{"id":232,"date":"2022-11-27T18:57:35","date_gmt":"2022-11-27T10:57:35","guid":{"rendered":"https:\/\/shangwendada.co\/?p=232"},"modified":"2022-11-30T20:44:06","modified_gmt":"2022-11-30T12:44:06","slug":"reverse%e6%94%bb%e9%98%b2%e4%b8%96%e7%95%8capk-%e9%80%86%e5%90%912-netdnspypython%e7%bd%91%e7%bb%9c%e6%9c%8d%e5%8a%a1","status":"publish","type":"post","link":"https:\/\/blog.shangwendada.top\/index.php\/2022\/11\/27\/reverse%e6%94%bb%e9%98%b2%e4%b8%96%e7%95%8capk-%e9%80%86%e5%90%912-netdnspypython%e7%bd%91%e7%bb%9c%e6%9c%8d%e5%8a%a1\/","title":{"rendered":"[Reverse]\u653b\u9632\u4e16\u754cAPK-\u9006\u54112(.net+dnspy+python\u7f51\u7edc\u670d\u52a1)"},"content":{"rendered":"

\u9898\u76ee\u4e0b\u8f7d:\u653b\u9632\u4e16\u754cAPK-\u9006\u54112<\/a><\/h1>\n

\u9898\u89e3<\/h1>\n

\u524d\u671f\u5206\u6790<\/h2>\n

\u67e5\u8be2\u7a0b\u5e8f\u4fe1\u606f<\/strong>
\n

\"file\"<\/div>
\n\u53d1\u73b0\u662f.NET\u7684\u7a0b\u5e8f \u6211\u4eec\u9700\u8981\u4f7f\u7528\u5230\u7684\u8f6f\u4ef6\u5c31\u662fdnSpy
\n\u7136\u540e\u6211\u4eec\u4f7f\u7528dnSpy\u6253\u5f00\u6587\u4ef6
\n
\"file\"<\/div><\/p>\n

