[ctf.show.reverse] 真正的签到，指生产的劣质产品

真正的签到

这个难了我一阵子，手工脱壳不会，脱壳工具不好用

1. Aspack的壳，用Unpacker_Aspacker1.0可正常脱壳
2. 脱完后是UPX的壳，用UPX3.96无法脱，用WSUnpacker_0.20可
3. flag加密很简单与自然数异或后与给定值比较
4. 汉字flag需要对bytes进行解码gb2312

int sub_4012F0()
{
  int v1[23]; // [esp+30h] [ebp-168h] BYREF
  int i; // [esp+8Ch] [ebp-10Ch]
  char String[264]; // [esp+90h] [ebp-108h] BYREF

  sub_401990();
  sub_401510();
  j_scanf(byte_403000, String);
  if ( j_strlen(String) == 18 )
  {
    i = j_strlen(String) - 1;
    j_memcpy(v1, dword_402000, 72);
    while ( 1 )
    {
      String[i] ^= i;
      if ( !i )
        break;
      --i;
    }
    j__strrev(String);
    for ( i = 0; i != 18; ++i )
    {
      if ( String[i] != v1[i] )
      {
        j_printf("%s\n", aTryAgain);
        return 0;
      }
    }
    j_printf("%s\n", aYouWin);
  }
  else
  {
    j_printf("%s\n", aTryAgain);
  }
  return 0;
}

解码：

a = [0x6c,0x2f,0x30,0x31,0x32,0x33,0xb6,0xbf,0xa0,0xcf,0x7c,0x71,0x6a,0x6c,0x70,0x64,0x75,0x63][::-1]
print(bytes([i^v for i,v in enumerate(a)]).decode('gb2312'))
#ctfshow{签到?????}

批量生产的劣质产品

这题没有加密，用JD打开APK找到入口（很长的）里边一堆函数，里边有一个显示flag

   static Object lambda3() {
        runtime.setAndCoerceProperty$Ex(Lit0, Lit3, "checkme", Lit4);
        return runtime.setAndCoerceProperty$Ex(Lit0, Lit5, "a", Lit4);
    }

    static Object lambda4() {
        runtime.setAndCoerceProperty$Ex(Lit13, Lit14, Lit15, Lit16);
        runtime.setAndCoerceProperty$Ex(Lit13, Lit17, Lit18, Lit16);
        return runtime.setAndCoerceProperty$Ex(Lit13, Lit19, "ctfshow{群主最爱36D}", Lit4);
    }

    static Object lambda5() {
        runtime.setAndCoerceProperty$Ex(Lit13, Lit14, Lit15, Lit16);
        runtime.setAndCoerceProperty$Ex(Lit13, Lit17, Lit18, Lit16);
        return runtime.setAndCoerceProperty$Ex(Lit13, Lit19, "ctfshow{群主最爱36D}", Lit4);
    }