攻防世界mobile之app1 write up

1.app1

拖进模拟器效果：

上dex2jar,得到代码如下：

package com.example.yaphetshan.tencentgreat;

import android.content.Context;
import android.content.pm.PackageInfo;
import android.content.pm.PackageManager;
import android.os.Bundle;
import android.support.v7.app.AppCompatActivity;
import android.view.View;
import android.widget.Button;
import android.widget.EditText;
import android.widget.Toast;

public class MainActivity extends AppCompatActivity {
  Button btn;
  
  public final String pName = "com.example.yaphetshan.tencentgreat";
  
  EditText text;
  
  protected void onCreate(Bundle paramBundle) {
    super.onCreate(paramBundle);
    setContentView(2130968603);
    this.btn = (Button)findViewById(2131427416);
    this.text = (EditText)findViewById(2131427415);
    this.btn.setOnClickListener(new View.OnClickListener() {
          public void onClick(View param1View) {
            try {
              String str1 = MainActivity.this.text.getText().toString();
              PackageInfo packageInfo = MainActivity.this.getPackageManager().getPackageInfo("com.example.yaphetshan.tencentgreat", 16384);
              String str2 = packageInfo.versionName;
              int j = packageInfo.versionCode;
              for (int i = 0;; i++) {
                if (i < str1.length() && i < str2.length()) {
                  if (str1.charAt(i) != (str2.charAt(i) ^ j)) {
                    Toast.makeText((Context)MainActivity.this, ", 1).show();
                    return;
                  } 
                } else {
                  if (str1.length() == str2.length()) {
                    Toast.makeText((Context)MainActivity.this, ", 1).show();
                    return;
                  } 
                  Toast.makeText((Context)MainActivity.this, ", 1).show();
                } 
              } 
            } catch (android.content.pm.PackageManager.NameNotFoundException nameNotFoundException) {}
            Toast.makeText((Context)MainActivity.this, ", 1).show();
          }
        });
  }
}

从代码可得到逻辑：对于输入，逐位与版本名按位与版本号异或之后比较。

然后我们查看BuildConfig得到版本号：

 public static final int VERSION_CODE = 15;
  
  public static final String VERSION_NAME = "X<cP[?PHNB<P?aj";

然后将这两个变量拿来放进代码：

        String str2 = "X<cP[?PHNB<P?aj";
		String result = "";
		for(int i=0;i<str2.length();i++) {
			result+=(char)(str2.charAt(i)^15);
		}
		System.out.println(result);

拿到输出result就是flag:W3l_T0_GAM3_0ne