解题前序
- 查了一下apk内部,可以拿到一个.dex,一个.jar和两个.so
- 解.jar发现其实是一个加密的.dex,将dex转成jar以后发现checkflag的函数
分析checkflag函数
- 发现其中先定义了一个二维数组,然后将其传入一个enc函数,这个函数是反编译不出来的,应该是加了壳
- 后分析libcore.so函数,发现其中有一个函数名以及函数的操作很可疑,函数首先将一串加密过的字符串还原,然后经过几个类似于取解密后字符串中的括号括起来的部分,按照函数原有逻辑顺序解一下,发现了主要check函数的名字,后面还接了地址(0x159CBC)
- 根据地址定位函数,IDA中那块字节码是乱掉的,不能被翻译成汇编,所以现将其变成dvm,然后来分析dvm
CODE:00159BCC # Method 0 (0x0)
CODE:00159BCC .short 0xC # Number of registers : 0xc
CODE:00159BCE .short 1 # Size of input args (in words) : 0x1
CODE:00159BD0 .short 2 # Size of output args (in words) : 0x2
CODE:00159BD2 .short 0 # Number of try_items : 0x0
CODE:00159BD4 .int byte_3028B7 # Debug info
CODE:00159BD8 .int 0xBB # Size of bytecode (in 16-bit units): 0xbb
CODE:00159BDC # ---------------------------------------------------------------------------
CODE:00159BDC const/4 v10, 2
CODE:00159BDE const/4 v9, 1
CODE:00159BE0 const/4 v8, 0
CODE:00159BE2 .prologue_end
CODE:00159BE2 .line 15
CODE:00159BE2 const/4 v2, 0
CODE:00159BE4 .line 16
CODE:00159BE4 new-instance v0, <t: StringBuilder>
CODE:00159BE8 invoke-direct {v0}, <void StringBuilder.<init>() imp. @ _def_StringBuilder__init_@V>
CODE:00159BEE .line 17
CODE:00159BEE const/4 v1, 0
CODE:00159BF0
CODE:00159BF0 loc_159BF0: # CODE XREF: CODE:00159D44↓j
CODE:00159BF0 invoke-virtual {v11}, <int String.length() imp. @ _def_String_length@I>
CODE:00159BF6 move-result v5
CODE:00159BF8 if-ge v1, v5, loc_159D48
CODE:00159BFC .line 18
CODE:00159BFC sget-object v5, ProtectedClass_key
CODE:00159C00 aget-object v5, v5, v8
CODE:00159C04 aget v5, v5, v8
CODE:00159C08 invoke-virtual {v11, v1}, <char String.charAt(int) imp. @ _def_String_charAt@CI>
CODE:00159C0E move-result v6
CODE:00159C10 add-int/lit8 v6, v6, -0x41
CODE:00159C14 mul-int/2addr v5, v6
CODE:00159C16 sget-object v6, ProtectedClass_key
CODE:00159C1A aget-object v6, v6, v8
CODE:00159C1E aget v6, v6, v9
CODE:00159C22 add-int/lit8 v7, v1, 1
CODE:00159C26 .line 19
CODE:00159C26 invoke-virtual {v11, v7}, <char String.charAt(int) imp. @ _def_String_charAt@CI>
CODE:00159C2C move-result v7
CODE:00159C2E add-int/lit8 v7, v7, -0x41
CODE:00159C32 mul-int/2addr v6, v7
CODE:00159C34 add-int/2addr v5, v6
CODE:001