XiaoRui

奋斗中的小白

17
文章
0
分类
9
标签

强网杯 writeup

0x1 simplecheck

反编译apk后查看java的源码

1
2
3
4
5
6
7
8
9
public void onClick(View paramAnonymousView)
      {
        if (a.a(paramBundle.getText().toString()))
        {
          Toast.makeText(jdField_this, "You get it~", 1).show();
          return;
        }
        Toast.makeText(jdField_this, "Sorry its wrong", 1).show();
      }

a函数检查输入的flag值是否正确，如果正确就输出”You get it~”，否则输出”Sorry its wrong”
分析a函数的操作流程

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
public class a
{
  private static int[] a = { 0, 146527998, 205327308, 94243885, 138810487, 408218567, 77866117, 71548549, 563255818, 559010506, 449018203, 576200653, 307283021, 467607947, 314806739, 341420795, 341420795, 469998524, 417733494, 342206934, 392460324, 382290309, 185532945, 364788505, 210058699, 198137551, 360748557, 440064477, 319861317, 676258995, 389214123, 829768461, 534844356, 427514172, 864054312 };
  private static int[] b = { 13710, 46393, 49151, 36900, 59564, 35883, 3517, 52957, 1509, 61207, 63274, 27694, 20932, 37997, 22069, 8438, 33995, 53298, 16908, 30902, 64602, 64028, 29629, 26537, 12026, 31610, 48639, 19968, 45654, 51972, 64956, 45293, 64752, 37108 };
  private static int[] c = { 38129, 57355, 22538, 47767, 8940, 4975, 27050, 56102, 21796, 41174, 63445, 53454, 28762, 59215, 16407, 64340, 37644, 59896, 41276, 25896, 27501, 38944, 37039, 38213, 61842, 43497, 9221, 9879, 14436, 60468, 19926, 47198, 8406, 64666 };
  private static int[] d = { 0, -341994984, -370404060, -257581614, -494024809, -135267265, 54930974, -155841406, 540422378, -107286502, -128056922, 265261633, 275964257, 119059597, 202392013, 283676377, 126284124, -68971076, 261217574, 197555158, -12893337, -10293675, 93868075, 121661845, 167461231, 123220255, 221507, 258914772, 180963987, 107841171, 41609001, 276531381, 169983906, 276158562 };
  
  public static boolean a(String paramString)
  {
    if (paramString.length() != b.length) {
      return false;
    }
    int[] arrayOfInt = new int[a.length];
    arrayOfInt[0] = 0;
    paramString = paramString.getBytes();
    int k = paramString.length;
    int i = 0;
    int j = 1;
    while (i < k)
    {
      arrayOfInt[j] = paramString[i];
      j += 1;
      i += 1;
    }
    i = 0;
    for (;;)
    {
      if (i >= c.length) {
        break label166;
      }
      if ((a[i] != b[i] * arrayOfInt[i] * arrayOfInt[i] + c[i] * arrayOfInt[i] + d[i]) || (a[(i + 1)] != b[i] * arrayOfInt[(i + 1)] * arrayOfInt[(i + 1)] + c[i] * arrayOfInt[(i + 1)] + d[i])) {
        break;
      }
      i += 1;
    }
    label166:
    return true;
  }
}

  1. paramString.length() == b.length 也就是34
  2. 创建一个新数组arrayOfInt，把flag的值赋给arrayOfInt[]
  3. 满足条件：a[i] != b[i] arrayOfInt[i] arrayOfInt[i] + c[i] arrayOfInt[i] + d[i]) || (a[(i + 1)] != b[i] arrayOfInt[(i + 1)] arrayOfInt[(i + 1)] + c[i] arrayOfInt[(i + 1)] + d[i])
  4. 数组a,b第一位是0，经过运算后还是0，第一位是没有用的，后面34位才是flag的值
    分析完程序流程，可以尝试用爆破得到flag的值：
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    a = [0, 146527998, 205327308, 94243885, 138810487, 408218567, 77866117, 71548549, 563255818, 559010506, 449018203,
         576200653, 307283021, 467607947, 314806739, 341420795, 341420795, 469998524, 417733494, 342206934, 392460324,
         382290309, 185532945, 364788505, 210058699, 198137551, 360748557, 440064477, 319861317, 676258995, 389214123,
         829768461, 534844356, 427514172, 864054312]
    b = [13710, 46393, 49151, 36900, 59564, 35883, 3517, 52957, 1509, 61207, 63274, 27694, 20932, 37997, 22069, 8438, 33995,
         53298, 16908, 30902, 64602, 64028, 29629, 26537, 12026, 31610, 48639, 19968, 45654, 51972, 64956, 45293, 64752,
         37108]
    c = [38129, 57355, 22538, 47767, 8940, 4975, 27050, 56102, 21796, 41174, 63445, 53454, 28762, 59215, 16407, 64340,
         37644, 59896, 41276, 25896, 27501, 38944, 37039, 38213, 61842, 43497, 9221, 9879, 14436, 60468, 19926, 47198, 8406,
         64666]
    d = [0, -341994984, -370404060, -257581614, -494024809, -135267265, 54930974, -155841406, 540422378, -107286502,
         -128056922, 265261633, 275964257, 119059597, 202392013, 283676377, 126284124, -68971076, 261217574, 197555158,
         -12893337, -10293675, 93868075, 121661845, 167461231, 123220255, 221507, 258914772, 180963987, 107841171, 41609001,
         276531381, 169983906, 276158562]
    flag = ""
    for i in range(1, 34):
        for j in range(32, 127):
            if ((a[i] == b[i - 1] * j * j + c[i - 1] * j + d[i - 1]) and (a[i] == b[i] * j * j + c[i] * j + d[i])):
                flag += chr(j)
                break
            else:
                pass
    print (flag + "}")