1
#include <iostream>
2
#include <Windows.h>
3
__int64 __fastcall fnv(byte *a1, unsigned __int64 a2, unsigned int a3, int a4)
4
{
5
    unsigned __int64 i;
6
    for (i = 0; i < a2; ++i)
7
        a3 = a4 * (a1[i] ^ a3);
8
    return a3;
9
}
10
int main()
11
{
12
    DWORD Key{};
13
    for (Key = 0; Key < 0xffffffff; Key++)
14
    {
15
        if (fnv((byte*)(&Key), 4, 0x811C9235LL, 0x1000193) == 0x7B3126E5)
16
        {
17
            printf("Key: %.4s\n", (char *)(&Key));
18
            break;
19
        }
20
    }
21
    return 0;
22
}

1
text:00007FF778F01240 ; __unwind { // __GSHandlerCheck
2
.text:00007FF778F01240 loc_7FF778F01240 db  48h ; H            ; CODE XREF: main+CE↓p
3
.text:00007FF778F01240                                         ; DATA XREF: sub_7FF778F01540+39↓o ...
4
.text:00007FF778F01242 push    rsp
5
.text:00007FF778F01243 and     al, 10h
6
.text:00007FF778F01245 mov     [rsp+8], rcx
7
.text:00007FF778F0124A push    rdi
8
.text:00007FF778F0124B sub     rsp, 250h
9
.text:00007FF778F01252 mov     rax, cs:__security_cookie
10
.text:00007FF778F01259 xor     rax, rsp
11
.text:00007FF778F0125C mov     [rsp+240h], rax
12
.text:00007FF778F01264 lea     rax, [rsp+40h]
13
.text:00007FF778F01269 mov     rdi, rax
14
.text:00007FF778F0126C xor     eax, eax
15
.text:00007FF778F0126E mov     ecx, 100h
16
.text:00007FF778F01273 rep stosb
17
.text:00007FF778F01275 mov     dword ptr [rsp+10h], 0
18
.text:00007FF778F0127D jmp     short loc_7FF778F01289
19
.text:00007FF778F0127F ; ---------------------------------------------------------------------------
20
.text:00007FF778F0127F
21
.text:00007FF778F0127F loc_7FF778F0127F:                       ; CODE XREF: .text:00007FF778F012A0↓j
22
.text:00007FF778F0127F mov     eax, [rsp+10h]
23
.text:00007FF778F01283 inc     eax
24
.text:00007FF778F01285 mov     [rsp+10h], eax
25
.text:00007FF778F01289
26
.text:00007FF778F01289 loc_7FF778F01289:                       ; CODE XREF: .text:00007FF778F0127D↑j
27
.text:00007FF778F01289 cmp     dword ptr [rsp+10h], 100h
28
.text:00007FF778F01291 jnb     short loc_7FF778F012A2
29
.text:00007FF778F01293 mov     eax, [rsp+10h]
30
.text:00007FF778F01297 movzx   ecx, byte ptr [rsp+10h]
31
.text:00007FF778F0129C mov     [rsp+rax+40h], cl
32
.text:00007FF778F012A0 jmp     short loc_7FF778F0127F
33
.text:00007FF778F012A2 ; ---------------------------------------------------------------------------
34
.text:00007FF778F012A2
35
.text:00007FF778F012A2 loc_7FF778F012A2:                       ; CODE XREF: .text:00007FF778F01291↑j
36
.text:00007FF778F012A2 mov     dword ptr [rsp+30h], 4
37
.text:00007FF778F012AA lea     rax, [rsp+140h]
38
.text:00007FF778F012B2 mov     rdi, rax
39
.text:00007FF778F012B5 xor     eax, eax
40
.text:00007FF778F012B7 mov     ecx, 100h
41
.text:00007FF778F012BC rep stosb
42
.text:00007FF778F012BE mov     dword ptr [rsp+14h], 0
43
.text:00007FF778F012C6 jmp     short loc_7FF778F012D2
44
.text:00007FF778F012C8 ; ---------------------------------------------------------------------------
45
.text:00007FF778F012C8
46
.text:00007FF778F012C8 loc_7FF778F012C8:                       ; CODE XREF: .text:00007FF778F01305↓j
47
.text:00007FF778F012C8 mov     eax, [rsp+14h]
48
.text:00007FF778F012CC inc     eax
49
.text:00007FF778F012CE mov     [rsp+14h], eax
50
.text:00007FF778F012D2
51
.text:00007FF778F012D2 loc_7FF778F012D2:                       ; CODE XREF: .text:00007FF778F012C6↑j
52
.text:00007FF778F012D2 cmp     dword ptr [rsp+14h], 100h
53
.text:00007FF778F012DA jge     short loc_7FF778F01307
54
.text:00007FF778F012DC xor     edx, edx
55
.text:00007FF778F012DE mov     eax, [rsp+14h]
56
.text:00007FF778F012E2 div     dword ptr [rsp+30h]
57
.text:00007FF778F012E6 mov     eax, edx
58
.text:00007FF778F012E8 mov     eax, eax
59
.text:00007FF778F012EA mov     rcx, [rsp+268h]
60
.text:00007FF778F012F2 movzx   eax, byte ptr [rcx+rax]
61
.text:00007FF778F012F6 xor     eax, 11h
62
.text:00007FF778F012F9 movsxd  rcx, dword ptr [rsp+14h]
63
.text:00007FF778F012FE mov     [rsp+rcx+140h], al
64
.text:00007FF778F01305 jmp     short loc_7FF778F012C8
65
.text:00007FF778F01307 ; ---------------------------------------------------------------------------
66
.text:00007FF778F01307
67
.text:00007FF778F01307 loc_7FF778F01307:                       ; CODE XREF: .text:00007FF778F012DA↑j
68
.text:00007FF778F01307 mov     dword ptr [rsp+1Ch], 0
69
.text:00007FF778F0130F mov     dword ptr [rsp+8], 0
70
.text:00007FF778F01317 jmp     short loc_7FF778F01323
