们跟进查看看看有没有什么惊喜。
代码包含了一些操作 EditText、Button 和 Toast 的逻辑，实现了一个简单的登录功能。
在 onStart() 方法中，有 login、name、password 这三个控件，并添加了一个点击监听器。当登录按钮被点击时，代码会尝试使用 mo4191eq() 方法判断密码是否正确，如果正确，则使用 dec() 方法对密码进行解密，并通过 Toast 显示 flag。
总的来说，这段代码是一个简单的登录功能，使用了一些常见的 Android 应用程序组件和加密算法。
主要发现这里使用了一个native方法，将apk文件使用压缩包打开，提取出该so文件，使用ida观察.
这里主要是动态注册Native 方法
这一段代码对一大串字符做了处理，我们使用脚本分析，看看处理出了什么东西。
输出结果:
发现第一个字符串像是一串序列号，第二个字符串是一个变化的base64密码表，第三第四个则是调用我们的eq函数
JNI_Onload() 里边有两个off_4010 off_4014 分别对应的就是第三第四个字符串。
我们对密码表进行跟进
发现784函数调用了该密码表，肯定是在其中进行了base64变表加密。
查看整个784函数,我们将该函数分为几段来进行讲解
这一串呢，首先是取出我们之前异或得到的那个类似于序列号的字符串，在此处实际上是作为rc4的key，然后对对其处理方式是删除其中所有的'-'然后逆序，再加上'-'，再利用码表，将其替换成码表里面的值。
这一段就是对rc4的s盒子，t盒进行处理，然而本次的rc4为魔改rc4它使用了自己给出的S盒。内容储存在unk_23E8中
这一段就是将每个字符先rc4加密在使用base64加密，同时进行。
但是每当迭代器为2的倍数时需要异或一个0xF。
这一段是每当迭代器为4的倍数时就需要将密文异或一个0x7，然后与储存的值进行比较。至此解析完毕，那么这个密文肯定就是密码。
我们需要将密文先按规则异或回去然后base64 解码。
脚本如下
然后我们可以得到处理后的密钥的值。
接下来我们需要处理rc4的key.
得到36f36b3c-a03e-4996-8759-8408e626c215
然后初始化RC4的密钥流
异或得到答案
输出:
然后我们将fu0kzHp2aqtZAuY6输入到软件中就可以拿到flag了
收益良多
package com.zhuotong.crackme;
import android.os.Bundle;
import android.os.Handler;
import android.os.Message;
import android.support.p003v7.app.AppCompiatActivity;
import android.text.TextUtils;
import android.view.View;
import android.widget.Button;
import android.widget.EditText;
import android.widget.Toast;
import java.lang.ref.WeakReference;
import java.util.concurrent.ExecutorService;
import java.util.concurrent.Executors;
public class MainActivity extends AppCompiatActivity {
public static final int MSG_LOGIN = 0;
private static final ExecutorService cachedThreadPool = Executors.newCachedThreadPool();
private static boolean hasLogin;
private static Runnable runnable;
private Handler handler;
private Button login;
private String mName;
private String mPassword;
private EditText name;
private EditText password;
private static class MyHandler extends Handler {
WeakReference<MainActivity> mWeakReference;
public MyHandler(MainActivity mainActivity) {
this.mWeakReference = new WeakReference<>(mainActivity);
}
public void handleMessage(Message message) {
super.handleMessage(message);
MainActivity mainActivity = this.mWeakReference.get();
if (mainActivity != null) {
switch (message.what) {
case 0:
String str = (String) message.obj;
if (!TextUtils.isEmpty(str)) {
StringBuilder sb = new StringBuilder();
for (int i = 0; i < str.length() / 2; i++) {
sb.append(str.charAt(i));
}
str = sb.toString();
}
Toast.makeText(mainActivity, "flag{" + str + "}", 1).show();
break;
case 1:
Toast.makeText(mainActivity, "登录失败", 1).show();
break;
}
mainActivity.login.setEnabled(true);
}
}
}
/* access modifiers changed from: protected */
@Override // android.support.p000v4.app.SupportActivity, android.support.p003v7.app.AppCompatActivity, android.support.p000v4.app.FragmentActivity
public void onCreate(Bundle bundle) {
super.onCreate(bundle);
setContentView(C0245R.layout.activity_main);
this.login = (Button) findViewById(C0245R.C0247id.login_button);
this.handler = new MyHandler(this);
this.login.setOnClickListener(new View.OnClickListener() {
/* class com.zhuotong.crackme.MainActivity.View$OnClickListenerC02431 */
public void onClick(View view) {
MainActivity.this.mName = MainActivity.this.name.getText().toString();
MainActivity.this.mPassword = MainActivity.this.password.getText().toString();
if (TextUtils.isEmpty(MainActivity.this.mName) || TextUtils.isEmpty(MainActivity.this.mPassword)) {
Toast.makeText(MainActivity.this, "用户名或密码为空", 1).show();
return;
}
boolean unused = MainActivity.hasLogin = true;
MainActivity.this.login.setEnabled(false);
MainActivity.this.login(MainActivity.this.mName, MainActivity.this.mPassword, MainActivity.this.handler);
}
});
this.name = (EditText) findViewById(C0245R.C0247id.name);
this.password = (EditText) findViewById(C0245R.C0247id.password);
}
/* access modifiers changed from: private */
/* access modifiers changed from: public */
private void login(final String str, final String str2, final Handler handler2) {
Toast.makeText(this, "登录中。。。", 1).show();
runnable = new Runnable() {
/* class com.zhuotong.crackme.MainActivity.RunnableC02442 */
public void run() {
Message obtain = Message.obtain();
StringBuilder sb = new StringBuilder(str2);
if (str.equals(sb.reverse().toString())) {
obtain.obj = sb.toString();
} else {
obtain.what = 1;
}
handler2.sendMessage(obtain);
}
};
cachedThreadPool.execute(runnable);
}
}package com.zhuotong.crackme;
import android.os.Bundle;
import android.os.Handler;
