2017 陕西省网络安全大赛 人民的名义 抓捕赵德汉2 200
先来感受下混淆
![](https://wnagzihxa1n.gitbook.io/~gitbook/image?url=https%3A%2F%2F2646860265-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FJh2iv6UDGq4O16NDjFK8%252Fuploads%252Fgit-blob-7458156a334cc50d548820b0d9b6bc164bdb4f3f%252F43DC5F0EBCE7E9A15E5D4B0AE05BA517.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=4659d297&sv=2)
不过这个混淆还是蛮一般的
找到入口
这个很奇怪的方法目测就是校验函数,跳过去,发现就是上面那个截图里的函数
![](https://wnagzihxa1n.gitbook.io/~gitbook/image?url=https%3A%2F%2F2646860265-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FJh2iv6UDGq4O16NDjFK8%252Fuploads%252Fgit-blob-27ed8206a5fd4a3a3eb35357f891296fe3ab9d7f%252FE363E7F113A8FD518C30B50C24154402.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=c5e96394&sv=2)
这尼玛怎么看,使用Jar2Dex工具转为Dex文件
然后就是一个个函数改啊改
![](https://wnagzihxa1n.gitbook.io/~gitbook/image?url=https%3A%2F%2F2646860265-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FJh2iv6UDGq4O16NDjFK8%252Fuploads%252Fgit-blob-600b6d52ec2426c8ad2f55cd714bdf9a2ca518bf%252F78FF1B49A127AE6AC18F9403802DBB25.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=d5589df9&sv=2)
发现又是一个可以使用Console输出RegCode的题目
上Eclipse
把四个类全都拷贝进Demo工程,把那些乱七八糟报错的直接去掉,不影响的,为了方便,直接在入口调用校验函数,然后在校验的地方把数据输出来
![](https://wnagzihxa1n.gitbook.io/~gitbook/image?url=https%3A%2F%2F2646860265-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FJh2iv6UDGq4O16NDjFK8%252Fuploads%252Fgit-blob-9e0351cd47499d83f3f6410cdafc6397df6c52fa%252F58F94741A197562EB9943D409A36BBF3.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=cc50ceed&sv=2)
如果校验函数没有修改条件的话,要默认输入19位字符
要注意的是,每隔4位有一个随意的字符填充,这个一般默认的是-
,所以我们默认填充-
![](https://wnagzihxa1n.gitbook.io/~gitbook/image?url=https%3A%2F%2F2646860265-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FJh2iv6UDGq4O16NDjFK8%252Fuploads%252Fgit-blob-61b5ca3522a2d6c8f0c3c59f25f4978c66f3db20%252F0712644673D61679C801C643D1CA3823.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=8b187aed&sv=2)
当然最后会多一个-
,到时去掉即可
运行输出
我们校验一下
![](https://wnagzihxa1n.gitbook.io/~gitbook/image?url=https%3A%2F%2F2646860265-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FJh2iv6UDGq4O16NDjFK8%252Fuploads%252Fgit-blob-02dd5cbb07d2284569a6f22ef993f32ddf58cac7%252F540582EEBE09FF3EF95688B1CB27E9F7.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=abd8d47d&sv=2)
有意思的是
![](https://wnagzihxa1n.gitbook.io/~gitbook/image?url=https%3A%2F%2F2646860265-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FJh2iv6UDGq4O16NDjFK8%252Fuploads%252Fgit-blob-b2dc019ed8276c7fe21506e2587534c75c18c3b8%252FF0F3D6E75EAC359ADA1BB2D98DE34BCA.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=d3dd0595&sv=2)
Last updated