拿到題之后解包, 整體上Java邏輯沒有明顯混淆, C層用了O-LLVM混淆, 但是代碼量不大. 整體上沒有加殼或者對(duì)完整性校驗(yàn). 通過觀察Java層邏輯, 要求我們依次點(diǎn)擊ping pong兩個(gè)按鍵, 共計(jì)100萬次.

    public MainActivity() {
        super();
        this.p = 0;
        this.num = 0;
        this.ttt = 1000000;
        this.tt = this.ttt;
        this.jping = new com.geekerchina.pingpongmachine.MainActivity$1(this);
        this.jpong = new com.geekerchina.pingpongmachine.MainActivity$2(this);
    }

        public void onClick(View arg7) {
            if(MainActivity.this.tt % 2 == 1) {
                MainActivity.this.p = 0;
                MainActivity.this.num = 0;
                MainActivity.this.tt = MainActivity.this.ttt;
            }

            --MainActivity.this.tt;
            MainActivity.this.p = MainActivity.this.ping(MainActivity.this.p, MainActivity.this.num);
            ++MainActivity.this.num;
            if(MainActivity.this.num >= 7) {
                MainActivity.this.num = 0;
            }

            View v0 = MainActivity.this.findViewById(2131427414);
            ((TextView)v0).setText("PING");
            if(MainActivity.this.tt == 0) {
                ((TextView)v0).setText("FLAG: BCTF{MagicNum" + Integer.toString(MainActivity.this.p) + "}");
            }
        }

        public void onClick(View arg7) {
            if(MainActivity.this.tt % 2 == 0) {
                MainActivity.this.p = 0;
                MainActivity.this.num = 0;
                MainActivity.this.tt = MainActivity.this.ttt;
            }

            --MainActivity.this.tt;
            MainActivity.this.p = MainActivity.this.pong(MainActivity.this.p, MainActivity.this.num);
            ++MainActivity.this.num;
            if(MainActivity.this.num >= 7) {
                MainActivity.this.num = 0;
            }

            View v0 = MainActivity.this.findViewById(2131427414);
            ((TextView)v0).setText("PONG");
            if(MainActivity.this.tt == 0) {
                ((TextView)v0).setText("FLAG: BCTF{MagicNum" + Integer.toString(MainActivity.this.p) + "}");
            }
        }

在C層會(huì)發(fā)現(xiàn)sleep(1) 暫停一秒, 如果直接調(diào)用點(diǎn)擊時(shí)間肯定不夠, 因此將sleep一秒patch掉, 可以改為 mov r1, r1.
之后自己寫一個(gè)包名和原程序相同的包, 依次調(diào)用ping 和pong 共計(jì)100萬次, 隨后輸出結(jié)果.

一個(gè)示例的調(diào)用程序?yàn)?

        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        int p = 0;
        int num = 0;

        p = pong(p, num);
        num ++;
        for(int tt = 1000000 - 1; tt != 0; --tt){
            if(tt % 2 == 0){
                p = ping(p,num);
                num ++;
                if(num >=7) num = 0;
            }else{
                p = pong(p, num);
                num ++;
                if(num >= 7) num = 0;
            }
        }
        //Log.e("yourdad", Integer.toString(p));
        ((TextView)findViewById(R.id.a)).setText(String.valueOf(p));