\u5206\u6790\u7a0b\u5e8f<\/h2>\n

\u4e3b\u51fd\u6570<\/h3>\n
private static void Main(string[] args)\n{\n    string hostname = "127.0.0.1";\n    int port = 31337;\n    TcpClient tcpClient = new TcpClient();\n    try\n    {\n        Console.WriteLine("Connecting...");\n        tcpClient.Connect(hostname, port);\n    }\n    catch (Exception)\n    {\n        Console.WriteLine("Cannot connect!\\nFail!");\n        return;\n    }\n    Socket client = tcpClient.Client;\n    string text = "Super Secret Key";\n    string text2 = Program.read();\n    client.Send(Encoding.ASCII.GetBytes("CTF{"));\n    foreach (char x in text)\n    {\n        client.Send(Encoding.ASCII.GetBytes(Program.search(x, text2)));\n    }\n    client.Send(Encoding.ASCII.GetBytes("}"));\n    client.Close();\n    tcpClient.Close();\n    Console.WriteLine("Success!");\n}\n<\/code><\/pre>\n
\u7b80\u5355\u7684\u5206\u6790\u5c31\u662f\u7a0b\u5e8f\u5728\u8fde\u63a5\u6210\u529f\u4e4b\u540e \u5c06text\u8d4b\u503c\u4e3aSuper Secret Key\u7136\u540e\u5c06text2\u8d4b\u503c\u4e3aread\u51fd\u6570\u8bfb\u53d6\u7684\u5185\u5bb9\u7136\u540e\u5728search\u51fd\u6570\u4e2d\u5904\u7406\u5305\u4e0aCTF{}\u5c31\u662f\u6211\u4eec\u7684flag\u4e86<\/p>\n
\u5173\u952e\u51fd\u6570<\/h3>\n
read<\/strong><\/h4>\n
private static string read()\n{\n    string fileName = Process.GetCurrentProcess().MainModule.FileName;\/\/\u83b7\u53d6\u6587\u4ef6\u7684\u7edd\u5bf9\u8def\u5f84\n    string[] array = fileName.Split(new char[]\n    {\n        '\\\\'\n    });\n    string path = array[array.Length - 1];\n    string result = "";\n    using (StreamReader streamReader = new StreamReader(path))\n    {\n        result = streamReader.ReadToEnd();\n    }\/\/\u8bfb\u53d6\u6587\u4ef6\u7684\u5185\u5bb9\u4e4b\u540ereturn\n    return result;\n}\n<\/code><\/pre>\n
\u4ece\u8fd4\u56de\u503c\u548c\u7a0b\u5e8f\u5185\u5bb9\u53ef\u4ee5\u770b\u51faread\u51fd\u6570\u5c31\u662f\u4ece\u7a0b\u5e8f\u5185\u90e8\u8bfb\u53d6\u4e00\u4e2a\u503c\u7136\u540e\u8fd4\u56de\u7ed9text2<\/p>\n
search<\/strong><\/h4>\n
private static string search(char x, string text)\n{\n    int length = text.Length;\n    for (int i = 0; i < length; i++)\n    {\n        if (x == text[i])\n        {\n            int value = i * 1337 % 256;\n            return Convert.ToString(value, 16).PadLeft(2, '0');\n        }\n    }\n    return "??";\n}<\/code><\/pre>\n
\u5185\u5bb9\u610f\u601d\u5c31\u662f\u5728text\u4e2d\u5bfb\u627ex\u7136\u540e\u5bf9\u627e\u5230\u7684 x\u7684\u4e0b\u6807 \u5904\u7406\uff0c\u7136\u540e\u8f6c\u5316\u4e3a16\u8fdb\u5236\u6700\u540e\u5982\u679c\u4e0d\u8db316\u4f4d\u7684\u8bdd\u5c31\u5f80\u524d\u9762\u88650<\/p>\n
EXP<\/h2>\n
\u65b9\u6cd5\u4e00\uff1a\u66b4\u529b\u89e3\u5bc6<\/h3>\n
text = 'Super Secret Key'\ntext2 = open('.\/1.exe', 'r', encoding='unicode-escape').read()\nflag = 'CTF{'\nnum = len(text2)\n\ndef search(i, text, num):\n    for j in range(0, num):\n        if i == text[j]:\n            x = j * 1337 % 256\n            return '%02x' % x\n\nfor i in text:\n    flag += search(i, text2, num)\nprint(flag + '}')<\/code><\/pre>\n
\u83b7\u53d6http\u76d1\u542c\u5185\u5bb9<\/h3>\n
\u76f4\u63a5\u8fde\u63a5\u8f6f\u4ef6\u6240\u76d1\u542c\u7684\u7aef\u53e3<\/p>\n
import http.server\n\nserver_address = ('127.0.0.1', 31337)\nhandler_class = http.server.BaseHTTPRequestHandler\nhttpd = http.server.HTTPServer(server_address, handler_class)\nhttpd.serve_forever()\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
\u9898\u76ee\u4e0b\u8f7d:\u653b\u9632\u4e16\u754cAPK-\u9006\u54112 \u9898\u89e3 \u524d\u671f\u5206\u6790 \u67e5\u8be2\u7a0b\u5e8f\u4fe1\u606f \u53d1\u73b0\u662f.NET\u7684\u7a0b\u5e8f \u6211\u4eec\u9700\u8981\u4f7f\u7528\u5230\u7684\u8f6f\u4ef6\u5c31\u662f […]<\/p>\n","protected":false},"author":1,"featured_media":181,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-232","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/232","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/comments?post=232"}],"version-history":[{"count":10,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/232\/revisions"}],"predecessor-version":[{"id":244,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/232\/revisions\/244"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/media\/181"}],"wp:attachment":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/media?parent=232"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/categories?post=232"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/tags?post=232"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}