CTF came(android 版）

短命女 2021-09-20 07:58 132阅读 0赞

放到模拟器上运行是一个验证框  
![CTF came(android 版）][CTF came_android]  
用工具反编译看看 有一个检查函数  
![CTF came(android 版）][CTF came_android 1]  
找在那个函数

![CTF came(android 版）][CTF came_android 2]  
大概知道算法  
1.它先去获取 key  
2.然创建一个数组  
3.然后计算  
要注意的是它有俩个 getkey()函数  
![CTF came(android 版）][CTF came_android 3]  
看看反编译的源码发现读不通其中就有：  
![CTF came(android 版）][CTF came_android 4]  
可能是工具的问题 换个就清析了  
![CTF came(android 版）][CTF came_android 5]  
找到关键点 他是把密码一个个字符计算

if ((iArr[i] & 255) != ((str.charAt(i) ^ str2.charAt(i % str2.length())) & 255)) {
    //                throw new RuntimeException();
    //            }

那好办我就暴力求解(当前类中的key 是错的)

key :   bobdylan
    密码：blow,in the winD

![CTF came(android 版）][CTF came_android 6]  
源码

public class allen {
        //正确 key
        public static  String getKey() {
            return "bobdylan";
        }
        public static void  main(String[] args){
    
            check("allen");
           // System.out.println("allenboy");
        }
        public static void check(String str) {
            int i = 0;
            if (str.length() != 16) {
                //throw new RuntimeException();
            }
            String str2 = "";
            try {
                str2 = getKey();
            } catch (Exception e) {
                System.out.println("allenboy");
                str2 = getKey();
                System.arraycopy(str2, 0, str, 5, 5);
            }
            int[] iArr = new int[16];
            iArr[0] = 0;
            iArr[12] = 14;
            iArr[10] = 7;
            iArr[14] = 15;
            iArr[15] = 42;
            try {
                iArr[1] = 3;
                iArr[5] = 5;
                System.out.println();
            } catch (Exception e2) {
                iArr[5] = 37;
                iArr[1] = 85;
            }
            iArr[6] = 15;
            iArr[2] = 13;
            iArr[3] = 19;
            iArr[11] = 68;
            iArr[4] = 85;
            iArr[13] = 5;
            iArr[9] = 7;
            iArr[7] = 78;
            iArr[8] = 22;
            System.out.println(str2);
            while (i < 16) {  //str为参数     str2为 key
                for(int j=0;j<128;j++){
                    char c=(char)j;
                    if ((iArr[i] & 255) == ((c^ str2.charAt(i % str2.length())) & 255)) {
                       System.out.print(c);
                    }
                }
                i++;
            }
        }
    
    }
    
    //    public void check(String str) {
    //        int i = 0;
    //        if (str.length() != 16) {
    //            throw new RuntimeException();
    //        }
    //        String str2 = "";
    //        try {
    //            str2 = getKey();
    //        } catch (Exception e) {
    //            str2 = getKey();
    //            System.arraycopy(str2, 0, str, 5, 5);
    //        }
    //        int[] iArr = new int[16];
    //        iArr[0] = 0;
    //        iArr[12] = 14;
    //        iArr[10] = 7;
    //        iArr[14] = 15;
    //        iArr[15] = 42;
    //        try {
    //            iArr[1] = 3;
    //            iArr[5] = 5;
    //            System.out.println();
    //        } catch (Exception e2) {
    //            iArr[5] = 37;
    //            iArr[1] = 85;
    //        }
    //        iArr[6] = 15;
    //        iArr[2] = 13;
    //        iArr[3] = 19;
    //        iArr[11] = 68;
    //        iArr[4] = 85;
    //        iArr[13] = 5;
    //        iArr[9] = 7;
    //        iArr[7] = 78;
    //        iArr[8] = 22;
    //        while (i < str.length()) {
    //            if ((iArr[i] & 255) != ((str.charAt(i) ^ str2.charAt(i % str2.length())) & 255)) {
    //                throw new RuntimeException();
    //            }
    //            i++;
    //        }
    //    }
    //
    //    public String getKey() {
    //        return "bobbydylan";
    //    }

转载于:https://blog.51cto.com/haidragon/2136366

[CTF came_android]: https://s1.51cto.com/images/blog/201807/05/2bf7b2e30626529d936f91490910d128.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[CTF came_android 1]: https://s1.51cto.com/images/blog/201807/05/59ec411c72688a293b414b92491dbc30.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[CTF came_android 2]: https://s1.51cto.com/images/blog/201807/05/a001e657523b324d936b333bd4ceac93.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[CTF came_android 3]: https://s1.51cto.com/images/blog/201807/05/4392dd5e16c3dc90046f026baff1bd00.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[CTF came_android 4]: https://s1.51cto.com/images/blog/201807/05/5ee40309ada1c812b478dd84b99ba5d9.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[CTF came_android 5]: https://s1.51cto.com/images/blog/201807/05/9e5f810d6ef833768bcbddbbdc697fda.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[CTF came_android 6]: https://s1.51cto.com/images/blog/201807/05/842bba0ee42783e80058b108a0f61659.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=