re学习笔记（68）天翼杯2020 - mobile

JEB载入

native，导出so文件

然后ida载入

每轮运算都用了flag的各个位，用z3约束求解，先C语言写出约束条件（谁叫我python写出来报错，，，

#include <iostream>
using namespace std;
unsigned int x[32] = {
    0x313EF, 0x32F1B, 0x31C4E, 0x3246F, 0x30158, 0x33BF0, 0x2E3C8, 0x2A9B9,
    0x30344, 0x31749, 0x2D060, 0x2D97F, 0x345ED, 0x35BA8, 0x27523, 0x3729D,
    0x31A55, 0x335FF, 0x29380, 0x32DA3, 0x33F5D, 0x35B6C, 0x2EAA9, 0x3241A,
    0x2B11A, 0x3062D, 0x31041, 0x33820, 0x2BA33, 0x322E9, 0x2FFCD, 0x38606
};
unsigned int xx[1024] = {
    0x0D, 0x90, 0x81, 0x24, 0x3A, 0x26, 0x35, 0x28,
    0x67, 0x7D, 0x61, 0x13, 0x44, 0x84, 0x1F, 0x94,
    0x96, 0x60, 0x76, 0x25, 0x1E, 0x8F, 0x86, 0x25,
    0x60, 0x2A, 0x81, 0x54, 0x6F, 0x42, 0x0D, 0x30,
    0x7F, 0x6F, 0x66, 0x11, 0x6F, 0x64, 0x78, 0x49,
    0x22, 0x90, 0x4E, 0x56, 0x85, 0x30, 0x40, 0x8D,
    0x6E, 0x0F, 0x0A, 0x25, 0x80, 0x77, 0x44, 0x68,
    0x89, 0x0C, 0x61, 0x1D, 0x2E, 0x0B, 0x74, 0x74,
    0x83, 0x7C, 0x36, 0x39, 0x37, 0x7A, 0x4A, 0x7B,
    0x39, 0x2C, 0x3F, 0x83, 0x51, 0x56, 0x38, 0x5C,
    0x1F, 0x76, 0x62, 0x87, 0x42, 0x73, 0x33, 0x80,
    0x66, 0x43, 0x29, 0x28, 0x29, 0x90, 0x35, 0x54,
    0x69, 0x79, 0x4A, 0x84, 0x28, 0x42, 0x3E, 0x3D,
    0x12, 0x67, 0x6B, 0x33, 0x85, 0x55, 0x84, 0x89,
    0x34, 0x2A, 0x45, 0x4F, 0x46, 0x93, 0x36, 0x2B,
    0x32, 0x91, 0x36, 0x45, 0x3A, 0x3A, 0x2F, 0x88,
    0x4A, 0x2A, 0x3A, 0x41, 0x3E, 0x86, 0x35, 0x38,
    0x8F, 0x4A, 0x46, 0x54, 0x21, 0x70, 0x24, 0x3D,
    0x29, 0x11, 0x5D, 0x6F, 0x42, 0x55, 0x3E, 0x25,
    0x85, 0x95, 0x90, 0x29, 0x67, 0x37, 0x10, 0x7D,
    0x84, 0x75, 0x35, 0x39, 0x68, 0x7D, 0x0A, 0x4E,
    0x13, 0x22, 0x19, 0x7E, 0x86, 0x8B, 0x5A, 0x16,
    0x8A, 0x8E, 0x38, 0x57, 0x2B, 0x74, 0x27, 0x4A,
    0x69, 0x3D, 0x36, 0x30, 0x3E, 0x88, 0x57, 0x81,
    0x44, 0x84, 0x1C, 0x66, 0x45, 0x47, 0x24, 0x48,
    0x3B, 0x72, 0x60, 0x37, 0x47, 0x4B, 0x7E, 0x4C,
    0x59, 0x6A, 0x74, 0x21, 0x8A, 0x8F, 0x90, 0x0F,
    0x41, 0x56, 0x3D, 0x4F, 0x40, 0x18, 0x3E, 0x0A,
    0x63, 0x0E, 0x18, 0x8D, 0x2D, 0x44, 0x19, 0x7C,
    0x78, 0x6C, 0x1D, 0x47, 0x26, 0x0A, 0x53, 0x3F,
    0x79, 0x2C, 0x1E, 0x70, 0x6B, 0x55, 0x42, 0x52,
    0x38, 0x89, 0x27, 0x22, 0x27, 0x3A, 0x74, 0x7D,
    0x2D, 0x3E, 0x78, 0x67, 0x37, 0x94, 0x38, 0x51,
    0x59, 0x63, 0x33, 0x71, 0x50, 0x4F, 0x66, 0x29,
    0x1B, 0x2E, 0x3E, 0x21, 0x4A, 0x46, 0x64, 0x38,
    0x25, 0x81, 0x66, 0x70, 0x89, 0x0D, 0x30, 0x91,
    0x34, 0x3D, 0x3C, 0x2F, 0x39, 0x50, 0x6F, 0x96,
    0x2C, 0x4E, 0x10, 0x3B, 0x83, 0x18, 0x2D, 0x6A,
    0x33, 0x4E, 0x92, 0x13, 0x71, 0x69, 0x89, 0x10,
    0x2F, 0x60, 0x54, 0x21, 0x59, 0x87, 0x3C, 0x8B,
    0x3C, 0x7B, 0x79, 0x0A, 0x1C, 0x41, 0x2B, 0x6F,
    0x90, 0x76, 0x0B, 0x1A, 0x25, 0x54, 0x67, 0x0C,
    0x0E, 0x39, 0x7E, 0x36, 0x1B, 0x74, 0x4E, 0x67,
    0x80, 0x49, 0x87, 0x6B, 0x66, 0x3F, 0x62, 0x4E,
    0x3C, 0x43, 0x3A, 0x30, 0x77, 0x36, 0x4E, 0x0A,
    0x2D, 0x2E, 0x78, 0x8A, 0x43, 0x1B, 0x94, 0x3D,
    0x45, 0x1D, 0x22, 0x68, 0x74, 0x37, 0x48, 0x62,
    0x58, 0x89, 0x48, 0x56, 0x76, 0x4F, 0x1D, 0x71,
    0x43, 0x3E, 0x77, 0x46, 0x88, 0x7D, 0x2F, 0x91,
    0x1B, 0x50, 0x4B, 0x45, 0x28, 0x91, 0x25, 0x25,
    0x61, 0x29, 0x72, 0x5A, 0x63, 0x57, 0x90, 0x82,
    0x42, 0x0A, 0x2A, 0x2B, 0x90, 0x82, 0x47, 0x6E,
    0x70, 0x7B, 0x8A, 0x75, 0x76, 0x34, 0x40, 0x78,
    0x5A, 0x8C, 0x5F, 0x7A, 0x16, 0x21, 0x7B, 0x1D,
    0x93, 0x64, 0x85, 0x5C, 0x6A, 0x27, 0x30, 0x65,
    0x1E, 0x95, 0x56, 0x75, 0x0F, 0x3D, 0x1C, 0x60,
    0x4C, 0x24, 0x6F, 0x8B, 0x35, 0x10, 0x5D, 0x4A,
    0x84, 0x18, 0x7B, 0x31, 0x5B, 0x18, 0x57, 0x28,
    0x20, 0x4A, 0x82, 0x49, 0x0D, 0x87, 0x58, 0x2E,
