{"id":404,"date":"2023-03-05T01:05:41","date_gmt":"2023-03-04T17:05:41","guid":{"rendered":"https:\/\/shangwendada.co\/?p=404"},"modified":"2023-07-21T15:54:35","modified_gmt":"2023-07-21T07:54:35","slug":"reversekctftransformer","status":"publish","type":"post","link":"https:\/\/blog.shangwendada.top\/index.php\/2023\/03\/05\/reversekctftransformer\/","title":{"rendered":"[Reverse][KCTF]Transformer"},"content":{"rendered":"

Transformer\u9898\u89e3<\/h1>\n

\u524d\u8a00<\/h2>\n

\u672c\u9898\u662f\u6211\u76ee\u524d\u505a\u8fc7\u52a0\u5bc6\u6b65\u9aa4\u6700\u7e41\u6742\u7684\u9898\u76ee\uff0c\u5199\u4e00\u7bc7wp\u8bb0\u5f55\u4e00\u4e0b\u3002<\/p>\n

\u6d89\u53ca\u77e5\u8bc6\u70b9<\/p>\n

    \n
  1. \u200b base64\u53d8\u8868\u52a0\u5bc6<\/li>\n
  2. \u200b RC4<\/li>\n
  3. \u200b Android\u5e94\u7528\u57fa\u7840<\/li>\n
  4. \u200b Activity\u7684\u65b9\u6cd5\u548c\u8c03\u7528\u987a\u5e8f<\/li>\n<\/ol>\n

    \u9996\u5148\u770b\u5230\u8fd9\u4e2a\u6807\u9898\uff0c\u6211\u662f\u5f88\u9707\u60ca\u7684\uff0ctransformer \u53d8\u538b\u5668\uff1f\u53d8\u5f62\u91d1\u521a\uff1f\uff1f\uff0c\u8fd8\u662f\u6df1\u5ea6\u5b66\u4e60\u6a21\u578b\uff0c\u672c\u4eba\u6700\u8fd1\u4e5f\u5728\u7814\u7a76\u6e05\u534e\u7684Anomaly-transformer\uff0c\u4e00\u770b\u8fd9\u6807\u9898\u5c31\u6765\u52b2\u4e86\u3002<\/p>\n

    Jadx\u9759\u6001\u5206\u6790<\/h2>\n

    \u6587\u4ef6\u662f\u5b89\u5353\u7684apk\u6587\u4ef6\uff0c\u6211\u4eec\u9009\u62e9jadx\u8fdb\u884c\u5206\u6790<\/p>\n

    package com.zhuotong.crackme;\n\nimport android.os.Bundle;\nimport android.os.Handler;\nimport android.os.Message;\nimport android.support.p003v7.app.AppCompiatActivity;\nimport android.text.TextUtils;\nimport android.view.View;\nimport android.widget.Button;\nimport android.widget.EditText;\nimport android.widget.Toast;\nimport java.lang.ref.WeakReference;\nimport java.util.concurrent.ExecutorService;\nimport java.util.concurrent.Executors;\n\npublic class MainActivity extends AppCompiatActivity {\n    public static final int MSG_LOGIN = 0;\n    private static final ExecutorService cachedThreadPool = Executors.newCachedThreadPool();\n    private static boolean hasLogin;\n    private static Runnable runnable;\n    private Handler handler;\n    private Button login;\n    private String mName;\n    private String mPassword;\n    private EditText name;\n    private EditText password;\n\n    private static class MyHandler extends Handler {\n        WeakReference<MainActivity> mWeakReference;\n\n        public MyHandler(MainActivity mainActivity) {\n            this.mWeakReference = new WeakReference<>(mainActivity);\n        }\n\n        public void handleMessage(Message message) {\n            super.handleMessage(message);\n            MainActivity mainActivity = this.mWeakReference.get();\n            if (mainActivity != null) {\n                switch (message.what) {\n                    case 0:\n                        String str = (String) message.obj;\n                        if (!TextUtils.isEmpty(str)) {\n                            StringBuilder sb = new StringBuilder();\n                            for (int i = 0; i < str.length() \/ 2; i++) {\n                                sb.append(str.charAt(i));\n                            }\n                            str = sb.toString();\n                        }\n                        Toast.makeText(mainActivity, "flag{" + str + "}", 1).show();\n                        break;\n                    case 1:\n                        Toast.makeText(mainActivity, "\u767b\u5f55\u5931\u8d25", 1).show();\n                        break;\n                }\n                mainActivity.login.setEnabled(true);\n            }\n        }\n    }\n\n    \/* access modifiers changed from: protected *\/\n    @Override \/\/ android.support.p000v4.app.SupportActivity, android.support.p003v7.app.AppCompatActivity, android.support.p000v4.app.FragmentActivity\n    public void onCreate(Bundle bundle) {\n        super.onCreate(bundle);\n        setContentView(C0245R.layout.activity_main);\n        this.login = (Button) findViewById(C0245R.C0247id.login_button);\n        this.handler = new MyHandler(this);\n        this.login.setOnClickListener(new View.OnClickListener() {\n            \/* class com.zhuotong.crackme.MainActivity.View$OnClickListenerC02431 *\/\n\n            public void onClick(View view) {\n                MainActivity.this.mName = MainActivity.this.name.getText().toString();\n                MainActivity.this.mPassword = MainActivity.this.password.getText().toString();\n                if (TextUtils.isEmpty(MainActivity.this.mName) || TextUtils.isEmpty(MainActivity.this.mPassword)) {\n                    Toast.makeText(MainActivity.this, "\u7528\u6237\u540d\u6216\u5bc6\u7801\u4e3a\u7a7a", 1).show();\n                    return;\n                }\n                boolean unused = MainActivity.hasLogin = true;\n                MainActivity.this.login.setEnabled(false);\n                MainActivity.this.login(MainActivity.this.mName, MainActivity.this.mPassword, MainActivity.this.handler);\n            }\n        });\n        this.name = (EditText) findViewById(C0245R.C0247id.name);\n        this.password = (EditText) findViewById(C0245R.C0247id.password);\n    }\n\n    \/* access modifiers changed from: private *\/\n    \/* access modifiers changed from: public *\/\n    private void login(final String str, final String str2, final Handler handler2) {\n        Toast.makeText(this, "\u767b\u5f55\u4e2d\u3002\u3002\u3002", 1).show();\n        runnable = new Runnable() {\n            \/* class com.zhuotong.crackme.MainActivity.RunnableC02442 *\/\n\n            public void run() {\n                Message obtain = Message.obtain();\n                StringBuilder sb = new StringBuilder(str2);\n                if (str.equals(sb.reverse().toString())) {\n                    obtain.obj = sb.toString();\n                } else {\n                    obtain.what = 1;\n                }\n                handler2.sendMessage(obtain);\n            }\n        };\n        cachedThreadPool.execute(runnable);\n    }\n}<\/code><\/pre>\n
    \u8be5\u5e94\u7528\u7a0b\u5e8f\u5177\u6709\u767b\u5f55\u529f\u80fd\uff0c\u63a5\u53d7\u7528\u6237\u540d\u548c\u5bc6\u7801\uff0c\u5e76\u68c0\u67e5\u53cd\u8f6c\u540e\u7684\u5bc6\u7801\u662f\u5426\u4e0e\u7528\u6237\u540d\u76f8\u540c\u3002\u5982\u679c\u76f8\u540c\uff0c\u5c06\u8fd4\u56de\u4e00\u4e2a\u5305\u542b\u5bc6\u7801\u7684Toast\u6d88\u606f\uff0c\u5e76\u5728\u5bc6\u7801\u524d\u52a0\u4e0a"flag{"\u548c"}"\u3002\u5426\u5219\uff0c\u5c06\u663e\u793a\u4e00\u4e2a\u767b\u5f55\u5931\u8d25\u7684Toast\u6d88\u606f\u3002\u8be5\u5e94\u7528\u7a0b\u5e8f\u4e2d\u7684\u4ee3\u7801\u5305\u62ec\u521b\u5efa\u4e00\u4e2a\u5904\u7406\u5668\uff0c\u5b9a\u4e49\u4e00\u4e2a\u53ef\u8fd0\u884c\u5bf9\u8c61\u548c\u4e00\u4e2a\u7ebf\u7a0b\u6c60\uff0c\u4ee5\u53ca\u5b9a\u4e49\u767b\u5f55\u529f\u80fd\u7684\u65b9\u6cd5\u3002\u5728\u521b\u5efa\u5904\u7406\u5668\u65f6\uff0c\u4f7f\u7528\u4e86\u4e00\u4e2a\u5f31\u5f15\u7528\u6765\u907f\u514d\u5185\u5b58\u6cc4\u6f0f\u3002\u5728\u767b\u5f55\u65b9\u6cd5\u4e2d\uff0c\u4f7f\u7528\u7ebf\u7a0b\u6c60\u6765\u6267\u884c\u53ef\u8fd0\u884c\u5bf9\u8c61\uff0c\u68c0\u67e5\u5bc6\u7801\u662f\u5426\u4e0e\u53cd\u8f6c\u540e\u7684\u7528\u6237\u540d\u76f8\u540c\uff0c\u5e76\u4f7f\u7528\u5904\u7406\u5668\u53d1\u9001\u6d88\u606f\u6765\u5904\u7406\u7ed3\u679c\u3002\u5f53\u7528\u6237\u5355\u51fb\u767b\u5f55\u6309\u94ae\u65f6\uff0c\u5c06\u8c03\u7528\u767b\u5f55\u65b9\u6cd5\u3002<\/p>\n
    \u5206\u6790\u5b8c\u6bd5\uff0c\u4f46\u662f\u6ca1\u5f97\u51fa\u4ec0\u4e48\u6709\u7528\u7684\u4e1c\u897f\uff0c\u6211\u4eec\u5148\u5f00\u6587\u4ef6\u770b\u4e00\u624b\u3002<\/p>\n
    \"file\"<\/div><\/p>\n
    \u770b\u5230\u5df2\u7ecf\u6709\u8d26\u6237\u540d\u4e86\uff0c\u4e0a\u9762\u5206\u6790\u53d1\u73b0\u5982\u679c\u8d26\u53f7\u53cd\u8f6c\u7b49\u4e8e\u5bc6\u7801\u7684\u8bdd\u5c31\u4f1a\u8f93\u51faflag\uff0c\u6211\u4eec\u5c06\u8d26\u53f7\u53cd\u8f6c\u5c1d\u8bd5\u4e00\u4e0b\u3002<\/p>\n
    \u53d1\u73b0\u8f93\u51fa\u201cerror\u201d\uff0c\u53ef\u662f\u6211\u4eec\u5728\u4ee3\u7801\u4e2d\u5e76\u672a\u53d1\u73b0\u7ed9\u51faerror\u63d0\u793a\u7684\u4ee3\u7801\uff0c\u4f7f\u7528\u5b57\u7b26\u4e32\u641c\u7d22\u4e5f\u6ca1\u6709\u8be5\u5b57\u7b26\u4e32\uff0c\u67e5\u770b\u4e3b\u51fd\u6570\u662f\u53d1\u73b0\u5176\u7ee7\u627f\u4e86\u4e00\u4e2aAppCompiatActivity\u7c7b\uff0c\u4ed4\u7ec6\u4e00\u770b\u597d\u5bb6\u4f19\uff0c\u8fd9\u73a9\u610f\u591a\u4e86\u4e00\u4e2ai\u3002\u662f\u4e2a\u81ea\u5199\u7c7b\u3002\u6211\u4eec\u8ddf\u8fdb\u67e5\u770b\u770b\u770b\u6709\u6ca1\u6709\u4ec0\u4e48\u60ca\u559c\u3002<\/p>\n
    package android.support.p003v7.app;\n\nimport android.os.Handler;\nimport android.text.TextUtils;\nimport android.util.Base64;\nimport android.view.View;\nimport android.widget.Button;\nimport android.widget.EditText;\nimport android.widget.Toast;\nimport com.zhuotong.crackme.C0245R;\nimport java.io.PrintStream;\nimport javax.crypto.Cipher;\nimport javax.crypto.spec.IvParameterSpec;\nimport javax.crypto.spec.SecretKeySpec;\n\n\/* renamed from: android.support.v7.app.AppCompiatActivity *\/\npublic class AppCompiatActivity extends AppCompatActivity {\n    public static final int MSG_LOGIN = 0;\n    private Handler handler;\n    private Button login;\n    private String mName;\n    private String mPassword;\n    private EditText name;\n    private EditText password;\n\n    \/* access modifiers changed from: protected *\/\n    \/* renamed from: eq *\/\n    public native boolean mo4191eq(String str);\n\n    static {\n        System.loadLibrary("oo000oo");\n    }\n\n    \/* access modifiers changed from: protected *\/\n    @Override \/\/ android.support.p003v7.app.AppCompatActivity, android.support.p000v4.app.FragmentActivity\n    public void onStart() {\n        super.onStart();\n        this.login = (Button) findViewById(C0245R.C0247id.login_button);\n        this.login.setOnClickListener(new View.OnClickListener() {\n            \/* class android.support.p003v7.app.AppCompiatActivity.View$OnClickListenerC01791 *\/\n\n            public void