import android.os.Message;
import android.support.p003v7.app.AppCompiatActivity;
import android.text.TextUtils;
import android.view.View;
import android.widget.Button;
import android.widget.EditText;
import android.widget.Toast;
import java.lang.ref.WeakReference;
import java.util.concurrent.ExecutorService;
import java.util.concurrent.Executors;
public class MainActivity extends AppCompiatActivity {
public static final int MSG_LOGIN = 0;
private static final ExecutorService cachedThreadPool = Executors.newCachedThreadPool();
private static boolean hasLogin;
private static Runnable runnable;
private Handler handler;
private Button login;
private String mName;
private String mPassword;
private EditText name;
private EditText password;
private static class MyHandler extends Handler {
WeakReference<MainActivity> mWeakReference;
public MyHandler(MainActivity mainActivity) {
this.mWeakReference = new WeakReference<>(mainActivity);
}
public void handleMessage(Message message) {
super.handleMessage(message);
MainActivity mainActivity = this.mWeakReference.get();
if (mainActivity != null) {
switch (message.what) {
case 0:
String str = (String) message.obj;
if (!TextUtils.isEmpty(str)) {
StringBuilder sb = new StringBuilder();
for (int i = 0; i < str.length() / 2; i++) {
sb.append(str.charAt(i));
}
str = sb.toString();
}
Toast.makeText(mainActivity, "flag{" + str + "}", 1).show();
break;
case 1:
Toast.makeText(mainActivity, "登录失败", 1).show();
break;
}
mainActivity.login.setEnabled(true);
}
}
}
/* access modifiers changed from: protected */
@Override // android.support.p000v4.app.SupportActivity, android.support.p003v7.app.AppCompatActivity, android.support.p000v4.app.FragmentActivity
public void onCreate(Bundle bundle) {
super.onCreate(bundle);
setContentView(C0245R.layout.activity_main);
this.login = (Button) findViewById(C0245R.C0247id.login_button);
this.handler = new MyHandler(this);
this.login.setOnClickListener(new View.OnClickListener() {
/* class com.zhuotong.crackme.MainActivity.View$OnClickListenerC02431 */
public void onClick(View view) {
MainActivity.this.mName = MainActivity.this.name.getText().toString();
MainActivity.this.mPassword = MainActivity.this.password.getText().toString();
if (TextUtils.isEmpty(MainActivity.this.mName) || TextUtils.isEmpty(MainActivity.this.mPassword)) {
Toast.makeText(MainActivity.this, "用户名或密码为空", 1).show();
return;
}
boolean unused = MainActivity.hasLogin = true;
MainActivity.this.login.setEnabled(false);
MainActivity.this.login(MainActivity.this.mName, MainActivity.this.mPassword, MainActivity.this.handler);
}
});
this.name = (EditText) findViewById(C0245R.C0247id.name);
this.password = (EditText) findViewById(C0245R.C0247id.password);
}
/* access modifiers changed from: private */
/* access modifiers changed from: public */
private void login(final String str, final String str2, final Handler handler2) {
Toast.makeText(this, "登录中。。。", 1).show();
runnable = new Runnable() {
/* class com.zhuotong.crackme.MainActivity.RunnableC02442 */
public void run() {
Message obtain = Message.obtain();
StringBuilder sb = new StringBuilder(str2);
if (str.equals(sb.reverse().toString())) {
obtain.obj = sb.toString();
} else {
obtain.what = 1;
}
handler2.sendMessage(obtain);
}
};
cachedThreadPool.execute(runnable);
}
}package android.support.p003v7.app;
import android.os.Handler;
import android.text.TextUtils;
import android.util.Base64;
import android.view.View;
import android.widget.Button;
import android.widget.EditText;
import android.widget.Toast;
import com.zhuotong.crackme.C0245R;
import java.io.PrintStream;
import javax.crypto.Cipher;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
/* renamed from: android.support.v7.app.AppCompiatActivity */public class AppCompiatActivity extends AppCompatActivity { public static final int MSG_LOGIN = 0;
private Handler handler;
private Button login;
private String mName;
private String mPassword;
private EditText name;
private EditText password;
/* access modifiers changed from: protected */
/* renamed from: eq */
public native boolean mo4191eq(String str);
static {
System.loadLibrary("oo000oo");
}
/* access modifiers changed from: protected */
@Override // android.support.p003v7.app.AppCompatActivity, android.support.p000v4.app.FragmentActivity
public void onStart() {
super.onStart();
this.login = (Button) findViewById(C0245R.C0247id.login_button);
this.login.setOnClickListener(new View.OnClickListener() {
