ƽ - LCG - LSG |׿ƽ||ƽܛ|ŷƱ  www.ykwek.com

 һܴa
 ע[Register]

QQ

ֻһ_ʼ

: ctf Ó ̳
1234567һ
б l
鿴: 8284|؏: 68
һ} һ}

欧国联赛程 : [Android ԭ] 2020t}㷨oB

  [朽]
Dָnj
ҹdzǡ l 2020-2-9 17:02
ҹdzǡ 2020-2-9 22:25 ݋

java

ŷƱ www.ykwek.com ȰapkϵJEBjavag߲鿴
image
ԿonClickcheckFlagnative

so

initЛ]гʼ
image
֪sodĕrinit_arrayMеĺjni_onloadԭȥ׿linkerԴa(Ϥ׿)
sub_4DF0
image
ʼһЩȫ׃͛]]ɶҕ

jni_onload
image
̖ܶȫ׃Ҷ
кsub_6A04ʼ̈́ҪõjһЩjava
image
@Щ̖Ҷˌ
䌍f@Щͽ@}PϵֻDŽ|׿˸㶮@Щ|

onclick
image
image
@ȡ˾݋ݔȻ{checkFlagC

checkFlag㷨Ȱ@ַ֞

thisiskey52pojie_2020_happy_chinese_new_year20200125

Âδaʾ

StringBuilder s1=new StringBuilder("thisiskey");
StringBuilder s2=new StringBuilder("52pojie_2020_happy_chinese_new_year");
StringBuilder s3=new StringBuilder("20200125");

image
image
Ȼs2s3Ӌһgַ
w㷨ѭh35ÿѭhȡһַӋܱ4͏s3ȡַǾs2ȡַ

for (int i=0;i<35;i++){
    if ((i%4==0)&&(i!=0)){
        int index=((i>>2)-1);
        System.out.println(i);
        char c=s3.charAt(index);
        tmp1.append(c);
    }else {
        tmp1.append(s2.charAt(i));
    }
}

õgַtmp1
image
image
image

Ӌtmp1md5ֵ,עDzѽDQ16Mַ32λַMD5ǽ^md5\õLȞ16byteMȻmd5ֹMs1ַȡõ16ֹĔMDQ32λ16MַTȡgڶλڶλַҲT[1:31]30λַݔַ^

Javaa

static void PrintHex(byte[] buff){
        System.out.print("char data[]={");
        for (int i=0;i<buff.length;i++){
            System.out.printf("0x%x,",buff[i]^0xFF);
        }
        System.out.print("}\n");
    }

    static void ctf(){
        StringBuilder s1=new StringBuilder("thisiskey");
        StringBuilder s2=new StringBuilder("52pojie_2020_happy_chinese_new_year");
        StringBuilder s3=new StringBuilder("20200125");
        StringBuilder tmp1=new StringBuilder();

        for (int i=0;i<35;i++){
            if ((i%4==0)&&(i!=0)){
                int index=((i>>2)-1);
                System.out.println(i);
                char c=s3.charAt(index);
                tmp1.append(c);
            }else {
                tmp1.append(s2.charAt(i));
            }
        }

        System.out.println(tmp1.toString());

        try {
            byte[] buff=tmp1.toString().getBytes();
            System.out.println(buff.length);
            MessageDigest md5=MessageDigest.getInstance("MD5");
            byte[] md5Bytes=md5.digest(buff);
            System.out.println(toHex(md5Bytes));
            byte[] s1_bytes=s1.toString().getBytes();
            for (int i=0;i<md5Bytes.length;i++){
                md5Bytes[i]^=s1_bytes[i%9];
            }
            PrintHex(md5Bytes);
            PrintHex(s1_bytes);
            System.out.println(toHex(md5Bytes));
            System.out.println(toHex(md5Bytes).substring(1,31));
        }catch (Exception se){
            se.printStackTrace();
        }
    }

@}java2C,Java߉݋ȫNDKF{ԇOȫԲʲô㷨һλӑBۙҲhookҲFı^@}^ĵط?ϧؼU]濵|Ի?XҲ]а׿_lh(еȥv)ȻԌxposed +VirtulXposedRoot㶨߀̫W׿hʲôv̫M

Mu

21ێ +21 ֵ +16
ꐷ܊ + 1 + 1 ĄDNܛȫߺęn
jFae + 1 + 1 @ʲô
Ño@ʾ + 1 + 1 ĄDNܛȫߺęn
jemmshy + 1 x[email protected]
sweetc + 1 + 1 Һٝͬ
kicchen + 1 Һٝͬ
֮ҹ + 1 + 1 Һٝͬ
HG/ww + 1 + 1 ӑՓ@
~2020 + 1 ӑՓ@
15035693367 + 1 + 1 x[email protected]
niyaLaoli + 1 + 1 x[email protected]
RSu52 + 1 x[email protected]
onething + 1 + 1 Ļ؏
ɽϵ + 1 x[email protected]
+ 1 xlԭƷƽՓ
pandada0 + 1 + 1 Һٝͬ
yixi + 1 + 1 x[email protected]
1006706246 + 2 + 1 Һٝͬ
Ů}r + 1 + 1 Һٝͬ
smile5 + 1 + 1 ӑՓ@
+ 1 + 1 ԭ@key߀Ҫ@\R㷨xx

鿴ȫu

lǰҪՓܕҪҵĴ𰸻ѽ˰l^ͬՈ؏Ͱl

؏

e

]
Hmily l 2020-2-10 20:15
@ҹdzǡ ҰlFĈD߀І}emdĴaչFDƬdiscuzֱcķʽչFDƬȻĈD^Εrg]˾ʧЧ㿴@ʽND//www.ykwek.com/misc.php? ... 29&messageid=36
]
 | ҹdzǡ l 2020-2-9 17:35 <
gunxsword l 2020-2-9 17:33
}]㶨,KEYҲ,Ҳ˺MD5P,g㷨],ӑB{ԇҲԇ,ǵһIDAӑB,Ҳ ...

ӑB{ԇԒԸۙ^ĵطֱhook equal
4#
Θ l 2020-2-9 17:26
ҲoB섂Û]k{ԇ^}ֻ{ԇ
5#
 | ҹdzǡ l 2020-2-9 17:28 <
Θ l 2020-2-9 17:26
ҲoB섂Û]k{ԇ^}ֻ{ԇ

}oBɶ{ԇO֛]&#128514;&#128514;yϸ
6#
ـؼ l 2020-2-9 17:29
x              
7#
gunxsword l 2020-2-9 17:33
}]㶨,KEYҲ,Ҳ˺MD5P,g㷨],ӑB{ԇҲԇ,ǵһIDAӑB,ҲǺܕ,Kʧ!
8#
Hmily l 2020-2-9 17:42
βׂDǶ
9#
 | ҹdzǡ l 2020-2-9 17:50 <

ǵrmdNDˎׂԇԇ˄h

cu

㾎݋h½ohe  Ԕ ؏ l 2020-2-9 18:16
10#
zs823455667 l 2020-2-9 17:57
xз^_^
11#
johnwen l 2020-2-9 18:02
xҲֻܞ
1234567һ
б l

eҎt 棺Kֹˮ؏c}oP`P

ٻ؏ ղ б

RSSӆ|С|“ϵ҂|ŷƱ ( ICP16042023̖ | W 11010502030087̖ )

GMT+8, 2020-4-7 01:52

Powered by Discuz!

Copyright © 2001-2020, Tencent Cloud.

ٻ؏ ŷƱ б