71
.text:00007FF778F01319 ; ---------------------------------------------------------------------------
72
.text:00007FF778F01319
73
.text:00007FF778F01319 loc_7FF778F01319:                       ; CODE XREF: .text:00007FF778F01391↓j
74
.text:00007FF778F01319 mov     eax, [rsp+8]
75
.text:00007FF778F0131D inc     eax
76
.text:00007FF778F0131F mov     [rsp+8], eax
77
.text:00007FF778F01323
78
.text:00007FF778F01323 loc_7FF778F01323:                       ; CODE XREF: .text:00007FF778F01317↑j
79
.text:00007FF778F01323 cmp     dword ptr [rsp+8], 100h
80
.text:00007FF778F0132B jge     short loc_7FF778F01393
81
.text:00007FF778F0132D movsxd  rax, dword ptr [rsp+8]
82
.text:00007FF778F01332 movzx   eax, byte ptr [rsp+rax+40h]
83
.text:00007FF778F01337 mov     ecx, [rsp+1Ch]
84
.text:00007FF778F0133B add     ecx, eax
85
.text:00007FF778F0133D mov     eax, ecx
86
.text:00007FF778F0133F movsxd  rcx, dword ptr [rsp+8]
87
.text:00007FF778F01344 movzx   ecx, byte ptr [rsp+rcx+140h]
88
.text:00007FF778F0134C add     eax, ecx
89
.text:00007FF778F0134E cdq
90
.text:00007FF778F0134F and     edx, 0FFh
91
.text:00007FF778F01355 add     eax, edx
92
.text:00007FF778F01357 and     eax, 0FFh
93
.text:00007FF778F0135C sub     eax, edx
94
.text:00007FF778F0135E mov     [rsp+1Ch], eax
95
.text:00007FF778F01362 movsxd  rax, dword ptr [rsp+8]
96
.text:00007FF778F01367 movzx   eax, byte ptr [rsp+rax+40h]
97
.text:00007FF778F0136C mov     [rsp+2], al
98
.text:00007FF778F01370 movsxd  rax, dword ptr [rsp+1Ch]
99
.text:00007FF778F01375 movsxd  rcx, dword ptr [rsp+8]
100
.text:00007FF778F0137A movzx   eax, byte ptr [rsp+rax+40h]
101
.text:00007FF778F0137F mov     [rsp+rcx+40h], al
102
.text:00007FF778F01383 movsxd  rax, dword ptr [rsp+1Ch]
103
.text:00007FF778F01388 movzx   ecx, byte ptr [rsp+2]
104
.text:00007FF778F0138D mov     [rsp+rax+40h], cl
105
.text:00007FF778F01391 jmp     short loc_7FF778F01319
106
.text:00007FF778F01393 ; ---------------------------------------------------------------------------
107
.text:00007FF778F01393
108
.text:00007FF778F01393 loc_7FF778F01393:                       ; CODE XREF: .text:00007FF778F0132B↑j
109
.text:00007FF778F01393 mov     byte ptr [rsp], 0
110
.text:00007FF778F01397 mov     byte ptr [rsp+1], 0
111
.text:00007FF778F0139C mov     rax, [rsp+260h]
112
.text:00007FF778F013A4 mov     [rsp+38h], rax
113
.text:00007FF778F013A9 mov     qword ptr [rsp+28h], 0FFFFFFFFFFFFFFFFh
114
.text:00007FF778F013B2
115
.text:00007FF778F013B2 loc_7FF778F013B2:                       ; CODE XREF: .text:00007FF778F013C5↓j
116
.text:00007FF778F013B2 inc     qword ptr [rsp+28h]
117
.text:00007FF778F013B7 mov     rax, [rsp+38h]
118
.text:00007FF778F013BC mov     rcx, [rsp+28h]
119
.text:00007FF778F013C1 cmp     byte ptr [rax+rcx], 0
120
.text:00007FF778F013C5 jnz     short loc_7FF778F013B2
121
.text:00007FF778F013C7 mov     rax, [rsp+28h]
122
.text:00007FF778F013CC mov     [rsp+20h], eax
123
.text:00007FF778F013D0 mov     dword ptr [rsp+18h], 0
124
.text:00007FF778F013D8 jmp     short loc_7FF778F013E4
125
.text:00007FF778F013DA ; ---------------------------------------------------------------------------
126
.text:00007FF778F013DA
127
.text:00007FF778F013DA loc_7FF778F013DA:                       ; CODE XREF: .text:00007FF778F014B9↓j
128
.text:00007FF778F013DA mov     eax, [rsp+18h]
129
.text:00007FF778F013DE inc     eax
130
.text:00007FF778F013E0 mov     [rsp+18h], eax
131
.text:00007FF778F013E4
132
.text:00007FF778F013E4 loc_7FF778F013E4:                       ; CODE XREF: .text:00007FF778F013D8↑j
133
.text:00007FF778F013E4 mov     eax, [rsp+20h]
134
.text:00007FF778F013E8 cmp     [rsp+18h], eax
135
.text:00007FF778F013EC jnb     loc_7FF778F014BE
136
.text:00007FF778F013F2 movzx   eax, byte ptr [rsp]
137
.text:00007FF778F013F6 inc     eax
138
.text:00007FF778F013F8 cdq
139
.text:00007FF778F013F9 and     edx, 0FFh
140
.text:00007FF778F013FF add     eax, edx
141
.text:00007FF778F01401 and     eax, 0FFh
142
.text:00007FF778F01406 sub     eax, edx
143
.text:00007FF778F01408 mov     [rsp], al
144
.text:00007FF778F0140B movzx   eax, byte ptr [rsp+1]
145
.text:00007FF778F01410 movzx   ecx, byte ptr [rsp]
146
.text:00007FF778F01414 movzx   ecx, byte ptr [rsp+rcx+40h]
147
.text:00007FF778F01419 add     eax, ecx
148
.text:00007FF778F0141B cdq
149
.text:00007FF778F0141C and     edx, 0FFh
150
.text:00007FF778F01422 add     eax, edx
151
.text:00007FF778F01424 and     eax, 0FFh
152
.text:00007FF778F01429 sub     eax, edx
153