/* class android.support.p003v7.app.AppCompiatActivity.View$OnClickListenerC01791 */
public void onClick(View view) {
AppCompiatActivity.this.mName = AppCompiatActivity.this.name.getText().toString();
AppCompiatActivity.this.mPassword = AppCompiatActivity.this.password.getText().toString();
if (TextUtils.isEmpty(AppCompiatActivity.this.mName) || TextUtils.isEmpty(AppCompiatActivity.this.mPassword)) {
Toast.makeText(AppCompiatActivity.this, "用户名或密码为空", 1).show();
return;
}
int i = 0;
AppCompiatActivity.this.login.setEnabled(false);
if (AppCompiatActivity.this.mo4191eq(AppCompiatActivity.this.mPassword)) {
byte[] bytes = AppCompiatActivity.this.mPassword.getBytes();
if (bytes.length != 24) {
byte[] bArr = new byte[24];
while (i < bArr.length) {
bArr[i] = i < bytes.length ? bytes[i] : (byte) i;
i++;
}
bytes = bArr;
}
byte[] dec = AppCompiatActivity.dec(bytes, "2ggdrsLgM7iPNYPQrD58Rg==".getBytes());
AppCompiatActivity appCompiatActivity = AppCompiatActivity.this;
Toast.makeText(appCompiatActivity, "flag{" + new String(dec) + "}", 1).show();
return;
}
Toast.makeText(AppCompiatActivity.this, "error", 1).show();
}
});
this.name = (EditText) findViewById(C0245R.C0247id.name);
this.name.setEnabled(false);
this.password = (EditText) findViewById(C0245R.C0247id.password);
}
/* access modifiers changed from: private */
public static byte[] dec(byte[] bArr, byte[] bArr2) {
byte[] decode = Base64.decode(bArr2, 0);
SecretKeySpec secretKeySpec = new SecretKeySpec(bArr, "AES");
try {
secretKeySpec.getEncoded();
PrintStream printStream = System.out;
printStream.println("getFormat = " + secretKeySpec.getFormat() + " ; getAlgorithm = " + secretKeySpec.getAlgorithm());
Cipher instance = Cipher.getInstance("AES/CFB/PKCS5Padding");
PrintStream printStream2 = System.out;
printStream2.println("getBlockSize = " + instance.getBlockSize());
instance.init(2, secretKeySpec, new IvParameterSpec(new byte[instance.getBlockSize()]));
return instance.doFinal(decode);
} catch (Throwable th) {
th.printStackTrace();
return null;
}
}
}package android.support.p003v7.app;
import android.os.Handler;
import android.text.TextUtils;
import android.util.Base64;
import android.view.View;
import android.widget.Button;
import android.widget.EditText;
import android.widget.Toast;
import com.zhuotong.crackme.C0245R;
import java.io.PrintStream;
import javax.crypto.Cipher;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
/* renamed from: android.support.v7.app.AppCompiatActivity */public class AppCompiatActivity extends AppCompatActivity { public static final int MSG_LOGIN = 0;
private Handler handler;
private Button login;
private String mName;
private String mPassword;
private EditText name;
private EditText password;
/* access modifiers changed from: protected */
/* renamed from: eq */
public native boolean mo4191eq(String str);
static {
System.loadLibrary("oo000oo");
}
/* access modifiers changed from: protected */
@Override // android.support.p003v7.app.AppCompatActivity, android.support.p000v4.app.FragmentActivity
public void onStart() {
super.onStart();
this.login = (Button) findViewById(C0245R.C0247id.login_button);
this.login.setOnClickListener(new View.OnClickListener() {
/* class android.support.p003v7.app.AppCompiatActivity.View$OnClickListenerC01791 */
public void onClick(View view) {
AppCompiatActivity.this.mName = AppCompiatActivity.this.name.getText().toString();
AppCompiatActivity.this.mPassword = AppCompiatActivity.this.password.getText().toString();
if (TextUtils.isEmpty(AppCompiatActivity.this.mName) || TextUtils.isEmpty(AppCompiatActivity.this.mPassword)) {
Toast.makeText(AppCompiatActivity.this, "用户名或密码为空", 1).show();
return;
}
int i = 0;
AppCompiatActivity.this.login.setEnabled(false);
if (AppCompiatActivity.this.mo4191eq(AppCompiatActivity.this.mPassword)) {
byte[] bytes = AppCompiatActivity.this.mPassword.getBytes();
if (bytes.length != 24) {
byte[] bArr = new byte[24];
while (i < bArr.length) {
bArr[i] = i < bytes.length ? bytes[i] : (byte) i;
i++;
}
bytes = bArr;
}
byte[] dec = AppCompiatActivity.dec(bytes, "2ggdrsLgM7iPNYPQrD58Rg==".getBytes());
AppCompiatActivity appCompiatActivity = AppCompiatActivity.this;
Toast.makeText(appCompiatActivity, "flag{" + new String(dec) + "}", 1).show();
return;
}
Toast.makeText(AppCompiatActivity.this, "error", 1).show();
}
});
this.name = (EditText) findViewById(C0245R.C0247id.name);
this.name.setEnabled(false);
this.password = (EditText) findViewById(C0245R.C0247id.password);
}
/* access modifiers changed from: private */