    0x69, 0x35, 0x28, 0x31, 0x30, 0x3F, 0x0F, 0x22,
    0x83, 0x59, 0x85, 0x91, 0x70, 0x7C, 0x51, 0x81,
    0x69, 0x4E, 0x79, 0x45, 0x0A, 0x81, 0x85, 0x1B,
    0x7B, 0x6C, 0x75, 0x79, 0x37, 0x7A, 0x26, 0x80,
    0x88, 0x35, 0x51, 0x1D, 0x46, 0x2D, 0x7F, 0x28,
    0x86, 0x85, 0x33, 0x3F, 0x7C, 0x6E, 0x2F, 0x75,
    0x4B, 0x22, 0x94, 0x1D, 0x70, 0x5A, 0x57, 0x53,
    0x7B, 0x19, 0x14, 0x94, 0x51, 0x26, 0x5F, 0x81,
    0x75, 0x48, 0x30, 0x21, 0x68, 0x26, 0x15, 0x8F,
    0x72, 0x8D, 0x12, 0x4B, 0x47, 0x71, 0x78, 0x30,
    0x25, 0x3B, 0x66, 0x85, 0x78, 0x50, 0x71, 0x31,
    0x8A, 0x17, 0x4E, 0x4B, 0x0B, 0x8D, 0x4C, 0x48,
    0x11, 0x17, 0x76, 0x3D, 0x69, 0x53, 0x42, 0x87,
    0x71, 0x53, 0x69, 0x5C, 0x66, 0x18, 0x3A, 0x7E,
    0x2E, 0x17, 0x22, 0x53, 0x59, 0x3E, 0x66, 0x45,
    0x10, 0x66, 0x67, 0x93, 0x2E, 0x1C, 0x65, 0x2A,
    0x14, 0x11, 0x1B, 0x0B, 0x84, 0x85, 0x77, 0x44,
    0x41, 0x29, 0x5F, 0x29, 0x86, 0x87, 0x87, 0x35,
    0x26, 0x83, 0x5D, 0x47, 0x52, 0x31, 0x73, 0x30,
    0x50, 0x44, 0x32, 0x33, 0x1C, 0x5A, 0x65, 0x22,
    0x18, 0x91, 0x4B, 0x92, 0x78, 0x3C, 0x5D, 0x70,
    0x18, 0x52, 0x8B, 0x96, 0x71, 0x80, 0x24, 0x82,
    0x2F, 0x20, 0x5D, 0x35, 0x7A, 0x27, 0x60, 0x13,
    0x83, 0x21, 0x2A, 0x7B, 0x50, 0x71, 0x6C, 0x18,
    0x49, 0x75, 0x83, 0x51, 0x1D, 0x42, 0x14, 0x95,
    0x1C, 0x7C, 0x38, 0x23, 0x3B, 0x78, 0x60, 0x71,
    0x57, 0x6F, 0x50, 0x7B, 0x86, 0x40, 0x57, 0x57,
    0x72, 0x92, 0x7B, 0x17, 0x7D, 0x37, 0x73, 0x3D,
    0x24, 0x4D, 0x7C, 0x69, 0x17, 0x8D, 0x6E, 0x31,
    0x70, 0x55, 0x74, 0x56, 0x36, 0x96, 0x55, 0x56,
    0x6C, 0x56, 0x2D, 0x24, 0x57, 0x7A, 0x33, 0x36,
    0x4B, 0x2C, 0x68, 0x67, 0x23, 0x80, 0x8F, 0x49,
    0x45, 0x0D, 0x2F, 0x26, 0x44, 0x0C, 0x7A, 0x32,
    0x41, 0x1B, 0x6D, 0x69, 0x3C, 0x7C, 0x5A, 0x0C,
    0x33, 0x3D, 0x1A, 0x8F, 0x8C, 0x25, 0x41, 0x0D,
    0x34, 0x8B, 0x4D, 0x59, 0x8A, 0x72, 0x6B, 0x17,
    0x8D, 0x17, 0x55, 0x4A, 0x77, 0x6A, 0x5A, 0x74,
    0x14, 0x40, 0x8A, 0x34, 0x17, 0x61, 0x34, 0x26,
    0x87, 0x41, 0x1A, 0x86, 0x87, 0x0E, 0x8F, 0x20,
    0x6E, 0x34, 0x32, 0x50, 0x85, 0x42, 0x45, 0x5A,
    0x4E, 0x14, 0x93, 0x1C, 0x73, 0x1B, 0x5D, 0x30,
    0x51, 0x60, 0x79, 0x3E, 0x91, 0x5E, 0x0A, 0x16,
    0x69, 0x17, 0x7D, 0x69, 0x2A, 0x82, 0x8B, 0x55,
    0x1D, 0x13, 0x26, 0x33, 0x62, 0x8B, 0x55, 0x50,
    0x6A, 0x37, 0x29, 0x2A, 0x95, 0x91, 0x0C, 0x4A,
    0x12, 0x84, 0x48, 0x79, 0x8A, 0x61, 0x68, 0x4A,
    0x28, 0x51, 0x21, 0x67, 0x71, 0x55, 0x20, 0x1D,
    0x92, 0x58, 0x1B, 0x89, 0x24, 0x7E, 0x20, 0x38,
    0x25, 0x1D, 0x52, 0x59, 0x4F, 0x64, 0x57, 0x48,
    0x5A, 0x5D, 0x44, 0x57, 0x34, 0x4B, 0x8A, 0x7A,
    0x8A, 0x54, 0x8D, 0x0D, 0x3B, 0x71, 0x66, 0x77,
    0x89, 0x37, 0x1B, 0x92, 0x34, 0x12, 0x41, 0x4E,
    0x2C, 0x87, 0x8B, 0x58, 0x6B, 0x8A, 0x74, 0x10,
    0x2C, 0x64, 0x8B, 0x65, 0x0D, 0x4C, 0x44, 0x11,
    0x38, 0x4A, 0x48, 0x1B, 0x66, 0x1C, 0x46, 0x6C,
    0x2E, 0x27, 0x22, 0x2E, 0x8E, 0x11, 0x8D, 0x3C,
    0x34, 0x67, 0x88, 0x46, 0x14, 0x66, 0x93, 0x62,
    0x37, 0x11, 0x0E, 0x21, 0x4D, 0x86, 0x93, 0x4B,
    0x7C, 0x3C, 0x52, 0x74, 0x1A, 0x92, 0x31, 0x6E,
    0x2C, 0x80, 0x36, 0x93, 0x6B, 0x3A, 0x42, 0x8F,
    0x18, 0x5A, 0x16, 0x5C, 0x8B, 0x49, 0x8D, 0x81,
    0x86, 0x54, 0x1B, 0x3E, 0x2E, 0x22, 0x3A, 0x90,
    0x2B, 0x88, 0x6B, 0x0B, 0x52, 0x5F, 0x18, 0x75,
    0x39, 0x71, 0x49, 0x2C, 0x5B, 0x8D, 0x2C, 0x3C,
    0x80, 0x8E, 0x60, 0x39, 0x7F, 0x3C, 0x4A, 0x36,
    0x8A, 0x77, 0x76, 0x3D, 0x82, 0x92, 0x0B, 0x41,
    0x5C, 0x52, 0x3C, 0x72, 0x36, 0x8B, 0x94, 0x54,
    0x6E, 0x8D, 0x8E, 0x54, 0x15, 0x46, 0x36, 0x78,
    0x30, 0x5D, 0x68, 0x62, 0x27, 0x67, 0x1D, 0x68
};