onClick(View view) {\n                AppCompiatActivity.this.mName = AppCompiatActivity.this.name.getText().toString();\n                AppCompiatActivity.this.mPassword = AppCompiatActivity.this.password.getText().toString();\n                if (TextUtils.isEmpty(AppCompiatActivity.this.mName) || TextUtils.isEmpty(AppCompiatActivity.this.mPassword)) {\n                    Toast.makeText(AppCompiatActivity.this, "\u7528\u6237\u540d\u6216\u5bc6\u7801\u4e3a\u7a7a", 1).show();\n                    return;\n                }\n                int i = 0;\n                AppCompiatActivity.this.login.setEnabled(false);\n                if (AppCompiatActivity.this.mo4191eq(AppCompiatActivity.this.mPassword)) {\n                    byte[] bytes = AppCompiatActivity.this.mPassword.getBytes();\n                    if (bytes.length != 24) {\n                        byte[] bArr = new byte[24];\n                        while (i < bArr.length) {\n                            bArr[i] = i < bytes.length ? bytes[i] : (byte) i;\n                            i++;\n                        }\n                        bytes = bArr;\n                    }\n                    byte[] dec = AppCompiatActivity.dec(bytes, "2ggdrsLgM7iPNYPQrD58Rg==".getBytes());\n                    AppCompiatActivity appCompiatActivity = AppCompiatActivity.this;\n                    Toast.makeText(appCompiatActivity, "flag{" + new String(dec) + "}", 1).show();\n                    return;\n                }\n                Toast.makeText(AppCompiatActivity.this, "error", 1).show();\n            }\n        });\n        this.name = (EditText) findViewById(C0245R.C0247id.name);\n        this.name.setEnabled(false);\n        this.password = (EditText) findViewById(C0245R.C0247id.password);\n    }\n\n    \/* access modifiers changed from: private *\/\n    public static byte[] dec(byte[] bArr, byte[] bArr2) {\n        byte[] decode = Base64.decode(bArr2, 0);\n        SecretKeySpec secretKeySpec = new SecretKeySpec(bArr, "AES");\n        try {\n            secretKeySpec.getEncoded();\n            PrintStream printStream = System.out;\n            printStream.println("getFormat = " + secretKeySpec.getFormat() + " ; getAlgorithm = " + secretKeySpec.getAlgorithm());\n            Cipher instance = Cipher.getInstance("AES\/CFB\/PKCS5Padding");\n            PrintStream printStream2 = System.out;\n            printStream2.println("getBlockSize = " + instance.getBlockSize());\n            instance.init(2, secretKeySpec, new IvParameterSpec(new byte[instance.getBlockSize()]));\n            return instance.doFinal(decode);\n        } catch (Throwable th) {\n            th.printStackTrace();\n            return null;\n        }\n    }\n}<\/code><\/pre>\n
    \u4ee3\u7801\u5305\u542b\u4e86\u4e00\u4e9b\u64cd\u4f5c EditText\u3001Button \u548c Toast \u7684\u903b\u8f91\uff0c\u5b9e\u73b0\u4e86\u4e00\u4e2a\u7b80\u5355\u7684\u767b\u5f55\u529f\u80fd\u3002<\/p>\n
    \u5728\u4ee3\u7801\u7684\u9876\u90e8\uff0cimport \u4e86\u4e00\u4e9b\u7c7b\u548c\u5e93\uff0c\u5982 Handler\u3001TextUtils\u3001Base64 \u7b49\u3002<\/p>\n
    \u4ee3\u7801\u4e2d\u5b9a\u4e49\u4e86\u4e00\u4e2a\u7c7b AppCompiatActivity\uff0c\u7ee7\u627f\u4e86 AppCompatActivity \u7c7b\u3002\u5728\u8be5\u7c7b\u4e2d\uff0c\u6709\u4e00\u4e9b\u53d8\u91cf\u548c\u65b9\u6cd5\uff1a<\/p>\n
      \n
    • handler\uff1a\u7528\u4e8e\u5904\u7406\u6d88\u606f\u7684 Handler \u5bf9\u8c61\u3002<\/li>\n
    • login\u3001name\u3001password\uff1a\u5206\u522b\u4ee3\u8868\u767b\u5f55\u6309\u94ae\u3001\u7528\u6237\u540d\u8f93\u5165\u6846\u3001\u5bc6\u7801\u8f93\u5165\u6846\u3002<\/li>\n
    • mName\u3001mPassword\uff1a\u5206\u522b\u4ee3\u8868\u7528\u6237\u540d\u548c\u5bc6\u7801\uff0c\u7528\u4e8e\u4fdd\u5b58\u4ece EditText \u4e2d\u83b7\u53d6\u7684\u5b57\u7b26\u4e32\u3002<\/li>\n
    • mo4191eq()\uff1a\u4e00\u4e2a native \u65b9\u6cd5\uff0c\u53ef\u80fd\u7528\u4e8e\u68c0\u67e5\u5bc6\u7801\u662f\u5426\u6b63\u786e\u3002<\/li>\n
    • onStart()\uff1a\u5f53 Activity \u5f00\u59cb\u65f6\u8c03\u7528\u7684\u65b9\u6cd5\uff0c\u7528\u4e8e\u521d\u59cb\u5316\u754c\u9762\u548c\u6dfb\u52a0\u76d1\u542c\u5668\u3002<\/li>\n
    • dec()\uff1a\u89e3\u5bc6\u5bc6\u7801\u7684\u65b9\u6cd5\uff0c\u4f7f\u7528 AES\/CFB\/PKCS5Padding \u7b97\u6cd5\u3002<\/li>\n<\/ul>\n
      \u5728 onStart() \u65b9\u6cd5\u4e2d\uff0c\u627e\u5230\u4e86 login\u3001name\u3001password \u8fd9\u4e09\u4e2a\u63a7\u4ef6\uff0c\u5e76\u6dfb\u52a0\u4e86\u4e00\u4e2a\u70b9\u51fb\u76d1\u542c\u5668\u3002\u5f53\u767b\u5f55\u6309\u94ae\u88ab\u70b9\u51fb\u65f6\uff0c\u4ee3\u7801\u4f1a\u5c1d\u8bd5\u4f7f\u7528 mo4191eq() \u65b9\u6cd5\u5224\u65ad\u5bc6\u7801\u662f\u5426\u6b63\u786e\uff0c\u5982\u679c\u6b63\u786e\uff0c\u5219\u4f7f\u7528 dec() \u65b9\u6cd5\u5bf9\u5bc6\u7801\u8fdb\u884c\u89e3\u5bc6\uff0c\u5e76\u901a\u8fc7 Toast \u663e\u793a flag\u3002<\/p>\n
      \u603b\u7684\u6765\u8bf4\uff0c\u8fd9\u6bb5\u4ee3\u7801\u662f\u4e00\u4e2a\u7b80\u5355\u7684\u767b\u5f55\u529f\u80fd\uff0c\u4f7f\u7528\u4e86\u4e00\u4e9b\u5e38\u89c1\u7684 Android \u5e94\u7528\u7a0b\u5e8f\u7ec4\u4ef6\u548c\u52a0\u5bc6\u7b97\u6cd5\u3002<\/p>\n
