鹤城杯 2021designEachStep

runwu2204 Lv6

只有一个activity组件

1
2
3
4
5
6
7
8
9
10
11
12
<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android" android:versionCode="1" android:versionName="1.0" android:compileSdkVersion="30" android:compileSdkVersionCodename="11" package="com.test.designeachstep" platformBuildVersionCode="30" platformBuildVersionName="11">
<uses-sdk android:minSdkVersion="21" android:targetSdkVersion="30"/>
<application android:theme="@style/Theme.DesignEachStep" android:label="@string/app_name" android:icon="@mipmap/ic_launcher" android:allowBackup="true" android:supportsRtl="true" android:roundIcon="@mipmap/ic_launcher_round" android:appComponentFactory="androidx.core.app.CoreComponentFactory">
<activity android:name="com.test.designeachstep.MainActivity">
<intent-filter>
<action android:name="android.intent.action.MAIN"/>
<category android:name="android.intent.category.LAUNCHER"/>
</intent-filter>
</activity>
</application>
</manifest>

有一个按钮触发事件(非常长)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
public class View$OnClickListenerC1003a implements View.OnClickListener {
public View$OnClickListenerC1003a() {
}

/* JADX WARN: Removed duplicated region for block: B:34:0x00af */
/* JADX WARN: Removed duplicated region for block: B:36:0x00bb */
/* JADX WARN: Removed duplicated region for block: B:76:0x0143 */
/* JADX WARN: Removed duplicated region for block: B:78:0x014f */
@Override // android.view.View.OnClickListener
/*
Code decompiled incorrectly, please refer to instructions dump.
*/
public void onClick(View view) {
byte[] bArr;
byte[] bArr2;
byte[] byteArray;
byte[] bArr3;
byte[] byteArray2;
String obj = MainActivity.this.f3918o.getText().toString();
if (obj.length() != 24) {
Toast.makeText(MainActivity.this, "Nono, try again please", 0).show();
return;
}
byte[] bytes = obj.getBytes();
byte[] bArr4 = new byte[8];
try {
DataInputStream dataInputStream = new DataInputStream(MainActivity.this.getAssets().open("data.bin"));
byte[] bArr5 = new byte[dataInputStream.available()];
dataInputStream.readFully(bArr5);
System.arraycopy(bytes, 0, bArr4, 0, 8);
ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
byte[] bArr6 = null;
try {
GZIPInputStream gZIPInputStream = new GZIPInputStream(new ByteArrayInputStream(bArr5));
byte[] bArr7 = new byte[256];
while (true) {
int read = gZIPInputStream.read(bArr7);
if (read < 0) {
break;
}
byteArrayOutputStream.write(bArr7, 0, read);
}
byteArray2 = byteArrayOutputStream.toByteArray();
} catch (IOException unused) {
}
if (byteArray2.length >= 8) {
byte[] bArr8 = new byte[8];
System.arraycopy(byteArray2, 0, bArr8, 0, 8);
byte[] bArr9 = new byte[byteArray2.length - 8];
System.arraycopy(byteArray2, 8, bArr9, 0, byteArray2.length - 8);
if (Arrays.equals(bArr8, bArr4)) {
try {
Cipher cipher = Cipher.getInstance("DES");
cipher.init(2, C0766a.m422j(bArr4));
bArr = cipher.doFinal(bArr9);
} catch (InvalidKeyException e) {
e.printStackTrace();
} catch (NoSuchAlgorithmException e2) {
e2.printStackTrace();
} catch (BadPaddingException e3) {
e3.printStackTrace();
} catch (IllegalBlockSizeException e4) {
e4.printStackTrace();
} catch (NoSuchPaddingException e5) {
e5.printStackTrace();
}
if (bArr != null) {
Toast.makeText(MainActivity.this, "The first step incorrect, try again please", 0).show();
return;
}
System.arraycopy(bytes, 8, bArr4, 0, 8);