int main()
{
    char flag[33] = {0};
    int i, j;
    unsigned int* xp = xx;
    for (j = 0; j < 32; ++j)
    {
        cout << "s.add(";
        for (i = 0; i <32; ++i)
        {
            cout << "flag[" << i << "] * " << xp[i];
            if (i != 31)
                cout << " + ";
        }
        cout <<" == " << x[j] <<")" << endl;
        xp += 32;
    }
}

然后

from z3 import *
flag = [0]*32
for i in range(32):
    flag[i] = Int('flag['+str(i)+']')
s = Solver()
base = 0
s.add(flag[0] * 13 + flag[1] * 144 + flag[2] * 129 + flag[3] * 36 + flag[4] * 58 + flag[5] * 38 + flag[6] * 53 + flag[7] * 40 + flag[8] * 103 + flag[9] * 125 + flag[10] * 97 + flag[11] * 19 + flag[12] * 68 + flag[13] * 132 + flag[14] * 31 + flag[15] * 148 + flag[16] * 150 + flag[17] * 96 + flag[18] * 118 + flag[19] * 37 + flag[20] * 30 + flag[21] * 143 + flag[22] * 134 + flag[23] * 37 + flag[24] * 96 + flag[25] * 42 + flag[26] * 129 + flag[27] * 84 + flag[28] * 111 + flag[29] * 66 + flag[30] * 13 + flag[31] * 48 == 201711)
s.add(flag[0] * 127 + flag[1] * 111 + flag[2] * 102 + flag[3] * 17 + flag[4] * 111 + flag[5] * 100 + flag[6] * 120 + flag[7] * 73 + flag[8] * 34 + flag[9] * 144 + flag[10] * 78 + flag[11] * 86 + flag[12] * 133 + flag[13] * 48 + flag[14] * 64 + flag[15] * 141 + flag[16] * 110 + flag[17] * 15 + flag[18] * 10 + flag[19] * 37 + flag[20] * 128 + flag[21] * 119 + flag[22] * 68 + flag[23] * 104 + flag[24] * 137 + flag[25] * 12 + flag[26] * 97 + flag[27] * 29 + flag[28] * 46 + flag[29] * 11 + flag[30] * 116 + flag[31] * 116 == 208667)
s.add(flag[0] * 131 + flag[1] * 124 + flag[2] * 54 + flag[3] * 57 + flag[4] * 55 + flag[5] * 122 + flag[6] * 74 + flag[7] * 123 + flag[8] * 57 + flag[9] * 44 + flag[10] * 63 + flag[11] * 131 + flag[12] * 81 + flag[13] * 86 + flag[14] * 56 + flag[15] * 92 + flag[16] * 31 + flag[17] * 118 + flag[18] * 98 + flag[19] * 135 + flag[20] * 66 + flag[21] * 115 + flag[22] * 51 + flag[23] * 128 + flag[24] * 102 + flag[25] * 67 + flag[26] * 41 + flag[27] * 40 + flag[28] * 41 + flag[29] * 144 + flag[30] * 53 + flag[31] * 84 == 203854)
s.add(flag[0] * 105 + flag[1] * 121 + flag[2] * 74 + flag[3] * 132 + flag[4] * 40 + flag[5] * 66 + flag[6] * 62 + flag[7] * 61 + flag[8] * 18 + flag[9] * 103 + flag[10] * 107 + flag[11] * 51 + flag[12] * 133 + flag[13] * 85 + flag[14] * 132 + flag[15] * 137 + flag[16] * 52 + flag[17] * 42 + flag[18] * 69 + flag[19] * 79 + flag[20] * 70 + flag[21] * 147 + flag[22] * 54 + flag[23] * 43 + flag[24] * 50 + flag[25] * 145 + flag[26] * 54 + flag[27] * 69 + flag[28] * 58 + flag[29] * 58 + flag[30] * 47 + flag[31] * 136 == 205935)
s.add(flag[0] * 74 + flag[1] * 42 + flag[2] * 58 + flag[3] * 65 + flag[4] * 62 + flag[5] * 134 + flag[6] * 53 + flag[7] * 56 + flag[8] * 143 + flag[9] * 74 + flag[10] * 70 + flag[11] * 84 + flag[12] * 33 + flag[13] * 112 + flag[14] * 36 + flag[15] * 61 + flag[16] * 41 + flag[17] * 17 + flag[18] * 93 + flag[19] * 111 + flag[20] * 66 + flag[21] * 85 + flag[22] * 62 + flag[23] * 37 + flag[24] * 133 + flag[25] * 149 + flag[26] * 144 + flag[27] * 41 + flag[28] * 103 + flag[29] * 55 + flag[30] * 16 + flag[31] * 125 == 196952)
s.add(flag[0] * 132 + flag[1] * 117 + flag[2] * 53 + flag[3] * 57 + flag[4] * 104 + flag[5] * 125 + flag[6] * 10 + flag[7] * 78 + flag[8] * 19 + flag[9] * 34 + flag[10] * 25 + flag[11] * 126 + flag[12] * 134 + flag[13] * 139 + flag[14] * 90 + flag[15] * 22 + flag[16] * 138 + flag[17] * 142 + flag[18] * 56 + flag[19] * 87 + flag[20] * 43 + flag[21] * 116 + flag[22] * 39 + flag[23] * 74 + flag[24] * 105 + flag[25] * 61 + flag[26] * 54 + flag[27] * 48 + flag[28] * 62 + flag[29] * 136 + flag[30] * 87 + flag[31] * 129 == 211952)
