James Hoi's Blog

TSCTF 2021 Writeup by sakura

Word count: 520Reading time: 3 min
2021/05/23 Share

Android签到题re1.zip

可以看出是动态加载dex

网上查到该dex加载路径,用虚拟机找到该文件

关键加密函数

爆破解出

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
tmp1 = [ 147, 219, 146, 143, 240, 200, 'f', 136, 'F', 'y', 'O', 'M', 196, '>', 254, 189, 's', 253, 'W', '~', 252, 135, ' ', 128, 3, 226, 17, 142, 254, '?', '{', 155, '\r', 'x', 4, ':', 199, 223, 'B', 'z', 184, '~', 'L']
enflag = []
for i in range(len(tmp1)):
if type(tmp1[i])==str: enflag.append(ord(tmp1[i]))
else: enflag.append(tmp1[i])

def encode(flag):
cArr = [183,232,151,64,46,200,155,10,44,138,221,76,147,99,163,226,137,102,236,39,216,35,238,55,222,78,234,164,211,179,184,122,24,241,157,48,153,49,186,15,75,62,152,37,1,243,106,38,119,86,112,140,107,167,9,4,118,150,199,182,156,117,79,2,170,228,63,214,28,133,253,123,12,237,154,89,61,127,189,5,130,105,30,190,93,7,206,145,172,176,247,3,111,134,66,169,26,204,174,173,27,36,50,72,71,103,42,65,29,168,92,131,143,53,19,18,240,171,148,175,159,0,60,11,43,165,17,51,244,248,224,121,77,13,215,210,205,166,81,85,229,162,54,197,201,45,194,144,97,80,96,231,68,239,32,52,25,83,242,67,198,124,90,230,132,225,185,110,98,135,8,47,219,203,142,59,227,195,146,233,58,115,113,116,178,217,252,213,95,202,223,188,20,22,69,250,208,23,57,218,84,245,136,91,180,181,56,187,220,41,40,120,114,160,34,101,108,141,177,149,251,212,94,87,191,14,125,192,255,88,139,249,82,193,21,74,73,126,235,207,158,109,254,31,129,104,70,246,196,100,6,128,209,161,16,33]
cArr3 = [0]*43
i3 = 0;
i4 = 0;
str_len = 43
for i5 in range(str_len):
i3 = (i3 + 1) & 255
i4 = (i4 + cArr[i3]) & 255
cArr[i3] = cArr[i3] ^ cArr[i4]
cArr[i4] = cArr[i4] ^ cArr[i3]
cArr[i3] = cArr[i3] ^ cArr[i4]
cArr3[i5] = cArr[(cArr[i3] + cArr[i4]) & 255] ^ flag[i5]
return cArr3

def brute(i):
global enflag
flag = [0]*43
for j in range(100):
flag[i] = j+32
if enflag[i] == encode(flag)[i]:
print(chr(flag[i]),end="")


for i in range(43):
brute(i)
#TSCTF{44a526be-0f5c-4e99-88e6-3d7eac912391}

签到

关注公众号回复即可

问卷

填写问卷即可

CATALOG
  1. 1. Android签到题re1.zip
  2. 2. 签到
  3. 3. 问卷