Inflater inflater = new Inflater();
inflater.setInput(bArr);
ByteArrayOutputStream byteArrayOutputStream2 = new ByteArrayOutputStream(bArr.length);
try {
try {
byte[] bArr10 = new byte[1024];
while (!inflater.finished()) {
byteArrayOutputStream2.write(bArr10, 0, inflater.inflate(bArr10));
}
try {
byteArrayOutputStream2.close();
} catch (IOException e6) {
e6.printStackTrace();
}
inflater.end();
byteArray = byteArrayOutputStream2.toByteArray();
} catch (Throwable th) {
try {
byteArrayOutputStream2.close();
} catch (IOException e7) {
e7.printStackTrace();
}
throw th;
}
} catch (Exception e8) {
e8.printStackTrace();
try {
byteArrayOutputStream2.close();
} catch (IOException e9) {
e9.printStackTrace();
}
}
if (byteArray.length >= 8) {
byte[] bArr11 = new byte[8];
System.arraycopy(byteArray, 0, bArr11, 0, 8);
byte[] bArr12 = new byte[byteArray.length - 8];
System.arraycopy(byteArray, 8, bArr12, 0, byteArray.length - 8);
if (Arrays.equals(bArr11, bArr4)) {
try {
Cipher cipher2 = Cipher.getInstance("DES");
cipher2.init(2, C0766a.m422j(bArr4));
bArr3 = cipher2.doFinal(bArr12);
} catch (InvalidKeyException e10) {
e10.printStackTrace();
bArr3 = null;
bArr2 = bArr3;
if (bArr2 == null) {
}
} catch (NoSuchAlgorithmException e11) {
e11.printStackTrace();
bArr3 = null;
bArr2 = bArr3;
if (bArr2 == null) {
}
} catch (BadPaddingException e12) {
e12.printStackTrace();
bArr3 = null;
bArr2 = bArr3;
if (bArr2 == null) {
}
} catch (IllegalBlockSizeException e13) {
e13.printStackTrace();
bArr3 = null;
bArr2 = bArr3;
if (bArr2 == null) {
}
} catch (NoSuchPaddingException e14) {
e14.printStackTrace();
bArr3 = null;
bArr2 = bArr3;
if (bArr2 == null) {
}
}
bArr2 = bArr3;
if (bArr2 == null) {
Toast.makeText(MainActivity.this, "The first step has been taken, try again please", 0).show();
return;
}
System.arraycopy(bytes, 16, bArr4, 0, 8);
LZ4SafeDecompressor safeDecompressor = LZ4Factory.safeInstance().safeDecompressor();
byte[] bArr13 = new byte[bArr2.length * 5];
int decompress = safeDecompressor.decompress(bArr2, 0, bArr2.length, bArr13, 0);
byte[] bArr14 = new byte[decompress];
System.arraycopy(bArr13, 0, bArr14, 0, decompress);
if (decompress >= 8) {
byte[] bArr15 = new byte[8];
System.arraycopy(bArr14, 0, bArr15, 0, 8);
int i = decompress - 8;
byte[] bArr16 = new byte[i];
System.arraycopy(bArr14, 8, bArr16, 0, i);
if (Arrays.equals(bArr15, bArr4)) {
try {
Cipher cipher3 = Cipher.getInstance("DES");
cipher3.init(2, C0766a.m422j(bArr4));
bArr6 = cipher3.doFinal(bArr16);
} catch (InvalidKeyException e15) {
e15.printStackTrace();
} catch (NoSuchAlgorithmException e16) {
e16.printStackTrace();
} catch (BadPaddingException e17) {
e17.printStackTrace();
} catch (IllegalBlockSizeException e18) {
e18.printStackTrace();
} catch (NoSuchPaddingException e19) {
e19.printStackTrace();
}
}
}
MainActivity mainActivity = MainActivity.this;
if (bArr6 == null) {
Toast.makeText(mainActivity, "Almost succeeded, try again please", 0).show();
return;
}
Toast.makeText(mainActivity, "Each step is correct, Congs!", 0).show();
MainActivity.this.f3919p.setImageBitmap(BitmapFactory.decodeByteArray(bArr6, 0, bArr6.length));
return;
}
}
bArr2 = null;
if (bArr2 == null) {
}
}
}
bArr = null;
if (bArr != null) {
}
} catch (IOException e20) {
Toast.makeText(MainActivity.this, "Get data error", 0).show();
e20.printStackTrace();
}
}
}