s.add(flag[0] * 68 + flag[1] * 132 + flag[2] * 28 + flag[3] * 102 + flag[4] * 69 + flag[5] * 71 + flag[6] * 36 + flag[7] * 72 + flag[8] * 59 + flag[9] * 114 + flag[10] * 96 + flag[11] * 55 + flag[12] * 71 + flag[13] * 75 + flag[14] * 126 + flag[15] * 76 + flag[16] * 89 + flag[17] * 106 + flag[18] * 116 + flag[19] * 33 + flag[20] * 138 + flag[21] * 143 + flag[22] * 144 + flag[23] * 15 + flag[24] * 65 + flag[25] * 86 + flag[26] * 61 + flag[27] * 79 + flag[28] * 64 + flag[29] * 24 + flag[30] * 62 + flag[31] * 10 == 189384)
s.add(flag[0] * 99 + flag[1] * 14 + flag[2] * 24 + flag[3] * 141 + flag[4] * 45 + flag[5] * 68 + flag[6] * 25 + flag[7] * 124 + flag[8] * 120 + flag[9] * 108 + flag[10] * 29 + flag[11] * 71 + flag[12] * 38 + flag[13] * 10 + flag[14] * 83 + flag[15] * 63 + flag[16] * 121 + flag[17] * 44 + flag[18] * 30 + flag[19] * 112 + flag[20] * 107 + flag[21] * 85 + flag[22] * 66 + flag[23] * 82 + flag[24] * 56 + flag[25] * 137 + flag[26] * 39 + flag[27] * 34 + flag[28] * 39 + flag[29] * 58 + flag[30] * 116 + flag[31] * 125 == 174521)
s.add(flag[0] * 45 + flag[1] * 62 + flag[2] * 120 + flag[3] * 103 + flag[4] * 55 + flag[5] * 148 + flag[6] * 56 + flag[7] * 81 + flag[8] * 89 + flag[9] * 99 + flag[10] * 51 + flag[11] * 113 + flag[12] * 80 + flag[13] * 79 + flag[14] * 102 + flag[15] * 41 + flag[16] * 27 + flag[17] * 46 + flag[18] * 62 + flag[19] * 33 + flag[20] * 74 + flag[21] * 70 + flag[22] * 100 + flag[23] * 56 + flag[24] * 37 + flag[25] * 129 + flag[26] * 102 + flag[27] * 112 + flag[28] * 137 + flag[29] * 13 + flag[30] * 48 + flag[31] * 145 == 197444)
s.add(flag[0] * 52 + flag[1] * 61 + flag[2] * 60 + flag[3] * 47 + flag[4] * 57 + flag[5] * 80 + flag[6] * 111 + flag[7] * 150 + flag[8] * 44 + flag[9] * 78 + flag[10] * 16 + flag[11] * 59 + flag[12] * 131 + flag[13] * 24 + flag[14] * 45 + flag[15] * 106 + flag[16] * 51 + flag[17] * 78 + flag[18] * 146 + flag[19] * 19 + flag[20] * 113 + flag[21] * 105 + flag[22] * 137 + flag[23] * 16 + flag[24] * 47 + flag[25] * 96 + flag[26] * 84 + flag[27] * 33 + flag[28] * 89 + flag[29] * 135 + flag[30] * 60 + flag[31] * 139 == 202569)
s.add(flag[0] * 60 + flag[1] * 123 + flag[2] * 121 + flag[3] * 10 + flag[4] * 28 + flag[5] * 65 + flag[6] * 43 + flag[7] * 111 + flag[8] * 144 + flag[9] * 118 + flag[10] * 11 + flag[11] * 26 + flag[12] * 37 + flag[13] * 84 + flag[14] * 103 + flag[15] * 12 + flag[16] * 14 + flag[17] * 57 + flag[18] * 126 + flag[19] * 54 + flag[20] * 27 + flag[21] * 116 + flag[22] * 78 + flag[23] * 103 + flag[24] * 128 + flag[25] * 73 + flag[26] * 135 + flag[27] * 107 + flag[28] * 102 + flag[29] * 63 + flag[30] * 98 + flag[31] * 78 == 184416)
s.add(flag[0] * 60 + flag[1] * 67 + flag[2] * 58 + flag[3] * 48 + flag[4] * 119 + flag[5] * 54 + flag[6] * 78 + flag[7] * 10 + flag[8] * 45 + flag[9] * 46 + flag[10] * 120 + flag[11] * 138 + flag[12] * 67 + flag[13] * 27 + flag[14] * 148 + flag[15] * 61 + flag[16] * 69 + flag[17] * 29 + flag[18] * 34 + flag[19] * 104 + flag[20] * 116 + flag[21] * 55 + flag[22] * 72 + flag[23] * 98 + flag[24] * 88 + flag[25] * 137 + flag[26] * 72 + flag[27] * 86 + flag[28] * 118 + flag[29] * 79 + flag[30] * 29 + flag[31] * 113 == 186751)
