2021NSCTF RE WP

题目

链接：https://pan.baidu.com/s/1yt4LNXsk6kdfnaVjT4AsNQ
提取码：py32

ViolentScript.apk

做法一

AndroidKiller搜索flag{定位主函数

一般题目字符串中没有flag时 从smali->com中找
apk中original存放的是配置信息，res存放资源文件（图片视频之类），smali存放字节码文件，其中Android和Androidx为安卓库文件，com中存放的是用户自定义的包

查看java源码

package com.liyasoft.crackmea;

import android.content.DialogInterface;
import android.content.DialogInterface.OnClickListener;
import android.os.Bundle;
import android.support.v7.app.AlertDialog.Builder;
import android.support.v7.app.AppCompatActivity;
import android.view.View;
import android.view.View.OnClickListener;
import android.widget.Button;
import android.widget.EditText;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;

public class MainActivity
  extends AppCompatActivity
  implements View.OnClickListener
{
  private static int[] mask = { 23, 1, 0, 1, 10, 17, 7, 90, 20 };
  private Button mButton;
  private EditText mPassword;
  private EditText mUsername;
  
  private static boolean checkUsername(String paramString)
  {
    boolean bool1 = true;
    int i = paramString.length();
    int j = 0;
    if (i == 9)
    {
      boolean bool2;
      for (;;)
      {
        bool2 = bool1;
        if (j >= 9) {
          break;
        }
        if ((paramString.charAt(j) ^ "miaomiao!".charAt(j)) != mask[j])
        {
          bool2 = false;
          break;
        }
        j++;
      }
      return bool2;
    }
    return false;
  }
  
  private static String getString(byte[] paramArrayOfByte)
  {
    StringBuilder localStringBuilder = new StringBuilder();
    for (int i = 0; i < paramArrayOfByte.length; i++) {
      localStringBuilder.append(paramArrayOfByte[i]);
    }
    return localStringBuilder.toString();
  }
  
  public static String hash(String paramString)
  {
    try
    {
      paramString = MessageDigest.getInstance("MD5").digest(paramString.getBytes());
      StringBuilder localStringBuilder = new java/lang/StringBuilder;
      localStringBuilder.<init>(40);
      int i = paramString.length;
      for (int j = 0; j < i; j++)
      {
        int k = paramString[j];
        if ((k & 0xFF) >> 4 == 0)
        {
          localStringBuilder.append("0");
          localStringBuilder.append(Integer.toHexString(k & 0xFF));
        }
        else
        {
          localStringBuilder.append(Integer.toHexString(k & 0xFF));
        }
      }
      paramString = localStringBuilder.toString();
      return paramString;
    }
    catch (NoSuchAlgorithmException paramString) {}
    return nu