apk逆向

main 只有一层

package com.example.activitytest;

import android.os.Bundle;
import android.view.View;
import android.widget.Button;
import android.widget.EditText;
import android.widget.Toast;
import androidx.appcompat.app.AppCompatActivity;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;

/* JADX INFO: loaded from: classes.dex */
public class FirstActivity extends AppCompatActivity implements View.OnClickListener {
    Button button;
    EditText password;
    EditText username;

    @Override // androidx.fragment.app.FragmentActivity, androidx.activity.ComponentActivity, androidx.core.app.ComponentActivity, android.app.Activity
    protected void onCreate(Bundle bundle) {
        super.onCreate(bundle);
        setContentView(R.layout.first_layout);
        this.button = (Button) findViewById(R.id.login_button);
        this.username = (EditText) findViewById(R.id.username);
        this.password = (EditText) findViewById(R.id.password);
        this.button.setOnClickListener(this);
    }

    @Override // android.view.View.OnClickListener
    public void onClick(View view) {
        String string = this.username.getText().toString();
        String string2 = this.password.getText().toString();
        if (checkUsername(string) && checkPass(string2)) {
            Toast.makeText(this, "登录成功", 0).show();
            Toast.makeText(this, "flag{" + string + string2 + "}", 0).show();
            return;
        }
        Toast.makeText(this, "登录失败", 0).show();
    }

    public boolean checkUsername(String str) {
        if (str != null) {
            try {
                if (str.length() != 0 && str != null) {
                    MessageDigest messageDigest = MessageDigest.getInstance("MD5");
                    messageDigest.reset();
                    messageDigest.update("zhishixuebao".getBytes());
                    String hexString = toHexString(messageDigest.digest(), "");
                    StringBuilder sb = new StringBuilder();
                    for (int i = 0; i < hexString.length(); i += 2) {
                        sb.append(hexString.charAt(i));
                    }
                    return (sb.toString()).equals(str);
                }
                return false;
            } catch (NoSuchAlgorithmException e) {
                e.printStackTrace();
            }
        }
        return false;
    }

    public boolean checkPass(String str) {
        if (str == null) {
            return false;
        }
        char[] charArray = str.toCharArray();
        if (charArray.length != 15) {
            return false;
        }
        for (int i = 0; i < charArray.length; i++) {
            charArray[i] = (char) ((((255 - i) + 2) - 98) - charArray[i]);
            if (charArray[i] != '0' || i >= 15) {
                return false;
            }
        }
        return true;
    }

    private static String toHexString(byte[] bArr, String str) {
        StringBuilder sb = new StringBuilder();
        for (byte b : bArr) {
            String hexString = Integer.toHexString(b & 255);
            if (hexString.length() == 1) {
                sb.append('0');
            }
            sb.append(hexString);
            sb.append(str);
        }
        return sb.toString();
    }
}

flag 用户名和密码拼接

用户名计算

MD5("zhishixuebao") == 7da5fec345fecde5fdcd641f68e0b6d1

然后各一位取用户名

7afc4fcefc616ebd

密码计算

charArray[i] = (char) ((((255 - i) + 2) - 98) - charArray[i]);

下面判断 密码变换后的字符为0

if (charArray[i] != '0' || i >= 15) {
                return false;

计算可以化简一下 我的数学功力深厚 哈哈哈哈

((255 - i) + 2) - 98 - charArray[i]
= 255 - i + 2 - 98 - charArray[i]
= (255 + 2 - 98) - i - charArray[i]
= 159 - i - charArray[i]

也就是

charArray[i] = (char) ((159 - i) - charArray[i]); == '0'

同时 0 的 ascii码是 48

所以exp可以这样写

import hashlib

username = hashlib.md5(b"zhishixuebao").hexdigest()[::2]
password = "".join(chr(111 - i) for i in range(15))

print(f"flag{{{username}{password}}}")

flag

flag{7afc4fcefc616ebdonmlkjihgfedcba}