s.add(flag[0] * 67 + flag[1] * 62 + flag[2] * 119 + flag[3] * 70 + flag[4] * 136 + flag[5] * 125 + flag[6] * 47 + flag[7] * 145 + flag[8] * 27 + flag[9] * 80 + flag[10] * 75 + flag[11] * 69 + flag[12] * 40 + flag[13] * 145 + flag[14] * 37 + flag[15] * 37 + flag[16] * 97 + flag[17] * 41 + flag[18] * 114 + flag[19] * 90 + flag[20] * 99 + flag[21] * 87 + flag[22] * 144 + flag[23] * 130 + flag[24] * 66 + flag[25] * 10 + flag[26] * 42 + flag[27] * 43 + flag[28] * 144 + flag[29] * 130 + flag[30] * 71 + flag[31] * 110 == 214509)
s.add(flag[0] * 112 + flag[1] * 123 + flag[2] * 138 + flag[3] * 117 + flag[4] * 118 + flag[5] * 52 + flag[6] * 64 + flag[7] * 120 + flag[8] * 90 + flag[9] * 140 + flag[10] * 95 + flag[11] * 122 + flag[12] * 22 + flag[13] * 33 + flag[14] * 123 + flag[15] * 29 + flag[16] * 147 + flag[17] * 100 + flag[18] * 133 + flag[19] * 92 + flag[20] * 106 + flag[21] * 39 + flag[22] * 48 + flag[23] * 101 + flag[24] * 30 + flag[25] * 149 + flag[26] * 86 + flag[27] * 117 + flag[28] * 15 + flag[29] * 61 + flag[30] * 28 + flag[31] * 96 == 220072)
s.add(flag[0] * 76 + flag[1] * 36 + flag[2] * 111 + flag[3] * 139 + flag[4] * 53 + flag[5] * 16 + flag[6] * 93 + flag[7] * 74 + flag[8] * 132 + flag[9] * 24 + flag[10] * 123 + flag[11] * 49 + flag[12] * 91 + flag[13] * 24 + flag[14] * 87 + flag[15] * 40 + flag[16] * 32 + flag[17] * 74 + flag[18] * 130 + flag[19] * 73 + flag[20] * 13 + flag[21] * 135 + flag[22] * 88 + flag[23] * 46 + flag[24] * 105 + flag[25] * 53 + flag[26] * 40 + flag[27] * 49 + flag[28] * 48 + flag[29] * 63 + flag[30] * 15 + flag[31] * 34 == 161059)
s.add(flag[0] * 131 + flag[1] * 89 + flag[2] * 133 + flag[3] * 145 + flag[4] * 112 + flag[5] * 124 + flag[6] * 81 + flag[7] * 129 + flag[8] * 105 + flag[9] * 78 + flag[10] * 121 + flag[11] * 69 + flag[12] * 10 + flag[13] * 129 + flag[14] * 133 + flag[15] * 27 + flag[16] * 123 + flag[17] * 108 + flag[18] * 117 + flag[19] * 121 + flag[20] * 55 + flag[21] * 122 + flag[22] * 38 + flag[23] * 128 + flag[24] * 136 + flag[25] * 53 + flag[26] * 81 + flag[27] * 29 + flag[28] * 70 + flag[29] * 45 + flag[30] * 127 + flag[31] * 40 == 225949)
s.add(flag[0] * 134 + flag[1] * 133 + flag[2] * 51 + flag[3] * 63 + flag[4] * 124 + flag[5] * 110 + flag[6] * 47 + flag[7] * 117 + flag[8] * 75 + flag[9] * 34 + flag[10] * 148 + flag[11] * 29 + flag[12] * 112 + flag[13] * 90 + flag[14] * 87 + flag[15] * 83 + flag[16] * 123 + flag[17] * 25 + flag[18] * 20 + flag[19] * 148 + flag[20] * 81 + flag[21] * 38 + flag[22] * 95 + flag[23] * 129 + flag[24] * 117 + flag[25] * 72 + flag[26] * 48 + flag[27] * 33 + flag[28] * 104 + flag[29] * 38 + flag[30] * 21 + flag[31] * 143 == 203349)
s.add(flag[0] * 114 + flag[1] * 141 + flag[2] * 18 + flag[3] * 75 + flag[4] * 71 + flag[5] * 113 + flag[6] * 120 + flag[7] * 48 + flag[8] * 37 + flag[9] * 59 + flag[10] * 102 + flag[11] * 133 + flag[12] * 120 + flag[13] * 80 + flag[14] * 113 + flag[15] * 49 + flag[16] * 138 + flag[17] * 23 + flag[18] * 78 + flag[19] * 75 + flag[20] * 11 + flag[21] * 141 + flag[22] * 76 + flag[23] * 72 + flag[24] * 17 + flag[25] * 23 + flag[26] * 118 + flag[27] * 61 + flag[28] * 105 + flag[29] * 83 + flag[30] * 66 + flag[31] * 135 == 210431)
s.add(flag[0] * 113 + flag[1] * 83 + flag[2] * 105 + flag[3] * 92 + flag[4] * 102 + flag[5] * 24 + flag[6] * 58 + flag[7] * 126 + flag[8] * 46 + flag[9] * 23 + flag[10] * 34 + flag[11] * 83 + flag[12] * 89 + flag[13] * 62 + flag[14] * 102 + flag[15] * 69 + flag[16] * 16 + flag[17] * 102 + flag[18] * 103 + flag[19] * 147 + flag[20] * 46 + flag[21] * 28 + flag[22] * 101 + flag[23] * 42 + flag[24] * 20 + flag[25] * 17 + flag[26] * 27 + flag[27] * 11 + flag[28] * 132 + flag[29] * 133 + flag[30] * 119 + flag[31] * 68 == 168832)