.text:00007FF778F0142B mov     [rsp+1], al
154
.text:00007FF778F0142F movzx   eax, byte ptr [rsp]
155
.text:00007FF778F01433 movzx   eax, byte ptr [rsp+rax+40h]
156
.text:00007FF778F01438 mov     [rsp+3], al
157
.text:00007FF778F0143C movzx   eax, byte ptr [rsp+1]
158
.text:00007FF778F01441 movzx   ecx, byte ptr [rsp]
159
.text:00007FF778F01445 movzx   eax, byte ptr [rsp+rax+40h]
160
.text:00007FF778F0144A mov     [rsp+rcx+40h], al
161
.text:00007FF778F0144E movzx   eax, byte ptr [rsp+1]
162
.text:00007FF778F01453 movzx   ecx, byte ptr [rsp+3]
163
.text:00007FF778F01458 mov     [rsp+rax+40h], cl
164
.text:00007FF778F0145C movzx   eax, byte ptr [rsp]
165
.text:00007FF778F01460 movzx   eax, byte ptr [rsp+rax+40h]
166
.text:00007FF778F01465 movzx   ecx, byte ptr [rsp+1]
167
.text:00007FF778F0146A movzx   ecx, byte ptr [rsp+rcx+40h]
168
.text:00007FF778F0146F add     eax, ecx
169
.text:00007FF778F01471 cdq
170
.text:00007FF778F01472 and     edx, 0FFh
171
.text:00007FF778F01478 add     eax, edx
172
.text:00007FF778F0147A and     eax, 0FFh
173
.text:00007FF778F0147F sub     eax, edx
174
.text:00007FF778F01481 mov     [rsp+4], al
175
.text:00007FF778F01485 movzx   eax, byte ptr [rsp+4]
176
.text:00007FF778F0148A movzx   eax, byte ptr [rsp+rax+40h]
177
.text:00007FF778F0148F mov     [rsp+5], al
178
.text:00007FF778F01493 mov     eax, [rsp+18h]
179
.text:00007FF778F01497 movzx   ecx, byte ptr [rsp+5]
180
.text:00007FF778F0149C mov     rdx, [rsp+260h]
181
.text:00007FF778F014A4 movzx   eax, byte ptr [rdx+rax]
182
.text:00007FF778F014A8 xor     eax, ecx
183
.text:00007FF778F014AA mov     ecx, [rsp+18h]
184
.text:00007FF778F014AE mov     rdx, [rsp+260h]
185
.text:00007FF778F014B6 mov     [rdx+rcx], al
186
.text:00007FF778F014B9 jmp     loc_7FF778F013DA
187
.text:00007FF778F014BE ; ---------------------------------------------------------------------------
188
.text:00007FF778F014BE
189
.text:00007FF778F014BE loc_7FF778F014BE:                       ; CODE XREF: .text:00007FF778F013EC↑j
190
.text:00007FF778F014BE mov     dword ptr [rsp+0Ch], 0
191
.text:00007FF778F014C6 jmp     short loc_7FF778F014D2
192
.text:00007FF778F014C8 ; ---------------------------------------------------------------------------
193
.text:00007FF778F014C8
194
.text:00007FF778F014C8 loc_7FF778F014C8:                       ; CODE XREF: .text:loc_7FF778F0151B↓j
195
.text:00007FF778F014C8 mov     eax, [rsp+0Ch]
196
.text:00007FF778F014CC inc     eax
197
.text:00007FF778F014CE mov     [rsp+0Ch], eax
198
.text:00007FF778F014D2
199
.text:00007FF778F014D2 loc_7FF778F014D2:                       ; CODE XREF: .text:00007FF778F014C6↑j
200
.text:00007FF778F014D2 mov     eax, [rsp+20h]
201
.text:00007FF778F014D6 cmp     [rsp+0Ch], eax
202
.text:00007FF778F014DA jnb     short loc_7FF778F0151D
203
.text:00007FF778F014DC cmp     dword ptr [rsp+0Ch], 0
204
.text:00007FF778F014E1 jz      short loc_7FF778F0151B
205
.text:00007FF778F014E3 movsxd  rax, dword ptr [rsp+0Ch]
206
.text:00007FF778F014E8 mov     ecx, [rsp+0Ch]
207
.text:00007FF778F014EC dec     ecx
208
.text:00007FF778F014EE movsxd  rcx, ecx
209
.text:00007FF778F014F1 mov     rdx, [rsp+260h]
210
.text:00007FF778F014F9 movzx   ecx, byte ptr [rdx+rcx]
211
.text:00007FF778F014FD mov     rdx, [rsp+260h]
212
.text:00007FF778F01505 movzx   eax, byte ptr [rdx+rax]
213
.text:00007FF778F01509 xor     eax, ecx
214
.text:00007FF778F0150B movsxd  rcx, dword ptr [rsp+0Ch]
215
.text:00007FF778F01510 mov     rdx, [rsp+260h]
216
.text:00007FF778F01518 mov     [rdx+rcx], al
217
.text:00007FF778F0151B
218
.text:00007FF778F0151B loc_7FF778F0151B:                       ; CODE XREF: .text:00007FF778F014E1↑j
219
.text:00007FF778F0151B jmp     short loc_7FF778F014C8
220
.text:00007FF778F0151D ; ---------------------------------------------------------------------------
221
.text:00007FF778F0151D
222
.text:00007FF778F0151D loc_7FF778F0151D:                       ; CODE XREF: .text:00007FF778F014DA↑j
223
.text:00007FF778F0151D mov     rcx, [rsp+240h]
224
.text:00007FF778F01525 xor     rcx, rsp
225
.text:00007FF778F01528 call    __security_check_cookie
226
.text:00007FF778F0152D add     rsp, 250h
227
.text:00007FF778F01534 pop     rdi
228
.text:00007FF778F01535 retn
229
.text:00007FF778F01535 ; } // starts at 7FF778F01240
230
.text:00007FF778F01535 ; ---------------------------------------------------------------------------
231
.text:00007FF778F01536 algn_7FF778F01536:                      ; DATA XREF: .pdata:00007FF778F0503C↓o
232
.text:00007FF778F01536 align 20h

