Writeup of Android02(android) in WhaleCTF

先甩链接Android02

老套路，直接把Android02扔进AndroidKiller，得到整个工程的反汇编代码。随后用jd-gui查看MainActivity的java代码——

package com.tencent.crasms;

import android.app.Activity;
import android.os.Bundle;
import android.telephony.SmsManager;
import android.view.View;
import android.view.View.OnClickListener;
import android.widget.Button;
import android.widget.Toast;

public class MainActivity
  extends Activity
{
  Button a;
  
  static
  {
    System.loadLibrary("msyk");
  }
  
  protected void onCreate(Bundle paramBundle)
  {
    super.onCreate(paramBundle);
    setContentView(2130968602);
    this.a = ((Button)findViewById(2131427420));
    this.a.setOnClickListener(new View.OnClickListener()
    {
      public void onClick(View paramAnonymousView)
      {
        try
        {
          paramAnonymousView = SmsManager.getDefault();
          MainActivity.this.rx3sdfx(paramAnonymousView);
          label12:
          Toast.makeText(MainActivity.this.getApplicationContext(), "ok", 0).show();
          return;
        }
        catch (Exception paramAnonymousView)
        {
          break label12;
        }
      }
    });
  }
  
  public native void rx3sdfx(SmsManager paramSmsManager);
}

观察这个程序，发现要取得SmsManager的默认实例，显然这个默认实例应当出现在rx3sdfx函数内，然而此处该函数缺失反编译代码。陷入沉思……

又观察到loadLibrary("msyk")，于是找到libmysk.so文件，索性用IDA反汇编下好了；扔进IDA，反编译得rx3sdfx的C风格伪代码——

int __fastcall rx3sdfx(int a1, int a2, int a3)
{
  int v3; // r9@1
  int v4; // r8@1
  char *v5; // r3@2
  int v6; // r11@5
  int result; // r0@9
  int v8; // [sp+18h] [bp-4F8h]@1
  int v9; // [sp+1Ch] [bp-4F4h]@4
  int v10; // [sp+24h] [bp-4ECh]@1
  int v11; // [sp+28h] [bp-4E8h]@1
  int v12; // [sp+2Ch] [bp-4E4h]@1
  char v13; // [sp+30h] [bp-4E0h]@1
  char v14; // [sp+31h] [bp-4DFh]@1
  char v15; // [sp+32h] [bp-4DEh]@1
  int s; // [sp+64h] [bp-4ACh]@1
  int v17; // [sp+68h] [bp-4A8h]@1
  int v18; // [sp+6Ch] [bp-4A4h]@1
  int v19; // [sp+70h] [bp-4A0h]@1
  int v20; // [sp+74h] [bp-49Ch]@1
  int v21; // [sp+78h] [bp-498h]@1
  int v22; // [sp+7Ch] [bp-494h]@1
  char v23; // [sp+E4h] [bp-42Ch]@1
  char v24; // [sp+E5h] [bp-42Bh]@1
  char v25; // [sp+E6h] [bp-42Ah]@1
  char v26; // [sp+E7h] [bp-429h]@1
  char v27; // [sp+E8h] [bp-428h]@1
  char v28; // [sp+E9h] [bp-427h]@1
  char v29; // [sp+EAh] [bp-426h]@1
  char v30; // [sp+EBh] [bp-425h]@1
  char v31; // [sp+ECh] [bp-424h]@1
  char v32; // [sp+EDh] [bp-423h]@1
  char v33; // [sp+EEh] [bp-422h]@1
  char v34; // [sp+EFh] [bp-421h]@1
  char v35; // [sp+F0h] [bp-420h]@1
  char v36; // [sp+F1h] [bp-41Fh]@1
  char v37; // [sp+F2h] [bp-41Eh]@1
  char v38; // [sp+F3h] [bp-41Dh]@1
  char v39; // [sp+F4h] [bp-41Ch]@1
  char v40; // [sp+F5h] [bp-41Bh]@1
  char v41; // [sp+F6h] [bp-41Ah]@1
  char v42; // [sp+F7h] [bp-419h]@1
  char v43; // [sp+F8h] [bp-418h]@1
  char v44; // [sp+F9h] [bp-417h]@1
  char v45; // [sp+FAh] [bp-416h]@1
  char v46; // [sp+FBh] [bp-415h]@1
  char v47; // [sp+FCh] [bp-414h]@1
  char v48; // [sp+FDh] [bp-413h]@1
  char v49; // [sp+FEh] [bp-412h]@1
  char v50; // [sp+FFh] [bp-411h]@1
  char v51; // [sp+100h] [bp-410h]@1
  char v52; // [sp+101h] [bp-40Fh]@1
  char v53; // [sp+102h] [bp-40Eh]@1
  char v54; // [sp+103h] [bp-40Dh]@1
  char v55; // [sp+104h] [bp-40Ch]@1
  char v56; // [sp+105h] [bp-40Bh]@1
  char v57; // [sp+106h] [bp-40Ah]@1
  char v58; // [sp+107h] [bp-409h]@1
  char v59; // [sp+108h] [bp-408h]@1
