标签：etc [] zip 结果 flag dba com print view
下载apk，先安装一下试试吧……
猜测是输入正确的内容后给flag吧
将后缀改成zip，解压，用dex2jar处理classes.dex，然后用jd-gui打开，可以看到，该apk中只有一个FlagActivity，一部分一部分来看
protected void onCreate(Bundle paramBundle) { super.onCreate(paramBundle); setContentView(2130968602); this.n = ((TextView)findViewById(2131427413)); this.o = ((TextView)findViewById(2131427415)); }
onCreate()等同于什么都没做
public void onClickTest(View paramView) { if (this.n.getText().toString().equals(i())) { this.o.setText(2131099685); return; } this.o.setText(2131099683); }
onClickTest()函数的功能非常简单：n指代的应该是输入框 ，o指代的应该是结果提示框，那么这个函数做的事情就是把输入的内容和i()函数的返回值比对，那大概是一样才行吧
所以最后我们来看这个i()函数
private static final byte[] p = { -40, -62, 107, 66, -126, 103, -56, 77, 122, -107, -24, -127, 72, -63, -98, 64, -24, -5, -49, -26, 79, -70, -26, -81, 120, 25, 111, -100, -23, -9, 122, -35, 66, -50, -116, 3, -72, 102, -45, -85, 0, 126, -34, 62, 83, -34, 48, -111, 61, -9, -51, 114, 20, 81, -126, -18, 27, -115, -76, -116, -48, -118, -10, -102, -106, 113, -104, 98, -109, 74, 48, 47, -100, -88, 121, 22, -63, -32, -20, -41, -27, -20, -118, 100, -76, 70, -49, -39, -27, -106, -13, -108, 115, -87, -1, -22, -53, 21, -100, 124, -95, -40, 62, -69, 29, 56, -53, 85, -48, 25, 37, -78, 11, -110, -24, -120, -82, 6, -94, -101 }; private static final byte[] q = { -57, -90, 53, -71, -117, 98, 62, 98, 101, -96, 36, 110, 77, -83, -121, 2, -48, 94, -106, -56, -49, -80, -1, 83, 75, 66, -44, 74, 2, -36, -42, -103, 6, -115, -40, 69, -107, 85, -78, -49, 54, 78, -26, 15, 98, -70, 8, -90, 94, -61, -84, 64, 112, 51, -29, -34, 126, -21, -126, -71, -31, -24, -60, -2, -81, 66, -84, 85, -91, 10, 84, 70, -8, -63, 26, 126, -76, -104, -123, -71, -126, -62, -23, 11, -39, 70, 14, 59, -101, -39, -124, 91, -109, 102, -49, 21, 105, 0, 37, -128, -57, 117, 110, -115, -86, 56, 25, -46, -55, 7, -125, 109, 76, 104, -15, 82, -53, 18, -28, -24 }; private String i() { int j = 0; byte[] arrayOfByte1 = new byte[p.length]; int i = 0; while (i < arrayOfByte1.length) { arrayOfByte1[i] = ((byte)(p[i] ^ q[i])); i += 1; } int k = arrayOfByte1[0]; i = 0; while (arrayOfByte1[(k + i)] != 0) i += 1; byte[] arrayOfByte2 = new byte[i]; while (j < i) { arrayOfByte2[j] = arrayOfByte1[(k + j)]; j += 1; } return new String(arrayOfByte2); }
可以看到这个函数不要输入，且输出结果固定…………好的果然是AndroidEasy…………写个Java跑一下i()函数的结果就可以了…………
1 public class DDCTF_EASY { 2 private static final byte[] p = { -40, -62, 107, 66, -126, 103, -56, 77, 122, -107, -24, -127, 72, -63, -98, 64, -24, -5, -49, -26, 79, -70, -26, -81, 120, 25, 111, -100, -23, -9, 122, -35, 66, -50, -116, 3, -72, 102, -45, -85, 0, 126, -34, 62, 83, -34, 48, -111, 61, -9, -51, 114, 20, 81, -126, -18, 27, -115, -76, -116, -48, -118, -10, -102, -106, 113, -104, 98, -109, 74, 48, 47, -100, -88, 121, 22, -63, -32, -20, -41, -27, -20, -118, 100, -76, 70, -49, -39, -27, -106, -13, -108, 115, -87, -1, -22, -53, 21, -100, 124, -95, -40, 62, -69, 29, 56, -53, 85, -48, 25, 37, -78, 11, -110, -24, -120, -82, 6, -94, -101 }; 3 private static final byte[] q = { -57, -90, 53, -71, -117, 98, 62, 98, 101, -96, 36, 110, 77, -83, -121, 2, -48, 94, -106, -56, -49, -80, -1, 83, 75, 66, -44, 74, 2, -36, -42, -103, 6, -115, -40, 69, -107, 85, -78, -49, 54, 78, -26, 15, 98, -70, 8, -90, 94, -61, -84, 64, 112, 51, -29, -34, 126, -21, -126, -71, -31, -24, -60, -2, -81, 66, -84, 85, -91, 10, 84, 70, -8, -63, 26, 126, -76, -104, -123, -71, -126, -62, -23, 11, -39, 70, 14, 59, -101, -39, -124, 91, -109, 102, -49, 21, 105, 0, 37, -128, -57, 117, 110, -115, -86, 56, 25, -46, -55, 7, -125, 109, 76, 104, -15, 82, -53, 18, -28, -24 }; 4 5 private String i() 6 { 7 int j = 0; 8 byte[] arrayOfByte1 = new byte[p.length]; 9 int i = 0; 10 while (i < arrayOfByte1.length) 11 { 12 arrayOfByte1[i] = ((byte)(p[i] ^ q[i])); 13 i += 1; 14 } 15 int k = arrayOfByte1[0]; 16 i = 0; 17 while (arrayOfByte1[(k + i)] != 0) 18 i += 1; 19 byte[] arrayOfByte2 = new byte[i]; 20 while (j < i) 21 { 22 arrayOfByte2[j] = arrayOfByte1[(k + j)]; 23 j += 1; 24 } 25 return new String(arrayOfByte2); 26 } 27 28 29 public static void main(String args[]) { 30 DDCTF_EASY t = new DDCTF_EASY(); 31 System.out.println(t.i()); 32 } 33 }
输出结果（即为本题flag）：DDCTF-3ad60811d87c4a2dba0ef651b2d93476@didichuxing.com
标签：etc [] zip 结果 flag dba com print view
原文地址：https://www.cnblogs.com/Briddle-ch/p/10344416.html
