吾爱破解2025新春红包之三Android初级题

往年红包只玩windows和web，今年web题少，心血来潮发现工具不足啊。

初级题先试试手吧

首先，apk拖入jadx，查找个人代码部分，发现有两个FoldFragment，FoldFragment1在播放三折叠的宣传MP3，没有连个字符串都没有。文本打开mp3，也没有flag。目标转向FoldFragment2，代码里发现了3个base64的字符串，使用的地方都用同一个接口去解码，直接复制在线解码，发现不是明文。调用接口跟进去发现是xxtea加解密，正己大神还贴心的把加密接口也写进去了。

跟踪接口调用并整理的到如下Java代码

import java.io.IOException;

import sun.misc.BASE64Decoder;

public class calcFlag {
	private static String YYLX = "my-xxtea-secret";
	private static String m7483db(String value) throws IOException {
    	BASE64Decoder decoder = new BASE64Decoder();
        byte[] decode = decoder.decodeBuffer(value);
        byte[] bytes = YYLX.getBytes("UTF-8");
        String retStr = new String(m7488de(decode, bytes), "UTF-8");
        return retStr;
    }

	private static byte[] m7488de(byte[] data, byte[] key) {
        return data.length == 0 ? data : toByteArray(m7487de(toIntArray(data, false), toIntArray(m7484fK(key), false)), true);
    }

    static int[] m7487de(int[] iArr, int[] iArr2) {
        int length = iArr.length;
        int i = length - 1;
        if (i < 1) {
            return iArr;
        }
        int i2 = iArr[0];
        for (int i3 = ((52 / length) + 6) * (-1640531527); i3 != 0; i3 -= -1640531527) {
            int i4 = (i3 >>> 2) & 3;
            for (int i5 = i; i5 > 0; i5--) {
                int i6 = iArr[i5 - 1];
                i2 = iArr[i5] - (((i2 ^ i3) + (i6 ^ iArr2[(i5 & 3) ^ i4])) ^ (((i6 >>> 5) ^ (i2 << 2)) + ((i2 >>> 3) ^ (i6 << 4))));
                iArr[i5] = i2;
            }
            int i7 = iArr[i];
            i2 = iArr[0] - (((i2 ^ i3) + (iArr2[i4] ^ i7)) ^ (((i7 >>> 5) ^ (i2 << 2)) + ((i2 >>> 3) ^ (i7 << 4))));
            iArr[0] = i2;
        }
        return iArr;
    }

    static int[] toIntArray(byte[] bArr, boolean z) {
        int length = (bArr.length + 3) / 4;
        int[] iArr = new int[length + (z ? 1 : 0)];
        int length2 = bArr.length;
        for (int i = 0; i < length2; i++) {
            int i2 = i / 4;
            iArr[i2] = iArr[i2] | ((bArr[i] & 0xFF) << ((i % 4) * 8));
        }
        if (z) {
            iArr[length] = bArr.length;
        }
        return iArr;
    }

    private static byte[] toByteArray(int[] iArr, boolean z) {
        int length = iArr.length * 4;
        if (z) {
            length = iArr[iArr.length - 1];
        }
        byte[] bArr = new byte[length];
        for (int i = 0; i < length; i++) {
            bArr[i] = (byte) ((iArr[i / 4] >> ((i % 4) * 8)) & 255);
        }
        return bArr;
    }

    private static byte[] m7484fK(byte[] bArr) {
        byte[] bArr2 = new byte[16];
        System.arraycopy(bArr, 0, bArr2, 0, bArr.length > 16?16:bArr.length);
        return bArr2;
    }
    
	public static void main(String[] args) throws IOException {
		// TODO Auto-generated method stub
		String flag = m7483db("2hyWtSLN69+QWLHQ");
		String flag2 = m7483db("hjyaQ8jNSdp+mZic7Kdtyw==");
		System.out.println(flag + flag2);
	}

}

flag拼接方法是因为试过了知道怎么用才这么写的，直接调用三次分别解三个更全面。