吾爱破解2023春节解题领红包 WriteUp
【2023春节】解题领红包之二.exe
lst = [408, 432, 388, 412, 492, 212, 200, 320, 444, 296, 420, 404, 200, 192, 200, 204, 288, 388, 448, 448, 484, 312, 404, 476, 356, 404, 388, 456, 500]
print(''.join(chr(x >> 2) for x in lst))
【2023春节】解题领红包之三.apk
方式1.jeb直接打开得到 flag
方式2. 分析代码
key.setText(this$0.decrypt("hnci}|jwfclkczkppkcpmwckng\u007f", 2));
public final String decrypt(String encryptTxt, int i) {
for (char c : charArray) {
sb.append((char) (c - i));
}
}
ar = "hnci}|jwfclkczkppkcpmwckng\x7f"
print(''.join(chr(ord(x) - 2) for x in ar))
# flag{zhudajiaxinniankuaile}
下面这个写法省事一点
bytearray([i - 2 for i in b"hnci}|jwfclkczkppkcpmwckng\x7f"])
【2023春节】解题领红包之四.apk
关键函数
package com.zj.wuaipojie2023_1;
/* loaded from: classes.dex */
public class B {
public static String encode(String str) {
int length = str.length();
char[] cArr = new char[length];
int i = length - 1;
while (i >= 0) {
int i2 = i - 1;
cArr[i] = (char) (str.charAt(i) ^ '5');
if (i2 < 0) {
break;
}
i = i2 - 1;
cArr[i2] = (char) (str.charAt(i2) ^ '2');
}
return new String(cArr);
}
}
public final boolean B(String str, String str2) {
Intrinsics.checkNotNullParameter(str, "str");
Intrinsics.checkNotNullParameter(str2, "str2");
if (!(str.length() == 0 && str2.length() == 0) && StringsKt.startsWith$default(str2, "flag{", false, 2, (Object) null) && StringsKt.endsWith$default(str2, "}", false, 2, (Object) null)) {
String substring = str2.substring(5, str2.length() - 1);
Intrinsics.checkNotNullExpressionValue(substring, "this as java.lang.String…ing(startIndex, endIndex)");
C c = C.INSTANCE;
MD5Utils mD5Utils = MD5Utils.INSTANCE;
Base64Utils base64Utils = Base64Utils.INSTANCE;
String encode = B.encode(str + "Wuaipojie2023");
Intrinsics.checkNotNullExpressionValue(encode, "encode(str3)");
byte[] bytes = encode.getBytes(Charsets.UTF_8);
Intrinsics.checkNotNullExpressionValue(bytes, "this as java.lang.String).getBytes(charset)");
return Intrinsics.areEqual(substring, c.cipher(mD5Utils.MD5(base64Utils.encodeToString(bytes)), 5));
}
return false;
}
直接扒出来存成Go.java
public class Go {
public static String encode(String str) {
int length = str.length();
char[] cArr = new char[length];
int i = length - 1;
while (i >= 0) {
int i2 = i - 1;
cArr[i] = (char) (str.charAt(i) ^ '5');
if (i2 < 0) {
break;
}
i = i2 - 1;
cArr[i2] = (char) (str.charAt(i2) ^ '2');
}
return new String(cArr);
}
public static void main(String[] args) {
System.out.println(Go.encode(args[0]));
}
}
// javac Go.java
// 使用 java Go some_str
import subprocess
from base64 import b64encode
import hashlib
uid = "176017"
payload = uid + "Wuaipojie2023"
encode = subprocess.getoutput(f'java Go {payload}')
flag = b64encode(encode.encode())
result = hashlib.md5(flag).hexdigest()
print(result)
# "4k65807686gg2k149h4k338211hi8643"
【2023春节】解题领红包之六
jadx打开 apk。
private final void Check_Volume(double d) {
...
write_img(); // 操作了 "aes.png"
}
解压找到 aes.png 和so文件, ida加载后有 3个函数
encrypt
decrypt
get_RealKey