      \u4e3b\u8981\u53d1\u73b0\u8fd9\u91cc\u4f7f\u7528\u4e86\u4e00\u4e2anative\u65b9\u6cd5\uff0c\u5c06apk\u6587\u4ef6\u4f7f\u7528\u538b\u7f29\u5305\u6253\u5f00\uff0c\u63d0\u53d6\u51fa\u8be5so\u6587\u4ef6\uff0c\u4f7f\u7528ida\u89c2\u5bdf.<\/p>\n
      IDA\u9759\u6001\u5206\u6790<\/h2>\n
      jint JNI_OnLoad(JavaVM *vm, void *reserved)\n{\n  int v3; \/\/ r5\n  int v4; \/\/ r6\n  int v5; \/\/ [sp+0h] [bp-18h] BYREF\n\n  v5 = 0;\n  if ( (*vm)->GetEnv(vm, (void **)&v5, 65540) )\n    return -1;\n  v3 = v5;\n  v4 = (*(int (__fastcall **)(int, void *))(*(_DWORD *)v5 + 24))(v5, off_4010);\n  dword_4110 = (*(int (__fastcall **)(int, int))(*(_DWORD *)v3 + 84))(v3, v4);\n  if ( !v4 || (*(int (__fastcall **)(int, int, char **, int))(*(_DWORD *)v3 + 860))(v3, v4, off_4014, 1) <= -1 )\n    return -1;\n  else\n    return 65542;\n}<\/code><\/pre>\n
      \u8fd9\u6bb5\u4ee3\u7801\u662f\u4e00\u4e2a JNI\uff08Java Native Interface\uff09\u51fd\u6570\uff0c\u5f53\u672c\u5730\u5e93\u88ab\u52a0\u8f7d\u65f6\uff0c\u5b83\u4f1a\u88ab\u8c03\u7528\u3002JNI \u5141\u8bb8 Java \u7a0b\u5e8f\u4e0e\u672c\u5730\u4ee3\u7801\u4ea4\u4e92\uff0c\u4f8b\u5982\u5728\u672c\u5730\u5b9e\u73b0\u4e00\u4e9b\u529f\u80fd\uff0c\u5e76\u5c06\u5176\u4f5c\u4e3a Java \u65b9\u6cd5\u8c03\u7528\u3002JNI_OnLoad \u51fd\u6570\u662f\u5728\u672c\u5730\u5e93\u52a0\u8f7d\u65f6\u7531 JVM\uff08Java \u865a\u62df\u673a\uff09\u8c03\u7528\u7684\u3002<\/p>\n
      \u8fd9\u4e2a\u51fd\u6570\u7684\u4f5c\u7528\u662f\u83b7\u53d6\u5f53\u524d\u7ebf\u7a0b\u7684 JNIEnv \u6307\u9488\uff0c\u5e76\u5c06\u5b83\u5b58\u50a8\u5728\u5c40\u90e8\u53d8\u91cf v5 \u4e2d\u3002\u7136\u540e\uff0c\u5b83\u8c03\u7528 off_4010 \u6307\u5411\u7684\u51fd\u6570\u6765\u83b7\u53d6\u4e00\u4e2a\u6574\u6570\u503c\uff0c\u5c06\u5b83\u5b58\u50a8\u5728 v4 \u4e2d\u3002\u63a5\u7740\uff0c\u5b83\u4f7f\u7528 v3 \u548c v4 \u4f5c\u4e3a\u53c2\u6570\u8c03\u7528 off_4014 \u6307\u5411\u7684\u51fd\u6570\uff0c\u5e76\u5c06\u5176\u8fd4\u56de\u503c\u4e0e -1 \u8fdb\u884c\u6bd4\u8f83\uff0c\u5982\u679c\u5c0f\u4e8e\u7b49\u4e8e -1\uff0c\u5219\u8fd4\u56de -1\uff0c\u5426\u5219\u8fd4\u56de 65542\u3002<\/p>\n
      \u8fd9\u6bb5\u4ee3\u7801\u6bd4\u8f83\u6666\u6da9\uff0c\u5176\u4e2d off_4010 \u548c off_4014 \u662f\u4e24\u4e2a\u51fd\u6570\u6307\u9488\uff0c\u5b83\u4eec\u7684\u5177\u4f53\u542b\u4e49\u4e0d\u5f97\u800c\u77e5<\/p>\n
      char *datadiv_decode5009363700628197108()\n{\n  int i; \/\/ r0\n  int j; \/\/ r0\n  int k; \/\/ r0\n  char *result; \/\/ r0\n\n  for ( i = 0; i != 37; ++i )\n    byte_4020[i] ^= 0xA5u;\n  for ( j = 0; j != 66; ++j )\n    byte_4050[j] ^= 0xA5u;\n  for ( k = 0; k != 42; ++k )\n    byte_40A0[k] ^= 0x84u;\n  result = &byte_40D0;\n  byte_40CA ^= 0xFCu;\n  byte_40CB ^= 0xFCu;\n  byte_40CC ^= 0xFCu;\n  byte_40D0 ^= 0x62u;\n  byte_40D1 ^= 0x62u;\n  byte_40D2 ^= 0x62u;\n  byte_40D3 ^= 0x62u;\n  byte_40D4 ^= 0x62u;\n  byte_40D5 ^= 0x62u;\n  word_40D6 ^= 0x6262u;\n  byte_40D8 ^= 0x62u;\n  byte_40D9 ^= 0x62u;\n  byte_40DA ^= 0x62u;\n  byte_40DB ^= 0x62u;\n  byte_40DC ^= 0x62u;\n  byte_40DD ^= 0x62u;\n  byte_40DE ^= 0x62u;\n  byte_40DF ^= 0x62u;\n  byte_40E0 ^= 0x62u;\n  byte_40E1 ^= 0x62u;\n  byte_40E2 ^= 0x62u;\n  byte_40E3 ^= 0x62u;\n  byte_40E4 ^= 0x62u;\n  byte_40E5 ^= 0x62u;\n  return result;\n}<\/code><\/pre>\n
      \u8fd9\u4e00\u6bb5\u4ee3\u7801\u5bf9\u4e00\u5927\u4e32\u5b57\u7b26\u505a\u4e86\u5904\u7406\uff0c\u6211\u4eec\u4f7f\u7528\u811a\u672c\u5206\u6790\uff0c\u770b\u770b\u5904\u7406\u51fa\u4e86\u4ec0\u4e48\u4e1c\u897f\u3002<\/p>\n
      #include<iostream>\n#include<algorithm>\n#include<cstdio>\n#include<cmath>\n#include<map>\n#include<vector>\n#include<queue>\n#include<stack>\n#include<set>\n#include<string>\n#include<cstring>\n#include<list>\n#include<stdlib.h>\n#include<windows.h>\nusing namespace std;\ntypedef int status;\ntypedef int selemtype;\nint v3; \/\/ r10\n  char *v4; \/\/ r6\n  char *v5; \/\/ r8\n  char *v6; \/\/ r11\n  int v7; \/\/ r0\n  int v8; \/\/ r2\n  char *v9; \/\/ r1\n  int v10; \/\/ r3\n  int v11; \/\/ r1\n  unsigned int v12; \/\/ r2\n  int v13; \/\/ r3\n  int v14; \/\/ r0\n  int v15; \/\/ r4\n char v16; \/\/ r0\n  char *v17; \/\/ r3\n  char *v18; \/\/ r5\n \/\/ r5\n  int v20; \/\/ r1\n  int v21; \/\/ r0\n \/\/ r1\n  int v23; \/\/ r2\n  int v24; \/\/ r8\n  unsigned int v25; \/\/ r5\n  char *v26; \/\/ r0\n  int v27; \/\/ r10\n  unsigned int v28; \/\/ r2\n  int v29; \/\/ r12\n  bool v30; \/\/ zf\n  char *v31; \/\/ r4\n  int v32; \/\/ r3\n  bool v33; \/\/ zf\n  int v34; \/\/ r3\n  int v35; \/\/ r1\n  char v36; \/\/ r11\n  char v37; \/\/ lr\n  int v38; \/\/ r3\n  unsigned __int8 v39; \/\/ r1\n  char *v40; \/\/ r2\n  int v41; \/\/ r3\n  int v42; \/\/ t1\n  char v44; \/\/ r1\n  unsigned int v45; \/\/ [sp+4h] [bp-234h]\n  unsigned int v46; \/\/ [sp+8h] [bp-230h]\n  unsigned int v47; \/\/ [sp+10h] [bp-228h]\n  char *v48; \/\/ [sp+14h] [bp-224h]\n  char v49[257]; \/\/ [sp+18h] [bp-220h] BYREF\n  char v50[257]; \/\/ [sp+118h] [bp-120h]\n\/*\n                   _ooOoo_\n                  o8888888o\n                  88" . "88\n                  (| -_- |)\n                  O\\  =  \/O\n               ____\/`---'\\____\n            .'  \\\\|     |\/\/  `.\n            \/  \\\\|||  :  |||\/\/  \\\n           \/  _||||| -:- |||||-  \\\n           |   | \\\\\\  -  \/\/\/ |   |\n           | \\_|  ''\\---\/''  |   |\n           \\  .-\\__  `-`  ___\/-. \/\n         ___`. .'  \/--.--\\  `. . __\n      ."" '<  `.___\\_<|>_\/___.'  >'"".\n     | | :  `- \\`.;`\\ _ \/`;.`\/ - ` : | |\n     \\  \\ `-.   \\_ __\\ \/__ _\/   .-` \/  \/\n======`-.____`-.___\\_____\/___.-`____.-'======\n                   `=---='\n^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n    \u4f5b\u7956\u4fdd\u4f51       \u6c38\u4e0d\u5b95\u673a     \u6c38\u65e0BUG\n*\/\nunsigned char ida_chars1[] =\n{\n  0x93, 0x90, 0x95, 0xC3, 0x9C, 0x95, 0x9C, 0xC6, 0x88, 0x92, \n  0x97, 0x94, 0x92, 0x88, 0x96, 0x93, 0x91, 0x92, 0x88, 0x9C, \n  0x96, 0x96, 0x94, 0x88, 0xC6, 0x9D, 0x97, 0xC1, 0xC3, 0x9D, \n  0xC7, 0x9C, 0x9D, 0xC0, 0x9C, 0x9D, 0xA5\n\n};\nunsigned char ida_chars2[] =\n{\n  0x84, 0x9F, 0x86, 0x81, 0x80, 0x83, 0x8D, 0x8C, 0x8E, 0x88, \n  0x8F, 0x8A, 0xC5, 0xDB, 0xFA, 0xFE, 0xF8, 0xDE, 0xD8, 0x9A, \n  0x99, 0x9B, 0x89, 0x8B, 0xE5, 0xFB, 0xC4, 0xC7, 0xC6, 0xC1, \n  0xC0, 0xC3, 0xC2, 0xCD, 0xCC, 0xCF, 0xCE, 0xC9, 0xC8, 0xCB, \n  0xCA, 0xD5, 0xD4, 0xD7, 0xD6, 0xD1, 0xD0, 0xD3, 0xD2, 0xDD, \n  0xDC, 0xDF, 0x95, 0x94, 0x97, 0x96, 0x91, 0x90, 0x93, 0x92, \n  0x9D, 0x9C, 0xF9, 0x82, 0x9E, 0xA5\n};\nunsigned char ida_chars3[] =\n{\n  0xE5, 0xEA, 0xE0, 0xF6, 0xEB, 0xED, 0xE0, 0xAB, 0xF7, 0xF1, \n  0xF4, 0xF4, 0xEB, 0xF6, 0xF0, 0xAB, 0xF2, 0xB3, 0xAB, 0xE5, \n  0xF4, 0xF4, 0xAB, 0xC5, 0xF4, 0xF4, 0xC7, 0xEB, 0xE9, 0xF4, \n  0xED, 0xE5, 0xF0, 0xC5, 0xE7, 0xF0, 0xED, 0xF2, 0xED, 0xF0, \n  0xFD, 0x84\n};\nunsigned char ida_chars4[] =\n{\n  0x99, 0x8D, 0xFC, 0x00, 0x00, 0x00, 0x4A, 0x2E, 0x08, 0x03, \n  0x14, 0x03, 0x4D, 0x0E, 0x03, 0x0C, 0x05, 0x4D, 0x31, 0x16, \n  0x10, 0x0B, 0x0C, 0x05, 0x59, 0x4B, 0x38, 0x62\n};\nunsigned char ida_chars[] =\n{\n  0xD7, 0xDF, 0x02, 0xD4, 0xFE, 0x6F, 0x53, 0x3C, 0x25, 0x6C, \n  0x99, 0x97, 0x06, 0x56, 0x8F, 0xDE, 0x40, 0x11, 0x64, 0x07, \n  0x36, 0x15, 0x70, 0xCA, 0x18, 0x17, 0x7D, 0x6A, 0xDB, 0x13, \n  0x30, 0x37, 0x29, 0x60, 0xE1, 0x23, 0x28, 0x8A, 0x50, 0x8C, \n  0xAC, 0x2F, 0x88, 0x20, 0x27, 0x0F, 0x7C, 0x52, 0xA2, 0xAB, \n  0xFC, 0xA1, 0xCC, 0x21, 0x14, 0x1F, 0xC2, 0xB2, 0x8B, 0x2C, \n  0xB0, 0x3A, 0x66, 0x46, 0x3D, 0xBB, 0x42, 0xA5, 0x0C, 0x75, \n  0x22, 0xD8, 0xC3, 0x76, 0x1E, 0x83, 0x74, 0xF0, 0xF6, 0x1C, \n  0x26, 0xD1, 0x4F, 0x0B, 0xFF, 0x4C, 0x4D, 0xC1, 0x87, 0x03, \n  0x5A, 0xEE, 0xA4, 0x5D, 0x9E, 0xF4, 0xC8, 0x0D, 0x62, 0x63, \n  0x3E, 0x44, 0x7B, 0xA3, 0x68, 0x32, 0x1B, 0xAA, 0x2D, 0x05, \n  0xF3, 0xF7, 0x16, 0x61, 0x94, 0xE0, 0xD0, 0xD3, 0x98, 0x69, \n  0x78, 0xE9, 0x0A, 0x65, 0x91, 0x8E, 0x35, 0x85, 0x7A, 0x51, \n  0x86, 0x10, 0x3F, 0x7F, 0x82, 0xDD, 0xB5, 0x1A, 0x95, 0xE7, \n  0x43, 0xFD, 0x9B, 0x24, 0x45, 0xEF, 0x92, 0x5C, 0xE4, 0x96, \n  0xA9, 0x9C, 0x55, 0x89, 0x9A, 0xEA, 0xF9, 0x90, 0x5F, 0xB8, \n  0x04, 0x84, 0xCF, 0x67, 0x93, 0x00, 0xA6, 0x39, 0xA8, 0x4E, \n  0x59, 0x31, 0x6B, 0xAD, 0x5E, 0x5B, 0x77, 0xB1, 0x54, 0xDC, \n  0x38, 0x41, 0xB6, 0x47, 0x9F, 0x73, 0xBA, 0xF8, 0xAE, 0xC4, \n  0xBE, 0x34, 0x01, 0x4B, 0x2A, 0x8D, 0xBD, 0xC5, 0xC6, 0xE8, \n  0xAF, 0xC9, 0xF5, 0xCB, 0xFB, 0xCD, 0x79, 0xCE, 0x12, 0x71, \n  0xD2, 0xFA, 0x09, 0xD5, 0xBC, 0x58, 0x19, 0x80, 0xDA, 0x49, \n  0x1D, 0xE6, 0x2E, 0xE3, 0x7E, 0xB7, 0x3B, 0xB3, 0xA0, 0xB9, \n  0xE5, 0x57, 0x6E, 0xD9, 0x08, 0xEB, 0xC7, 0xED, 0x81, 0xF1, \n  0xF2, 0xBF, 0xC0, 0xA7, 0x4A, 0xD6, 0x2B, 0xB4, 0x72, 0x9D, \n  0x0E, 0x6D, 0xEC, 0x48, 0xE2, 0x33\n};\nchar vs16[] = "2409715836dbeafc";\nint main ()\n{\n    for(int i = 0 ; i < 38 ; i ++ )\n    {\n        ida_chars1[i]^=0xa5;\n    }\n    for(int i = 0 ; i < 66 ; i ++ )\n    {\n        ida_chars2[i]^=0xa5;\n    }\n    for(int i = 0 ; i <42 ; i ++  )\n    {\n        ida_chars3[i]^=0x84;\n    }\n    for(int i = 0 ; i <28 ; i++ )\n    {\n        if(i<=2)\n        {\n            ida_chars4[i]^=0xfc;\n        }\n        else\n        {\n            ida_chars4[i]^=0x62;\n        }\n    }\n    ida_chars4[2]='"';\n    printf("%s\\n%s\\n%s\\n%s\\n",ida_chars1,ida_chars2,ida_chars3,ida_chars4);<\/code><\/pre>\n
      \u8f93\u51fa\u7ed3\u679c:<\/p>\n
      650f909c-7217-3647-9331-c82df8b98e98\n!:#$%&()+-*\/`~_[]{}?<>,.@^abcdefghijklmnopqrstuvwxyz0123456789\\';\nandroid\/support\/v7\/app\/AppCompiatActivity\neq"bbb(Ljava\/lang\/String;)Z<\/code><\/pre>\n
      \u53d1\u73b0\u7b2c\u4e00\u4e2a\u5b57\u7b26\u4e32\u50cf\u662f\u4e00\u4e32\u5e8f\u5217\u53f7\uff0c\u7b2c\u4e8c\u4e2a\u5b57\u7b26\u4e32\u662f\u4e00\u4e2a\u53d8\u5316\u7684base64\u5bc6\u7801\u8868\uff0c\u7b2c\u4e09\u7b2c\u56db\u4e2a\u5219\u662f\u8c03\u7528\u6211\u4eec\u7684eq\u51fd\u6570<\/p>\n
      JNI_Onload()  \u91cc\u8fb9\u6709\u4e24\u4e2aoff_4010 off_4014 \u5206\u522b\u5bf9\u5e94\u7684\u5c31\u662f\u7b2c\u4e09\u7b2c\u56db\u4e2a\u5b57\u7b26\u4e32\u3002<\/p>\n
      \u6211\u4eec\u5bf9\u5bc6\u7801\u8868\u8fdb\u884c\u8ddf\u8fdb<\/p>\n
