CTF_论剑场 android1

附件是一个apk包，这里用apktool解包并转成jar程序，看到如下代码

package com.example.test.myapplication;

import android.os.Bundle;
import android.support.v7.app.AppCompatActivity;
import android.view.View;
import android.view.View.OnClickListener;
import android.widget.Button;
import android.widget.EditText;
import android.widget.Toast;
import java.util.Arrays;

public class MainActivity
  extends AppCompatActivity
{
  protected void onCreate(Bundle paramBundle)
  {
    super.onCreate(paramBundle);
    setContentView(2131296284);
    ((Button)findViewById(2131165218)).setOnClickListener(new View.OnClickListener()
    {
      public void onClick(View paramAnonymousView)
      {
        paramAnonymousView = ((EditText)MainActivity.this.findViewById(2131165238)).getText().toString();
        byte[] arrayOfByte = paramAnonymousView.getBytes();
        for (int i = 0; i < paramAnonymousView.length(); i++)
        {
          arrayOfByte[i] = ((byte)(byte)(arrayOfByte[i] ^ (byte)i));
          arrayOfByte[i] = ((byte)(byte)(arrayOfByte[i] + 1));
        }
        if (Arrays.equals(arrayOfByte, new byte[] { 103, 110, 100, 101, -128, 101, 64, 56, 108, 112, 60, 61, 59, 63, 109, 56, 40, 36, 120, 35, 114, 33, 39, 115, 124, -128, 127, 126, 44, 45, 121, 48, 25, 19, 23, 22, 90 })) {
          Toast.makeText(MainActivity.this, "you are right~!", 1).show();
        } else {
          Toast.makeText(MainActivity.this, "wrong!", 1).show();
        }
      }
    });
  }
}

可以看到，它把byte数组先^i再+1然后与一个数组比较，于是把那个数组复制出来，写出下面的逆向脚本

lis=[103, 110, 100, 101, 128, 101, 64, 56, 108, 112, 60, 61, 59, 63, 109, 56, 40, 36, 120, 35, 114, 33, 39, 115, 124, 128, 127, 126, 44, 45, 121, 48, 25, 19, 23, 22, 90]
t=0
for i in lis:
    res=i-1
    res=res^t
    t+=1
    print(chr(res),end="")
    pass

那个数组里面有-128，在转成字符的时候会报错，这个不知道是怎么跑出来的，把它们改成128即可

运行脚本得到flag