  char v60; // [sp+109h] [bp-407h]@1
  char v61; // [sp+10Ah] [bp-406h]@1
  char v62; // [sp+10Bh] [bp-405h]@1
  char v63; // [sp+10Ch] [bp-404h]@1
  char v64; // [sp+10Dh] [bp-403h]@1
  char v65; // [sp+10Eh] [bp-402h]@1
  char v66; // [sp+10Fh] [bp-401h]@1
  char v67; // [sp+110h] [bp-400h]@1
  char v68; // [sp+111h] [bp-3FFh]@1
  char v69; // [sp+112h] [bp-3FEh]@1
  char v70; // [sp+113h] [bp-3FDh]@1
  char v71; // [sp+114h] [bp-3FCh]@1
  char v72; // [sp+115h] [bp-3FBh]@1
  char v73; // [sp+116h] [bp-3FAh]@1
  char v74; // [sp+117h] [bp-3F9h]@1
  char v75; // [sp+118h] [bp-3F8h]@1
  char v76; // [sp+119h] [bp-3F7h]@1
  char v77; // [sp+11Ah] [bp-3F6h]@1
  char v78; // [sp+11Bh] [bp-3F5h]@1
  char v79; // [sp+11Ch] [bp-3F4h]@1
  char v80; // [sp+11Dh] [bp-3F3h]@1
  char v81; // [sp+11Eh] [bp-3F2h]@1
  char v82; // [sp+11Fh] [bp-3F1h]@1
  char v83; // [sp+120h] [bp-3F0h]@1
  char v84; // [sp+121h] [bp-3EFh]@1
  char v85; // [sp+122h] [bp-3EEh]@1
  char v86; // [sp+123h] [bp-3EDh]@1
  char v87; // [sp+124h] [bp-3ECh]@1
  char v88; // [sp+125h] [bp-3EBh]@1
  char v89; // [sp+126h] [bp-3EAh]@1
  char v90; // [sp+127h] [bp-3E9h]@1
  char v91; // [sp+128h] [bp-3E8h]@1
  char v92; // [sp+129h] [bp-3E7h]@1
  char v93; // [sp+12Ah] [bp-3E6h]@1
  char v94; // [sp+12Bh] [bp-3E5h]@1
  char v95; // [sp+12Ch] [bp-3E4h]@1
  char v96; // [sp+12Dh] [bp-3E3h]@1
  char v97; // [sp+12Eh] [bp-3E2h]@1
  char v98; // [sp+12Fh] [bp-3E1h]@1
  char v99; // [sp+130h] [bp-3E0h]@1
  char v100; // [sp+131h] [bp-3DFh]@1
  char v101; // [sp+132h] [bp-3DEh]@1
  char v102; // [sp+133h] [bp-3DDh]@1
  char v103; // [sp+134h] [bp-3DCh]@1
  char v104; // [sp+135h] [bp-3DBh]@1
  char v105; // [sp+136h] [bp-3DAh]@1
  char v106; // [sp+137h] [bp-3D9h]@1
  char v107; // [sp+138h] [bp-3D8h]@1
  char v108; // [sp+139h] [bp-3D7h]@1
  char v109; // [sp+13Ah] [bp-3D6h]@1
  char v110; // [sp+13Bh] [bp-3D5h]@1
  char v111; // [sp+13Ch] [bp-3D4h]@1
  char v112; // [sp+13Dh] [bp-3D3h]@1
  char v113; // [sp+13Eh] [bp-3D2h]@1
  char v114; // [sp+13Fh] [bp-3D1h]@1
  char v115; // [sp+140h] [bp-3D0h]@1
  char v116; // [sp+141h] [bp-3CFh]@1
  char v117; // [sp+142h] [bp-3CEh]@1
  char v118; // [sp+143h] [bp-3CDh]@1
  char v119; // [sp+144h] [bp-3CCh]@1
  char v120; // [sp+145h] [bp-3CBh]@1
  char v121; // [sp+146h] [bp-3CAh]@1
  char v122; // [sp+147h] [bp-3C9h]@1
  char v123; // [sp+148h] [bp-3C8h]@1
  char v124; // [sp+149h] [bp-3C7h]@1
  char v125; // [sp+14Ah] [bp-3C6h]@1
  char v126; // [sp+14Bh] [bp-3C5h]@1
  char v127; // [sp+14Ch] [bp-3C4h]@1
  char v128; // [sp+14Dh] [bp-3C3h]@1
  char v129; // [sp+14Eh] [bp-3C2h]@1
  char v130; // [sp+14Fh] [bp-3C1h]@1
  char v131; // [sp+150h] [bp-3C0h]@1
  char v132; // [sp+151h] [bp-3BFh]@1
  char v133; // [sp+152h] [bp-3BEh]@1
  int v134; // [sp+1E4h] [bp-32Ch]@1
  int v135; // [sp+1E8h] [bp-328h]@1
  char v136; // [sp+1ECh] [bp-324h]@1
  char v137; // [sp+1EDh] [bp-323h]@1
  char v138; // [sp+1EEh] [bp-322h]@1
  int v139; // [sp+2E4h] [bp-22Ch]@1
  int v140; // [sp+2E8h] [bp-228h]@1
  int v141; // [sp+2ECh] [bp-224h]@1
  int v142; // [sp+2F0h] [bp-220h]@1
  int v143; // [sp+2F4h] [bp-21Ch]@1
  int v144; // [sp+2F8h] [bp-218h]@1
  int v145; // [sp+2FCh] [bp-214h]@1
  int v146; // [sp+300h] [bp-210h]@1
  int v147; // [sp+304h] [bp-20Ch]@1
  char v148; // [sp+308h] [bp-208h]@1
  char v149; // [sp+309h] [bp-207h]@1
  int v150; // [sp+4E4h] [bp-2Ch]@1