      \"file\"<\/div><\/p>\n
      \u53d1\u73b0784\u51fd\u6570\u8c03\u7528\u4e86\u8be5\u5bc6\u7801\u8868\uff0c\u80af\u5b9a\u662f\u5728\u5176\u4e2d\u8fdb\u884c\u4e86base64\u53d8\u8868\u52a0\u5bc6\u3002<\/p>\n
      \u67e5\u770b\u6574\u4e2a784\u51fd\u6570,\u6211\u4eec\u5c06\u8be5\u51fd\u6570\u5206\u4e3a\u51e0\u6bb5\u6765\u8fdb\u884c\u8bb2\u89e3<\/p>\n
      if ( v3 )\n  {\n    v7 = 0;\n    v8 = v3;\n    v9 = byte_4020;\n    do\n    {\n      v10 = (unsigned __int8)*v9++;\n      if ( v10 != 45 )\n        *((_BYTE *)v5 + v7++) = v10;\n      --v8;\n    }\n    while ( v8 );\n    if ( v7 >= 1 )\n    {\n      v11 = v7 - 1;\n      v12 = -8;\n      v13 = 0;\n      v14 = 0;\n      do\n      {\n        if ( (v13 | (v12 >> 2)) > 3 )\n        {\n          v15 = v14;\n        }\n        else\n        {\n          v15 = v14 + 1;\n          v4[v14] = 45;\n        }\n        v16 = *((_BYTE *)v5 + v11--);\n        v13 += 0x40000000;\n        v4[v15] = v16;\n        ++v12;\n        v14 = v15 + 1;\n      }\n      while ( v11 != -1 );\n      if ( v15 >= 0 )\n      {\n        v17 = v6;\n        while ( 1 )\n        {\n          v18 = (_BYTE *)*v4;\n          if ( (unsigned __int8)((_BYTE)v18 - 97) <= 5u )\n            break;\n          if ( (unsigned __int8)((_BYTE)v18 - 48) <= 9u )\n          {\n            v18 = (char *)&unk_23DE + (_DWORD)v18 - 48;\n            goto LABEL_18;\n          }\nLABEL_19:\n          *v17++ = (unsigned __int8)v18;\n          --v14;\n          ++v4;\n          if ( !v14 )\n            goto LABEL_20;\n        }\n        v18 = (char *)&unk_23D8 + (_DWORD)v18 - 97;\nLABEL_18:\n        LOBYTE(v18) = *v18;\n        goto LABEL_19;\n      }\n    }\n  }<\/code><\/pre>\n
      \u8fd9\u4e00\u4e32\u5462\uff0c\u9996\u5148\u662f\u53d6\u51fa\u6211\u4eec\u4e4b\u524d\u5f02\u6216\u5f97\u5230\u7684\u90a3\u4e2a\u7c7b\u4f3c\u4e8e\u5e8f\u5217\u53f7\u7684\u5b57\u7b26\u4e32\uff0c\u5728\u6b64\u5904\u5b9e\u9645\u4e0a\u662f\u4f5c\u4e3arc4\u7684key\uff0c\u7136\u540e\u5bf9\u5bf9\u5176\u5904\u7406\u65b9\u5f0f\u662f\u5220\u9664\u5176\u4e2d\u6240\u6709\u7684’-‘\u7136\u540e\u9006\u5e8f\uff0c\u518d\u52a0\u4e0a’-‘\uff0c\u518d\u5229\u7528\u7801\u8868\uff0c\u5c06\u5176\u66ff\u6362\u6210\u7801\u8868\u91cc\u9762\u7684\u503c\u3002<\/p>\n
        for ( i = 0; i != 256; ++i )\n  {\n    sub_D20(i, v3);\n    v50[i] = v6[v20];\n  }\n  v21 = (unsigned __int8)(v50[0] - 41);\n  v49[0] = v49[v21];\n  v49[v21] = -41;\n  for ( j = 1; j != 256; ++j )\n  {\n    v23 = (unsigned __int8)v49[j];\n    v21 = (v21 + (unsigned __int8)v50[j] + v23) % 256;\n    v49[j] = v49[v21];\n    v49[v21] = v23;\n  }\n  v24 = strlen(v48);\n  v25 = v6[3];\n  v46 = 8 * (3 - -3 * (v24 \/ 3));\n  v45 = v25 + v46 \/ 6;\n  v26 = malloc(v45 + 1);\n  if ( !v24 )\n    goto LABEL_44;\n  v27 = 0;\n  v28 = 0;\n  v29 = 0;\n  v47 = v25;<\/code><\/pre>\n
      \u8fd9\u4e00\u6bb5\u5c31\u662f\u5bf9rc4\u7684s\u76d2\u5b50\uff0ct\u76d2\u8fdb\u884c\u5904\u7406\uff0c\u7136\u800c\u672c\u6b21\u7684rc4\u4e3a\u9b54\u6539rc4\u5b83\u4f7f\u7528\u4e86\u81ea\u5df1\u7ed9\u51fa\u7684S\u76d2\u3002\u5185\u5bb9\u50a8\u5b58\u5728unk_23E8\u4e2d<\/p>\n
      while ( 1 )\n  {\n    v27 = (v27 + 1) % 256;\n    v35 = (unsigned __int8)v49[v27];\n    v29 = (v29 + v35) % 256;\n    v49[v27] = v49[v29];\n    v49[v29] = v35;\n    v36 = v49[(unsigned __int8)(v35 + v49[v27])] ^ v48[v28];\n    if ( !v28 )\n      break;\n    v37 = 3 * (v28 \/ 3);\n    if ( v37 == v28 )\n      break;\n    v30 = v28 == 1;\n    if ( v28 != 1 )\n      v30 = v37 + 1 == v28;\n    if ( v30 )\n    {\n      v26[v47 + v28] = byte_4050[(unsigned __int8)v26[v47 + v28] | (v36 >> 4)];\n      v31 = &v26[v47 + v28];\n      v32 = (4 * v36) & 0x3C;\n      v31[1] = v32;\n      if ( v28 + 1 >= v24 )\n      {\n        v44 = byte_4050[v32];\n        v31[2] = 52;\n        goto LABEL_43;\n      }\n    }\n    else\n    {\n      v33 = v28 == 2;\n      if ( v28 != 2 )\n        v33 = v37 + 2 == v28;\n      if ( v33 )\n      {\n        v34 = v47 + v28;\n        ++v47;\n        v26[v34] = byte_4050[(unsigned __int8)v26[v34] | ((unsigned __int8)(v36 & 0xC0) >> 6)] ^ 0xF;\n        v26[v34 + 1] = byte_4050[v36 & 0x3F];\n      }\n    }\nLABEL_40:\n    if ( ++v28 >= v24 )\n      goto LABEL_44;\n  }<\/code><\/pre>\n
      \u8fd9\u4e00\u6bb5\u5c31\u662f\u5c06\u6bcf\u4e2a\u5b57\u7b26\u5148rc4\u52a0\u5bc6\u5728\u4f7f\u7528base64\u52a0\u5bc6\uff0c\u540c\u65f6\u8fdb\u884c\u3002<\/p>\n
      \u4f46\u662f\u6bcf\u5f53\u8fed\u4ee3\u5668\u4e3a2\u7684\u500d\u6570\u65f6\u9700\u8981\u5f02\u6216\u4e00\u4e2a0xF\u3002<\/p>\n
      v26[v47 + v28] = byte_4050[v36 >> 2] ^ 7;\n  v31 = &v26[v47 + v28];\n  v38 = (16 * v36) & 0x30;\n  v31[1] = v38;\n  if ( v28 + 1 < v24 )\n    goto LABEL_40;\n  v44 = byte_4050[v38];\n  *((_WORD *)v31 + 1) = 15163;\nLABEL_43:\n  v31[1] = v44;\nLABEL_44:\n  if ( v46 )\n  {\n    v39 = 1;\n    v40 = &byte_24E8;\n    do\n    {\n      v41 = (unsigned __int8)v26[v25++];\n      v42 = (unsigned __int8)*v40++;\n      if ( v42 != v41 )\n        v39 = 0;\n    }\n    while ( v25 < v45 );\n  }\n  else\n  {\n    return 1;\n  }\n  return v39;<\/code><\/pre>\n