s.add(flag[0] * 65 + flag[1] * 41 + flag[2] * 95 + flag[3] * 41 + flag[4] * 134 + flag[5] * 135 + flag[6] * 135 + flag[7] * 53 + flag[8] * 38 + flag[9] * 131 + flag[10] * 93 + flag[11] * 71 + flag[12] * 82 + flag[13] * 49 + flag[14] * 115 + flag[15] * 48 + flag[16] * 80 + flag[17] * 68 + flag[18] * 50 + flag[19] * 51 + flag[20] * 28 + flag[21] * 90 + flag[22] * 101 + flag[23] * 34 + flag[24] * 24 + flag[25] * 145 + flag[26] * 75 + flag[27] * 146 + flag[28] * 120 + flag[29] * 60 + flag[30] * 93 + flag[31] * 112 == 208291)
s.add(flag[0] * 24 + flag[1] * 82 + flag[2] * 139 + flag[3] * 150 + flag[4] * 113 + flag[5] * 128 + flag[6] * 36 + flag[7] * 130 + flag[8] * 47 + flag[9] * 32 + flag[10] * 93 + flag[11] * 53 + flag[12] * 122 + flag[13] * 39 + flag[14] * 96 + flag[15] * 19 + flag[16] * 131 + flag[17] * 33 + flag[18] * 42 + flag[19] * 123 + flag[20] * 80 + flag[21] * 113 + flag[22] * 108 + flag[23] * 24 + flag[24] * 73 + flag[25] * 117 + flag[26] * 131 + flag[27] * 81 + flag[28] * 29 + flag[29] * 66 + flag[30] * 20 + flag[31] * 149 == 212829)
s.add(flag[0] * 28 + flag[1] * 124 + flag[2] * 56 + flag[3] * 35 + flag[4] * 59 + flag[5] * 120 + flag[6] * 96 + flag[7] * 113 + flag[8] * 87 + flag[9] * 111 + flag[10] * 80 + flag[11] * 123 + flag[12] * 134 + flag[13] * 64 + flag[14] * 87 + flag[15] * 87 + flag[16] * 114 + flag[17] * 146 + flag[18] * 123 + flag[19] * 23 + flag[20] * 125 + flag[21] * 55 + flag[22] * 115 + flag[23] * 61 + flag[24] * 36 + flag[25] * 77 + flag[26] * 124 + flag[27] * 105 + flag[28] * 23 + flag[29] * 141 + flag[30] * 110 + flag[31] * 49 == 220012)
s.add(flag[0] * 112 + flag[1] * 85 + flag[2] * 116 + flag[3] * 86 + flag[4] * 54 + flag[5] * 150 + flag[6] * 85 + flag[7] * 86 + flag[8] * 108 + flag[9] * 86 + flag[10] * 45 + flag[11] * 36 + flag[12] * 87 + flag[13] * 122 + flag[14] * 51 + flag[15] * 54 + flag[16] * 75 + flag[17] * 44 + flag[18] * 104 + flag[19] * 103 + flag[20] * 35 + flag[21] * 128 + flag[22] * 143 + flag[23] * 73 + flag[24] * 69 + flag[25] * 13 + flag[26] * 47 + flag[27] * 38 + flag[28] * 68 + flag[29] * 12 + flag[30] * 122 + flag[31] * 50 == 191145)
s.add(flag[0] * 65 + flag[1] * 27 + flag[2] * 109 + flag[3] * 105 + flag[4] * 60 + flag[5] * 124 + flag[6] * 90 + flag[7] * 12 + flag[8] * 51 + flag[9] * 61 + flag[10] * 26 + flag[11] * 143 + flag[12] * 140 + flag[13] * 37 + flag[14] * 65 + flag[15] * 13 + flag[16] * 52 + flag[17] * 139 + flag[18] * 77 + flag[19] * 89 + flag[20] * 138 + flag[21] * 114 + flag[22] * 107 + flag[23] * 23 + flag[24] * 141 + flag[25] * 23 + flag[26] * 85 + flag[27] * 74 + flag[28] * 119 + flag[29] * 106 + flag[30] * 90 + flag[31] * 116 == 205850)
s.add(flag[0] * 20 + flag[1] * 64 + flag[2] * 138 + flag[3] * 52 + flag[4] * 23 + flag[5] * 97 + flag[6] * 52 + flag[7] * 38 + flag[8] * 135 + flag[9] * 65 + flag[10] * 26 + flag[11] * 134 + flag[12] * 135 + flag[13] * 14 + flag[14] * 143 + flag[15] * 32 + flag[16] * 110 + flag[17] * 52 + flag[18] * 50 + flag[19] * 80 + flag[20] * 133 + flag[21] * 66 + flag[22] * 69 + flag[23] * 90 + flag[24] * 78 + flag[25] * 20 + flag[26] * 147 + flag[27] * 28 + flag[28] * 115 + flag[29] * 27 + flag[30] * 93 + flag[31] * 48 == 176410)
