TSCTF 2021 Writeup by sakura

Android签到题re1.zip

可以看出是动态加载dex

网上查到该dex加载路径，用虚拟机找到该文件

关键加密函数

爆破解出

tmp1 = [ 147, 219, 146, 143, 240, 200, 'f', 136, 'F', 'y', 'O', 'M', 196, '>', 254, 189, 's', 253, 'W', '~', 252, 135, ' ', 128, 3, 226, 17, 142, 254, '?', '{', 155, '\r', 'x', 4, ':', 199, 223, 'B', 'z', 184, '~', 'L']
enflag = []
for i in range(len(tmp1)):
    if type(tmp1[i])==str: enflag.append(ord(tmp1[i]))
    else: enflag.append(tmp1[i])
def encode(flag):
    cArr = [183,232,151,64,46,200,155,10,44,138,221,76,147,99,163,226,137,102,236,39,216,35,238,55,222,78,234,164,211,179,184,122,24,241,157,48,153,49,186,15,75,62,152,37,1,243,106,38,119,86,112,140,107,167,9,4,118,150,199,182,156,117,79,2,170,228,63,214,28,133,253,123,12,237,154,89,61,127,189,5,130,105,30,190,93,7,206,145,172,176,247,3,111,134,66,169,26,204,174,173,27,36,50,72,71,103,42,65,29,168,92,131,143,53,19,18,240,171,148,175,159,0,60,11,43,165,17,51,244,248,224,121,77,13,215,210,205,166,81,85,229,162,54,197,201,45,194,144,97,80,96,231,68,239,32,52,25,83,242,67,198,124,90,230,132,225,185,110,98,135,8,47,219,203,142,59,227,195,146,233,58,115,113,116,178,217,252,213,95,202,223,188,20,22,69,250,208,23,57,218,84,245,136,91,180,181,56,187,220,41,40,120,114,160,34,101,108,141,177,149,251,212,94,87,191,14,125,192,255,88,139,249,82,193,21,74,73,126,235,207,158,109,254,31,129,104,70,246,196,100,6,128,209,161,16,33]    
    cArr3 = [0]*43
    i3 = 0;
    i4 = 0;
    str_len = 43
    for i5 in range(str_len):
        i3 = (i3 + 1) & 255
        i4 = (i4 + cArr[i3]) & 255
        cArr[i3] = cArr[i3] ^ cArr[i4]
        cArr[i4] = cArr[i4] ^ cArr[i3]
        cArr[i3] = cArr[i3] ^ cArr[i4]
        cArr3[i5] = cArr[(cArr[i3] + cArr[i4]) & 255] ^ flag[i5]
    return cArr3
def brute(i):
    global enflag
    flag = [0]*43
    for j in range(100):
        flag[i] = j+32
        if enflag[i] == encode(flag)[i]: 
            print(chr(flag[i]),end="")
for i in range(43):
    brute(i)
#TSCTF{44a526be-0f5c-4e99-88e6-3d7eac912391}

签到

关注公众号回复即可

问卷

填写问卷即可