SimpleCheck之flag破解分析

SimpleCheck之flag破解分析

1.编写目的
分析SimpleCheck app得到正确flag的方式.
2.分析工具
逆向环境:jadx

     编译环境:eclipse

     运行环境:小米 5S 

3.分析过程3.1 使用adb获取当前APP的界面
(1)在cmd命令窗输入adbshell dumpsys activity top获取当前屏幕显示的activity进行定位.

3.2 使用jadx分析并定位当前activity
(1)定位当前activity.
(2)观看onCreate函数
(3)在点击事件中发现调用了a.a(String)函数,返回true则提示” You getit~”
(4)由此我们可以看出真正的算法都在a.a(String)函数中.

3.3 分析a.a(String)函数
1.将输入的字符串str传入.
2.比较str与数组b的长度时候一致,一致则继续
3.定义一个与a数组长度的新数组iArr
4.将iArr的第一个元素设置为0, 并且定义一个变量I,属性为1.
5.将str转换为字节数组后将每个元素填充到iArr中.iArr从i开始接收,
6.将数组a的元素每个都与(((b[i2] * iArr[i2]) * iArr[i2]) + (c[i2] *iArr[i2])) + d[i2] || a[i2 + 1] != (((b[i2] * iArr[i2 + 1]) * iArr[i2 + 1]) +(c[i2] * iArr[i2 + 1])) + d[i2])该运算得到的值进行比较,全部一致这返回true让界面显示” You get it~”
7.在此得出分析结果:数组a为正确的输入命令.

3.4 利用java算法进行flag还原
public class Test2 {

private static int[] a = new int[]{0, 146527998, 205327308, 94243885, 138810487, 408218567, 77866117, 71548549, 563255818, 559010506, 449018203, 576200653, 307283021, 467607947, 314806739, 341420795, 341420795, 469998524, 417733494, 342206934, 392460324, 382290309, 185532945, 364788505, 210058699, 198137551, 360748557, 440064477, 319861317, 676258995, 389214123, 829768461, 534844356, 427514172, 864054312};
private static int[] b = new int[]{13710, 46393, 49151, 36900, 59564, 35883, 3517, 52957, 1509, 61207, 63274, 27694, 20932, 37997, 22069, 8438, 33995, 53298, 16908, 30902, 64602, 64028, 29629, 26537, 12026, 31610, 48639, 19968, 45654, 51972, 64956, 45293, 64752, 37108};
private static int[] c = new int[]{38129, 57355, 22538, 47767, 8940, 4975, 27050, 56102, 21796, 41174, 63445, 53454, 28762, 59215, 16407, 64340, 37644, 59896, 41276, 25896, 27501, 38944, 37039, 38213, 61842, 43497, 9221, 9879, 14436, 60468, 19926, 47198, 8406, 64666};
private static int[] d = new int[]{0, -341994984, -370404060, -257581614, -494024809, -135267265, 54930974, -155841406, 540422378, -107286502, -128056922, 265261633, 275964257, 119059597, 202392013, 283676377, 126284124, -68971076, 261217574, 197555158, -12893337, -10293675, 93868075, 121661845, 167461231, 123220255, 221507, 258914772, 180963987, 107841171, 41609001, 276531381, 169983906, 276158562};

private static String getKey(){
  StringBuilder sb = new StringBuilder();
  //按数组C的长度进行循环计算
  for (int i = 0; i < 34; i++) {
     //字符根据ASCII码表进行转换
     for (int j = 0; j < 128; j++) {
        //使用符合这个算法(a == b * j * j + c * j + d)&(a == b[i-1] * j * j + c[i-1] * j + d[i-1])计算出的值才是正确的元素

// if ((a == b * j * j + c * j + d)&(a == b[i-1] * j * j + c[i-1] * j + d[i-1])) {
// //将每位元素转换成字符后进行拼接
// sb.append((char)j);
// }
if (a[i+1]==(((b * j) * j) + (c * j)) + d ) {
//将每位元素转换成字符后进行拼接
sb.append((char)j);
}
}
}

  return sb.toString();
}
public static void main(String[] args) {
  System.out.println(getKey());

}
}
复制代码

3.5 验证结果

4. 总结
   感谢狂徒对最后一位”}”的字符的还原G