1
data:00007FF778F04078 asc_7FF778F04078 db 86h,8Bh,82h,0DCh,31h,'a',10h,'Sk',17h,13h,'[w',19h,84h,0B1h,0E5h,2Ch,0EAh
2
.data:00007FF778F04078                                         ; DATA XREF: main+DA↑o
3
.data:00007FF778F0408B                 db 97h,0D8h,0C1h,0C4h,0F4h,'*',0E6h,8Bh,0D9h,17h,')',0D3h,30h

1
def reverse_smc_algorithm(key, encrypted_data):
2
    key_bytes = key.encode('ascii')
3
    if len(key_bytes) != 4:
4
        raise ValueError("密钥必须是4字节")
5

6
    encrypted_bytes = encrypted_data
7

8
    temp_data = list(encrypted_bytes)
9
    for i in range(len(temp_data) - 1, 0, -1):
10
        temp_data[i] = temp_data[i] ^ temp_data[i-1]
11

12
    s_box = list(range(256))
13

14
    processed_key = []
15
    for i in range(256):
16
        processed_key.append((key_bytes[i % 4] ^ 0x11) & 0xFF)
17

18
    j = 0
19
    for i in range(256):
20
        j = (j + s_box[i] + processed_key[i]) & 0xFF
21
        s_box[i], s_box[j] = s_box[j], s_box[i]
22

23
    i = j = 0
24
    output = []
25

26
    for byte_val in temp_data:
27
        i = (i + 1) & 0xFF
28
        j = (j + s_box[i]) & 0xFF
29
        s_box[i], s_box[j] = s_box[j], s_box[i]
30

31
        keystream_byte = s_box[(s_box[i] + s_box[j]) & 0xFF]
32
        decrypted_byte = byte_val ^ keystream_byte
33
        output.append(decrypted_byte)
34

35
    return bytes(output)
36

37
def solve():
38
    key = "LYLY"
39

40
    target_data = bytes([0x86, 0x8B, 0x82, 0xDC, 0x31, 0x61, 0x10, 0x53, 0x6B, 0x17, 0x13, 0x5B, 0x77, 0x19, 0x84, 0xB1, 0xE5, 0x2C, 0xEA, 0x97, 0xD8, 0xC1, 0xC4, 0xF4, 0x2A, 0xE6, 0x8B, 0xD9, 0x17, 0x29, 0xD3, 0x30])
41

42
    decrypted = reverse_smc_algorithm(key, target_data)
43
    flag = decrypted.decode('ascii', errors='ignore').rstrip('\x00')
44

45
    print(f"Flag: {flag}")
46
    return flag
47

48
if __name__ == "__main__":
49
    solve()

1
with open("libandroidchallenge.so.enc", "rb") as f:
2
    data = f.read()
3
with open("libandroidchallenge.so", "wb") as f:
4
    encheader = b"\x2D\x6e\x7E\x31"
5
    elfheader = b"\x7f\x45\x4c\x46"
6
    key = []
7
    for i in range(len(encheader)):
8
        key.append((encheader[i] ^ elfheader[i]) - i) #反推用户名
9
    print("key: ", bytes(key))
10
    f.write(bytes([ data[i] ^ ((key[i % len(key)] + i) & 0xff) for i in
11
range(len(data)) ])) # 解密so文件
12
print("done")

1
function hookenc(intervalId){
2
    try {
3
// 获取目标 so 模块（libandroidchallenge.so）
4
        var md = Process.getModuleByName("libandroidchallenge.so");
5
// 获取模块的基地址。
6

7
        var mdBase = md.base;
8
//目标加密函数的相对偏移地址（通过ida反汇编得到）
9
// 这里 0x028018 是arm64架构下 Encrypt 函数的偏移；在x86_x64架构下是0x26FA0
10
        var funcAddr = 0x028018;
11
// 一旦成功找到模块，就清除定时器，避免重复 hook
12
        clearInterval(intervalId);
13
// 使用 Interceptor.attach 在目标函数入口处挂钩
14
// 第一个参数是“目标函数的真实内存地址”
15
        Interceptor.attach(mdBase.add(funcAddr), {
16
// onEnter：在目标函数刚进入时触发（可以获取参数）
17
            onEnter: function (args) {
18
// 目标函数的第三个参数（args[2]）是密钥的地址
19
// Frida 的 args 数组对应函数的参数列表：
20
// args[0] → 第1个参数，args[1] → 第2个参数 .
21
            var keyAddr = args[2];
22
// 从密钥地址处读取16个字节内容（因为 key 是16字节）
23
            var key = keyAddr.readByteArray(16);
24
//打印读取到的 key（会以十六进制 dump 的形式显示）
25
            console.log("key:\n", key);
26
        },
27
// onLeave：在目标函数**返回之后**触发
28
// 这里我们没有对返回值做处理，所以留空
29
        onLeave: function (retval) { }
30
    });
31
}
32
    catch(e){
33
// 9. 如果在获取模块或 hook 过程中出错（比如so 还没加载），就打印错误信息
34
        console.log(e);
35
    }
36
}
37
// 刚开始so没有加载，如果直接 hook 可能会报错“找不到模块”，每隔1秒检查一次，直到成功为止
38
const intervalId = setInterval(() => {
39
    hookenc(intervalId);
40
}, 1000);

1
key:
2
/           0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F 0123456789ABCDEF
3
/ 00000000 5b 34 07 0c 6e e7 9f d8 ab 2f a6 db 12 4f 10 f9 [4 .n..../ .O .

