茶余饭后-newstarCTF2023 week4|REVERSE--简单的跨 writeup
推荐 原创题目为安卓apk，安装到模拟器或真机发现无输入点。
使用jadx-gui进行静态分析，定位关键代码：
encrypt（）是java编写,RC4加密，key为“runrunrun"。
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
|
public void mbox(Integer[] numArr, String
str
) {
for
(
int
i
=
0
; i <
256
; i
+
+
) {
numArr[i]
=
Integer.valueOf(i);
}
int
i2
=
0
;
for
(
int
i3
=
0
; i3 <
256
; i3
+
+
) {
i2
=
((i2
+
numArr[i3].intValue())
+
str
.charAt(i3
%
str
.length()))
%
256
;
change(numArr, i3, i2);
}
}
public void genenc(Integer[] numArr, Character[] chArr,
int
i) {
int
i2
=
0
;
int
i3
=
0
;
for
(
int
i4
=
0
; i4 < i; i4
+
+
) {
i2
=
(i2
+
1
)
%
256
;
i3
=
(i3
+
numArr[i2].intValue())
%
256
;
change(numArr, i2, i3);
chArr[i4]
=
Character.valueOf((char) numArr[(numArr[i2].intValue()
+
numArr[i3].intValue())
%
256
].intValue());
}
}
public void change(Integer[] numArr,
int
i,
int
i2) {
Integer num
=
numArr[i];
numArr[i]
=
numArr[i2];
numArr[i2]
=
num;
}
public String encrypt(String
str
, String str2) {
Integer[] numArr
=
new Integer[
256
];
Character[] chArr
=
new Character[
str
.length()];
StringBuffer stringBuffer
=
new StringBuffer();
mbox(numArr, str2);
genenc(numArr, chArr,
str
.length());
for
(
int
i
=
0
; i <
str
.length(); i
+
+
) {
stringBuffer.append((char) (
str
.charAt(i) ^ chArr[i].charValue()));
}
return
stringBuffer.toString();
}
|
encode（）是native函数，将lib中的libantidbg.so提取，使用ida分析，发现为base64(置换了字典表)编码，再和目标串“Jr0VJ81KJD1PJpY2WytxgeAnJWu2H1qutyA0xFtyJrZHJrZeJrM8ATCWJWft9FtgJsV2SCtR4yASJrE2Uv=="”比较：
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
|
__int64 __fastcall xxx(__int64 a1, __int64 a2, __int64 a3)
{
unsigned __int8
*
v5;
/
/
x21
int
v6;
/
/
w0
const char
*
v7;
/
/
x0
const char
*
v8;
/
/
x1
v5
=
(unsigned __int8
*
)(
*
(__int64 (__fastcall
*
*
)(__int64, __int64, _QWORD))(
*
(_QWORD
*
)a1
+
1352LL
))(a1, a3,
0LL
);
v6
=
(
*
(__int64 (__fastcall
*
*
)(__int64, __int64))(
*
(_QWORD
*
)a1
+
1344LL
))(a1, a3);
v7
=
(const char
*
)b64(v5, v6);
if
( !strcmp(v7,
"Jr0VJ81KJD1PJpY2WytxgeAnJWu2H1qutyA0xFtyJrZHJrZeJrM8ATCWJWft9FtgJsV2SCtR4yASJrE2Uv=="
) )
v8
=
"you win"
;
else
v8
=
"you lost"
;
return
(
*
(__int64 (__fastcall
*
*
)(__int64, const char
*
))(
*
(_QWORD
*
)a1
+
1336LL
))(a1, v8);
}
|
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
|
import
base64
def
mbox(numArr,
str
):
for
i
in
range
(
256
):
numArr[i]
=
i
# print([hex(x) for x in numArr])
i2
=
0
for
i3
in
range
(
256
):
i2
=
((i2
+
numArr[i3])
+
ord
(
str
[i3
%
len
(
str
)]))
%
256
# print(hex(i2))
numArr[i3],numArr[i2]
=
