【攻防世界】mobile App1 Writeup

 这个题目属于最简单的入门级别，但要注意代码里故意交换了versionName和versionCode的赋值。

protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        this.setContentView(0x7F04001B);  // layout:activity_main
        this.btn = (Button)this.findViewById(0x7F0B0058);  // id:checBtn
        this.text = (EditText)this.findViewById(0x7F0B0057);  // id:input
        this.btn.setOnClickListener(new View.OnClickListener() {
            @Override  // android.view.View$OnClickListener
            public void onClick(View v) {
                try {
                    String s = MainActivity.this.text.getText().toString();
                    PackageInfo packageInfo0 = MainActivity.this.getPackageManager().getPackageInfo("com.example.yaphetshan.tencentgreat", 0x4000);
                    String versionCode = packageInfo0.versionName;
                    int versionName = packageInfo0.versionCode;
                    for(int i = 0; i < s.length() && i < versionCode.length(); ++i) {
                        if(s.charAt(i) != (versionCode.charAt(i) ^ versionName)) {
                            Toast.makeText(MainActivity.this, "再接再厉，加油~", 1).show();
                            return;
                        }
                    }

                    if(s.length() == versionCode.length()) {
                        Toast.makeText(MainActivity.this, "恭喜开启闯关之门！", 1).show();
                        return;
                    }
                }
                catch(PackageManager.NameNotFoundException packageManager$NameNotFoundException0) {
                }

                Toast.makeText(MainActivity.this, "年轻人不要耍小聪明噢", 1).show();
            }
        });
    }

versionCode和version Name的值都可以在Manifest中找到，使用下面的代码就可得到flag：

versionName = "X<cP[?PHNB<P?aj"
versionCode = 15
s = ""
for  i in range(len(versionName)) :
    #if(s.charAt(i) != (versionName.charAt(i) ^ versionCode)):
    s += chr(ord(versionName[i]) ^ versionCode)
    
print(s)