【攻防世界】Moblie系列之app1

【攻防世界】Mobile系列之app1

使用jadx反汇编该app,查看MainActivity类，逻辑判断代码如下

public class MainActivity extends AppCompatActivity {
    Button btn;
    public final String pName = BuildConfig.APPLICATION_ID;
    EditText text;

    /* access modifiers changed from: protected */
    @Override // android.support.v4.app.BaseFragmentActivityGingerbread, android.support.v7.app.AppCompatActivity, android.support.v4.app.FragmentActivity
    public void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        this.btn = (Button) findViewById(R.id.checBtn);
        this.text = (EditText) findViewById(R.id.input);
        this.btn.setOnClickListener(new View.OnClickListener() {
            /* class com.example.yaphetshan.tencentgreat.MainActivity.AnonymousClass1 */

            public void onClick(View v) {
                try {
                    String inputString = MainActivity.this.text.getText().toString();
                    PackageInfo pinfo = MainActivity.this.getPackageManager().getPackageInfo(BuildConfig.APPLICATION_ID, 16384);
                    String versionCode = pinfo.versionName;
                    int versionName = pinfo.versionCode;
                    int i = 0;
                    while (i < inputString.length() && i < versionCode.length()) {
                        if (inputString.charAt(i) != (versionCode.charAt(i) ^ versionName)) {
                            Toast.makeText(MainActivity.this, "再接再厉，加油~", 1).show();
                            return;
                        }
                        i++;
                    }
                    if (inputString.length() == versionCode.length()) {
                        Toast.makeText(MainActivity.this, "恭喜开启闯关之门！", 1).show();
                        return;
                    }
                } catch (PackageManager.NameNotFoundException e) {
                }
                Toast.makeText(MainActivity.this, "年轻人不要耍小聪明噢", 1).show();
            }
        });
    }
}

上述代码中只要使得输入的字符串长度和versionCode.length()相等时，即弹窗成功。根据代码分析可推出versionCode字段对应的字符串保存在BuildConfig中

可以得出versionCode字符串为**”X<cP[?PHNB<P?aj”**，versionName为15

我们这里需要对字符串进行变化处理，可以看到代码中的一行判断语句

if (inputString.charAt(i) != (versionCode.charAt(i) ^ versionName))

这是对字符串和15进行了异或处理

代码逆向

versioncode = 15
versionName = 'X<cP[?PHNB<P?aj'
result = ''
for i in versionName:
    result +=chr( ord(i) ^ versioncode)
print(result)

得出结果为W3l_T0_GAM3_0ne

打赏