[攻防世界]mobile新手练习区easyjava_mobile区

[攻防世界]mobile新手练习区easyjava

easyjava最佳Writeup由zer0sun • zer0sun提供

难度系数： 7.0

题目来源：暂无

题目描述：无

题目场景：暂无

题目附件：附件1

反编译后有用的附件内容：

MainActivity.class

a.class

b.class

package com.a.easyjava;

import android.content.Context;
import android.os.Bundle;
import android.support.v7.app.c;
import android.view.View;
import android.view.View.OnClickListener;
import android.widget.EditText;
import android.widget.Toast;
import java.util.Timer;
import java.util.TimerTask;

public class MainActivity
  extends c
{
  private static char a(String paramString, b paramb, a parama)
  {
    return parama.a(paramb.a(paramString));
  }
  
  private static Boolean b(String paramString)
  {
    int i = 0;
    if (!paramString.startsWith("flag{")) {
      paramString = Boolean.valueOf(false);
    }
    for (;;)
    {
      return paramString;
      if (!paramString.endsWith("}"))
      {
        paramString = Boolean.valueOf(false);
      }
      else
      {
        String str = paramString.substring(5, paramString.length() - 1);
        paramString = new b(Integer.valueOf(2));
        a locala = new a(Integer.valueOf(3));
        StringBuilder localStringBuilder = new StringBuilder();
        int k;
        for (int j = 0; i < str.length(); j = k)
        {
          localStringBuilder.append(a(str.charAt(i) + "", paramString, locala));
          Integer localInteger = Integer.valueOf(paramString.b().intValue() / 25);
          k = j;
          if (localInteger.intValue() > j)
          {
            k = j;
            if (localInteger.intValue() >= 1) {
              k = j + 1;
            }
          }
          i++;
        }
        paramString = Boolean.valueOf(localStringBuilder.toString().equals("wigwrkaugala"));
      }
    }
  }
  
  protected void onCreate(Bundle paramBundle)
  {
    super.onCreate(paramBundle);
    setContentView(2130968603);
    findViewById(2131427446).setOnClickListener(new View.OnClickListener()
    {
      public void onClick(View paramAnonymousView)
      {
        if (MainActivity.a(((EditText)((MainActivity)jdField_this).findViewById(2131427445)).getText().toString()).booleanValue()) {
          Toast.makeText(jdField_this, "You are right!", 1).show();
        }
        for (;;)
        {
          return;
          Toast.makeText(jdField_this, "You are wrong! Bye~", 1).show();
          paramAnonymousView = new TimerTask()
          {
            public void run()
            {
              System.exit(1);
            }
          };
          new Timer().schedule(paramAnonymousView, 2000L);
        }
      }
    });
  }
}

package com.a.easyjava;

import java.util.ArrayList;

public class a
{
  public static ArrayList<Integer> a = new ArrayList();
  static String b = "abcdefghijklmnopqrstuvwxyz";
  static Integer d = Integer.valueOf(0);
  Integer[] c = { Integer.valueOf(7), Integer.valueOf(14), Integer.valueOf(16), Integer.valueOf(21), Integer.valueOf(4), Integer.valueOf(24), Integer.valueOf(25), Integer.valueOf(20), Integer.valueOf(5), Integer.valueOf(15), Integer.valueOf(9), Integer.valueOf(17), Integer.valueOf(6), Integer.valueOf(13), Integer.valueOf(3), Integer.valueOf(18), Integer.valueOf(12), Integer.valueOf(10), Integer.valueOf(19), Integer.valueOf(0), Integer.valueOf(22), Integer.valueOf(2), Integer.valueOf(11), Integer.valueOf(23), Integer.valueOf(1), Integer.valueOf(8) };
  
  public a(Integer paramInteger)
  {
    for (int i = paramInteger.intValue(); i < this.c.length; i++) {
      a.add(this.c[i]);
    }
    for (i = 0; i < paramInteger.intValue(); i++) {
      a.add(this.c[i]);
    }
  }
  
  public static void a()
  {
    Integer localInteger = d;
    d = Integer.valueOf(d.intValue() + 1);
    if (d.intValue() == 25)
    {
      int i = ((Integer)a.get(0)).intValue();
      a.remove(0);
      a.add(Integer.valueOf(i));
      d = Integer.valueOf(0);
    }
  }
  
  public char a(Integer paramInteger)
  {
    int i = 0;
    Integer localInteger = Integer.valueOf(0);
    if (paramInteger.intValue() == -10)
    {
      a();
      i = " ".charAt(0);
    }
    for (int j = i;; j = i)
    {
      return j;
      while (i < a.size() - 1)
      {
        if (a.get(i) == paramInteger) {
          localInteger = Integer.valueOf(i);
        }
        i++;
      }
      a();
      i = b.charAt(localInteger.intValue());
    }
  }
}

package com.a.easyjava;

import java.util.ArrayList;

