GFSJ1092-【easyEZbaby_app】
apk逆向
main 只有一层
package com.example.activitytest;
import android.os.Bundle;
import android.view.View;
import android.widget.Button;
import android.widget.EditText;
import android.widget.Toast;
import androidx.appcompat.app.AppCompatActivity;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
/* JADX INFO: loaded from: classes.dex */
public class FirstActivity extends AppCompatActivity implements View.OnClickListener {
Button button;
EditText password;
EditText username;
@Override // androidx.fragment.app.FragmentActivity, androidx.activity.ComponentActivity, androidx.core.app.ComponentActivity, android.app.Activity
protected void onCreate(Bundle bundle) {
super.onCreate(bundle);
setContentView(R.layout.first_layout);
this.button = (Button) findViewById(R.id.login_button);
this.username = (EditText) findViewById(R.id.username);
this.password = (EditText) findViewById(R.id.password);
this.button.setOnClickListener(this);
}
@Override // android.view.View.OnClickListener
public void onClick(View view) {
String string = this.username.getText().toString();
String string2 = this.password.getText().toString();
if (checkUsername(string) && checkPass(string2)) {
Toast.makeText(this, "登录成功", 0).show();
Toast.makeText(this, "flag{" + string + string2 + "}", 0).show();
return;
}
Toast.makeText(this, "登录失败", 0).show();
}
public boolean checkUsername(String str) {
if (str != null) {
try {
if (str.length() != 0 && str != null) {
MessageDigest messageDigest = MessageDigest.getInstance("MD5");
messageDigest.reset();
messageDigest.update("zhishixuebao".getBytes());
String hexString = toHexString(messageDigest.digest(), "");
StringBuilder sb = new StringBuilder();
for (int i = 0; i < hexString.length(); i += 2) {
sb.append(hexString.charAt(i));
}
return (sb.toString()).equals(str);
}
return false;
} catch (NoSuchAlgorithmException e) {
e.printStackTrace();
}
}
return false;
}
public boolean checkPass(String str) {
if (str == null) {
return false;
}
char[] charArray = str.toCharArray();
if (charArray.length != 15) {
return false;
}
for (int i = 0; i < charArray.length; i++) {
charArray[i] = (char) ((((255 - i) + 2) - 98) - charArray[i]);
if (charArray[i] != '0' || i >= 15) {
return false;
}
}
return true;
}
private static String toHexString(byte[] bArr, String str) {
StringBuilder sb = new StringBuilder();
for (byte b : bArr) {
String hexString = Integer.toHexString(b & 255);
if (hexString.length() == 1) {
sb.append('0');
}
sb.append(hexString);
sb.append(str);
}
return sb.toString();
}
}
flag 用户名和密码拼接
用户名计算
MD5("zhishixuebao") == 7da5fec345fecde5fdcd641f68e0b6d1
然后各一位取用户名
7afc4fcefc616ebd
密码计算
charArray[i] = (char) ((((255 - i) + 2) - 98) - charArray[i]);
下面判断 密码变换后的字符为0
if (charArray[i] != '0' || i >= 15) {
return false;
计算可以化简一下 我的数学功力深厚 哈哈哈哈
((255 - i) + 2) - 98 - charArray[i]
= 255 - i + 2 - 98 - charArray[i]
= (255 + 2 - 98) - i - charArray[i]
= 159 - i - charArray[i]
也就是
charArray[i] = (char) ((159 - i) - charArray[i]); == '0'
同时 0 的 ascii码是 48
所以exp可以这样写
import hashlib
username = hashlib.md5(b"zhishixuebao").hexdigest()[::2]
password = "".join(chr(111 - i) for i in range(15))
print(f"flag{{{username}{password}}}")
flag
flag{7afc4fcefc616ebdonmlkjihgfedcba}
评论