public static byte[] dec(byte[] bArr, byte[] bArr2) {
byte[] decode = Base64.decode(bArr2, 0);
SecretKeySpec secretKeySpec = new SecretKeySpec(bArr, "AES");
try {
secretKeySpec.getEncoded();
PrintStream printStream = System.out;
printStream.println("getFormat = " + secretKeySpec.getFormat() + " ; getAlgorithm = " + secretKeySpec.getAlgorithm());
Cipher instance = Cipher.getInstance("AES/CFB/PKCS5Padding");
PrintStream printStream2 = System.out;
printStream2.println("getBlockSize = " + instance.getBlockSize());
instance.init(2, secretKeySpec, new IvParameterSpec(new byte[instance.getBlockSize()]));
return instance.doFinal(decode);
} catch (Throwable th) {
th.printStackTrace();
return null;
}
}
}jint JNI_OnLoad(JavaVM *vm, void *reserved)
{ int v3; // r5
int v4; // r6
int v5; // [sp+0h] [bp-18h] BYREF
v5 = 0;
if ( (*vm)->GetEnv(vm, (void **)&v5, 65540) )
return -1;
v3 = v5;
v4 = (*(int (__fastcall **)(int, void *))(*(_DWORD *)v5 + 24))(v5, off_4010);
dword_4110 = (*(int (__fastcall **)(int, int))(*(_DWORD *)v3 + 84))(v3, v4);
if ( !v4 || (*(int (__fastcall **)(int, int, char **, int))(*(_DWORD *)v3 + 860))(v3, v4, off_4014, 1) <= -1 )
return -1;
else
return 65542;
}jint JNI_OnLoad(JavaVM *vm, void *reserved)
{ int v3; // r5
int v4; // r6
int v5; // [sp+0h] [bp-18h] BYREF
v5 = 0;
if ( (*vm)->GetEnv(vm, (void **)&v5, 65540) )
return -1;
v3 = v5;
v4 = (*(int (__fastcall **)(int, void *))(*(_DWORD *)v5 + 24))(v5, off_4010);
dword_4110 = (*(int (__fastcall **)(int, int))(*(_DWORD *)v3 + 84))(v3, v4);
if ( !v4 || (*(int (__fastcall **)(int, int, char **, int))(*(_DWORD *)v3 + 860))(v3, v4, off_4014, 1) <= -1 )
return -1;
else
return 65542;
}char *datadiv_decode5009363700628197108()
{ int i; // r0
int j; // r0
int k; // r0
char *result; // r0
for ( i = 0; i != 37; ++i )
byte_4020[i] ^= 0xA5u;
for ( j = 0; j != 66; ++j )
byte_4050[j] ^= 0xA5u;
for ( k = 0; k != 42; ++k )
byte_40A0[k] ^= 0x84u;
result = &byte_40D0;
byte_40CA ^= 0xFCu;
byte_40CB ^= 0xFCu;
byte_40CC ^= 0xFCu;
byte_40D0 ^= 0x62u;
byte_40D1 ^= 0x62u;
byte_40D2 ^= 0x62u;
byte_40D3 ^= 0x62u;
byte_40D4 ^= 0x62u;
byte_40D5 ^= 0x62u;
word_40D6 ^= 0x6262u;
byte_40D8 ^= 0x62u;
byte_40D9 ^= 0x62u;
byte_40DA ^= 0x62u;
byte_40DB ^= 0x62u;
byte_40DC ^= 0x62u;
byte_40DD ^= 0x62u;
byte_40DE ^= 0x62u;
byte_40DF ^= 0x62u;
byte_40E0 ^= 0x62u;
byte_40E1 ^= 0x62u;
byte_40E2 ^= 0x62u;
byte_40E3 ^= 0x62u;
byte_40E4 ^= 0x62u;
byte_40E5 ^= 0x62u;
return result;
}char *datadiv_decode5009363700628197108()
{ int i; // r0
int j; // r0
int k; // r0
char *result; // r0
for ( i = 0; i != 37; ++i )
byte_4020[i] ^= 0xA5u;
for ( j = 0; j != 66; ++j )
byte_4050[j] ^= 0xA5u;
for ( k = 0; k != 42; ++k )
byte_40A0[k] ^= 0x84u;
result = &byte_40D0;
byte_40CA ^= 0xFCu;
byte_40CB ^= 0xFCu;
byte_40CC ^= 0xFCu;
byte_40D0 ^= 0x62u;
byte_40D1 ^= 0x62u;
byte_40D2 ^= 0x62u;
byte_40D3 ^= 0x62u;
byte_40D4 ^= 0x62u;
byte_40D5 ^= 0x62u;
word_40D6 ^= 0x6262u;
byte_40D8 ^= 0x62u;
byte_40D9 ^= 0x62u;
byte_40DA ^= 0x62u;
byte_40DB ^= 0x62u;
byte_40DC ^= 0x62u;
byte_40DD ^= 0x62u;
byte_40DE ^= 0x62u;
byte_40DF ^= 0x62u;
byte_40E0 ^= 0x62u;
byte_40E1 ^= 0x62u;
byte_40E2 ^= 0x62u;
byte_40E3 ^= 0x62u;
byte_40E4 ^= 0x62u;
byte_40E5 ^= 0x62u;
return result;
}#include<iostream>#include<algorithm>#include<cstdio>#include<cmath>#include<map>#include<vector>#include<queue>#include<stack>#include<set>#include<string>#include<cstring>#include<list>#include<stdlib.h>#include<windows.h>using namespace std;
typedef int status;
typedef int selemtype;
int v3; // r10
char *v4; // r6
char *v5; // r8
char *v6; // r11
int v7; // r0
int v8; // r2
char *v9; // r1
int v10; // r3
int v11; // r1
unsigned int v12; // r2
int v13; // r3
int v14; // r0
int v15; // r4
char v16; // r0
char *v17; // r3
char *v18; // r5
// r5
int v20; // r1
int v21; // r0
// r1
int v23; // r2
int v24; // r8
unsigned int v25; // r5
char *v26; // r0
int v27; // r10
unsigned int v28; // r2
int v29; // r12
bool v30; // zf
char *v31; // r4
int v32; // r3
bool v33; // zf
int v34; // r3
int v35; // r1
char v36; // r11
char v37; // lr
int v38; // r3
unsigned __int8 v39; // r1
char *v40; // r2
int v41; // r3
int v42; // t1
char v44; // r1
unsigned int v45; // [sp+4h] [bp-234h]
unsigned int v46; // [sp+8h] [bp-230h]
unsigned int v47; // [sp+10h] [bp-228h]
char *v48; // [sp+14h] [bp-224h]
char v49[257]; // [sp+18h] [bp-220h] BYREF
char v50[257]; // [sp+118h] [bp-120h]
/* _ooOoo_
o8888888o
88" . "88
(| -_- |)
O\ = /O
____/`---'\____
.' \\| |// `.
