【CTF】DD - Android Easy

0x01 题目描述

无

0x02 题解

下载的是一个apk文件，安装到模拟器发显示一个猜密码程序

送入jeb尝试反汇编，成功反汇编成java代码

package com.didi_ctf.flagapp;

import android.os.Bundle;
import android.support.v7.a.d;
import android.view.View;
import android.widget.TextView;

public class FlagActivity extends d {
    private static String m;
    private TextView n;
    private TextView o;
    private static final byte[] p;
    private static final byte[] q;

    static {
        FlagActivity.m = "com.didi_ctf.flagapp.FlagActivity";
        FlagActivity.p = new byte[]{-40, -62, 107, 66, -126, 103, -56, 77, 122, -107, -24, -127, 72, -63, -98, 64, -24, -5, -49, -26, 79, -70, -26, -81, 120, 25, 111, -100, -23, -9, 122, -35, 66, -50, -116, 3, -72, 102, -45, -85, 0, 126, -34, 62, 83, -34, 48, -111, 61, -9, -51, 114, 20, 81, -126, -18, 27, -115, -76, -116, -48, -118, -10, -102, -106, 113, -104, 98, -109, 74, 48, 47, -100, -88, 121, 22, -63, -32, -20, -41, -27, -20, -118, 100, -76, 70, -49, -39, -27, -106, -13, -108, 115, -87, -1, -22, -53, 21, -100, 124, -95, -40, 62, -69, 29, 56, -53, 85, -48, 25, 37, -78, 11, -110, -24, -120, -82, 6, -94, -101};
        FlagActivity.q = new byte[]{-57, -90, 53, -71, -117, 98, 62, 98, 101, -96, 36, 110, 77, -83, -121, 2, -48, 94, -106, -56, -49, -80, -1, 83, 75, 66, -44, 74, 2, -36, -42, -103, 6, -115, -40, 69, -107, 85, -78, -49, 54, 78, -26, 15, 98, -70, 8, -90, 94, -61, -84, 64, 112, 51, -29, -34, 126, -21, -126, -71, -31, -24, -60, -2, -81, 66, -84, 85, -91, 10, 84, 70, -8, -63, 26, 126, -76, -104, -123, -71, -126, -62, -23, 11, -39, 70, 14, 59, -101, -39, -124, 91, -109, 102, -49, 21, 105, 0, 37, -128, -57, 117, 110, -115, -86, 56, 25, -46, -55, 7, -125, 109, 76, 104, -15, 82, -53, 18, -28, -24};
    }

    public FlagActivity() {
        super();
    }

    private String i() {
        int v1 = 0;
        byte[] v2 = new byte[FlagActivity.p.length];
        int v0;
        for(v0 = 0; v0 < v2.length; ++v0) {
            v2[v0] = ((byte)(FlagActivity.p[v0] ^ FlagActivity.q[v0]));
        }

        int v3 = v2[0];
        for(v0 = 0; v2[v3 + v0] != 0; ++v0) {
        }

        byte[] v4 = new byte[v0];
        while(v1 < v0) {
            v4[v1] = v2[v3 + v1];
            ++v1;
        }

        return new String(v4);
    }

    public void onClickTest(View arg3) {
        if(this.n.getText().toString().equals(this.i())) {
            this.o.setText(2131099685);
        }
        else {
            this.o.setText(2131099683);
        }
    }

    protected void onCreate(Bundle arg2) {
        super.onCreate(arg2);
        this.setContentView(2130968602);
        this.n = this.findViewById(2131427413);
        this.o = this.findViewById(2131427415);
    }
}

针对算法写出脚本，得到flag

p = [-40, -62, 107, 66, -126, 103, -56, 77, 122, -107, -24, -127, 72, -63, -98, 64, -24, -5, -49, -26, 79, -70, -26, -81, 120, 25, 111, -100, -23, -9, 122, -35, 66, -50, -116, 3, -72, 102, -45, -85, 0, 126, -34, 62, 83, -34, 48, -111, 61, -9, -51, 114, 20, 81, -126, -18, 27, -115, -76, -116, -48, -118, -10, -102, -106, 113, -104, 98, -109, 74, 48, 47, -100, -88, 121, 22, -63, -32, -20, -41, -27, -20, -118, 100, -76, 70, -49, -39, -27, -106, -13, -108, 115, -87, -1, -22, -53, 21, -100, 124, -95, -40, 62, -69, 29, 56, -53, 85, -48, 25, 37, -78, 11, -110, -24, -120, -82, 6, -94, -101]

q = [-57, -90, 53, -71, -117, 98, 62, 98, 101, -96, 36, 110, 77, -83, -121, 2, -48, 94, -106, -56, -49, -80, -1, 83, 75, 66, -44, 74, 2, -36, -42, -103, 6, -115, -40, 69, -107, 85, -78, -49, 54, 78, -26, 15, 98, -70, 8, -90, 94, -61, -84, 64, 112, 51, -29, -34, 126, -21, -126, -71, -31, -24, -60, -2, -81, 66, -84, 85, -91, 10, 84, 70, -8, -63, 26, 126, -76, -104, -123, -71, -126, -62, -23, 11, -39, 70, 14, 59, -101, -39, -124, 91, -109, 102, -49, 21, 105, 0, 37, -128, -57, 117, 110, -115, -86, 56, 25, -46, -55, 7, -125, 109, 76, 104, -15, 82, -53, 18, -28, -24]


m = []
j = 0
n = 0
flag = ""

k = int(p[0]) ^ int(q[0])

for i in range(len(p)):

    m.append(int(p[i] ^ q[i]))

while True:
    if int(m[k+j]) == 0:
        count = j
        break
    j += 1


while n < count:

    flag += chr(m[k + n])
    n += 1

print flag