1
function callDecrypt(){
2
// 获取名为 "libandroidchallenge.so" 的模块（也就是目标 so 动态库）
3
   var md = Process.getModuleByName("libandroidchallenge.so");
4
//获取这个模块的基地址。so 文件加载到内存后，会有一个实际的起始地址，这就是 base
5
   var mdBase = md.base; // 获取模块的基地址
6
// 计算目标解密函数的实际地址：
7
// 0x286F8 是arm64架构下解密函数相对偏移;在x86_x64下是0x275E0
8
// 使用 mdBase.add(偏移) 得到解密函数在内存中的真实地址
9
// 然后用 NativeFunction 创建一个可以直接调用的 JS 函数。
10
// 返回类型：'pointer'（指针）
11
// 参数类型：['pointer', 'int', 'pointer'] → (输入数据指针, 输入长度, 密钥指针)
12
   var DecryptFunc = new NativeFunction(mdBase.add(0x286F8), 'pointer',
13
['pointer', 'int', 'pointer']);
14
// 分配一块内存空间，用来存放要解密的密文数据（大小 100 字节，足够存32字节）
15
   var input = Memory.alloc(100);
16
// 再分配一块内存空间，用来存放解密使用的 key（同样分配 100 字节）
17
   var key = Memory.alloc(100);
18
// 定义密文数组（32 个字节）：
19
// 这些字节就是程序中实际被加密的数据
20
   var inputBytes = [
21
       0xA8, 0xD1, 0xFE, 0xD6, 0x83, 0xE5, 0xD4, 0x5F,
22
       0xA5, 0x96, 0x9C, 0xDA, 0xD3, 0x6D, 0x5B, 0x35,
23
       0x60, 0x7C, 0x02, 0xE4, 0x92, 0x35, 0xF8, 0xA0,
24
       0x3A, 0x9B, 0xBC, 0x48, 0xEC, 0x48, 0x24, 0xDE
25
    ];
26
// 密文的实际长度（这里是32字节）
27
   var inputlen = 32;
28
// 定义密钥数组（16 个字节）
29
   var keyBytes = [
30
       0x5B, 0x34, 0x07, 0x0C, 0x6E, 0xE7, 0x9F, 0xD8,
31
       0xAB, 0x2F, 0xA6, 0xDB, 0x12, 0x4F, 0x10, 0xF9
32
   ];
33
// 将 keyBytes 逐字节写入到之前分配的 key 内存中
34
   for (var i = 0; i < 16; i++) {
35
       key.add(i).writeU8(keyBytes[i]);
36
   }
37
// 将 inputBytes 逐字节写入到 input 内存中
38
   for (var i = 0; i < 32; i++) {
39
       input.add(i).writeU8(inputBytes[i]);
40
   }
41
}
42
// 调用解密函数，传入参数：
43
// - input：密文数据的内存地址
44
// - inputlen：密文长度
45
// - key：密钥的内存地址
46
//
47
// 解密函数执行后，返回值是一个指向解密结果的指针
48
var res = DecryptFunc(input, inputlen, key);
49
// 从返回的指针位置，读取 32 字节的解密结果数据
50
var resbyte = res.readByteArray(32);
51
// 打印解密后的字节内容
52
console.log("decrypt resbyte:\n", resbyte);

1
Java.perform(function () {
2
    let NativeLoader = Java.use("com.huanghunr.androidchallenge.NativeLoader");
3
    let instance = NativeLoader.INSTANCE.value; // 拿到单例对象
4
    NativeLoader.ivGen.implementation = function () {
5
        let result = instance.ivGen(); // 调用单例对象的方法
6
        console.log("ivGen result =", JSON.stringify(result));
7
        return result;
8
    };
9
});
10
// 主动调用
11
function getiv(){
12
   let NativeLoader =
13
Java.use("com.huanghunr.androidchallenge.NativeLoader").$new();
14
   var result = NativeLoader.ivGen();
15
   console.log("ivGen result =", JSON.stringify(result));
16
   return result;
17
}

1
iv = [43,-35,-113,-32,-104,-91,31,35,-49,125,-42,17,2,83,121,73]
2
encdata = bytes.fromhex("74 89 e7 d3 c7 d2 2f 51 a3 19 89 5e 64 0c 39 27 4f af e0 89 fc fa 2e 16 90 1c bb 51 78 72 17 2e".replace(" ", ""))
3

4
res = []
5
for i in range(len(encdata)):
6
    res.append(encdata[i] ^ iv[i % len(iv)] & 0xff)
7
print(bytes(res).decode())

1
void unnamed_function_22(undefined4 param1,undefined4 param2,undefined4 param3)
2

3
{
4
    int iVar1;
5
    undefined4 uVar2;
6
    int iVar3;
7
    undefined4 uVar4;
8
    uint uVar5;
9
    undefined4 uVar6;
10
    undefined4 uVar7;
11
    undefined1 auStack_24 [4];
12
    undefined1 auStack_20 [4];
13
    undefined1 auStack_1c [4];
14
    undefined1 auStack_18 [4];
15
    undefined1 auStack_14 [4];
16
    undefined1 auStack_10 [4];
17
    undefined1 auStack_c [4];
18
    undefined1 auStack_8 [4];
19
    undefined1 auStack_4 [4];
20

