KCTF2019 变形金刚

最新推荐文章于 2024-09-21 15:14:12 发布

原创

最新推荐文章于 2024-09-21 15:14:12 发布 · 522 阅读

1 ·

CC 4.0 BY-SA版权

本文介绍了KCTF2019中的一道安卓逆向题目，涉及 APK反编译、字符串反转迷惑、native层的解密逻辑。解题关键在于理解在JNI_LOAD中注册的Eq函数，该函数使用输入作为AES密钥解密Base64编码的flag。提供了三种解题方法：逆向加密算法、穷举输入和手动解密，详细分析了每种方法的思路。

一道安卓逆向，由于没找到关键函数，比赛时没搞出来，复现一下

对APK进行反编译，结果十分诡异，看起来就像是对用户名进行了字符串反转，但测试后并非这样

public class MainActivity extends AppCompiatActivity {
    class MyHandler extends Handler {
        WeakReference mWeakReference;

        public MyHandler(MainActivity arg2) {
            super();
            this.mWeakReference = new WeakReference(arg2);
        }

        public void handleMessage(Message arg6) {
            String v6_1;
            StringBuilder v1;
            super.handleMessage(arg6);
            Object v0 = this.mWeakReference.get();
            if(v0 == null) {
                return;
            }

            switch(arg6.what) {
                case 0: {
                    Object v6 = arg6.obj;
                    if(!TextUtils.isEmpty(((CharSequence)v6))) {
                        v1 = new StringBuilder();
                        int v3;
                        for(v3 = 0; v3 < ((String)v6).length() / 2; ++v3) {
                            v1.append(((String)v6).charAt(v3));
                        }

                        v6_1 = v1.toString();
                    }

                    v1 = new StringBuilder();
                    v1.append("flag{");
                    v1.append(v6_1);
                    v1.append("}");
                    Toast.makeText(((Context)v0), v1.toString(), 1).show();
                    break;
                }
                case 1: {
                    Toast.makeText(((Context)v0), "登录失败", 1).show();
                    break;
                }
                default: {
                    break;
                }
            }

            ((MainActivity)v0).login.setEnabled(true);
        }
    }

private void login(String arg3, String arg4, Handler arg5) {
        Toast.makeText(((Context)this), "登录中。。。", 1).show();
        MainActivity.runnable = new Runnable(arg4, arg3, arg5) {
            public void run() {
                Message v0 = Message.obtain();
                StringBuilder v1 = new StringBuilder(this.val$password);
                if(this.val$name.equals(v1.reverse().toString())) {
                    v0.obj = v1.toString();
                }
                else {
                    v0.what = 1;
                }

                this.val$handler.sendMessage(v0);
            }
        };
        MainActivity.cachedThreadPool.execute(MainActivity.runnable);
    }

    protected void onCreate(Bundle arg2) {
        super.onCreate(arg2);
        this.setContentView(2131296283);
        this.login = this.findViewById(2131165260);
        this.handler = new MyHandler(this);
        this.login.setOnClickListener(new View$OnClickListener() {
            public void onClick(View arg4) {
                MainActivity.this.mName = MainActivity.this.name.getText().toString();