ISC2016训练赛 phrackCTF--Smali

测试文件：https://static2.ichunqiu.com/icq/resources/fileupload/phrackCTF/REVERSE/Crackme.smali

参考资料：https://www.cnblogs.com/lz2017/p/6917049.html

1.文件分析

使用SmaliJavaUI反编译文件，得到

 /**
   * Generated by smali2java 1.0.0.558
   * Copyright (C) 2013 Hensence.com
   */

 package net.bluelotus.tomorrow.easyandroid;

 import android.util.Base64;
 import java.io.PrintStream;
 import java.security.NoSuchAlgorithmException;
 import javax.crypto.NoSuchPaddingException;
 import java.security.InvalidKeyException;
 import javax.crypto.IllegalBlockSizeException;
 import javax.crypto.BadPaddingException;
 import javax.crypto.spec.SecretKeySpec;
 import javax.crypto.Cipher;
 import java.security.Key;
 import java.security.GeneralSecurityException;

 public class Crackme {
     private String str2 = "cGhyYWNrICBjdGYgMjAxNg==";

     public Crackme() {
         GetFlag("sSNnx1UKbYrA1+MOrdtDTA==");
     }

     private String GetFlag(String p1) {//将上面两段字符串经过base64解密
         byte[] "content" = Base64.decode(p1.getBytes(), 0x0);
         String "kk" = new String(Base64.decode(str2.getBytes(), 0x0));
         System.out.println(decrypt("content", "kk"));
         return null;
     }

     private String decrypt(byte[] p1, String p2) {//将解密后的序列，一段用来生成key，一段作为被AES加密的字符串。
         String "m" = 0x0;
         try {
             byte[] "keyStr" = p2.getBytes();
             SecretKeySpec "key" = new SecretKeySpec("keyStr", "AES");
             Cipher "cipher" = Cipher.getInstance("AES/ECB/NoPadding");
             "cipher".init(0x2, "key");
             byte[] "result" = "cipher".doFinal(p1);
             return "m";
         } catch(NoSuchPaddingException "e") {
             "e".printStackTrace();
         }
         return  "m";
     }
 }

2.脚本获取

from Crypto.Cipher import AES
import base64

key = base64.b64decode("cGhyYWNrICBjdGYgMjAxNg==")
str1 = base64.b64decode("sSNnx1UKbYrA1+MOrdtDTA==")

cryptor = AES.new(key, AES.MODE_ECB)
result = cryptor.decrypt(str1)
print(result)

3.get flag！

PCTF{Sm4liRiver}