numArr[i2],numArr[i3]
return
numArr
def
genenc(numArr,chArr,i):
i2
=
i3
=
0
for
i4
in
range
(i):
i2
=
(i2
+
1
)
%
256
i3
=
(i3
+
numArr[i2])
%
256
;
numArr[i3],numArr[i2]
=
numArr[i2],numArr[i3]
chArr[i4]
=
numArr[(numArr[i2]
+
numArr[i3])
%
256
]
# print(chArr[i4])
return
chArr
def
encrypt(
str
,str2):
numArr
=
[
0
]
*
256
chArr
=
[
0
]
*
(
len
(
str
))
mbox(numArr,str2)
genenc(numArr, chArr,
len
(
str
))
result
=
[]
for
i
in
range
(
len
(
str
)):
result.append(
ord
(
str
[i])^chArr[i]);
return
result
def
b64():
raw_table
=
'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
new_table
=
'0123456789ABCMtuvwxNOPQRabcdefghijklSTUVWXDEFGHIJKLYZmnopqrsyz+/'
dictionary_decode
=
str
.maketrans(new_table, raw_table)
# 创建字符映射关系 用于base64decode
# print(dictionary_decode)
cipher
=
'Jr0VJ81KJD1PJpY2WytxgeAnJWu2H1qutyA0xFtyJrZHJrZeJrM8ATCWJWft9FtgJsV2SCtR4yASJrE2Uv=='
return
(base64.b64decode(cipher.translate(dictionary_decode)))
enc
=
b64()
#print(enc)
enc
=
enc.replace(b
'\xc0\x80'
,b
'\x00'
)
#print(enc)
print
(''.join([
chr
(x)
for
x
in
encrypt(enc.decode(),
"runrunrun"
)]))
#flag{DED3D3DED3DE03DEBUG1sfunnyr1gh7??}
|
更多【茶余饭后-newstarCTF2023 week4|REVERSE--简单的跨 writeup】相关视频教程：www.yxfzedu.com
相关文章推荐
- [驱动出租]-无痕注入 - 游戏逆向 软件逆向 Windows内核 驱动出租
- CE图标工具 - 游戏逆向 软件逆向 Windows内核 驱动出租
- 驱动出租及驱动定制价格 - 游戏逆向 软件逆向 Windows内核 驱动出租
- 二进制漏洞-初探内核漏洞：HEVD学习笔记——TypeConfusion - Pwn HarmonyOS Web安全 软件逆向
- 二进制漏洞-初探内核漏洞：HEVD学习笔记——IntegerOverflow - Pwn HarmonyOS Web安全 软件逆向
- 软件逆向-LMCompatibilityLevel 安全隐患 - Pwn HarmonyOS Web安全 软件逆向
- Android安全-记一次完整的Android native层动态调试--使用avd虚拟机 - Pwn HarmonyOS Web安全 软件逆向
- 二进制漏洞-零基础入门V8——CVE-2021-38001漏洞利用 - Pwn HarmonyOS Web安全 软件逆向
- 二进制漏洞-初探内核漏洞：HEVD学习笔记——UAF - Pwn HarmonyOS Web安全 软件逆向
- Pwn-glibc高版本堆题攻击之safe unlink - Pwn HarmonyOS Web安全 软件逆向
- 二进制漏洞-CVE-2020-1054提权漏洞学习笔记 - Pwn HarmonyOS Web安全 软件逆向
- 二进制漏洞-初探内核漏洞：HEVD学习笔记——BufferOverflowNonPagedPool - Pwn HarmonyOS Web安全 软件逆向
- CTF对抗-2022DASCTF Apr X FATE 防疫挑战赛-Reverse-奇怪的交易 - Pwn HarmonyOS Web安全 软件逆向
- 编程技术-一个规避安装包在当前目录下被DLL劫持的想法 - Pwn HarmonyOS Web安全 软件逆向
- CTF对抗-sql注入学习笔记 - Pwn HarmonyOS Web安全 软件逆向
- Pwn-DamCTF and Midnight Sun CTF Qualifiers pwn部分wp - Pwn HarmonyOS Web安全 软件逆向
- 软件逆向-OLLVM-deflat 脚本学习 - Pwn HarmonyOS Web安全 软件逆向
- 软件逆向-3CX供应链攻击样本分析 - Pwn HarmonyOS Web安全 软件逆向
- Android安全-某艺TV版 apk 破解去广告及源码分析 - Pwn HarmonyOS Web安全 软件逆向
- Pwn-Hack-A-Sat 4 Qualifiers pwn部分wp - Pwn HarmonyOS Web安全 软件逆向
记录自己的技术轨迹
文章规则：
1)：文章标题请尽量与文章内容相符
2)：严禁色情、血腥、暴力
3)：严禁发布任何形式的广告贴
4)：严禁发表关于中国的政治类话题
5)：严格遵守中国互联网法律法规
6)：有侵权,疑问可发邮件至service@yxfzedu.com
近期原创 更多