  v3 = a1;
  v8 = a3;
  v150 = _stack_chk_guard;
  j_j_memset(&s, 0, 0x80u);
  s = 0x190F050A;
  v17 = 0x440F0204;
  v18 = 0xE070E1F;
  v19 = 0x504031B;
  LOBYTE(v20) = 18;
  BYTE3(v20) = 6;
  v21 = 0x50A2618;
  v22 = 0x190E0C0A;
  *(&v20 + 1) = '8D';
  j_j_memset(&v10, 0, 0x40u);
  v10 = 0xF050E18;
  v11 = 0x1F130E3F;
  v12 = 0x18180E26;
  v13 = 0xA;
  v14 = 12;
  v15 = 14;
  j_j_memset(&v23, 0, 0x100u);
  v23 = 67;
  v26 = 0xA;
  v27 = 29;
  v28 = 0xA;
  v31 = 0xA;
  v32 = 5;
  v33 = 12;
  v35 = 56;
  v36 = 31;
  v37 = 25;
  v38 = 2;
  v39 = 5;
  v40 = 12;
  v41 = 80;
  v44 = 0xA;
  v45 = 29;
  v46 = 0xA;
  v49 = 0xA;
  v50 = 5;
  v51 = 12;
  v53 = 56;
  v54 = 31;
  v55 = 25;
  v24 = 39;
  v25 = 1;
  v29 = 'D';
  v30 = 7;
  v34 = 'D';
  v42 = 39;
  v43 = 1;
  v47 = 'D';
  v48 = 7;
  v52 = 'D';
  v56 = 2;
  v57 = 5;
  v58 = 12;
  v59 = 80;
  v60 = 39;
  v61 = 1;
  v62 = 0xA;
  v63 = 29;
  v64 = 0xA;
  v65 = 'D';
  v66 = 7;
  v67 = 0xA;
  v68 = 5;
  v69 = 12;
  v70 = 'D';
  v71 = 56;
  v72 = 31;
  v73 = 25;
  v74 = 2;
  v75 = 5;
  v76 = 12;
  v77 = 80;
  v78 = 39;
  v79 = 0xA;
  v80 = 5;
  v81 = 15;
  v82 = 25;
  v83 = 4;
  v84 = 2;
  v85 = 15;
  v86 = 'D';
  v87 = 0xA;
  v88 = 27;
  v89 = 27;
  v90 = 'D';
  v91 = 59;
  v92 = 14;
  v93 = 5;
  v94 = 15;
  v95 = 2;
  v96 = 5;
  v97 = 12;
  v98 = 34;
  v99 = 5;
  v100 = 31;
  v101 = 14;
  v102 = 5;
  v103 = 31;
  v104 = 80;
  v105 = 39;
  v106 = 0xA;
  v107 = 5;
  v108 = 15;
  v109 = 25;
  v110 = 4;
  v111 = 2;
  v112 = 15;
  v114 = 0xA;
  v115 = 27;
  v116 = 27;
  v117 = 'D';
  v118 = 59;
  v119 = 14;
  v120 = 5;
  v121 = 15;
  v122 = 2;
  v123 = 5;
  v113 = 'D';
  v124 = 12;
  v125 = 34;
  v126 = 5;
  v127 = 31;
  v128 = 14;
  v129 = 5;
  v130 = 31;
  v131 = 80;
  v132 = 66;
  v133 = 61;
  j_j_memset(&v139, 0, 0x200u);
  v139 = 0x1802033F;
  v140 = 0x4033B4B;
  v141 = 0x34B0E05;
  v142 = 0x94B180A;
  v143 = 0x4B050E0E;
