jeb载入
将输入传入了MainActivity.a方法
a方法直接传给了b方法
其中new b(),可以看到是将传入的参数为界,参数下标前面的移动到最后去
// 原始数据
{8, 25, 17, 23, 7, 22, 1, 16, 6, 9, 21, 0, 15, 5, 10, 18, 2, 24, 4, 11, 3, 14, 19, 12, 20, 13};
// 得到的数组b.a
{17, 23, 7, 22, 1, 16, 6, 9, 21, 0, 15, 5, 10, 18, 2, 24, 4, 11, 3, 14, 19, 12, 20, 13, 8, 25};
a类同b类
// 原始数据
{7, 14, 16, 21, 4, 24, 25, 20, 5, 15, 9, 17, 6, 13, 3, 18, 12, 10, 19, 0, 22, 2, 11, 23, 1, 8};
// 得到的数组b.a
{21, 4, 24, 25, 20, 5, 15, 9, 17, 6, 13, 3, 18, 12, 10, 19, 0, 22, 2, 11, 23, 1, 8, 7, 14, 16};
生成了a b两个对象v4 v5后,遍历flag{}中的内容,然后将每一位连同v4 v5传入MainActivity.a方法中
MainActivity.a方法中调用arg3.a(arg2.a(arg1));,即分别调用ab类中的a方法
b中的a方法为
其中空参a()要结合smali来看,先取第一个元素后删第一个元素
a类的方法
则流程为
- 取输入的每个字符ch,ch为字母的话进行如下变换
- 找到
b.b[n1] == ch
- 再找
b.a[n2] == n1
- 对
b.a, b.b, b.d
进行变换,将n2传给a.a
- 找到
a.a[n3] == n2
- 对
a.a, a.b, a.d
进行变换 - 返回
a.b[n3]
- ch为
' '
则原样输出,为其他则不输出
写脚本进行爆破
ens = "wigwrkaugala"
# print(len(ens)) # 12
a_a = [21, 4, 24, 25, 20, 5, 15, 9, 17, 6, 13, 3, 18,
12, 10, 19, 0, 22, 2, 11, 23, 1, 8, 7, 14, 16]
a_b = "abcdefghijklmnopqrstuvwxyz"
a_d = 0
b_a = [17, 23, 7, 22, 1, 16, 6, 9, 21, 0, 15, 5, 10,
18, 2, 24, 4, 11, 3, 14, 19, 12, 20, 13, 8, 25]
b_b = "abcdefghijklmnopqrstuvwxyz"
b_d = 0
flag = ""
for rech in ens:
f = 0
for ch in "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz":
n1 = b_b.find(ch)
if n1 == -1:
continue
n2 = b_a.index(n1)
if n2 == -1:
continue
n3 = a_a.index(n2)
if n3 == -1:
continue
if a_b[n3] == rech:
flag += ch
f = 1
b_a = b_a[1:] + b_a[:1]
b_b = b_b[1:] + b_b[:1]
b_d += 1
break
if f == 0:
flag += "#"
print("flag{" + flag + "}")
得到flag为flag{venividivkcr}