public class b
{
  public static ArrayList<Integer> a = new ArrayList();
  static String b = "abcdefghijklmnopqrstuvwxyz";
  static Integer d = Integer.valueOf(0);
  Integer[] c = { Integer.valueOf(8), Integer.valueOf(25), Integer.valueOf(17), Integer.valueOf(23), Integer.valueOf(7), Integer.valueOf(22), Integer.valueOf(1), Integer.valueOf(16), Integer.valueOf(6), Integer.valueOf(9), Integer.valueOf(21), Integer.valueOf(0), Integer.valueOf(15), Integer.valueOf(5), Integer.valueOf(10), Integer.valueOf(18), Integer.valueOf(2), Integer.valueOf(24), Integer.valueOf(4), Integer.valueOf(11), Integer.valueOf(3), Integer.valueOf(14), Integer.valueOf(19), Integer.valueOf(12), Integer.valueOf(20), Integer.valueOf(13) };
  
  public b(Integer paramInteger)
  {
    for (int i = paramInteger.intValue(); i < this.c.length; i++) {
      a.add(this.c[i]);
    }
    for (i = 0; i < paramInteger.intValue(); i++) {
      a.add(this.c[i]);
    }
  }
  
  public static void a()
  {
    int i = ((Integer)a.get(0)).intValue();
    a.remove(0);
    a.add(Integer.valueOf(i));
    char c1 = b.charAt(0);
    b = b + "" + c1;
    b = b.substring(1, 27);
    Integer localInteger = d;
    d = Integer.valueOf(d.intValue() + 1);
  }
  
  public Integer a(String paramString)
  {
    int i = 0;
    Integer localInteger = Integer.valueOf(0);
    if (b.contains(paramString.toLowerCase()))
    {
      int j = b.indexOf(paramString);
      for (;;)
      {
        paramString = localInteger;
        if (i >= a.size() - 1) {
          break;
        }
        if (a.get(i) == Integer.valueOf(j)) {
          localInteger = Integer.valueOf(i);
        }
        i++;
      }
    }
    if (paramString.contains(" ")) {}
    for (paramString = Integer.valueOf(-10);; paramString = Integer.valueOf(-1))
    {
      a();
      return paramString;
    }
  }
  
  public Integer b()
  {
    return d;
  }
}

解题

拿到附件989ca07c3f90426fa05406e4369901ff.apk，flag一定要反编译。博主用的ApkIDE进行反编译。先找到入口主类MainActivity，发现super调用了自身onCreate方法，点击事件MainActivity.a(((EditText)((MainActivity)jdField_this).findViewById(2131427445)).getText().toString()).booleanValue()为真时成功。MainActivity调用了方法a，根据每一个函数调用关系，分析得出flag。具体可参见这位博主的文章https://blog.csdn.net/shuaicenglou3032/article/details/104309962/

解题思路：apk逆向->分析源码->逆向算法->得出flag

代码的实现

博主也找了相关的代码实现，思路是对给定的字符串和数组进行索引和取值。在析构函数中对数组做了一定的变换。如下。

b = "abcdefghijklmnopqrstuvwxyz"
localStringBuilder = "wigwrkaugala"

#逆向后的代码实现

s_b2 = [17, 23, 7, 22, 1, 16, 6, 9, 21, 0, 15, 5, 10, 18, 2, 24, 4, 11, 3, 14, 19, 12, 20, 13, 8, 25]
s_a3 = [21, 4, 24, 25, 20, 5, 15, 9, 17, 6, 13, 3, 18, 12, 10, 19, 0, 22, 2, 11, 23, 1, 8, 7, 14, 16]
b = "abcdefghijklmnopqrstuvwxyz"
s3 = "wigwrkaugala"
re1 = []
for i in s3:
    re1.append(s_a3[b.index(i)])
print(re1)
flag = ''
for i in re1:
    s4 = s_b2[i]
    flag += b[s4]
    s_b2.append(s_b2[0])
    s_b2.remove(s_b2[0])
    b += b[0]
    b = b[1:]
flag = 'flag{'+flag+'}'
print(flag)

如此就可以得到flag

venividivkcr

flag{venividivkcr}

话说这个题目有点坑，就是没有提示flag的形式，必须裹上flag{}才可以。

也看到了Java的同学给出的答案

import java.util.ArrayList;
import java.util.List;
import java.util.Arrays;
public class Main
{
    public static void main(String[] args)
    {
        List < Integer > tableListA = new ArrayList < > (Arrays.asList(21, 4, 24, 25, 20, 5, 15, 9, 17, 6, 13, 3, 18, 12, 10, 19, 0, 22, 2, 11, 23, 1, 8, 7, 14, 16));
        List < Integer > tableListB = new ArrayList < > (Arrays.asList(17, 23, 7, 22, 1, 16, 6, 9, 21, 0, 15, 5, 10, 18, 2, 24, 4, 11, 3, 14, 19, 12, 20, 13, 8, 25));
        String tableB = "abcdefghijklmnopqrstuvwxyz";
        String tableA = "abcdefghijklmnopqrstuvwxyz";
        String pwd = "wigwrkaugala";
        char[] pwdChars = pwd.toCharArray();
        String key = "";
        for(int i = 0; i < pwdChars.length; i++)
        {
            int pwdIndex = tableA.indexOf(pwdChars[i]);
            int tabBIndex = tableListA.get(pwdIndex); //获取tabB的index 
            key += tableB.charAt(tableListB.get(tabBIndex)); //修改tableB 
            int intValue = tableListB.get(0);
            tableListB.remove(0);
            tableListB.add(intValue);
            tableB += tableB.charAt(0);
            tableB = tableB.substring(1, 27);
        }
        System.out.println("flag{" + key + "}");
    }
}