  LOWORD(v144) = 0xA03;
  BYTE2(v144) = 8;
  v145 = 0x4B470F0E;
  v146 = 0x53512538;
  v147 = 0x595A5258;
  v148 = 0x5A;
  v149 = 0x5E;
  j_j_memset(&v134, 0, 0x100u);
  v136 = 0x5F;
  v134 = 0x5B52585A;
  v135 = 0x5C535B5A;
  v137 = 0x5A;
  v138 = 0x53;
  s ^= 0x6B6B6B6Bu;
  v17 ^= 0x6B6B6B6Bu;
  v18 ^= 0x6B6B6B6Bu;
  v19 ^= 0x6B6B6B6Bu;
  v20 ^= 0x6B6B6B6Bu;
  v21 ^= 0x6B6B6B6Bu;
  v22 ^= 0x6B6B6B6Bu;
  v4 = (*(*v3 + 24))(v3, &s);
  j_j_memset(&s, 0, 0x80u);
  if ( v4 )
  {
    v10 ^= 0x6B6B6B6Bu;
    v11 ^= 0x6B6B6B6Bu;
    v12 ^= 0x6B6B6B6Bu;
    v13 ^= 0x6Bu;
    v14 ^= 0x6Bu;
    v15 ^= 0x6Bu;
    v5 = &v23;
    do
    {
      *v5 ^= 0x6B6B6B6Bu;
      v5 += 4;
    }
    while ( v5 != &v131 );
    v131 ^= 0x6Bu;
    v132 ^= 0x6Bu;
    v133 ^= 0x6Bu;
    v9 = (*(*v3 + 132))(v3, v4, &v10, &v23);
    j_j_memset(&v10, 0, 0x40u);
    j_j_memset(&v23, 0, 0x100u);
    if ( v9 )
    {
      v134 ^= 0x6B6B6B6Bu;
      v135 ^= 0x6B6B6B6Bu;
      v136 ^= 0x6Bu;
      v137 ^= 0x6Bu;
      v138 ^= 0x6Bu;
      v6 = (*(*v3 + 668))(v3, &v134);
      j_j_memset(&v134, 0, 0x100u);
      v139 ^= 0x6B6B6B6Bu;
      v140 ^= 0x6B6B6B6Bu;
      v141 ^= 0x6B6B6B6Bu;
      v142 ^= 0x6B6B6B6Bu;
      v143 ^= 0x6B6B6B6Bu;
      v144 ^= 0x6B6B6B6Bu;
      v145 ^= 0x6B6B6B6Bu;
      v146 ^= 0x6B6B6B6Bu;
      v147 ^= 0x6B6B6B6Bu;
      v148 ^= 0x6Bu;
      v149 ^= 0x6Bu;
      if ( (*(*v3 + 668))(v3, &v139) )
        _JNIEnv::CallVoidMethod(v3, v8, v9, v6);
      j_j_memset(&v139, 0, 0x200u);
    }
    (*(*v3 + 92))(v3, v4);
  }
  result = (*(*v3 + 912))(v3);
  if ( result )
    result = (*(*v3 + 68))(v3);
  if ( v150 != _stack_chk_guard )
    j_j___stack_chk_fail(result);
  return result;
}

连虚拟机都懒得开……就直接手算吧……

得到最终内存中应该出现的数据：

• v139~v149 : This Phone has been hacked, SN:8391215
• v134~v138 : 13901087418
• v10~v15 : sendTextMessage
• s~v22 : android/telephone

于是得到题目要求的恶意短信内容与SN；提交，pass~