BUUCTF(reverse)findit

题目下载一个apk文件

1、使用工具jadxgui打开文件

找到代码：

    public void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        final EditText edit = (EditText) findViewById(R.id.widget2);
        final TextView text = (TextView) findViewById(R.id.widget1);
        final char[] a = {'T', 'h', 'i', 's', 'I', 's', 'T', 'h', 'e', 'F', 'l', 'a', 'g', 'H', 'o', 'm', 'e'};
        final char[] b = {'p', 'v', 'k', 'q', '{', 'm', '1', '6', '4', '6', '7', '5', '2', '6', '2', '0', '3', '3', 'l', '4', 'm', '4', '9', 'l', 'n', 'p', '7', 'p', '9', 'm', 'n', 'k', '2', '8', 'k', '7', '5', '}'};
        ((Button) findViewById(R.id.widget3)).setOnClickListener(new View.OnClickListener() {
            /* class com.example.findit.MainActivity.AnonymousClass1 */

            public void onClick(View v) {
                char[] x = new char[17];
                char[] y = new char[38];
                for (int i = 0; i < 17; i++) {
                    if ((a[i] < 'I' && a[i] >= 'A') || (a[i] < 'i' && a[i] >= 'a')) {
                        x[i] = (char) (a[i] + 18);
                    } else if ((a[i] < 'A' || a[i] > 'Z') && (a[i] < 'a' || a[i] > 'z')) {
                        x[i] = a[i];
                    } else {
                        x[i] = (char) (a[i] - '\b');
                    }
                }
                if (String.valueOf(x).equals(edit.getText().toString())) {
                    for (int i2 = 0; i2 < 38; i2++) {
                        if ((b[i2] < 'A' || b[i2] > 'Z') && (b[i2] < 'a' || b[i2] > 'z')) {
                            y[i2] = b[i2];
                        } else {
                            y[i2] = (char) (b[i2] + 16);
                            if ((y[i2] > 'Z' && y[i2] < 'a') || y[i2] >= 'z') {
                                y[i2] = (char) (y[i2] - 26);
                            }
                        }
                    }
                    text.setText(String.valueOf(y));
                    return;
                }
                text.setText("答案错了肿么办。。。不给你又不好意思。。。哎呀好纠结啊~~~");
            }
        });
    }

2、分析代码

y就是所要找的flag，直接对代码修改为pytho代码

3、解题

a = ['T', 'h', 'i', 's', 'I', 's', 'T', 'h', 'e', 'F', 'l', 'a', 'g', 'H', 'o', 'm', 'e'];
b = ['p', 'v', 'k', 'q', '{', 'm', '1', '6', '4', '6', '7', '5', '2', '6', '2', '0', '3', '3', 'l', '4', 'm', '4', '9',
     'l', 'n', 'p', '7', 'p', '9', 'm', 'n', 'k', '2', '8', 'k', '7', '5', '}'];
x =''
y =''

for i in range(1,18):
    if ((ord(a[i-1]) < ord('I') and ord(a[i-1]) >= ord('A')) or (ord(a[i-1]) < ord('i') and ord(a[i-1]) >= ord('a'))):
        x = x+chr(ord(a[i-1]) + 18);
    elif((ord(a[i-1]) < ord('A') or ord(a[i-1]) > ord('Z')) and (ord(a[i-1]) < ord('a') or ord(a[i-1]) > ord('z'))):
        x = x+a[i-1];
    else:
        x =x+ chr (ord(a[i-1]) - ord('\b'));

print(x)

for j in range(1,39):
    if ((b[j - 1] < 'A' or b[j - 1] > 'Z') and (b[j - 1] < 'a' or b[j - 1] > 'z')):
            y = y+b[j - 1];
    else:
        m=chr(ord(b[j - 1]) + 16);
        if (m > 'Z' and m < 'a') or m >= 'z':
            m = chr(ord(m) - 26);
        y=y+m

print(y)

输出：

LzakAkLzwXdsyZgew
flag{c164675262033b4c49bdf7f9cda28a75}