21
    unnamed_function_23(param1,auStack_4);
22
    unnamed_function_24(param2,auStack_8);
23
    unnamed_function_25(param3,auStack_c);
24
    unnamed_function_26(0x4c,auStack_20);
25
    unnamed_function_27(0,auStack_18);
26
    iVar1 = unnamed_function_28(auStack_4);
27
    uVar2 = unnamed_function_29(auStack_8);
28
    iVar3 = unnamed_function_30(uVar2,1);
29
    uVar2 = unnamed_function_31(iVar1 + iVar3 * 4);
30
    unnamed_function_32(uVar2,auStack_14);
31
    do {
32
        uVar2 = unnamed_function_33(auStack_18);
33
        uVar2 = unnamed_function_34(uVar2,0x1ce4e5b9);
34
        unnamed_function_35(uVar2,auStack_18);
35
        uVar2 = unnamed_function_36(auStack_18);
36
        uVar2 = unnamed_function_37(uVar2,2);
37
        uVar2 = unnamed_function_38(uVar2,3);
38
        unnamed_function_39(uVar2,auStack_24);
39
        unnamed_function_40(0,auStack_1c);
40
        while( true ) {
41
            uVar2 = unnamed_function_41(auStack_1c);
42
            uVar4 = unnamed_function_42(auStack_8);
43
            uVar4 = unnamed_function_43(uVar4,1);
44
            uVar5 = unnamed_function_44(uVar2,uVar4);
45
            if ((uVar5 & 1) == 0) break;
46
            iVar1 = unnamed_function_45(auStack_4);
47
            uVar2 = unnamed_function_46(auStack_1c);
48
            iVar3 = unnamed_function_47(uVar2,1);
49
            uVar2 = unnamed_function_48(iVar1 + iVar3 * 4);
50
            unnamed_function_49(uVar2,auStack_10);
51
            uVar2 = unnamed_function_50(auStack_14);
52
            uVar2 = unnamed_function_51(uVar2,6);
53
            uVar4 = unnamed_function_52(auStack_10);
54
            uVar4 = unnamed_function_53(uVar4,1);
55
            uVar2 = unnamed_function_54(uVar2,uVar4);
56
            uVar4 = unnamed_function_55(auStack_10);
57
            uVar4 = unnamed_function_56(uVar4,5);
58
            uVar6 = unnamed_function_57(auStack_14);
59
            uVar6 = unnamed_function_58(uVar6,6);
60
            uVar4 = unnamed_function_59(uVar4,uVar6);
61
            uVar2 = unnamed_function_60(uVar2,uVar4);
62
            uVar4 = unnamed_function_61(auStack_18);
63
            uVar6 = unnamed_function_62(auStack_10);
64
            uVar4 = unnamed_function_63(uVar4,uVar6);
65
            iVar1 = unnamed_function_64(auStack_c);
66
            uVar6 = unnamed_function_65(auStack_1c);
67
            uVar6 = unnamed_function_66(uVar6,3);
68
            uVar7 = unnamed_function_67(auStack_24);
69
            iVar3 = unnamed_function_68(uVar6,uVar7);
70
            uVar6 = unnamed_function_69(iVar1 + iVar3 * 4);
71
            uVar7 = unnamed_function_70(auStack_14);
72
            uVar6 = unnamed_function_71(uVar6,uVar7);
73
            uVar4 = unnamed_function_72(uVar4,uVar6);
74
            uVar2 = unnamed_function_73(uVar2,uVar4);
75
            iVar1 = unnamed_function_74(auStack_4);
76
            iVar3 = unnamed_function_75(auStack_1c);
77
            iVar1 = iVar1 + iVar3 * 4;
78
            uVar4 = unnamed_function_76(iVar1);
79
            uVar2 = unnamed_function_77(uVar4,uVar2);
80
      unnamed_function_78(uVar2,iVar1);
81
      unnamed_function_79(uVar2,auStack_14);
82
      uVar2 = unnamed_function_80(auStack_1c);
83
      uVar2 = unnamed_function_81(uVar2,1);
84
      unnamed_function_82(uVar2,auStack_1c);
85
    }
86
    uVar2 = unnamed_function_83(auStack_4);
87
    uVar2 = unnamed_function_84(uVar2);
88
    unnamed_function_85(uVar2,auStack_10);
89
    uVar2 = unnamed_function_86(auStack_14);
90
    uVar2 = unnamed_function_87(uVar2,6);
91
    uVar4 = unnamed_function_88(auStack_10);
92
    uVar4 = unnamed_function_89(uVar4,1);
93
    uVar2 = unnamed_function_90(uVar2,uVar4);
94
    uVar4 = unnamed_function_91(auStack_10);
95
    uVar4 = unnamed_function_92(uVar4,5);
96
    uVar6 = unnamed_function_93(auStack_14);
97
    uVar6 = unnamed_function_94(uVar6,6);
98
    uVar4 = unnamed_function_95(uVar4,uVar6);
99
    uVar2 = unnamed_function_96(uVar2,uVar4);
100
    uVar4 = unnamed_function_97(auStack_18);
101
    uVar6 = unnamed_function_98(auStack_10);
102
    uVar4 = unnamed_function_99(uVar4,uVar6);
103
    iVar1 = unnamed_function_100(auStack_c);
104
    uVar6 = unnamed_function_101(auStack_1c);
105
    uVar6 = unnamed_function_102(uVar6,3);
106
    uVar7 = unnamed_function_103(auStack_24);
107
    iVar3 = unnamed_function_104(uVar6,uVar7);
108
    uVar6 = unnamed_function_105(iVar1 + iVar3 * 4);
109
    uVar7 = unnamed_function_106(auStack_14);
110
    uVar6 = unnamed_function_107(uVar6,uVar7);
111
    uVar4 = unnamed_function_108(uVar4,uVar6);
112
    uVar2 = unnamed_function_109(uVar2,uVar4);
113
    iVar1 = unnamed_function_110(auStack_4);
114
    uVar4 = unnamed_function_111(auStack_8);
115
    iVar3 = unnamed_function_112(uVar4,1);
116
    iVar1 = iVar1 + iVar3 * 4;
117
    uVar4 = unnamed_function_113(iVar1);
118
    uVar2 = unnamed_function_114(uVar4,uVar2);
119
    unnamed_function_115(uVar2,iVar1);
120
    unnamed_function_116(uVar2,auStack_14);
121
    uVar2 = unnamed_function_117(auStack_20);
122
    uVar2 = unnamed_function_118(uVar2,0xffffffff);
123
    unnamed_function_119(uVar2,auStack_20);
124
    uVar5 = unnamed_function_120(uVar2,0);
125
  } while ((uVar5 & 1) != 0);
126
  return;
127
}

