iscc2018决赛android 1000

解题前序

- 查了一下apk内部,可以拿到一个.dex,一个.jar和两个.so

- 解.jar发现其实是一个加密的.dex,将dex转成jar以后发现checkflag的函数

 

分析checkflag函数

- 发现其中先定义了一个二维数组,然后将其传入一个enc函数,这个函数是反编译不出来的,应该是加了壳

- 后分析libcore.so函数,发现其中有一个函数名以及函数的操作很可疑,函数首先将一串加密过的字符串还原,然后经过几个类似于取解密后字符串中的括号括起来的部分,按照函数原有逻辑顺序解一下,发现了主要check函数的名字,后面还接了地址(0x159CBC)

- 根据地址定位函数,IDA中那块字节码是乱掉的,不能被翻译成汇编,所以现将其变成dvm,然后来分析dvm

 

CODE:00159BCC # Method 0 (0x0)
CODE:00159BCC                 .short 0xC              # Number of registers : 0xc
CODE:00159BCE                 .short 1                # Size of input args (in words) : 0x1
CODE:00159BD0                 .short 2                # Size of output args (in words) : 0x2
CODE:00159BD2                 .short 0                # Number of try_items : 0x0
CODE:00159BD4                 .int byte_3028B7        # Debug info
CODE:00159BD8                 .int 0xBB               # Size of bytecode (in 16-bit units): 0xbb
CODE:00159BDC # ---------------------------------------------------------------------------
CODE:00159BDC                 const/4                         v10, 2
CODE:00159BDE                 const/4                         v9, 1
CODE:00159BE0                 const/4                         v8, 0
CODE:00159BE2                 .prologue_end
CODE:00159BE2                 .line 15
CODE:00159BE2                 const/4                         v2, 0
CODE:00159BE4                 .line 16
CODE:00159BE4                 new-instance                    v0, <t: StringBuilder>
CODE:00159BE8                 invoke-direct                   {v0}, <void StringBuilder.<init>() imp. @ _def_StringBuilder__init_@V>
CODE:00159BEE                 .line 17
CODE:00159BEE                 const/4                         v1, 0
CODE:00159BF0
CODE:00159BF0 loc_159BF0:                             # CODE XREF: CODE:00159D44↓j
CODE:00159BF0                 invoke-virtual                  {v11}, <int String.length() imp. @ _def_String_length@I>
CODE:00159BF6                 move-result                     v5
CODE:00159BF8                 if-ge                           v1, v5, loc_159D48
CODE:00159BFC                 .line 18
CODE:00159BFC                 sget-object                     v5, ProtectedClass_key
CODE:00159C00                 aget-object                     v5, v5, v8
CODE:00159C04                 aget                            v5, v5, v8
CODE:00159C08                 invoke-virtual                  {v11, v1}, <char String.charAt(int) imp. @ _def_String_charAt@CI>
CODE:00159C0E                 move-result                     v6
CODE:00159C10                 add-int/lit8                    v6, v6, -0x41
CODE:00159C14                 mul-int/2addr                   v5, v6
CODE:00159C16                 sget-object                     v6, ProtectedClass_key
CODE:00159C1A                 aget-object                     v6, v6, v8
CODE:00159C1E                 aget                            v6, v6, v9
CODE:00159C22                 add-int/lit8                    v7, v1, 1
CODE:00159C26                 .line 19
CODE:00159C26                 invoke-virtual                  {v11, v7}, <char String.charAt(int) imp. @ _def_String_charAt@CI>
CODE:00159C2C                 move-result                     v7
CODE:00159C2E                 add-int/lit8                    v7, v7, -0x41
CODE:00159C32                 mul-int/2addr                   v6, v7
CODE:00159C34                 add-int/2addr                   v5, v6
CODE:001