Java层分析
jeb载入
MainActivity类
将编辑框内容传给MainActivity.a(MainActivity arg1, String arg2)
调用MainActivity.a(String arg3)
里面先是调用了new a().a()
方法
a类
像是自定义字符表的base64
hook一下方法的参数和结果
public class MyHook implements IXposedHookLoadPackage {
@Override
public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
Log.d("Forgotten", "SSStart hooking...");
XposedBridge.hookAllMethods(XposedHelpers.findClass("com.a.easyjni.a", loadPackageParam.classLoader), "a", new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
Log.e("Forgotten", "Print Stack:", new Throwable("stack dump"));
byte[] origin = (byte[]) param.args[0];
Log.d("Forgotten","b64origin: "+new String(origin));
String result = (String) param.getResult();
Log.d("Forgotten","b64result: "+result);
}
});
}
}
验证一下CyberChef_v9.21.0.html#recipe=To_Base64('i5jLW7S0GX6uf1cv3ny4q8es2Q%2BbdkYgKOIT/tAxUrFlVPzhmow9BHCMDpEaJRZN%3D')&input=MTIzNDU2Nzg5MA
a.a
即是对输入的字符进行自定义字符表的base64
然后将结果传入了native的ncheck
方法
So层分析
查看导出函数列表
ctrl+F9
导入jni.h
头文件,修改参数类型
程序流程
- 进行自定义字符表base64加密
- 判断长度为32
- 前16与后16前后交换位置
- 两两交换位置
- 与
"MbT3sQgX039i3g==AQOoMQFPskB1Bsc7"
进行比较
解题脚本
import base64
ens = "MbT3sQgX039i3g==AQOoMQFPskB1Bsc7"
enlist = list(ens)
for i in range(0, len(enlist), 2):
enlist[i], enlist[i + 1] = enlist[i + 1], enlist[i]
for i in range(len(enlist) // 2):
enlist[i], enlist[i + 16] = enlist[i + 16], enlist[i]
table = str.maketrans("i5jLW7S0GX6uf1cv3ny4q8es2Q+bdkYgKOIT/tAxUrFlVPzhmow9BHCMDpEaJRZN=",
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=")
ens = "".join(enlist)
flag = base64.b64decode(ens.translate(table).encode("utf-8"))
flag = str(flag, "utf-8")
print(flag)
得到最终flag为flag{just_ANot#er_@p3}