1
void xxtea(undefined4 param1,undefined4 param2,undefined4 param3)
2
{
3
undefined4 uVar1;
4
int iVar2;
5
undefined4 uVar3;
6
uint uVar4;
7
int key;
8
undefined4 p;
9
undefined4 e;
10
undefined e_1 [4];
11
undefined round [4];
12
undefined i [4];
13
undefined sum [4];
14
undefined z [4];
15
undefined auStack_10 [4];
16
undefined inputKey [4];
17
undefined len [4];
18
undefined input [4];
19
a2b(param1,input);
20
a2b(param2,len);
21
a2b(param3,inputKey);
22
a2b(0x4c,round);
23
a2b(0,sum);
24
key = gv(input);
25
uVar1 = gv(len);
26
iVar2 = sub(uVar1,1);
27
uVar1 = gv(key + iVar2 * 4);
28
a2b(uVar1,z);
29
do {
30
uVar1 = gv(sum);
31
uVar1 = add(uVar1,0x1ce4e5b9);
32
a2b(uVar1,sum);
33
uVar1 = gv(sum);
34
uVar1 = ror(uVar1,2);
35
uVar1 = and(uVar1,3);
36
a2b(uVar1,e_1);
37
a2b(0,i);
38
while( true ) {
39
uVar1 = gv(i);
40
uVar3 = gv(len);
41
uVar3 = sub(uVar3,1);
42
uVar4 = AlowB(uVar1,uVar3);
43
if ((uVar4 & 1) = 0) break;
44
key = gv(input);
45
uVar1 = gv(i);
46
iVar2 = add(uVar1,1);
47
uVar1 = gv(key + iVar2 * 4);
48
a2b(uVar1,auStack_10);
49
uVar1 = gv(z);
50
uVar1 = ror(uVar1,6);
51
uVar3 = gv(auStack_10);
52
uVar3 = rol(uVar3,1);
53
uVar1 = xor(uVar1,uVar3);
54
uVar3 = gv(auStack_10);
55
uVar3 = ror(uVar3,5);
56
p = gv(z);
57
p = rol(p,6);
58
uVar3 = xor(uVar3,p);
59
uVar1 = add(uVar1,uVar3);
60
uVar3 = gv(sum);
61
p = gv(auStack_10);
62
uVar3 = xor(uVar3,p);
63
key = gv(inputKey);
64
p = gv(i);
65
p = and(p,3);
66
e = gv(e_1);
67
iVar2 = xor(p,e);
68
p = gv(key + iVar2 * 4);
69
e = gv(z);
70
p = xor(p,e);
71
uVar3 = add(uVar3,p);
72
uVar1 = xor(uVar1,uVar3);
73
key = gv(input);
74
iVar2 = gv(i);
75
key = key + iVar2 * 4;
76
uVar3 = gv(key);
77
uVar1 = add(uVar3,uVar1);
78
a2b(uVar1,key);
79
a2b(uVar1,z);
80
uVar1 = gv(i);
81
大概命名完后正式分析check函数。
82
uVar1 = gv(uVar1,1);
83
a2b(uVar1,i);
84
}
85
uVar1 = unnamed_function_83(input); /后面和上面差不多
86
uVar1 = unnamed_function_84(uVar1);
87
unnamed_function_85(uVar1,auStack_10);
88
uVar1 = unnamed_function_86(z);
89
uVar1 = unnamed_function_87(uVar1,6);
90
uVar3 = unnamed_function_88(auStack_10);
91
uVar3 = unnamed_function_89(uVar3,1);
92
uVar1 = unnamed_function_90(uVar1,uVar3);
93
uVar3 = unnamed_function_91(auStack_10);
94
uVar3 = unnamed_function_92(uVar3,5);
95
p = unnamed_function_93(z);
96
p = unnamed_function_94(p,6);
97
uVar3 = unnamed_function_95(uVar3,p);
98
uVar1 = unnamed_function_96(uVar1,uVar3);
99
uVar3 = unnamed_function_97(sum);
100
p = unnamed_function_98(auStack_10);
101
uVar3 = unnamed_function_99(uVar3,p);
102
key = unnamed_function_100(inputKey);
103
p = unnamed_function_101(i);
104
p = unnamed_function_102(p,3);
105
e = unnamed_function_103(e_1);
106
iVar2 = unnamed_function_104(p,e);
107
p = unnamed_function_105(key + iVar2 * 4);
108
e = unnamed_function_106(z);
109
p = unnamed_function_107(p,e);
110
uVar3 = unnamed_function_108(uVar3,p);
111
uVar1 = unnamed_function_109(uVar1,uVar3);
112
key = unnamed_function_110(input);
113
uVar3 = unnamed_function_111(len);
114
iVar2 = unnamed_function_112(uVar3,1);
115
key = key + iVar2 * 4;
116
uVar3 = unnamed_function_113(key);
117
uVar1 = unnamed_function_114(uVar3,uVar1);
118
unnamed_function_115(uVar1,key);
119
unnamed_function_116(uVar1,z);
120
uVar1 = unnamed_function_117(round);
121
uVar1 = unnamed_function_118(uVar1,0xffffffff);
122
unnamed_function_119(uVar1,round);
123
uVar4 = unnamed_function_120(uVar1,0);
124
} while ((uVar4 & 1) = 0);
125
return;
126
}

1
        0x95,0xB5,0xE4,0x59, 0xCF,0xD4,0xE1,0x51,
2
        0x18,0x84,0x37,0xAA, 0xE6,0xF7,0x65,0x18,
3
        0x93,0x41,0x4A,0x3E, 0x7C,0x37,0xD0,0x6B,
4
        0xD7,0x20,0x86,0x63, 0x10,0x83,0x63,0x7B,
5
        0xA8,0x11,0x9B,0x24, 0x3D,0x26,0xCD,0x6B

1
#!/usr/bin/env python3
2
from typing import List
3
def u32(x): return x & 0xFFFFFFFF
4
def dec_btea(v: List[int], n: int, key: List[int]) -> List[int]:
5
    delta=0x1ce4e5b9; rounds=0x4c; s=(rounds*delta)&0xFFFFFFFF; y=v[0]
6
    for _ in range(rounds):
7
        e=(s>>2)&3
8
        for p in range(n-1,0,-1):
9
            z=v[p-1]
10
            t=(((z>>6)^((y<<1)&0xFFFFFFFF))+((y>>5)^((z<<6)&0xFFFFFFFF)))&0xFFFFFFFF
11
            t^=((s^y)+(key[(p&3)^e]^z))&0xFFFFFFFF
12
            v[p]=u32(v[p]-t); y=v[p]
13
        z=v[n-1]
14
        t=(((z>>6)^((y<<1)&0xFFFFFFFF))+((y>>5)^((z<<6)&0xFFFFFFFF)))&0xFFFFFFFF
15
        t^=((s^y)+(key[e]^z))&0xFFFFFFFF
16
        v[0]=u32(v[0]-t); s=u32(s-delta); y=v[0]
17
    return v
18
def b2u32le(b: bytes) -> List[int]: return [int.from_bytes(b[i:i+4],'little') for i in range(0,len(b),4)]
19
def u322ble(v: List[int]) -> bytes: return b''.join(x.to_bytes(4,'little') for x in v)
20
ct=bytes([0x95,0xB5,0xE4,0x59,0xCF,0xD4,0xE1,0x51,0x18,0x84,0x37,0xAA,0xE6,0xF7,0x65,0x18,0x93,0x41,0x4A,0x3E,0x7C,0x37,0xD0,0x6B,0xD7,0x20,0x86,0x63,0x10,0x83,0x63,0x7B,0xA8,0x11,0x9B,0x24,0x3D,0x26,0xCD,0x6B])
21
key=b2u32le(bytes([0xF3,0x76,0x8A,0xE6,0xB3,0xA7,0x0A,0x93,0xE5,0x3E,0xC0,0x61,0x25,0xE7,0xA0,0xD3]))
22
v=b2u32le(ct)
23
pt=u322ble(dec_btea(v,len(v),key))[:len(ct)]
24
print(pt.decode('latin1'))

1
  0x4D, 0x7A, 0x3E, 0x7A, 0x84, 0xFF, 0x51, 0xB1, 0x31, 0x97,
2
  0xFB, 0xDC, 0x2B, 0xA4, 0xCD, 0xFB, 0x85, 0xCD, 0x0A, 0x2B,
3
  0xBD, 0x91, 0xCF, 0x69, 0xBA, 0x2B, 0x70, 0xD5, 0x43, 0xB8,
4
  0x3E, 0x1F

