测试文件:https://static2.ichunqiu.com/icq/resources/fileupload/phrackCTF/REVERSE/Crackme.smali
参考资料:https://www.cnblogs.com/lz2017/p/6917049.html
使用SmaliJavaUI反编译文件,得到
/**
* Generated by smali2java 1.0.0.558
* Copyright (C) 2013 Hensence.com
*/
package net.bluelotus.tomorrow.easyandroid;
import android.util.Base64;
import java.io.PrintStream;
import java.security.NoSuchAlgorithmException;
import javax.crypto.NoSuchPaddingException;
import java.security.InvalidKeyException;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.BadPaddingException;
import javax.crypto.spec.SecretKeySpec;
import javax.crypto.Cipher;
import java.security.Key;
import java.security.GeneralSecurityException;
public class Crackme {
private String str2 = "cGhyYWNrICBjdGYgMjAxNg==";
public Crackme() {
GetFlag("sSNnx1UKbYrA1+MOrdtDTA==");
}
private String GetFlag(String p1) {//将上面两段字符串经过base64解密
byte\[\] "content" = Base64.decode(p1.getBytes(), 0x0);
String "kk" = new String(Base64.decode(str2.getBytes(), 0x0));
System.out.println(decrypt("content", "kk"));
return null;
}
private String decrypt(byte\[\] p1, String p2) {//将解密后的序列,一段用来生成key,一段作为被AES加密的字符串。
String "m" = 0x0;
try {
byte\[\] "keyStr" = p2.getBytes();
SecretKeySpec "key" = new SecretKeySpec("keyStr", "AES");
Cipher "cipher" = Cipher.getInstance("AES/ECB/NoPadding");
"cipher".init(0x2, "key");
byte\[\] "result" = "cipher".doFinal(p1);
return "m";
} catch(NoSuchPaddingException "e") {
"e".printStackTrace();
}
return "m";
}
}
from Crypto.Cipher import AES
import base64
key = base64.b64decode("cGhyYWNrICBjdGYgMjAxNg==")
str1 = base64.b64decode("sSNnx1UKbYrA1+MOrdtDTA==")
cryptor = AES.new(key, AES.MODE_ECB)
result = cryptor.decrypt(str1)
print(result)
PCTF{Sm4liRiver}
手机扫一扫
移动阅读更方便
你可能感兴趣的文章