本文为看雪论坛优秀文章
看雪论坛作者ID:逆时针向左
from idaapi import *
bytes_addr = 0x00033004
bytes_size = 32
data = get_bytes(bytes_addr,bytes_size)
L = [hex(ch) for ch in data]
print (L)
# 真密文
# ['0x8c', '0xc4', '0x0', '0xe6', '0x6a', '0x88', '0xb8', '0x90', '0xc2', '0x7', '0x6b', '0xa9', '0xc3', '0xa', '0x3e', '0xc0', '0x44', '0xa6', '0xfe', '0x7e', '0xf0', '0x59', '0x4c', '0x83', '0x3d', '0x2b', '0xe2', '0xd3', '0x38', '0xcb', '0x82', '0x5b']
继续分析代码可以看出,输入字符串长度应为 32,且只在此处进行了异或操作:
于是考虑动态调试 so 文件,思路参考 [1],调试方法参考 [2] 和 [3]。
思路:输入错误的 flag,得到假密文,将错误的 flag 、假密文、真密文进行异或,即可得到真 flag。
D:\IDA Pro\IDA Pro 7.5\dbgsrv>adb push android_x86_server
adb.exe: push requires an argument
D:\IDA Pro\IDA Pro 7.5\dbgsrv>adb push android_x86_server /data/local/tmp
android_x86_server: 1 file pushed, 0 skipped. 30.5 MB/s (1130104 bytes in 0.035s)
D:\IDA Pro\IDA Pro 7.5\dbgsrv>adb shell
aosp:/ # su
aosp:/ # cd /data/local/tmp
aosp:/data/local/tmp # ll
total 1104
-rw-rw-rw- 1 root root 1130104 2020-12-11 22:18 android_x86_server
aosp:/data/local/tmp # chmod 777 android_x86_server
aosp:/data/local/tmp # ./android_x86_server
IDA Android x86 32-bit remote debug server(ST) v7.5.26. Hex-Rays (c) 2004-2020
Listening on 0.0.0.0:23946...
C:\Users\admin>adb forward tcp:23946 tcp:23946
23946
C:\Users\admin>adb forward --list
emulator-5554 tcp:23946 tcp:23946
from idaapi import *
bytes_addr = 0xCFFFD6F8
bytes_size = 32
data = get_bytes(bytes_addr,bytes_size)
L = [hex(ch) for ch in data]
print (L)
# 假密文
#['0xdd', '0x9f', '0x58', '0xb3', '0x72', '0x80', '0xef', '0x96', '0xc1', '0x2', '0x3b', '0xfe', '0x97', '0xc', '0x39', '0x94', '0x43', '0xaf', '0xac', '0x78', '0xf8', '0x59', '0x4c', '0x84', '0x68', '0x2a', '0xe4', '0x86', '0x68', '0x9c', '0xd2', '0x13']
enc = [0x8C, 0x0C4, 0x0, 0x0E6, 0x6A, 0x88, 0x0B8, 0x90, 0x0C2, 0x7, 0x6B, 0x0A9, 0x0C3, 0x0A, 0x3E, 0x0C0, 0x44, 0x0A6, 0x0FE, 0x7E, 0x0F0, 0x59, 0x4C, 0x83, 0x3D, 0x2B, 0x0E2, 0x0D3, 0x38, 0x0CB, 0x82, 0x5B]
fake_flag = "flag{11111111111111111111111111}"
fake_flag_cipher = [0xdd, 0x9f, 0x58, 0xb3, 0x72, 0x80, 0xef, 0x96, 0xc1, 0x2, 0x3b, 0xfe, 0x97, 0xc, 0x39, 0x94, 0x43, 0xaf, 0xac, 0x78, 0xf8, 0x59, 0x4c, 0x84, 0x68, 0x2a, 0xe4, 0x86, 0x68, 0x9c, 0xd2, 0x13]
for i in range(32):
print(chr(ord(fake_flag[i])^fake_flag_cipher[i]^enc[i]), end='')
# 7792c9f724afe76e68c79116d07dafa5
1、[原创]DASCTF八月挑战赛 re :
https://bbs.pediy.com/thread-269129.htm
2、安卓逆向_17 --- IDA 动态调试:
https://blog.csdn.net/freeking101/article/details/106701908
3、IDA远程调试Android中so文件:
https://www.cnblogs.com/ddms/p/8820044.html
看雪ID:逆时针向左
https://bbs.pediy.com/user-home-781904.htm
官网:https://www.bagevent.com/event/6334937
# 往期推荐
球分享
球点赞
球在看
点击“阅读原文”,了解更多!