0x01 題目描述

無

0x02 題解

這道題也是個apk课梳，很尷尬的是我安裝不上距辆，不知道究竟是為什么余佃。。那直接拖進jeb看看能否反匯編

成功反匯編成java代碼

package com.a.sample.androidtest;

import android.os.Bundle;
import android.support.v7.app.AppCompatActivity;
import android.view.View$OnClickListener;
import android.view.View;
import android.widget.EditText;
import android.widget.Toast;

public class MainActivity extends AppCompatActivity {
    private EditText editText;
    private byte[] s;

    public MainActivity() {
        super();
        this.s = new byte[]{113, 123, 118, 112, 108, 94, 99, 72, 38, 68, 72, 87, 89, 72, 36, 118, 100, 78, 72, 87, 121, 83, 101, 39, 62, 94, 62, 38, 107, 115, 106};
    }

    public boolean check() {
        boolean v2 = false;
        byte[] v0 = this.editText.getText().toString().getBytes();
        if(v0.length == this.s.length) {
            int v1 = 0;
            while(v1 < this.s.length) {
                if(v1 >= v0.length) {
                    break;
                }

                if(this.s[v1] == (v0[v1] ^ 23)) {
                    ++v1;
                    continue;
                }
                else {
                    return v2;
                }
            }

            v2 = true;
        }

        return v2;
    }

    protected void onCreate(Bundle arg4) {
        super.onCreate(arg4);
        this.setContentView(2130968603);
        this.editText = this.findViewById(2131427415);
        this.findViewById(2131427416).setOnClickListener(new View$OnClickListener(this) {
            public void onClick(View arg4) {
                if(MainActivity.this.check()) {
                    Toast.makeText(this.val$context, "You got the flag!", 1).show();
                }
                else {
                    Toast.makeText(this.val$context, "Sorry your flag is wrong", 1).show();
                }
            }
        });
    }
}

可以看到當(dāng)check返回true的話就會得到flag了跨算。
那就看check函數(shù)咙冗，如果我們輸入的字符串的每一位都與23異或后的結(jié)果等于s數(shù)組中對應(yīng)的值，那么在全部完成31次后check函數(shù)就會返回true
那么很容易逆過來漂彤，腳本如下

s = [113, 123, 118, 112, 108, 94, 99, 72, 38, 68, 72, 87, 89, 72, 36, 118, 100, 78, 72, 87, 121, 83, 101, 39, 62, 94, 62, 38, 107, 115, 106]

result = ''

for i in range(len(s)):

    result += chr(int(s[i]) ^ 23)

print result