【攻防世界】Reverse——easyEZbaby_app writeup

用jadx反编译得到：

public class FirstActivity extends AppCompatActivity implements View.OnClickListener {
    Button button;
    EditText password;
    EditText username;

    /* JADX INFO: Access modifiers changed from: protected */
    @Override // androidx.fragment.app.FragmentActivity, androidx.activity.ComponentActivity, androidx.core.app.ComponentActivity, android.app.Activity
    public void onCreate(Bundle bundle) {
        super.onCreate(bundle);
        setContentView(R.layout.first_layout);
        this.button = (Button) findViewById(R.id.login_button);
        this.username = (EditText) findViewById(R.id.username);
        this.password = (EditText) findViewById(R.id.password);
        this.button.setOnClickListener(this);
    }

    @Override // android.view.View.OnClickListener
    public void onClick(View view) {
        String obj = this.username.getText().toString();
        String obj2 = this.password.getText().toString();
        if (checkUsername(obj) && checkPass(obj2)) {
            Toast.makeText(this, "登录成功", 0).show();
            Toast.makeText(this, "flag{" + obj + obj2 + "}", 0).show();
            return;
        }
        Toast.makeText(this, "登录失败", 0).show();
    }

    public boolean checkUsername(String str) {
        if (str != null) {
            try {
                if (str.length() != 0 && str != null) {
                    MessageDigest messageDigest = MessageDigest.getInstance("MD5");
                    messageDigest.reset();
                    messageDigest.update("zhishixuebao".getBytes());
                    String hexString = toHexString(messageDigest.digest(), "");
                    StringBuilder sb = new StringBuilder();
                    for (int i = 0; i < hexString.length(); i += 2) {
                        sb.append(hexString.charAt(i));
                    }
                    String sb2 = sb.toString();
                    return (sb2).equals(str);
                }
                return false;
            } catch (NoSuchAlgorithmException e) {
                e.printStackTrace();
            }
        }
        return false;
    }

    public boolean checkPass(String str) {
        if (str != null) {
            char[] charArray = str.toCharArray();
            if (charArray.length != 15) {
                return false;
            }
            for (int i = 0; i < charArray.length; i++) {
                charArray[i] = (char) ((((255 - i) + 2) - 98) - charArray[i]);
                if (charArray[i] != '0' || i >= 15) {
                    return false;
                }
            }
            return true;
        }
        return false;
    }

    private static String toHexString(byte[] bArr, String str) {
        StringBuilder sb = new StringBuilder();
        for (byte b : bArr) {
            String hexString = Integer.toHexString(b & 255);
            if (hexString.length() == 1) {
                sb.append('0');
            }
            sb.append(hexString);
            sb.append(str);
        }
        return sb.toString();
    }
}

该程序通过检查输入的用户名和密码，合法则登录成功。题目的答案就是flag{用户名密码}。

checkpass的逆向：

def getPass():
    arr_s = [0] * 15
    for i in range(15):
        arr_s[i] = 0x9f -0x30-i
    password = ''.join(chr(i) for i in arr_s)
    print(password)
username=getUserName()
to_hex_string(username.encode('utf-8'))
getPass()

checkUserName的逆向，因为有反编译代码，所以直接复制粘贴过来修改一下下就可以用了：

import java.security.MessageDigest;
class HelloWorld {
    public static String getUsername() {

            try {
                    MessageDigest messageDigest = MessageDigest.getInstance("MD5");
                    messageDigest.reset();
                    messageDigest.update("zhishixuebao".getBytes());
                    String hexString = toHexString(messageDigest.digest(), "");
                    StringBuilder sb = new StringBuilder();
                    for (int i = 0; i < hexString.length(); i += 2) {
                        sb.append(hexString.charAt(i));
                    }
                    String sb2 = sb.toString();
                    return sb2;

            } catch (Exception e) {
                e.printStackTrace();
            }
            return " ";

    }
    private static String toHexString(byte[] bArr, String str) {
        StringBuilder sb = new StringBuilder();
        for (byte b : bArr) {
            String hexString = Integer.toHexString(b & 255);
            if (hexString.length() == 1) {
                sb.append('0');
            }
            sb.append(hexString);
            sb.append(str);
        }
        return sb.toString();
    }

    public static void main(String[] args) {
        String username= getUsername();
        System.out.println(username);
    }
}