Android逆向题解攻防世界-easy-apk

Jeb反编译apk

题目比较简单，就是一个改了码表的base64编码。

    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        this.setContentView(0x7F04001B);  // layout:activity_main
        ((Button)this.findViewById(0x7F0B0076)).setOnClickListener(new View.OnClickListener() {  // id:button
            @Override  // android.view.View$OnClickListener
            public void onClick(View view) {
                String s = ((EditText)MainActivity.this.findViewById(0x7F0B0075)).getText().toString();  // id:editText
                if(new Base64New().Base64Encode(s.getBytes()).equals("5rFf7E2K6rqN7Hpiyush7E6S5fJg6rsi5NBf6NGT5rs=")) {
                    Toast.makeText(MainActivity.this, "验证通过!", 1).show();
                    return;
                }

                Toast.makeText(MainActivity.this, "验证失败!", 1).show();
            }
        });
    }
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

public class Base64New {
    private static final char[] Base64ByteToStr = null;
    private static final int RANGE = 0xFF;
    private static byte[] StrToBase64Byte;

    static {
        Base64New.Base64ByteToStr = new char[]{'v', 'w', 'x', 'r', 's', 't', 'u', 'o', 'p', 'q', '3', '4', '5', '6', '7', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'y', 'z', '0', '1', '2', 'P', 'Q', 'R', 'S', 'T', 'K', 'L', 'M', 'N', 'O', 'Z', 'a', 'b', 'c', 'd', 'U', 'V', 'W', 'X', 'Y', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', '8', '9', '+', '/'};
        Base64New.StrToBase64Byte = new byte[0x80];
    }

    public String Base64Encode(byte[] bytes) {
        StringBuilder res = new StringBuilder();
        for(int i = 0; i <= bytes.length - 1; i += 3) {
            byte[] enBytes = new byte[4];
            byte tmp = 0;
            for(int k = 0; k <= 2; ++k) {
                if(i + k <= bytes.length - 1) {
                    enBytes[k] = (byte)((bytes[i + k] & 0xFF) >>> k * 2 + 2 | tmp);
                    tmp = (byte)(((bytes[i + k] & 0xFF) << (2 - k) * 2 + 2 & 0xFF) >>> 2);
                }
                else {
                    enBytes[k] = tmp;
                    tmp = 0x40;
                }
            }

            enBytes[3] = tmp;
            for(int k = 0; k <= 3; ++k) {
                if(enBytes[k] <= 0x3F) {
                    res.append(Base64New.Base64ByteToStr[enBytes[k]]);
                }
                else {
                    res.append('=');
                }
            }
        }
        return res.toString();
    }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

解密

魔改码表与标准码表参照对比，将加密字符串还原成标准码表编码的字符串，再标准base64解码即可。

        String newBase64 = "vwxrstuopq34567ABCDEFGHIJyz012PQRSTKLMNOZabcdUVWXYefghijklmn89+/";
        String oldBase64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
        String target = "5rFf7E2K6rqN7Hpiyush7E6S5fJg6rsi5NBf6NGT5rs=";
        StringBuilder stringBuilder = new StringBuilder();
        for (int i = 0; i < target.length(); i++) {
            char ch = target.charAt(i);
            if (ch == '=') {
                stringBuilder.append('=');
                continue;
            }
            int index = newBase64.indexOf(ch);
            stringBuilder.append(oldBase64.charAt(index));
        }
        System.out.println(stringBuilder);
        System.out.println(new String(Base64.getDecoder().decode(stringBuilder.toString()), StandardCharsets.UTF_8));
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

运行结果：flag{05397c42f9b6da593a3644162d36eb01}