有一个解压的操作里面有第一个8个字节密钥

1
2
3
4
5
6
7
8
9
10
11
12
13
14
try {
GZIPInputStream gZIPInputStream = new GZIPInputStream(new ByteArrayInputStream(bArr5));
byte[] bArr7 = new byte[256];
while (true) {
int read = gZIPInputStream.read(bArr7);
if (read < 0) {
break;
}
byteArrayOutputStream.write(bArr7, 0, read);
}//直接将解压后的读入输出流中
byteArray2 = byteArrayOutputStream.toByteArray();//将输出流的数据转化为byte数组
} catch (IOException unused) {
}

后面跟着一个解密操作和一个Inflater解压缩

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
if (byteArray2.length >= 8) {
byte[] bArr8 = new byte[8];
System.arraycopy(byteArray2, 0, bArr8, 0, 8);
byte[] bArr9 = new byte[byteArray2.length - 8];
System.arraycopy(byteArray2, 8, bArr9, 0, byteArray2.length - 8);
if (Arrays.equals(bArr8, bArr4)) {
try {
Cipher cipher = Cipher.getInstance("DES");
cipher.init(2, C0766a.m422j(bArr4));
bArr = cipher.doFinal(bArr9);
} catch (InvalidKeyException e) {
e.printStackTrace();
} catch (NoSuchAlgorithmException e2) {
e2.printStackTrace();
} catch (BadPaddingException e3) {
e3.printStackTrace();
} catch (IllegalBlockSizeException e4) {
e4.printStackTrace();
} catch (NoSuchPaddingException e5) {
e5.printStackTrace();
}
if (bArr != null) {
Toast.makeText(MainActivity.this, "The first step incorrect, try again please", 0).show();
return;
}//不知道为啥此处会校验bArr是否不等于null,解密成功才会进入?这样不符合逻辑了
System.arraycopy(bytes, 8, bArr4, 0, 8);
Inflater inflater = new Inflater();
inflater.setInput(bArr);
ByteArrayOutputStream byteArrayOutputStream2 = new ByteArrayOutputStream(bArr.length);
try {
try {
byte[] bArr10 = new byte[1024];
while (!inflater.finished()) {
byteArrayOutputStream2.write(bArr10, 0, inflater.inflate(bArr10));
}
try {
byteArrayOutputStream2.close();
} catch (IOException e6) {
e6.printStackTrace();
}
inflater.end();
byteArray = byteArrayOutputStream2.toByteArray();
} catch (Throwable th) {
try {
byteArrayOutputStream2.close();
} catch (IOException e7) {
e7.printStackTrace();
}
throw th;
}
} catch (Exception e8) {
e8.printStackTrace();
try {
byteArrayOutputStream2.close();
} catch (IOException e9) {
e9.printStackTrace();
}
}

又跟了一个解密这次是中间的8个字节密钥

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
if (byteArray.length >= 8) {
byte[] bArr11 = new byte[8];
System.arraycopy(byteArray, 0, bArr11, 0, 8);
byte[] bArr12 = new byte[byteArray.length - 8];
System.arraycopy(byteArray, 8, bArr12, 0, byteArray.length - 8);
if (Arrays.equals(bArr11, bArr4)) {
try {
Cipher cipher2 = Cipher.getInstance("DES");
cipher2.init(2, C0766a.m422j(bArr4));
bArr3 = cipher2.doFinal(bArr12);
} catch (InvalidKeyException e10) {
e10.printStackTrace();
bArr3 = null;
bArr2 = bArr3;
if (bArr2 == null) {
}
} catch (NoSuchAlgorithmException e11) {
e11.printStackTrace();
bArr3 = null;
bArr2 = bArr3;
if (bArr2 == null) {
}
} catch (BadPaddingException e12) {
e12.printStackTrace();
bArr3 = null;
bArr2 = bArr3;
if (bArr2 == null) {
}
} catch (IllegalBlockSizeException e13) {
e13.printStackTrace();
bArr3 = null;
bArr2 = bArr3;
if (bArr2 == null) {
}
} catch (NoSuchPaddingException e14) {
e14.printStackTrace();
bArr3 = null;
bArr2 = bArr3;
if (bArr2 == null) {
}
}
bArr2 = bArr3;
if (bArr2 == null) {
Toast.makeText(MainActivity.this, "The first step has been taken, try again please", 0).show();
return;
}

