18/09/24-1-bugku-Reverse-loopandloop (Ali CTF)

---restore content starts---

0x00
Title Link: https://pan.baidu.com/s/1boi4DX2Dp9-6cel0Q0KeHw Password: JMGF

0x01
Download the zipped package and unzip it to get the APK, install and open apk.
Try to enter, if only enter the number, pop "not right! ", if you enter characters with the exception of numbers, the" not a Valid Integer number "pops up.

0x02
Using JEB2 to decompile the APK, find the core algorithm area to decompile the Java source code for analysis.
1) ' Analyze the OnClick method.
A.try-catch
NumberFormatException is a numeric format exception that is thrown when an attempt is made to convert a string to the specified number type, and the string does not satisfy the format required by the number type. Therefore, if the APK input has a character outside the number, the program captures the exception, the "not a Valid" message pops up.

B.if-else
Check (v1,99) ==1835996258 to determine, if the condition pops up flag, otherwise pop "not right."

1  Public voidOnClick (View arg7) {2 intv1;3String v2 = This. Val$ed.gettext (). toString ();4 Try {5V1 =Integer.parseint (v2);6 }7 Catch(NumberFormatException v0) {8  This. Val$tv1.settext ("Not a Valid Integer number");9 return;Ten } One  A if(Mainactivity. This. Check (v1, 99) = = 1835996258) { -  This. Val$tv1.settext ("The flag is:"); -  This. Val$tv2.settext ("alictf{" + mainactivity. This. stringFromJNI2 (v1) + "}"); the } - Else { -  This. Val$tv1.settext ("Not right!"); - } + } -});

View Code

2) Analyzing the Check method
The A.check method is the native function of the native layer, and there are also check1,check2,check3 methods.

1  Publicmainactivity () {2 Super();3 }4 5  Public native intChecintArg1,intarg2) {6 }7 8  Public intCheckintArg2,intArg3) {9 return  This. Chec (Arg2, arg3);Ten } One  A  Public intCheck1 (intARG4,intarg5) { - intV1 =Arg4; - intV0; the  for(V0 = 1; v0 < 100; + +v0) { -V1 + =V0; - } -  + return  This. Chec (v1, arg5); - } +  A  Public intCheck2 (intARG5,intArg6) { at intv2; - intV3 = 1000; - intV1 =Arg5; - if(Arg6% 2 = = 0) { - intV0; -  for(V0 = 1; v0 < V3; + +v0) { inV1 + =V0; - } to  +V2 = This. Chec (v1, ARG6); - } the Else { *  for(V0 = 1; v0 < V3; + +v0) { $V1-=V0;Panax Notoginseng } -  theV2 = This. Chec (v1, ARG6); + } A  the returnv2; + } -  $  Public intCheck3 (intARG4,intarg5) { $ intV1 =Arg4; - intV0; -  for(V0 = 1; v0 < 10000; + +v0) { theV1 + =V0; - }Wuyi  the return  This. Chec (v1, arg5); -}

View Code

B. Analyze the IDA so file and decompile the check method.

By search, the first two parameters of the native layer check method are the JNI interface pointers and references to objects and Java classes, which are the default, and the latter two parameters are Java layer parameters, as described in (49156847).

And the functions of Getmethodid and Callintmethod to invoke the Java layer method for the JNI layer, see (44133741)).

The function of the check method is as follows:
Determines whether the second parameter passed in by the Java layer is less than or equal to 1, and if it returns the first parameter passed in to the Java layer, one of the Check1,check2,check3 methods in the Java layer is not recalled.
The Callmethod function * (&V10 + 2 * V8% 3) determines which of the Java layer three methods to call, V7 and v8-1 are variables passed into the Java layer method.

1 int__fastcall Java_net_bluelotus_tomorrow_easyandroid_mainactivity_chec (intA1,intA2,intA3,intA4)2 {3 intV4;//R44 intV5;//R75 intResult//R06 intV7;//[Sp+ch] [bp-34h]7 intV8;//[sp+10h] [bp-30h]8 intV9;//[sp+14h] [bp-2ch]9 intV10;//[sp+1ch] [bp-24h]Ten intV11;//[sp+20h] [bp-20h] One intV12;//[sp+24h] [bp-1ch] A  -V9 =A2; -V8 =A4; theV4 =A1; -V7 =A3; -V5 = (* (int(**) (void)) (* (_dword *) A1 + 24))(); -v10 = _jnienv::getmethodid (V4, V5, "Check1", "(II) I"); +V11 = _jnienv::getmethodid (v4, V5, "Check2", "(II) I"); -V12 = _jnienv::getmethodid (v4, V5, "Check3", "(II) I"); + if(v8-1 <= 0 ) Aresult =V7; at Else -result = _jnienv::callintmethod (v4, V9, * (&AMP;V10 + 2 * V8% 3), V7, V8-1); - returnresult; -}

View Code

0x03
Program Algorithm Analysis
Satisfy check (i,99) ==1835996258 can get flag,i for the value entered in the APK, check for the native layer of the native function, the function is based on the second parameter of the incoming check k*2%3 value selection callback Java layer Three one of the methods, Check1,check2,check3 are all changes to the I value, the analysis of the last return of the value of the check is also I, to meet the final I equals 1835996258, the incoming 99 in the check each time the 1,check function of the termination condition is reduced to 2. Then the algorithm is inverse, write the script can.

0x04
Problem Solving Scripts
The details of the script need to be noted in the inverse of the Check2 method, if the judging condition is (num-1)%2==0, do not forget to subtract 1, because the native layer check function passed to the Java layer method of the second parameter minus 1.

1num = 992Flag = 18359962583  whileNum-1 >0:4TMP = num * 2 35     if(TMP = =0):6Flag-=49507     if(TMP = = 1):8         if((num-1)% 2 = =0):9Flag-= 499500Ten         Else: OneFlag +=499500 A     if(TMP = = 2): -Flag-= 49995000 -num-= 1 the PrintFlag

View Code

18/09/24-1-bugku-Reverse-loopandloop (Ali CTF)