一枚小小的 Android Crackme

gy3026

[Java] 纯文本查看 复制代码

public MainActivity() {
        super();
        this.handler = new Handler() {
            public void handleMessage(Message msg) {
                super.handleMessage(msg);
                if(msg.getData().getString("user") == null) {
                    goto label_10;
                }
                else if(msg.getData().getString("pass") != null) {
                    switch(msg.getData().getString("user").hashCode() + msg.getData().getString("pass")
                            .hashCode()) {
                        case 931511726: {
                            Toast.makeText(MainActivity.this.getApplicationContext(), "success!", 1)
                                    .show();
                            return;
                        label_10:
                            Toast.makeText(MainActivity.this.getApplicationContext(), "请输入账户和密码！", 1)
                                    .show();
                            return;
                        }
                        default: {
                            Toast.makeText(MainActivity.this.getApplicationContext(), "failed!", 1).
                                    show();
                            return;
                        }
                    }
                }
                else {
                    goto label_10;
                }
            }
        };
    }

菜鸟一枚，不知道关键位置在不在这里

gy3026

a813630449 发表于 2015-12-30 14:21
主要是找出来正确的用户名和密码

菜鸟，错了千万不要笑我
因为看不懂代码，菜鸟表达下自己看法
switch里面是user和pass组成的哈希值【不懂，可能是等于sucess那个case就跳转了，所以我觉得应该要找到sucess那个case的值就行】

[Java] 纯文本查看 复制代码

msg.getData().getString("user").hashCode() +msg.getData().getString("pass").hashCode()

这句对应smali是

   

[Java] 纯文本查看 复制代码

invoke-virtual {p1}, Landroid/os/Message;->getData()Landroid/os/Bundle;

    move-result-object v1

    const-string v2, "user"

    invoke-virtual {v1, v2}, Landroid/os/Bundle;->getString(Ljava/lang/String;)Ljava/lang/String;

    move-result-object v1

    invoke-virtual {v1}, Ljava/lang/String;->hashCode()I

    move-result v1

    invoke-virtual {p1}, Landroid/os/Message;->getData()Landroid/os/Bundle;

    move-result-object v2

    const-string v3, "pass"

    invoke-virtual {v2, v3}, Landroid/os/Bundle;->getString(Ljava/lang/String;)Ljava/lang/String;

    move-result-object v2

    invoke-virtual {v2}, Ljava/lang/String;->hashCode()I

    move-result v2

    add-int v0, v1, v2

这样的话，获取V1和V2的值应该可以试试【本来想验证一下想法对不对的，木有条件】

获取值的方法我目前有两种想法，都是注入代码，一个是加log,还有一个是加toast，代码都有现成的。

想学动态调试，想学逆向，就是太菜鸟

Avenshy

>Exception in thread "main" b.a.a.e: resource spec: 0x0101032e
>    at b.a.d.a.p.a(Unknown Source)
>    at b.a.d.a.q.a(Unknown Source)
>    at org.c.b.b.c.a(Unknown Source)
>    at com.rover12421.shaka.a.b.p.a(Unknown Source)
>    at b.a.d.a.p.b(Unknown Source)
>    at b.a.d.a.w.a(Unknown Source)
>    at b.a.d.a.w.a(Unknown Source)
>    at b.a.d.a.a.t.d(Unknown Source)
>    at b.a.d.a.a.t.a(Unknown Source)
>    at b.a.d.a.a.u.h(Unknown Source)
>    at b.a.d.a.a.w.a(Unknown Source)
>    at b.a.d.a.a.w.a(Unknown Source)
>    at b.a.d.a.a(Unknown Source)
>    at b.a.d.a.c(Unknown Source)
>    at b.a.a.b(Unknown Source)
>    at b.a.E.a(Unknown Source)
>    at b.b.a.a(Unknown Source)
>    at b.b.a.a(Unknown Source)
>    at com.rover12421.shaka.cli.Main.main(Unknown Source)

这apk弄的我心好痛

萋小磊

禁止变相上传附件的哦  可以压缩ZIP 在上传  

赶紧修改哦

qtfreet00

计算有点麻烦，hashcode是个毒瘤