/ \\||| : |||// \
/ _||||| -:- |||||- \
| | \\\ - /// | |
| \_| ''\---/'' | |
\ .-\__ `-` ___/-. /
___`. .' /--.--\ `. . __
."" '< `.___\_<|>_/___.' >'"".
| | : `- \`.;`\ _ /`;.`/ - ` : | |
\ \ `-. \_ __\ /__ _/ .-` / /
======`-.____`-.___\_____/___.-`____.-'====== `=---='
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 佛祖保佑 永不宕机 永无BUG
*/unsigned char ida_chars1[] =
{ 0x93, 0x90, 0x95, 0xC3, 0x9C, 0x95, 0x9C, 0xC6, 0x88, 0x92,
0x97, 0x94, 0x92, 0x88, 0x96, 0x93, 0x91, 0x92, 0x88, 0x9C,
0x96, 0x96, 0x94, 0x88, 0xC6, 0x9D, 0x97, 0xC1, 0xC3, 0x9D,
0xC7, 0x9C, 0x9D, 0xC0, 0x9C, 0x9D, 0xA5
};unsigned char ida_chars2[] =
{ 0x84, 0x9F, 0x86, 0x81, 0x80, 0x83, 0x8D, 0x8C, 0x8E, 0x88,
0x8F, 0x8A, 0xC5, 0xDB, 0xFA, 0xFE, 0xF8, 0xDE, 0xD8, 0x9A,
0x99, 0x9B, 0x89, 0x8B, 0xE5, 0xFB, 0xC4, 0xC7, 0xC6, 0xC1,
0xC0, 0xC3, 0xC2, 0xCD, 0xCC, 0xCF, 0xCE, 0xC9, 0xC8, 0xCB,
0xCA, 0xD5, 0xD4, 0xD7, 0xD6, 0xD1, 0xD0, 0xD3, 0xD2, 0xDD,
0xDC, 0xDF, 0x95, 0x94, 0x97, 0x96, 0x91, 0x90, 0x93, 0x92,
0x9D, 0x9C, 0xF9, 0x82, 0x9E, 0xA5
};unsigned char ida_chars3[] =
{ 0xE5, 0xEA, 0xE0, 0xF6, 0xEB, 0xED, 0xE0, 0xAB, 0xF7, 0xF1,
0xF4, 0xF4, 0xEB, 0xF6, 0xF0, 0xAB, 0xF2, 0xB3, 0xAB, 0xE5,
0xF4, 0xF4, 0xAB, 0xC5, 0xF4, 0xF4, 0xC7, 0xEB, 0xE9, 0xF4,
0xED, 0xE5, 0xF0, 0xC5, 0xE7, 0xF0, 0xED, 0xF2, 0xED, 0xF0,
0xFD, 0x84
};unsigned char ida_chars4[] =
{ 0x99, 0x8D, 0xFC, 0x00, 0x00, 0x00, 0x4A, 0x2E, 0x08, 0x03,
0x14, 0x03, 0x4D, 0x0E, 0x03, 0x0C, 0x05, 0x4D, 0x31, 0x16,
0x10, 0x0B, 0x0C, 0x05, 0x59, 0x4B, 0x38, 0x62
};unsigned char ida_chars[] =
{ 0xD7, 0xDF, 0x02, 0xD4, 0xFE, 0x6F, 0x53, 0x3C, 0x25, 0x6C,
0x99, 0x97, 0x06, 0x56, 0x8F, 0xDE, 0x40, 0x11, 0x64, 0x07,
0x36, 0x15, 0x70, 0xCA, 0x18, 0x17, 0x7D, 0x6A, 0xDB, 0x13,
0x30, 0x37, 0x29, 0x60, 0xE1, 0x23, 0x28, 0x8A, 0x50, 0x8C,
0xAC, 0x2F, 0x88, 0x20, 0x27, 0x0F, 0x7C, 0x52, 0xA2, 0xAB,
0xFC, 0xA1, 0xCC, 0x21, 0x14, 0x1F, 0xC2, 0xB2, 0x8B, 0x2C,
0xB0, 0x3A, 0x66, 0x46, 0x3D, 0xBB, 0x42, 0xA5, 0x0C, 0x75,
0x22, 0xD8, 0xC3, 0x76, 0x1E, 0x83, 0x74, 0xF0, 0xF6, 0x1C,
0x26, 0xD1, 0x4F, 0x0B, 0xFF, 0x4C, 0x4D, 0xC1, 0x87, 0x03,
0x5A, 0xEE, 0xA4, 0x5D, 0x9E, 0xF4, 0xC8, 0x0D, 0x62, 0x63,
0x3E, 0x44, 0x7B, 0xA3, 0x68, 0x32, 0x1B, 0xAA, 0x2D, 0x05,
0xF3, 0xF7, 0x16, 0x61, 0x94, 0xE0, 0xD0, 0xD3, 0x98, 0x69,
0x78, 0xE9, 0x0A, 0x65, 0x91, 0x8E, 0x35, 0x85, 0x7A, 0x51,
0x86, 0x10, 0x3F, 0x7F, 0x82, 0xDD, 0xB5, 0x1A, 0x95, 0xE7,
0x43, 0xFD, 0x9B, 0x24, 0x45, 0xEF, 0x92, 0x5C, 0xE4, 0x96,
