先安卓测试一下，发现输入字符串包含非数字字符时，会报错，然后用procyon-decompiler反汇编，下面我贴出两个重要文件：

com/geekerchina/hi/MainActivity.java

//

// Decompiled by Procyon v0.5.30

//

package com.geekerchina.hi;

import android.view.MenuItem;

import android.view.Menu;

import android.view.View;

import android.view.View$OnClickListener;

import android.widget.EditText;

import android.widget.Button;

import android.os.Bundle;

import android.support.v7.app.AppCompatActivity;

public class MainActivity extends AppCompatActivity

{

@Override

protected void onCreate(final Bundle bundle) {

super.onCreate(bundle);

this.setContentView(2130968603);

((Button)this.findViewById(2131427415)).setOnClickListener((View$OnClickListener)new View$OnClickListener() {

final /* synthetic */ EditText val$Et1 = (EditText)this.findViewById(2131427414);

public void onClick(final View view) {

final int int1 = Integer.parseInt(this.val$Et1.getText().toString());

if (int1 > 10000000 && int1 < 99999999) {

int n = 1;

int n2 = 10000000;

final boolean b = true;

if (Math.abs(int1 / 1000 % 100 - 36) == 3 && int1 % 1000 % 584 == 0) {

int n3 = 0;

int n4;

while (true) {

n4 = (b ? 1 : 0);

if (n3 >= 4) {

break;

}

if (int1 / n % 10 != int1 / n2 % 10) {

n4 = 0;

break;

}

n *= 10;

n2 /= 10;

++n3;

}

if (n4 == 1) {

this.val$Et1.setText((CharSequence)("NJCTF{" + (char)(int1 / 1000000) + (char)(int1 / 10000 % 100) + (char)(int1 / 100 % 100) + "f4n}"));

}

}

}

}

});

}

public boolean onCreateOptionsMenu(final Menu menu) {

this.getMenuInflater().inflate(2131558400, menu);

return true;

}

public boolean onOptionsItemSelected(final MenuItem menuItem) {

return menuItem.getItemId() == 2131427439 || super.onOptionsItemSelected(menuItem);

}

}

com/geekerchina/hi/androidTest.java

//

// Decompiled by Procyon v0.5.30

//

package com.geekerchina.hi;

import android.view.MenuItem;

import android.view.Menu;

import android.view.View;

import android.view.View$OnClickListener;

import android.widget.EditText;

import android.widget.Button;

import android.os.Bundle;

import android.support.v7.app.AppCompatActivity;

public class androidTest extends AppCompatActivity

{

@Override

protected void onCreate(final Bundle bundle) {

super.onCreate(bundle);

this.setContentView(2130968604);

((Button)this.findViewById(2131427415)).setOnClickListener((View$OnClickListener)new View$OnClickListener() {

final /* synthetic */ EditText val$Et1 = (EditText)this.findViewById(2131427414);

public void onClick(final View view) {

final int int1 = Integer.parseInt(this.val$Et1.getText().toString());

if (int1 > 10000000 && int1 < 99999999) {

int n = 1;

int n2 = 10000000;

final boolean b = true;

if (Math.abs(int1 / 1000 % 100 - 36) == 3 && int1 % 1000 % 584 == 0) {

int n3 = 0;

int n4;

while (true) {

n4 = (b ? 1 : 0);

if (n3 >= 3) {

break;

}

if (int1 / n % 10 != int1 / n2 % 10) {

n4 = 0;

break;

}

n *= 10;

n2 /= 10;

++n3;

}

if (n4 == 1) {

this.val$Et1.setText((CharSequence)("NJCTF{have" + (char)(int1 / 1000000) + (char)(int1 / 10000 % 100) + (char)(int1 / 100 % 100 + 10) + "f4n}"));

}

}

}

}

});

}

public boolean onCreateOptionsMenu(final Menu menu) {

this.getMenuInflater().inflate(2131558400, menu);

return true;

}

public boolean onOptionsItemSelected(final MenuItem menuItem) {

return menuItem.getItemId() == 2131427439 || super.onOptionsItemSelected(menuItem);

}

}

上面的代码已经很明确了，我们只需要爆破就行，不必进行代码分析，下面是我的爆破代码：

main.java

public class main {

public static void main(String[] args) {

int int1;

System.out.println("MainActivity.java:");

for (int1 = 10000000; int1 < 99999999; int1++) {

if (int1 > 10000000 && int1 < 99999999) {

int n = 1;

int n2 = 10000000;

final boolean b = true;

if (Math.abs(int1 / 1000 % 100 - 36) == 3 && int1 % 1000 % 584 == 0) {

int n3 = 0;

int n4;

while (true) {

n4 = (b ? 1 : 0);

if (n3 >= 4) {

break;

}

if (int1 / n % 10 != int1 / n2 % 10) {

n4 = 0;

break;

}

n *= 10;

n2 /= 10;

++n3;

}

if (n4 == 1) {

System.out.println("NJCTF{" + (char) (int1 / 1000000) + (char) (int1 / 10000 % 100)

+ (char) (int1 / 100 % 100) + "f4n}");

}

}

}

}

System.out.println();

System.out.println("androidTest.java:");

for (int1 = 10000000; int1 < 99999999; int1++) {

if (int1 > 10000000 && int1 < 99999999) {

int n = 1;

int n2 = 10000000;

final boolean b = true;

if (Math.abs(int1 / 1000 % 100 - 36) == 3 && int1 % 1000 % 584 == 0) {

int n3 = 0;

int n4;

while (true) {

n4 = (b ? 1 : 0);

if (n3 >= 3) {

break;

}

if (int1 / n % 10 != int1 / n2 % 10) {

n4 = 0;

break;

}

n *= 10;

n2 /= 10;

++n3;

}

if (n4 == 1) {

System.out.println("NJCTF{have" + (char) (int1 / 1000000) + (char) (int1 / 10000 % 100)

+ (char) (int1 / 100 % 100 + 10) + "f4n}");

}

}

}

}

}

}

编译执行效果如下：

ex@Ex:~/test/unzip/out/com/geekerchina/hi$ javac main.java

ex@Ex:~/test/unzip/out/com/geekerchina/hi$ java main

MainActivity.java:

NJCTF{05#f4n}

androidTest.java:

NJCTF{have05-f4n}

NJCTF{have05if4n}

生成了3个flag，再根据题目给的提示：“flag格式NJCTF{xxx} 并且 xxx只包含[a-z][A-Z][0-9]”，就可以过滤掉两个错误的flag。

0

0

投票数

文章评分