最后有最后的8个密钥和一个LZ4解压缩(IDEA抽风了,包下了半天才出来)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
System.arraycopy(bytes, 16, bArr4, 0, 8);
LZ4SafeDecompressor safeDecompressor = LZ4Factory.safeInstance().safeDecompressor();
byte[] bArr13 = new byte[bArr2.length * 5];
int decompress = safeDecompressor.decompress(bArr2, 0, bArr2.length, bArr13, 0);
byte[] bArr14 = new byte[decompress];
System.arraycopy(bArr13, 0, bArr14, 0, decompress);
if (decompress >= 8) {
byte[] bArr15 = new byte[8];
System.arraycopy(bArr14, 0, bArr15, 0, 8);
int i = decompress - 8;
byte[] bArr16 = new byte[i];
System.arraycopy(bArr14, 8, bArr16, 0, i);
if (Arrays.equals(bArr15, bArr4)) {
try {
Cipher cipher3 = Cipher.getInstance("DES");
cipher3.init(2, C0766a.m422j(bArr4));
bArr6 = cipher3.doFinal(bArr16);
} catch (InvalidKeyException e15) {
e15.printStackTrace();
} catch (NoSuchAlgorithmException e16) {
e16.printStackTrace();
} catch (BadPaddingException e17) {
e17.printStackTrace();
} catch (IllegalBlockSizeException e18) {
e18.printStackTrace();
} catch (NoSuchPaddingException e19) {
e19.printStackTrace();
}
}
}
MainActivity mainActivity = MainActivity.this;
if (bArr6 == null) {
Toast.makeText(mainActivity, "Almost succeeded, try again please", 0).show();
return;
}
Toast.makeText(mainActivity, "Each step is correct, Congs!", 0).show();
MainActivity.this.f3919p.setImageBitmap(BitmapFactory.decodeByteArray(bArr6, 0, bArr6.length));

最后根据代码逻辑推出的解密exp

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
package org.example;
import net.jpountz.lz4.LZ4SafeDecompressor;

import java.io.*;
import java.security.InvalidKeyException;
import java.security.Key;
import java.security.NoSuchAlgorithmException;
import java.util.Arrays;
import java.util.zip.GZIPInputStream;
import java.util.zip.Inflater;
import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.spec.SecretKeySpec;
import net.jpountz.lz4.LZ4Factory;
import net.jpountz.lz4.LZ4Compressor;
import net.jpountz.lz4.LZ4FastDecompressor;


public class Main {

public static String Read2(String infile) throws Exception
{
StringBuffer sb = new StringBuffer();

File file = new File(infile);
FileInputStream fis = new FileInputStream(file);
byte buffer[] = new byte[1024];
int len = 0;
while((len = fis.read(buffer)) != -1)
{
sb.append(new String(buffer, 0, len));
//sb.append(new String(buffer, 0, len, "UTF-8")); //将byte转String可以指定编码方式
}
fis.close();
return sb.toString();
}

public static Key get_key(byte[] arg4) {
int v0 = 8;
byte[] v1 = new byte[v0];
int v2;
for(v2 = 0; v2 < arg4.length; ++v2) {
if(v2 >= v0) {
break;
}
v1[v2] = arg4[v2];
}

return new SecretKeySpec(v1, "DES");
}

public static void main(String[] args) throws IOException {
ByteArrayOutputStream byteArrayOutputStream;
byte[] byteArray2=null;
DataInputStream dataInputStream=null;
byte[] bArr=null;
byte[] byteArray=null;
byte[] bArr3=null;
byte[] bArr2=null;
byte[] bArr6 = null;