0xA9, 0x9C, 0x55, 0x89, 0x9A, 0xEA, 0xF9, 0x90, 0x5F, 0xB8,
0x04, 0x84, 0xCF, 0x67, 0x93, 0x00, 0xA6, 0x39, 0xA8, 0x4E,
0x59, 0x31, 0x6B, 0xAD, 0x5E, 0x5B, 0x77, 0xB1, 0x54, 0xDC,
0x38, 0x41, 0xB6, 0x47, 0x9F, 0x73, 0xBA, 0xF8, 0xAE, 0xC4,
0xBE, 0x34, 0x01, 0x4B, 0x2A, 0x8D, 0xBD, 0xC5, 0xC6, 0xE8,
0xAF, 0xC9, 0xF5, 0xCB, 0xFB, 0xCD, 0x79, 0xCE, 0x12, 0x71,
0xD2, 0xFA, 0x09, 0xD5, 0xBC, 0x58, 0x19, 0x80, 0xDA, 0x49,
0x1D, 0xE6, 0x2E, 0xE3, 0x7E, 0xB7, 0x3B, 0xB3, 0xA0, 0xB9,
0xE5, 0x57, 0x6E, 0xD9, 0x08, 0xEB, 0xC7, 0xED, 0x81, 0xF1,
0xF2, 0xBF, 0xC0, 0xA7, 0x4A, 0xD6, 0x2B, 0xB4, 0x72, 0x9D,
0x0E, 0x6D, 0xEC, 0x48, 0xE2, 0x33
};char vs16[] = "2409715836dbeafc";
int main ()
{ for(int i = 0 ; i < 38 ; i ++ )
{
ida_chars1[i]^=0xa5;
}
for(int i = 0 ; i < 66 ; i ++ )
{
ida_chars2[i]^=0xa5;
}
for(int i = 0 ; i <42 ; i ++ )
{
ida_chars3[i]^=0x84;
}
for(int i = 0 ; i <28 ; i++ )
{
if(i<=2)
{
ida_chars4[i]^=0xfc;
}
else
{
ida_chars4[i]^=0x62;
}
}
ida_chars4[2]='"';
printf("%s\n%s\n%s\n%s\n",ida_chars1,ida_chars2,ida_chars3,ida_chars4);
#include<iostream>#include<algorithm>#include<cstdio>#include<cmath>#include<map>#include<vector>#include<queue>#include<stack>#include<set>#include<string>#include<cstring>#include<list>#include<stdlib.h>#include<windows.h>using namespace std;
typedef int status;
typedef int selemtype;
int v3; // r10
char *v4; // r6
char *v5; // r8
char *v6; // r11
int v7; // r0
int v8; // r2
char *v9; // r1
int v10; // r3
int v11; // r1
unsigned int v12; // r2
int v13; // r3
int v14; // r0
int v15; // r4
char v16; // r0
char *v17; // r3
char *v18; // r5
// r5
int v20; // r1
int v21; // r0
// r1
int v23; // r2
int v24; // r8
unsigned int v25; // r5
char *v26; // r0
int v27; // r10
unsigned int v28; // r2
int v29; // r12
bool v30; // zf
char *v31; // r4
int v32; // r3
bool v33; // zf
int v34; // r3
int v35; // r1
char v36; // r11
char v37; // lr
int v38; // r3
unsigned __int8 v39; // r1
char *v40; // r2
int v41; // r3
int v42; // t1
char v44; // r1
unsigned int v45; // [sp+4h] [bp-234h]
unsigned int v46; // [sp+8h] [bp-230h]
unsigned int v47; // [sp+10h] [bp-228h]
char *v48; // [sp+14h] [bp-224h]
char v49[257]; // [sp+18h] [bp-220h] BYREF
char v50[257]; // [sp+118h] [bp-120h]
/* _ooOoo_
o8888888o
88" . "88
(| -_- |)
O\ = /O
____/`---'\____
.' \\| |// `.
/ \\||| : |||// \
/ _||||| -:- |||||- \
| | \\\ - /// | |
| \_| ''\---/'' | |
\ .-\__ `-` ___/-. /
___`. .' /--.--\ `. . __
."" '< `.___\_<|>_/___.' >'"".
