虚假的APK,权当我学习python了:
net程序一个:
dnspy分析源码: 主逻辑就三,先读取自己,然后search关键字符串得到最后输出
using System; using System.Diagnostics; using System.IO; using System.Net.Sockets; using System.Text; namespace Rev_100 { // Token: 0x02000002 RID: 2 internal class Program { // Token: 0x06000001 RID: 1 RVA: 0x00002050 File Offset: 0x00000250 private static void Main(string[] args) { string hostname = "127.0.0.1"; int port = 31337; TcpClient tcpClient = new TcpClient(); try { Console.WriteLine("Connecting..."); tcpClient.Connect(hostname, port); } catch (Exception) { Console.WriteLine("Cannot connect! Fail!"); return; } Socket client = tcpClient.Client; string text = "Super Secret Key"; //硬编码字符 string text2 = Program.read(); //调用read函数得到text2 client.Send(Encoding.ASCII.GetBytes("CTF{")); foreach (char x in text) // { client.Send(Encoding.ASCII.GetBytes(Program.search(x, text2))); //text2里面搜索text1里面的字符串 } client.Send(Encoding.ASCII.GetBytes("}")); client.Close(); tcpClient.Close(); Console.WriteLine("Success!"); } // Token: 0x06000002 RID: 2 RVA: 0x0000213C File Offset: 0x0000033C private static string read() { string fileName = Process.GetCurrentProcess().MainModule.FileName; //获取当前进程 string[] array = fileName.Split(new char[] { '\' }); string path = array[array.Length - 1]; string result = ""; using (StreamReader streamReader = new StreamReader(path)) { result = streamReader.ReadToEnd(); //读取整个文件 } return result; } // Token: 0x06000003 RID: 3 RVA: 0x000021B0 File Offset: 0x000003B0 private static string search(char x, string text) { int length = text.Length; for (int i = 0; i < length; i++) { if (x == text[i]) { int value = i * 1337 % 256; //如果字符存在就下标变换一下得到返回 return Convert.ToString(value, 16).PadLeft(2, '0'); //uincode输出 } } return "??"; } } }
keygen:
# coding=gbk text='Super Secret Key' text2 = open('D:\4122e391e1574335907f8e2c4f438d0e.exe','r',encoding = 'unicode-escape').read() flag = "" num = len(text2) def search(i,text2,num): for j in range(0,num): if i == text2[j]: x = j * 1337 % 256 return '%02x' % x for i in text: flag += search(i,text2,num) print("CTF{"+ flag + '}')
CTF{7eb67b0bb4427e0b43b40b6042670b55}