try {
dataInputStream = new DataInputStream(new FileInputStream("E:\\EDGE下载\\task_DesignEachStep\\DesignEachStep\\assets\\data\\data"));
byte[] bArr7 = new byte[256];
byteArray2=new byte[400];
byteArrayOutputStream = new ByteArrayOutputStream();
while (true) {
int read = dataInputStream.read(bArr7);
if (read < 0) {
break;
}
byteArrayOutputStream.write(bArr7, 0, read);
}
byteArray2 = byteArrayOutputStream.toByteArray();
}
catch(Exception e)
{
System.out.println("nonono");
System.exit(0);
}
finally
{
dataInputStream.close();
}
if (byteArray2.length >= 8) {
byte[] bArr8 = new byte[8];
System.arraycopy(byteArray2, 0, bArr8, 0, 8);
byte[] bArr9 = new byte[byteArray2.length - 8];
System.arraycopy(byteArray2, 8, bArr9, 0, byteArray2.length - 8);
try {
Cipher cipher = Cipher.getInstance("DES");
cipher.init(2, get_key(bArr8));
bArr = cipher.doFinal(bArr9);
FileOutputStream fos = new FileOutputStream("E:\\EDGE下载\\task_DesignEachStep\\DesignEachStep\\assets\\data\\data2");
fos.write(bArr);
fos.close();
}catch(Exception e)
{
System.out.println("cipher error");
}
Inflater inflater = new Inflater();
inflater.setInput(bArr);
ByteArrayOutputStream byteArrayOutputStream2 = new ByteArrayOutputStream(bArr.length);
try{
byte[] bArr10 = new byte[1024];
while (!inflater.finished()) {
byteArrayOutputStream2.write(bArr10, 0, inflater.inflate(bArr10));
}

}
catch(Exception e)
{
System.out.println("inflater error");
}
inflater.end();
byteArray = byteArrayOutputStream2.toByteArray();
byteArrayOutputStream2.close();
if (byteArray.length >= 8) {
byte[] bArr11 = new byte[8];
System.arraycopy(byteArray, 0, bArr11, 0, 8);
byte[] bArr12 = new byte[byteArray.length - 8];
System.arraycopy(byteArray, 8, bArr12, 0, byteArray.length - 8);
try {
Cipher cipher2 = Cipher.getInstance("DES");
cipher2.init(2, get_key(bArr11));
bArr3 = cipher2.doFinal(bArr12);
FileOutputStream fos = new FileOutputStream("E:\\EDGE下载\\task_DesignEachStep\\DesignEachStep\\assets\\data\\data3");
fos.write(bArr3);
fos.close();
}catch(Exception e)
{
System.out.println("cipher2 error ");
}
}
bArr2=bArr3;
byte[] bArr13 = new byte[bArr2.length * 5];
LZ4SafeDecompressor safeDecompressor = LZ4Factory.safeInstance().safeDecompressor();
int decompress = safeDecompressor.decompress(bArr2, 0, bArr2.length, bArr13, 0);
byte[] bArr14 = new byte[decompress];
System.arraycopy(bArr13, 0, bArr14, 0, decompress);
byte[] bArr15 = new byte[8];
System.arraycopy(bArr14, 0, bArr15, 0, 8);
int i = decompress - 8;
byte[] bArr16 = new byte[i];
System.arraycopy(bArr14, 8, bArr16, 0, i);
try {
Cipher cipher3 = Cipher.getInstance("DES");
cipher3.init(2, get_key(bArr15));
bArr6 = cipher3.doFinal(bArr16);
FileOutputStream fos = new FileOutputStream("E:\\EDGE下载\\task_DesignEachStep\\DesignEachStep\\assets\\data\\data4.png");
fos.write(bArr6);
fos.close();
}catch (Exception e)
{
System.out.println("cipher 3 error");
}


}
}
}

虽然中间好像少了8位的密钥,但flag就是最后的png图片data4(doge),那就不管了

image-20230623001026699

  • 标题: 鹤城杯 2021designEachStep
  • 作者: runwu2204
  • 创建于 : 2023-06-22 22:46:05
  • 更新于 : 2023-06-23 00:10:57
  • 链接: https://runwu2204.github.io/2023/06/22/CTF WP/Re/安卓/鹤城杯 2021designEachStep/
  • 版权声明: 本文章采用 CC BY-NC-SA 4.0 进行许可。
评论
目录
鹤城杯 2021designEachStep