| | : `- \`.;`\ _ /`;.`/ - ` : | |
\ \ `-. \_ __\ /__ _/ .-` / /
======`-.____`-.___\_____/___.-`____.-'====== `=---='
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 佛祖保佑 永不宕机 永无BUG
*/unsigned char ida_chars1[] =
{ 0x93, 0x90, 0x95, 0xC3, 0x9C, 0x95, 0x9C, 0xC6, 0x88, 0x92,
0x97, 0x94, 0x92, 0x88, 0x96, 0x93, 0x91, 0x92, 0x88, 0x9C,
0x96, 0x96, 0x94, 0x88, 0xC6, 0x9D, 0x97, 0xC1, 0xC3, 0x9D,
0xC7, 0x9C, 0x9D, 0xC0, 0x9C, 0x9D, 0xA5
};unsigned char ida_chars2[] =
{ 0x84, 0x9F, 0x86, 0x81, 0x80, 0x83, 0x8D, 0x8C, 0x8E, 0x88,
0x8F, 0x8A, 0xC5, 0xDB, 0xFA, 0xFE, 0xF8, 0xDE, 0xD8, 0x9A,
0x99, 0x9B, 0x89, 0x8B, 0xE5, 0xFB, 0xC4, 0xC7, 0xC6, 0xC1,
0xC0, 0xC3, 0xC2, 0xCD, 0xCC, 0xCF, 0xCE, 0xC9, 0xC8, 0xCB,
0xCA, 0xD5, 0xD4, 0xD7, 0xD6, 0xD1, 0xD0, 0xD3, 0xD2, 0xDD,
0xDC, 0xDF, 0x95, 0x94, 0x97, 0x96, 0x91, 0x90, 0x93, 0x92,
0x9D, 0x9C, 0xF9, 0x82, 0x9E, 0xA5
};unsigned char ida_chars3[] =
{ 0xE5, 0xEA, 0xE0, 0xF6, 0xEB, 0xED, 0xE0, 0xAB, 0xF7, 0xF1,
0xF4, 0xF4, 0xEB, 0xF6, 0xF0, 0xAB, 0xF2, 0xB3, 0xAB, 0xE5,
0xF4, 0xF4, 0xAB, 0xC5, 0xF4, 0xF4, 0xC7, 0xEB, 0xE9, 0xF4,
0xED, 0xE5, 0xF0, 0xC5, 0xE7, 0xF0, 0xED, 0xF2, 0xED, 0xF0,
0xFD, 0x84
};unsigned char ida_chars4[] =
{ 0x99, 0x8D, 0xFC, 0x00, 0x00, 0x00, 0x4A, 0x2E, 0x08, 0x03,
0x14, 0x03, 0x4D, 0x0E, 0x03, 0x0C, 0x05, 0x4D, 0x31, 0x16,
0x10, 0x0B, 0x0C, 0x05, 0x59, 0x4B, 0x38, 0x62
};unsigned char ida_chars[] =
{ 0xD7, 0xDF, 0x02, 0xD4, 0xFE, 0x6F, 0x53, 0x3C, 0x25, 0x6C,
0x99, 0x97, 0x06, 0x56, 0x8F, 0xDE, 0x40, 0x11, 0x64, 0x07,
0x36, 0x15, 0x70, 0xCA, 0x18, 0x17, 0x7D, 0x6A, 0xDB, 0x13,
0x30, 0x37, 0x29, 0x60, 0xE1, 0x23, 0x28, 0x8A, 0x50, 0x8C,
0xAC, 0x2F, 0x88, 0x20, 0x27, 0x0F, 0x7C, 0x52, 0xA2, 0xAB,
0xFC, 0xA1, 0xCC, 0x21, 0x14, 0x1F, 0xC2, 0xB2, 0x8B, 0x2C,
0xB0, 0x3A, 0x66, 0x46, 0x3D, 0xBB, 0x42, 0xA5, 0x0C, 0x75,
0x22, 0xD8, 0xC3, 0x76, 0x1E, 0x83, 0x74, 0xF0, 0xF6, 0x1C,
0x26, 0xD1, 0x4F, 0x0B, 0xFF, 0x4C, 0x4D, 0xC1, 0x87, 0x03,
0x5A, 0xEE, 0xA4, 0x5D, 0x9E, 0xF4, 0xC8, 0x0D, 0x62, 0x63,
0x3E, 0x44, 0x7B, 0xA3, 0x68, 0x32, 0x1B, 0xAA, 0x2D, 0x05,
0xF3, 0xF7, 0x16, 0x61, 0x94, 0xE0, 0xD0, 0xD3, 0x98, 0x69,
0x78, 0xE9, 0x0A, 0x65, 0x91, 0x8E, 0x35, 0x85, 0x7A, 0x51,
0x86, 0x10, 0x3F, 0x7F, 0x82, 0xDD, 0xB5, 0x1A, 0x95, 0xE7,
0x43, 0xFD, 0x9B, 0x24, 0x45, 0xEF, 0x92, 0x5C, 0xE4, 0x96,
0xA9, 0x9C, 0x55, 0x89, 0x9A, 0xEA, 0xF9, 0x90, 0x5F, 0xB8,
0x04, 0x84, 0xCF, 0x67, 0x93, 0x00, 0xA6, 0x39, 0xA8, 0x4E,
0x59, 0x31, 0x6B, 0xAD, 0x5E, 0x5B, 0x77, 0xB1, 0x54, 0xDC,
0x38, 0x41, 0xB6, 0x47, 0x9F, 0x73, 0xBA, 0xF8, 0xAE, 0xC4,
0xBE, 0x34, 0x01, 0x4B, 0x2A, 0x8D, 0xBD, 0xC5, 0xC6, 0xE8,
0xAF, 0xC9, 0xF5, 0xCB, 0xFB, 0xCD, 0x79, 0xCE, 0x12, 0x71,
0xD2, 0xFA, 0x09, 0xD5, 0xBC, 0x58, 0x19, 0x80, 0xDA, 0x49,
0x1D, 0xE6, 0x2E, 0xE3, 0x7E, 0xB7, 0x3B, 0xB3, 0xA0, 0xB9,
0xE5, 0x57, 0x6E, 0xD9, 0x08, 0xEB, 0xC7, 0xED, 0x81, 0xF1,
0xF2, 0xBF, 0xC0, 0xA7, 0x4A, 0xD6, 0x2B, 0xB4, 0x72, 0x9D,
0x0E, 0x6D, 0xEC, 0x48, 0xE2, 0x33