s.add(flag[0] * 81 + flag[1] * 96 + flag[2] * 121 + flag[3] * 62 + flag[4] * 145 + flag[5] * 94 + flag[6] * 10 + flag[7] * 22 + flag[8] * 105 + flag[9] * 23 + flag[10] * 125 + flag[11] * 105 + flag[12] * 42 + flag[13] * 130 + flag[14] * 139 + flag[15] * 85 + flag[16] * 29 + flag[17] * 19 + flag[18] * 38 + flag[19] * 51 + flag[20] * 98 + flag[21] * 139 + flag[22] * 85 + flag[23] * 80 + flag[24] * 106 + flag[25] * 55 + flag[26] * 41 + flag[27] * 42 + flag[28] * 149 + flag[29] * 145 + flag[30] * 12 + flag[31] * 74 == 198189)
s.add(flag[0] * 18 + flag[1] * 132 + flag[2] * 72 + flag[3] * 121 + flag[4] * 138 + flag[5] * 97 + flag[6] * 104 + flag[7] * 74 + flag[8] * 40 + flag[9] * 81 + flag[10] * 33 + flag[11] * 103 + flag[12] * 113 + flag[13] * 85 + flag[14] * 32 + flag[15] * 29 + flag[16] * 146 + flag[17] * 88 + flag[18] * 27 + flag[19] * 137 + flag[20] * 36 + flag[21] * 126 + flag[22] * 32 + flag[23] * 56 + flag[24] * 37 + flag[25] * 29 + flag[26] * 82 + flag[27] * 89 + flag[28] * 79 + flag[29] * 100 + flag[30] * 87 + flag[31] * 72 == 200769)
s.add(flag[0] * 90 + flag[1] * 93 + flag[2] * 68 + flag[3] * 87 + flag[4] * 52 + flag[5] * 75 + flag[6] * 138 + flag[7] * 122 + flag[8] * 138 + flag[9] * 84 + flag[10] * 141 + flag[11] * 13 + flag[12] * 59 + flag[13] * 113 + flag[14] * 102 + flag[15] * 119 + flag[16] * 137 + flag[17] * 55 + flag[18] * 27 + flag[19] * 146 + flag[20] * 52 + flag[21] * 18 + flag[22] * 65 + flag[23] * 78 + flag[24] * 44 + flag[25] * 135 + flag[26] * 139 + flag[27] * 88 + flag[28] * 107 + flag[29] * 138 + flag[30] * 116 + flag[31] * 16 == 210976)
s.add(flag[0] * 44 + flag[1] * 100 + flag[2] * 139 + flag[3] * 101 + flag[4] * 13 + flag[5] * 76 + flag[6] * 68 + flag[7] * 17 + flag[8] * 56 + flag[9] * 74 + flag[10] * 72 + flag[11] * 27 + flag[12] * 102 + flag[13] * 28 + flag[14] * 70 + flag[15] * 108 + flag[16] * 46 + flag[17] * 39 + flag[18] * 34 + flag[19] * 46 + flag[20] * 142 + flag[21] * 17 + flag[22] * 141 + flag[23] * 60 + flag[24] * 52 + flag[25] * 103 + flag[26] * 136 + flag[27] * 70 + flag[28] * 20 + flag[29] * 102 + flag[30] * 147 + flag[31] * 98 == 178739)
s.add(flag[0] * 55 + flag[1] * 17 + flag[2] * 14 + flag[3] * 33 + flag[4] * 77 + flag[5] * 134 + flag[6] * 147 + flag[7] * 75 + flag[8] * 124 + flag[9] * 60 + flag[10] * 82 + flag[11] * 116 + flag[12] * 26 + flag[13] * 146 + flag[14] * 49 + flag[15] * 110 + flag[16] * 44 + flag[17] * 128 + flag[18] * 54 + flag[19] * 147 + flag[20] * 107 + flag[21] * 58 + flag[22] * 66 + flag[23] * 143 + flag[24] * 24 + flag[25] * 90 + flag[26] * 22 + flag[27] * 92 + flag[28] * 139 + flag[29] * 73 + flag[30] * 141 + flag[31] * 129 == 205545)
s.add(flag[0] * 134 + flag[1] * 84 + flag[2] * 27 + flag[3] * 62 + flag[4] * 46 + flag[5] * 34 + flag[6] * 58 + flag[7] * 144 + flag[8] * 43 + flag[9] * 136 + flag[10] * 107 + flag[11] * 11 + flag[12] * 82 + flag[13] * 95 + flag[14] * 24 + flag[15] * 117 + flag[16] * 57 + flag[17] * 113 + flag[18] * 73 + flag[19] * 44 + flag[20] * 91 + flag[21] * 141 + flag[22] * 44 + flag[23] * 60 + flag[24] * 128 + flag[25] * 142 + flag[26] * 96 + flag[27] * 57 + flag[28] * 127 + flag[29] * 60 + flag[30] * 74 + flag[31] * 54 == 196557)
s.add(flag[0] * 138 + flag[1] * 119 + flag[2] * 118 + flag[3] * 61 + flag[4] * 130 + flag[5] * 146 + flag[6] * 11 + flag[7] * 65 + flag[8] * 92 + flag[9] * 82 + flag[10] * 60 + flag[11] * 114 + flag[12] * 54 + flag[13] * 139 + flag[14] * 148 + flag[15] * 84 + flag[16] * 110 + flag[17] * 141 + flag[18] * 142 + flag[19] * 84 + flag[20] * 21 + flag[21] * 70 + flag[22] * 54 + flag[23] * 120 + flag[24] * 48 + flag[25] * 93 + flag[26] * 104 + flag[27] * 98 + flag[28] * 39 + flag[29] * 103 + flag[30] * 29 + flag[31] * 104 == 230918)
print(s.check())
print(s.model())

