513 words
3 minutes
SummerFan

Summer Fan#

題目

여름은 갔지만,, 열이올라요… 더울 때 이걸 사용해줘! :fan:

跟之前一樣先把 apk 拆開再說

Terminal window
apktool d SUMMER_FAN.apk

找了一圈沒有找到 flag,查一下對於 android 逆向大神都是怎麼做的

文章連結:Android App 逆向入門之一:拆開與重組 apk開源項目精選: 手把手教你如何用 JADX 反編譯 APK

先查看 AndroidManifest.xml

<?xml version="1.0" encoding="utf-8" standalone="no"?><manifest xmlns:android="http://schemas.android.com/apk/res/android" android:compileSdkVersion="32" android:compileSdkVersionCodename="12" package="com.example.summer" platformBuildVersionCode="32" platformBuildVersionName="12">
<application android:allowBackup="true" android:appComponentFactory="androidx.core.app.CoreComponentFactory" android:dataExtractionRules="@xml/data_extraction_rules" android:fullBackupContent="@xml/backup_rules" android:icon="@mipmap/ic_main" android:label="@string/app_name" android:roundIcon="@mipmap/ic_main_round" android:supportsRtl="true" android:theme="@style/Theme.SUMMER">
<activity android:exported="true" android:name="com.example.summer.MainActivity">
<intent-filter>
<action android:name="android.intent.action.MAIN"/>
<category android:name="android.intent.category.LAUNCHER"/>
</intent-filter>
</activity>
<service android:name="com.example.summer.TimerService"/>
</application>
</manifest>

pakagename 是 com.example.summer ,有一個 activity com.example.summer.MainActivity

下載 JADX

jadx

SUMMER_FAN\smali\com\example\summer\MainActivity.smali 找到

private final void checkTime(Intent intent) {
Toast.makeText(this, (((int) intent.getDoubleExtra(TimerService.TIME_EXTRA, 0.0d)) % 86400) / 3600 >= 31337 ? generateFlag() : "플래그를 주기엔 아직 너무 더운걸...", 0).show();
}
private final String generateFlag() {
ArrayList arrayList = new ArrayList();
int size = MainActivityKt.getFLAG().size();
for (int i = 0; i < size; i++) {
arrayList.add(Character.valueOf((char) ((MainActivityKt.getFLAG().get(i).intValue() ^ StringsKt.first(MainActivityKt.getKEY().get(i % MainActivityKt.getKEY().size()))) - gen(i))));
}
return CollectionsKt.joinToString$default(arrayList, "", null, null, 0, null, null, 62, null);
}

把這些跟 generateFlag 有關的函式跟變數拿出來寫成.java

import java.util.ArrayList;
import java.util.List;
import java.util.Arrays;
public class Main {
private static final List<Integer> FLAG = Arrays.asList(
220, 211, 180, 230, 192, 22, 341, 220, 227, 341,
139, 163, 355, 293, 333, 196, 142, 216, 376, 133,
248, 26, 342, 378, 231, 149, 145, 173, 185, 1, 10, 198
);
private static final List<String> KEY = Arrays.asList(
"h", "o", "t", "_", "h", "o", "t", "_", "s", "u",
"m", "m", "m", "e", "r", "r"
);
public static void main(String[] args) {
Main main = new Main();
String flag = main.generateFlag();
System.out.println("FLAG: " + flag);
}
private String generateFlag() {
ArrayList<Character> arrayList = new ArrayList<>();
int size = FLAG.size();
int keySize = KEY.size();
for (int i = 0; i < size; i++) {
char decodedChar = (char) ((FLAG.get(i) ^ KEY.get(i % keySize).charAt(0)) - gen(i));
arrayList.add(decodedChar);
}
return joinToString(arrayList);
}
private int gen(int i) {
int size = KEY.size();
return (((int) Math.pow(i, 3.0)) % 256) ^ KEY.get(size - ((i % size) + 1)).charAt(0);
}
private String joinToString(List<Character> list) {
StringBuilder sb = new StringBuilder();
for (Character ch : list) {
sb.append(ch);
}
return sb.toString();
}
}

執行之後就拿到 flag 了

flag

BISC{it_1s_so_hott_4c5515c5553a}

中間試過很多起模擬器用 Frida 之類的,都弄不起來,耗了不少時間
三個小時的 challenge 完成的時候只剩下八分鐘
滿喜歡 Dreamhack 的 Blitz CTF 的,有點像 CTF 版的 Leetcode 每日
下次繼續 ( • ̀ω•́ )