1
import struct
2

3
def xtea_decrypt_block(v0, v1, key):
4
    DELTA = 0x9E3779B9
5
    sum_ = (DELTA * 32) & 0xFFFFFFFF
6
    for _ in range(32):
7
        v1 = (v1 - (((v0 << 4 ^ v0 >> 5) + v0) ^ (sum_ + key[(sum_ >> 11) & 3]))) & 0xFFFFFFFF
8
        sum_ = (sum_ - DELTA) & 0xFFFFFFFF
9
        v0 = (v0 - (((v1 << 4 ^ v1 >> 5) + v1) ^ (sum_ + key[sum_ & 3]))) & 0xFFFFFFFF
10
    return v0, v1
11

12
k0 = 1495531287
13
k1 = (-1758678609) & 0xFFFFFFFF
14
k2 = (-880611118) & 0xFFFFFFFF
15
k3 = (-38157364) & 0xFFFFFFFF
16
key = [k0, k1, k2, k3]
17
key_bytes = struct.pack('<IIII', *key)
18
whitening = key_bytes[8:16][::-1]
19

20
ciphertext = bytes([0x4D, 0x7A, 0x3E, 0x7A, 0x84, 0xFF, 0x51, 0xB1, 0x31, 0x97, 0xFB, 0xDC, 0x2B, 0xA4, 0xCD, 0xFB, 0x85, 0xCD, 0x0A, 0x2B, 0xBD, 0x91, 0xCF, 0x69, 0xBA, 0x2B, 0x70, 0xD5, 0x43, 0xB8, 0x3E, 0x1F])
21

22
plaintext = b''
23
for i in range(0, len(ciphertext), 8):
24
    block = ciphertext[i:i+8]
25
    temp = bytes(b ^ w for b, w in zip(block, whitening))
26
    v0, v1 = struct.unpack('>II', temp)
27
    v0, v1 = xtea_decrypt_block(v0, v1, key)
28
    pt_block = struct.pack('<II', v0, v1)
29
    plaintext += pt_block
30

31
print(plaintext.decode('ascii', errors='ignore').strip())

1
char __fastcall sub_1400011C0(char a1)
2
{
3
  char result; // al
4
  unsigned int v2; // [rsp+0h] [rbp-28h]
5

6
  switch ( a1 )
7
  {
8
    case 'a':
9
      v2 = dword_1400051C4 - 1;
10
      break;
11
    case 'd':
12
      v2 = dword_1400051C4 + 1;
13
      break;
14
    case 's':
15
      v2 = dword_1400051C4 + 18;
16
      break;
17
    case 'w':
18
      v2 = dword_1400051C4 - 18;
19
      break;
20
    default:
21
      return 0;
22
  }
23
  if ( v2 >= 0x144 )
24
    return 0;
25
  switch ( asc_140005080[v2] )
26
  {
27
    case 0:
28
      dword_1400051C4 = v2;
29
      result = 0;
30
      break;
31
    case 4:
32
      if ( asc_140005080[79] )
33
        --asc_140005080[79];
34
      result = 0;
35
      break;
36
    case 5:
37
      if ( asc_140005080[195] )
38
        --asc_140005080[195];
39
      result = 0;
40
      break;
41
    case 6:
42
      if ( asc_140005080[281] )
43
        --asc_140005080[281];
44
      result = 0;
45
      break;
46
    case 9:
47
      result = 0;
48
      break;
49
    case 100:
50
      dword_1400051C4 = v2;
51
      result = 1;
52
      break;
53
    default:
54
      result = 0;
55
      break;
56
  }
57
  return result;
58
}

1
    9,   9,   9,   9,   9,   9,   9,   9,   9,   9,
2
    9,   9,   9,   9,   9,   9,   9,   9,   9,   0,
3
    9,   4,   0,   0,   0,   0,   9,   0,   0,   0,
4
    0,   5,   0,   0,   9,   9,   9,   0,   9,   9,
5
    9,   0,   9,   0,   9,   9,   9,   9,   9,   0,
6
    9,   0,   9,   9,   9,   0,   0,   0,   0,   0,
7
    9,   0,   9,   0,   0,   0,   9,   0,   9,   0,
8
    9,   9,   9,   9,   9,   9,   9,   9,   9,   1,
9
    9,   0,   9,   0,   9,   0,   9,   9,   9,   9,
10
    9,   0,   0,   0,   9,   0,   9,   0,   0,   0,
11
    9,   0,   9,   0,   0,   0,   9,   9,   9,   0,
12
    9,   0,   9,   0,   9,   9,   9,   9,   9,   0,
13
    9,   0,   9,   0,   9,   9,   9,   0,   9,   0,
14
    0,   0,   0,   0,   9,   0,   0,   0,   9,   0,
15
    9,   0,   9,   9,   9,   0,   9,   9,   9,   9,
16
    9,   9,   9,   0,   9,   9,   9,   9,   9,   0,
17
    9,   9,   9,   6,   9,   0,   0,   0,   0,   0,
18
    9,   0,   0,   0,   0,   0,   0,   0,   9,   9,
19
    9,   0,   9,   0,   9,   9,   9,   0,   9,   9,
20
    9,   9,   9,   9,   9,   2,   9,   9,   9,   0,
21
    9,   0,   0,   0,   9,   0,   0,   0,   9,   0,
22
    0,   0,   0,   0,   9,   9,   9,   0,   9,   9,
23
    9,   0,   9,   9,   9,   0,   9,   0,   9,   9,
24
    9,   9,   9,   9,   9,   0,   0,   0,   9,   0,
25
    0,   0,   9,   0,   0,   0,   9,   0,   0,   0,
26
    9,   9,   9,   0,   9,   0,   9,   9,   9,   0,
27
    9,   9,   9,   9,   9,   0,   9,   0,   9,   9,
28
    9,   0,   9,   0,   0,   0,   0,   0,   0,   0,
29
    0,   3,   0,   0,   9,   0,   0,   9,   9,   9,
30
    9,   9,   9,   9,   9,   9,   9,   9,   9,   9,
31
    9,   9,   9,   9, 100,   9,   9,   9,   9,   9,
32
    9,   9,   9,   9,   9,   9,   9,   9,   9,   9,
33
    9,   9,   9,   9