re学习笔记（79）攻防世界 - mobile区 - easyjava

jeb载入
将输入传入了MainActivity.a方法

a方法直接传给了b方法

其中new b()，可以看到是将传入的参数为界，参数下标前面的移动到最后去

// 原始数据
{8, 25, 17, 23, 7, 22, 1, 16, 6, 9, 21, 0, 15, 5, 10, 18, 2, 24, 4, 11, 3, 14, 19, 12, 20, 13};
// 得到的数组b.a
{17, 23, 7, 22, 1, 16, 6, 9, 21, 0, 15, 5, 10, 18, 2, 24, 4, 11, 3, 14, 19, 12, 20, 13, 8, 25};

a类同b类

// 原始数据
{7, 14, 16, 21, 4, 24, 25, 20, 5, 15, 9, 17, 6, 13, 3, 18, 12, 10, 19, 0, 22, 2, 11, 23, 1, 8};
// 得到的数组b.a
{21, 4, 24, 25, 20, 5, 15, 9, 17, 6, 13, 3, 18, 12, 10, 19, 0, 22, 2, 11, 23, 1, 8, 7, 14, 16};

生成了a b两个对象v4 v5后，遍历flag{}中的内容，然后将每一位连同v4 v5传入MainActivity.a方法中

MainActivity.a方法中调用arg3.a(arg2.a(arg1));，即分别调用ab类中的a方法

b中的a方法为

其中空参a()要结合smali来看，先取第一个元素后删第一个元素

a类的方法

则流程为

1. 取输入的每个字符ch，ch为字母的话进行如下变换
2. 找到b.b[n1] == ch
3. 再找b.a[n2] == n1
4. 对b.a, b.b, b.d进行变换，将n2传给a.a
5. 找到a.a[n3] == n2
6. 对a.a, a.b, a.d进行变换
7. 返回a.b[n3]
8. ch为' '则原样输出，为其他则不输出

写脚本进行爆破

ens = "wigwrkaugala"
# print(len(ens))  # 12

a_a = [21, 4, 24, 25, 20, 5, 15, 9, 17, 6, 13, 3, 18,
       12, 10, 19, 0, 22, 2, 11, 23, 1, 8, 7, 14, 16]
a_b = "abcdefghijklmnopqrstuvwxyz"
a_d = 0
b_a = [17, 23, 7, 22, 1, 16, 6, 9, 21, 0, 15, 5, 10,
       18, 2, 24, 4, 11, 3, 14, 19, 12, 20, 13, 8, 25]
b_b = "abcdefghijklmnopqrstuvwxyz"
b_d = 0
flag = ""
for rech in ens:
    f = 0
    for ch in "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz":
        n1 = b_b.find(ch)
        if n1 == -1:
            continue
        n2 = b_a.index(n1)
        if n2 == -1:
            continue
        n3 = a_a.index(n2)
        if n3 == -1:
            continue
        if a_b[n3] == rech:
            flag += ch
            f = 1
            b_a = b_a[1:] + b_a[:1]
            b_b = b_b[1:] + b_b[:1]
            b_d += 1
            break
    if f == 0:
        flag += "#"
print("flag{" + flag + "}")

得到flag为flag{venividivkcr}