解得

FAKE{th15_15_n07_7h3_r341_f14g!}

成功得到假flag😂😂
so加密了，晚些动调试试看

在外面，有师傅说initarray 回去开搞！
IDA调试so，ctrl+s查看区段

找到init_array段进去

arm汇编，告辞！（应该调试这里就好了叭？但是没安卓动调环境…还要继续学习呀！

（搞了半天没搞出来，安卓还没调试过……不太会，，，厚脸皮的嫖评论区师傅@tansenen的数据
（等我会了一定会再次回来补wp的 咕咕咕）

tansenen:我们一起在坑底快乐的握手。。哈哈。。。。后来用arm模拟器跑了，实时抓到的x数组的值不一样。运行起来以后x数组变了，那个数组可以得到真实flagx =[230633, 241616, 235681, 243044, 215926, 247340, 226354, 208221, 233269, 218105, 219068, 223956, 243594, 269613, 193282, 278408, 250240, 248290, 209107, 252851, 250114, 260688, 230815, 235191, 210685, 220035, 235265, 262900, 221536, 246427, 226293, 277096]

替换上面的脚本重新算一下，，

unsigned int x[32] = {
230633, 241616, 235681, 243044, 215926, 247340, 226354, 208221, 233269, 218105, 219068, 223956, 243594, 269613, 193282, 278408, 250240, 248290, 209107, 252851, 250114, 260688, 230815, 235191, 210685, 220035, 235265, 262900, 221536, 246427, 226293, 277096
};

得到最终flag为

flag{we11_y0u_f0und_17_c0ngr47z}