};char vs16[] = "2409715836dbeafc";
int main ()
{ for(int i = 0 ; i < 38 ; i ++ )
{
ida_chars1[i]^=0xa5;
}
for(int i = 0 ; i < 66 ; i ++ )
{
ida_chars2[i]^=0xa5;
}
for(int i = 0 ; i <42 ; i ++ )
{
ida_chars3[i]^=0x84;
}
for(int i = 0 ; i <28 ; i++ )
{
if(i<=2)
{
ida_chars4[i]^=0xfc;
}
else
{
ida_chars4[i]^=0x62;
}
}
ida_chars4[2]='"';
printf("%s\n%s\n%s\n%s\n",ida_chars1,ida_chars2,ida_chars3,ida_chars4);
650f909c-7217-3647-9331-c82df8b98e98!:#$%&()+-*/`~_[]{}?<>,.@^abcdefghijklmnopqrstuvwxyz0123456789\';android/support/v7/app/AppCompiatActivityeq"bbb(Ljava/lang/String;)Z650f909c-7217-3647-9331-c82df8b98e98!:#$%&()+-*/`~_[]{}?<>,.@^abcdefghijklmnopqrstuvwxyz0123456789\';android/support/v7/app/AppCompiatActivityeq"bbb(Ljava/lang/String;)Zif ( v3 )
{
v7 = 0;
v8 = v3;
v9 = byte_4020;
do
{
v10 = (unsigned __int8)*v9++;
if ( v10 != 45 )
*((_BYTE *)v5 + v7++) = v10;
--v8;
}
while ( v8 );
if ( v7 >= 1 )
{
v11 = v7 - 1;
v12 = -8;
v13 = 0;
v14 = 0;
do
{
if ( (v13 | (v12 >> 2)) > 3 )
{
v15 = v14;
}
else
{
v15 = v14 + 1;
v4[v14] = 45;
}
v16 = *((_BYTE *)v5 + v11--);
v13 += 0x40000000;
v4[v15] = v16;
++v12;
v14 = v15 + 1;
}
while ( v11 != -1 );
if ( v15 >= 0 )
{
v17 = v6;
while ( 1 )
{
v18 = (_BYTE *)*v4;
if ( (unsigned __int8)((_BYTE)v18 - 97) <= 5u )
break;
if ( (unsigned __int8)((_BYTE)v18 - 48) <= 9u )
{
v18 = (char *)&unk_23DE + (_DWORD)v18 - 48;
goto LABEL_18;
}
LABEL_19: *v17++ = (unsigned __int8)v18;
--v14;
++v4;
if ( !v14 )
goto LABEL_20;
}
v18 = (char *)&unk_23D8 + (_DWORD)v18 - 97;
LABEL_18: LOBYTE(v18) = *v18;
goto LABEL_19;
}
}
}
if ( v3 )
{
v7 = 0;
v8 = v3;
v9 = byte_4020;
do
{
v10 = (unsigned __int8)*v9++;
if ( v10 != 45 )
*((_BYTE *)v5 + v7++) = v10;
--v8;
}
while ( v8 );
if ( v7 >= 1 )
{
v11 = v7 - 1;
v12 = -8;
v13 = 0;
v14 = 0;
do
{
if ( (v13 | (v12 >> 2)) > 3 )
{
v15 = v14;
}
else
{
v15 = v14 + 1;
v4[v14] = 45;
}
v16 = *((_BYTE *)v5 + v11--);
v13 += 0x40000000;
v4[v15] = v16;
++v12;
v14 = v15 + 1;
}
while ( v11 != -1 );
if ( v15 >= 0 )
{
v17 = v6;
while ( 1 )
{
v18 = (_BYTE *)*v4;
if ( (unsigned __int8)((_BYTE)v18 - 97) <= 5u )
break;
if ( (unsigned __int8)((_BYTE)v18 - 48) <= 9u )
{
v18 = (char *)&unk_23DE + (_DWORD)v18 - 48;
goto LABEL_18;
}
LABEL_19: *v17++ = (unsigned __int8)v18;
--v14;
++v4;
if ( !v14 )
goto LABEL_20;
}
v18 = (char *)&unk_23D8 + (_DWORD)v18 - 97;
LABEL_18: LOBYTE(v18) = *v18;
goto LABEL_19;
}
}
}
for ( i = 0; i != 256; ++i )
{ sub_D20(i, v3);
v50[i] = v6[v20];
}v21 = (unsigned __int8)(v50[0] - 41);
v49[0] = v49[v21];v49[v21] = -41;for ( j = 1; j != 256; ++j )
{ v23 = (unsigned __int8)v49[j];
v21 = (v21 + (unsigned __int8)v50[j] + v23) % 256;
v49[j] = v49[v21];
v49[v21] = v23;
}v24 = strlen(v48);
v25 = v6[3];v46 = 8 * (3 - -3 * (v24 / 3));v45 = v25 + v46 / 6;v26 = malloc(v45 + 1);
if ( !v24 )
goto LABEL_44;
v27 = 0;v28 = 0;v29 = 0;v47 = v25;for ( i = 0; i != 256; ++i )
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
最后于 2025-1-10 09:34
被Shangwendada编辑
，原因：
|
|
|---|---|
