re学习笔记（84）攻防世界 - mobile区 - easy-dex

推荐肉丝r0ysue课程（包含安卓逆向与js逆向）：https://img-blog.csdnimg.cn/7fa698312c304ab7bb0a03e2c866990f.png
AndroidManifest看一下入口，为android.app.NativeActivity，去so层分析

So层分析

ANativeActivity_onCreate

创建了一个新线程，前往新线程

FUNC

查看自定义函数j_android_main

android_main

首先对filename和name进行一个异或解密

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
int main()
{
    char filename[54];
    *(int*)filename = 0x9D888D2F;
    *(int*)&filename[4] = 0x888DC688;
    *(int*)&filename[8] = 0x8AC6889D;
    *(int*)&filename[12] = 0x88C78486;
    *(int*)&filename[16] = 0x84889AC7;
    *(int*)&filename[20] = 0xC78C8599;
    *(int*)&filename[24] = 0x8D87808F;
    *(int*)&filename[28] = 0x8C8D9084;
    *(int*)&filename[32] = 0x808FC691;
    *(int*)&filename[36] = 0xC69A8C85;
    *(int*)&filename[40] = 0x9A88858A;
    *(int*)&filename[44] = 0xC79A8C9A;
    *(int*)&filename[48] = 0xE9918C8D;
    filename[52] = 0;


    char name[48];
    *(int*)name = 0x9D888DC6;
    *(int*)&name[4] = 0x888DC688;
    *(int*)&name[8] = 0x8AC6889D;
    *(int*)&name[12] = 0x88C78486;
    *(int*)&name[16] = 0x84889AC7;
    *(int*)&name[20] = 0xC78C8599;
    *(int*)&name[24] = 0x8D87808F;
    *(int*)&name[28] = 0x8C8D9084;
    *(int*)&name[32] = 0x808FC691;
    *(int*)&name[36] = 0xC69A8C85;
    *(int*)&name[40] = 0x918C8D86;
    name[46] = 0;
    *(short*)&name[44] = 0xE9C6;

    int v4 = 1;
    do
        filename[v4++] ^= 0xE9u;
    while (v4 != 53);
    int v5 = 1;
    name[0] = 47;
    do
        name[v5++] ^= 0xE9u;
    while (v5 != 47);
    printf("filename: ");
    puts(filename);
    printf("name: ");
    puts(name);
}

得到

filename: /data/data/com.a.sample.findmydex/files/classes.dex
name: /data/data/com.a.sample.findmydex/files/odex/

对数据进行解密

摇动一百次之后的操作

可以知道从byte_7004开始，长度为0x35A0C是加密后的数据
数据太大，ida会卡死，写idapython来提取

解密

可以分析解密流程是，将数据分成10份，每一份与Num（9,19,29…）进行异或
其中最后一份剩余的与89进行异或

写idapython脚本

import idc
import idaapi
import zlib
data = []
data_len = 0x3CA10
addr = 0x7004
data = idaapi.get_bytes(addr, data_len)
data = list(data)
for Num in range(90):
    if Num % 10 == 9:
        v15 = Num // 10
        v17 = data_len // 10
        for i in range(v17 * v15, v17 * (v15 + 1)):
            data[i] ^= Num
        if Num == 89:
            for i in range((v15 + 1) * v17, data_len):
                data[i] ^= 89


with open("D:\\data.dex", "wb") as f:
    f.write(zlib.decompress(bytes(data)))
print("down!")

会在d盘写出一个data.dex文件，进行分析

如果能so调试，直接在删除文件前断下来，复制出dex即可
可惜模拟器不能动调

Java层分析

com.a.sample.findmydex.MainActivity

查看a类

a

将编辑框的内容经过MainActivity.a方法加密后与数组进行比较，比较后进行Toast提示

返回AndroidKiller搜索id值，id值位于public.xml

再去string.xml搜索对应的name属性

可以发现即是正确提示
MainActivity.a有两个参数，参数1为用户输入，参数2为字符串"I have a male fish and a female fish."

MainActivity.a

a方法直接调用了b方法

查看其他wp，得到这是twofish加密算法

解密

byte[] data = new byte[]{-120, 77, -14, -38, 17, 5, -42, 44, (byte)0xE0, 109, 85, 0x1F, 24, -91, (byte)0x90, -83, 0x40, -83, (byte)0x80, 84, 5, -94, -98, -30, 18, 70, -26, 71, 5, -99, -62, -58, 0x75, 29, -44, 6, 0x70, -4, 81, 84, 9, 22, -51, 0x5F, -34, 12, 0x2F, 77};

提取到的结果byte数组
twofish 在线加解密
发现输出结果是以base64进行编码的
于是将数组data经过base64编码得到

iE3y2hEF1izgbVUfGKWQrUCtgFQFop7iEkbmRwWdwsZ1HdQGcPxRVAkWzV/eDC9N

同时输入key解得flag

flag为qwb{TH3y_Io<e_EACh_OTh3r_FOrEUER}