      \u8fd9\u4e00\u6bb5\u662f\u6bcf\u5f53\u8fed\u4ee3\u5668\u4e3a4\u7684\u500d\u6570\u65f6\u5c31\u9700\u8981\u5c06\u5bc6\u6587\u5f02\u6216\u4e00\u4e2a0x7\uff0c\u7136\u540e\u4e0e\u50a8\u5b58\u7684\u503c\u8fdb\u884c\u6bd4\u8f83\u3002\u81f3\u6b64\u89e3\u6790\u5b8c\u6bd5\uff0c\u90a3\u4e48\u8fd9\u4e2a\u5bc6\u6587\u80af\u5b9a\u5c31\u662f\u5bc6\u7801\u3002<\/p>\n
      \u89e3\u9898<\/h2>\n
      \u6211\u4eec\u9700\u8981\u5c06\u5bc6\u6587\u5148\u6309\u89c4\u5219\u5f02\u6216\u56de\u53bb\u7136\u540ebase64 \u89e3\u7801\u3002<\/p>\n
      \u811a\u672c\u5982\u4e0b<\/p>\n
      import string\n\ns = " {9*8ga*l!Tn?@#fj'j$\\g;;"\ncc = ''\nfor i in xrange(len(s)):\n     if (i % 4 == 0):\n             cc += chr(ord(s[i]) ^ 7)\n     elif (i % 4 == 2):\n             cc += chr(ord(s[i]) ^ 0xF)\n     else:\n             cc += s[i]\nmy_base64table = "!:#$%&()+-*\/`~_[]{}?<>,.@^abcdefghijklmnopqrstuvwxyz0123456789\\\\';"\nstd_base64table ="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\/="\nt = string.maketrans(my_base64table, std_base64table)\nprint map(ord, cc.translate(t).decode('base64'))\n#[253, 30, 138, 78, 9, 202, 144, 3, 231, 241, 133, 159, 155, 247, 131, 62, 14]<\/code><\/pre>\n
      \u7136\u540e\u6211\u4eec\u53ef\u4ee5\u5f97\u5230\u5904\u7406\u540e\u7684\u5bc6\u94a5\u7684\u503c\u3002<\/p>\n
      \u63a5\u4e0b\u6765\u6211\u4eec\u9700\u8981\u5904\u7406rc4\u7684key.<\/p>\n
      v3 = 36;\n    v5 = (char *)malloc(v3);\n    v6 = (char *)malloc(v3);\n    v4 = (char *)malloc(v3);\n    if(v3)\n    {\n        v7 = 0;\n        v8 = v3;\n        v9 = ida_chars5;\n        do\n        {\n            v10 = *v9++;\n            if(v10!=45)\n            {\n                *(v5 + v7++) = v10;\n            }\n            --v8;\n\n        }while(v8);\n        if ( v7 >= 1 )\n        {\n            v11 = v7 - 1;\n            v12 = -8;\n            v13 = 0;\n            v14 = 0;\n            do\n            {\n                if ( (v13 | (v12 >> 2)) > 3 )\n                {\n                  v15 = v14;\n                }\n                else\n                {\n                  v15 = v14 + 1;\n                  v4[v14] = '-';\n                }\n                v16 = *(v5 + v11--);\n                v13 += 0x40000000;\n                v4[v15] = v16;\n                ++v12;\n                v14 = v15 + 1;\n          }while ( v11 != -1 );\n        }\n\n        for(int i = 0 ; i < 36 ; i ++ )\n        {\n            if((unsigned char)(v4[i]-'a') <= 5u )\n            {\n                v4[i] = vs16[v4[i]-'a'+10];\n            }else if((unsigned char)(v4[i]-'0') <= 9u )\n            {\n                v4[i]= vs16[v4[i]-'0'];\n            }\n        }\n        printf("%s\\n",v4);\n    }<\/code><\/pre>\n
      \u5f97\u523036f36b3c-a03e-4996-8759-8408e626c215<\/p>\n
      \u7136\u540e\u521d\u59cb\u5316RC4\u7684\u5bc6\u94a5\u6d41<\/p>\n
      char s[257]={0};\n    unsigned char K[257]={0};\n    memcpy(&s[0],&ida_chars[0],0x100);\n    for(int i = 0 ; i < 256 ; i ++ )\n    {\n        K[i]=v4[i%36];\n        \/\/printf("%d,",K[i]);\n    }\n    int j = 0;\n\n    j = (unsigned char)(K[0] - 41);\n    s[0]=s[j];\n    s[j]=0xd7;\n    for(int i = 1 ; i<256 ; i ++ )\n    {\n        int tmp = (unsigned char)s[i];\n        j =(j+(unsigned char)K[i]+tmp)%256;\n        s[i]=s[j];\n        s[j]=tmp;\n    }\n    for(int i=0;i<0x100;i++){\n        printf("%02X ",(unsigned char)s[i]);\n        if((i+1)%16==0){\n            printf("\\n");\n        }\n    }<\/code><\/pre>\n
      \u5f02\u6216\u5f97\u5230\u7b54\u6848<\/p>\n
          int txi = 0 , txj = 0;\n    unsigned char tx =0;\n    for(int i = 0 ; i < 16 ; i ++ )\n    {\n        txi = (txi+1)%256;\n        tx = (unsigned char)s[txi];\n        txj=(txj+tx)%256;\n        s[txi]=s[txj];\n        s[txj]=tx;\n    \/\/  printf("%X,",s[tx+s[txi]]);\n        printf("%c",s[(tx+s[txi])%256]^debase[i]);\n    }<\/code><\/pre>\n
      \u5b8c\u6574exp<\/h2>\n
      #include<iostream>\n#include<algorithm>\n#include<cstdio>\n#include<cmath>\n#include<map>\n#include<vector>\n#include<queue>\n#include<stack>\n#include<set>\n#include<string>\n#include<cstring>\n#include<list>\n#include<stdlib.h>\n#include<windows.h>\nusing namespace std;\ntypedef int status;\ntypedef int selemtype;\nint v3; \/\/ r10\n  char *v4; \/\/ r6\n  char *v5; \/\/ r8\n  char *v6; \/\/ r11\n  int v7; \/\/ r0\n  int v8; \/\/ r2\n  char *v9; \/\/ r1\n  int v10; \/\/ r3\n  int v11; \/\/ r1\n  unsigned int v12; \/\/ r2\n  int v13; \/\/ r3\n  int v14; \/\/ r0\n  int v15; \/\/ r4\n char v16; \/\/ r0\n  char *v17; \/\/ r3\n  char *v18; \/\/ r5\n \/\/ r5\n  int v20; \/\/ r1\n  int v21; \/\/ r0\n \/\/ r1\n  int v23; \/\/ r2\n  int v24; \/\/ r8\n  unsigned int v25; \/\/ r5\n  char *v26; \/\/ r0\n  int v27; \/\/ r10\n  unsigned int v28; \/\/ r2\n  int v29; \/\/ r12\n  bool v30; \/\/ zf\n  char *v31; \/\/ r4\n  int v32; \/\/ r3\n  bool v33; \/\/ zf\n  int v34; \/\/ r3\n  int v35; \/\/ r1\n  char v36; \/\/ r11\n  char v37; \/\/ lr\n  int v38; \/\/ r3\n  unsigned __int8 v39; \/\/ r1\n  char *v40; \/\/ r2\n  int v41; \/\/ r3\n  int v42; \/\/ t1\n  char v44; \/\/ r1\n  unsigned int v45; \/\/ [sp+4h] [bp-234h]\n  unsigned int v46; \/\/ [sp+8h] [bp-230h]\n  unsigned int v47; \/\/ [sp+10h] [bp-228h]\n  char *v48; \/\/ [sp+14h] [bp-224h]\n  char v49[257]; \/\/ [sp+18h] [bp-220h] BYREF\n  char v50[257]; \/\/ [sp+118h] [bp-120h]\n\/*\n                   _ooOoo_\n                  o8888888o\n                  88" . "88\n                  (| -_- |)\n                  O\\  =  \/O\n               ____\/`---'\\____\n            .'  \\\\|     |\/\/  `.\n            \/  \\\\|||  :  |||\/\/  \\\n           \/  _||||| -:- |||||-  \\\n           |   | \\\\\\  -  \/\/\/ |   |\n           | \\_|  ''\\---\/''  |   |\n           \\  .-\\__  `-`  ___\/-. \/\n         ___`. .'  \/--.--\\  `. . __\n      ."" '<  `.___\\_<|>_\/___.'  >'"".\n     | | :  `- \\`.;`\\ _ \/`;.`\/ - ` : | |\n     \\  \\ `-.   \\_ __\\ \/__ _\/   .-` \/  \/\n======`-.____`-.___\\_____\/___.-`____.-'======\n                   `=---='\n^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n    \u4f5b\u7956\u4fdd\u4f51       \u6c38\u4e0d\u5b95\u673a     \u6c38\u65e0BUG\n*\/\nunsigned char ida_chars1[] =\n{\n  0x93, 0x90, 0x95, 0xC3, 0x9C, 0x95, 0x9C, 0xC6, 0x88, 0x92, \n  0x97, 0x94, 0x92, 0x88, 0x96, 0x93, 0x91, 0x92, 0x88, 0x9C, \n  0x96, 0x96, 0x94, 0x88, 0xC6, 0x9D, 0x97, 0xC1, 0xC3, 0x9D, \n  0xC7, 0x9C, 0x9D, 0xC0, 0x9C, 0x9D, 0xA5\n\n};\nunsigned char ida_chars2[] =\n{\n  0x84, 0x9F, 0x86, 0x81, 0x80, 0x83, 0x8D, 0x8C, 0x8E, 0x88, \n  0x8F, 0x8A, 0xC5, 0xDB, 0xFA, 0xFE, 0xF8, 0xDE, 0xD8, 0x9A, \n  0x99, 0x9B, 0x89, 0x8B, 0xE5, 0xFB, 0xC4, 0xC7, 0xC6, 0xC1, \n  0xC0, 0xC3, 0xC2, 0xCD, 0xCC, 0xCF, 0xCE, 0xC9, 0xC8, 0xCB, \n  0xCA, 0xD5, 0xD4, 0xD7, 0xD6, 0xD1, 0xD0, 0xD3, 0xD2, 0xDD, \n  0xDC, 0xDF, 0x95, 0x94, 0x97, 0x96, 0x91, 0x90, 0x93, 0x92, \n  0x9D, 0x9C, 0xF9, 0x82, 0x9E, 0xA5\n};\nunsigned char ida_chars3[] =\n{\n  0xE5, 0xEA, 0xE0, 0xF6, 0xEB, 0xED, 0xE0, 0xAB, 0xF7, 0xF1, \n  0xF4, 0xF4, 0xEB, 0xF6, 0xF0, 0xAB, 0xF2, 0xB3, 0xAB, 0xE5, \n  0xF4, 0xF4, 0xAB, 0xC5, 0xF4, 0xF4, 0xC7, 0xEB, 0xE9, 0xF4, \n  0xED, 0xE5, 0xF0, 0xC5, 0xE7, 0xF0, 0xED, 0xF2, 0xED, 0xF0, \n  0xFD, 0x84\n};\nunsigned char ida_chars4[] =\n{\n  0x99, 0x8D, 0xFC, 0x00, 0x00, 0x00, 0x4A, 0x2E, 0x08, 0x03, \n  0x14, 0x03, 0x4D, 0x0E, 0x03, 0x0C, 0x05, 0x4D, 0x31, 0x16, \n  0x10, 0x0B, 0x0C, 0x05, 0x59, 0x4B, 0x38, 0x62\n};\nunsigned char ida_chars[] =\n{\n  0xD7, 0xDF, 0x02, 0xD4, 0xFE, 0x6F, 0x53, 0x3C, 0x25, 0x6C, \n  0x99, 0x97, 0x06, 0x56, 0x8F, 0xDE, 0x40, 0x11, 0x64, 0x07, \n  0x36, 0x15, 0x70, 0xCA, 0x18, 0x17, 0x7D, 0x6A, 0xDB, 0x13, \n  0x30, 0x37, 0x29, 0x60, 0xE1, 0x23, 0x28, 0x8A, 0x50, 0x8C, \n  0xAC, 0x2F, 0x88, 0x20, 0x27, 0x0F, 0x7C, 0x52, 0xA2, 0xAB, \n  0xFC, 0xA1, 0xCC, 0x21, 0x14, 0x1F, 0xC2, 0xB2, 0x8B, 0x2C, \n  0xB0, 0x3A, 0x66, 0x46, 0x3D, 0xBB, 0x42, 0xA5, 0x0C, 0x75, \n  0x22, 0xD8, 0xC3, 0x76, 0x1E, 0x83, 0x74, 0xF0, 0xF6, 0x1C, \n  0x26, 0xD1, 0x4F, 0x0B, 0xFF, 0x4C, 0x4D, 0xC1, 0x87, 0x03, \n  0x5A, 0xEE, 0xA4, 0x5D, 0x9E, 0xF4, 0xC8, 0x0D, 0x62, 0x63, \n  0x3E, 0x44, 0x7B, 0xA3, 0x68, 0x32, 0x1B, 0xAA, 0x2D, 0x05, \n  0xF3, 0xF7, 0x16, 0x61, 0x94, 0xE0, 0xD0, 0xD3, 0x98, 0x69, \n  0x78, 0xE9, 0x0A, 0x65, 0x91, 0x8E, 0x35, 0x85, 0x7A, 0x51, \n  0x86, 0x10, 0x3F, 0x7F, 0x82, 0xDD, 0xB5, 0x1A, 0x95, 0xE7, \n  0x43, 0xFD, 0x9B, 0x24, 0x45, 0xEF, 0x92, 0x5C, 0xE4, 0x96, \n  0xA9, 0x9C, 0x55, 0x89, 0x9A, 0xEA, 0xF9, 0x90, 0x5F, 0xB8, \n  0x04, 0x84, 0xCF, 0x67, 0x93, 0x00, 0xA6, 0x39, 0xA8, 0x4E, \n  0x59, 0x31, 0x6B, 0xAD, 0x5E, 0x5B, 0x77, 0xB1, 0x54, 0xDC, \n  0x38, 0x41, 0xB6, 0x47, 0x9F, 0x73, 0xBA, 0xF8, 0xAE, 0xC4, \n  0xBE, 0x34, 0x01, 0x4B, 0x2A, 0x8D, 0xBD, 0xC5, 0xC6, 0xE8, \n  0xAF, 0xC9, 0xF5, 0xCB, 0xFB, 0xCD, 0x79, 0xCE, 0x12, 0x71, \n  0xD2, 0xFA, 0x09, 0xD5, 0xBC, 0x58, 0x19, 0x80, 0xDA, 0x49, \n  0x1D, 0xE6, 0x2E, 0xE3, 0x7E, 0xB7, 0x3B, 0xB3, 0xA0, 0xB9, \n  0xE5, 0x57, 0x6E, 0xD9, 0x08, 0xEB, 0xC7, 0xED, 0x81, 0xF1, \n  0xF2, 0xBF, 0xC0, 0xA7, 0x4A, 0xD6, 0x2B, 0xB4, 0x72, 0x9D, \n  0x0E, 0x6D, 0xEC, 0x48, 0xE2, 0x33\n};\nchar vs16[] = "2409715836dbeafc";\nint main ()\n{\n    for(int i = 0 ; i < 38 ; i ++ )\n    {\n        ida_chars1[i]^=0xa5;\n    }\n    for(int i = 0 ; i < 66 ; i ++ )\n    {\n        ida_chars2[i]^=0xa5;\n    }\n    for(int i = 0 ; i <42 ; i ++  )\n    {\n        ida_chars3[i]^=0x84;\n    }\n    for(int i = 0 ; i <28 ; i++ )\n    {\n        if(i<=2)\n        {\n            ida_chars4[i]^=0xfc;\n        }\n        else\n        {\n            ida_chars4[i]^=0x62;\n        }\n    }\n    ida_chars4[2]='"';\n    printf("%s\\n%s\\n%s\\n%s\\n",ida_chars1,ida_chars2,ida_chars3,ida_chars4);\n    \/\/ {9*8ga*l!Tn?@#fj'j$\\\\g;;\n    \/\/650f909c-7217-3647-9331-c82df8b98e98\n    char ida_chars5[37]={0};\n    unsigned char debase[26]={0xFD, 0x1E, 0x8A, 0x4E, 0x09, 0xCA, 0x90, 0x03, 0xE7, 0xF1, 0x85, 0x9F, 0x9B, 0xF7, 0x83, 0x3E};\n    for(int i = 0 ; i < 36 ; i ++ )\n    {\n        ida_chars5[i]=ida_chars1[i];\n    }\n    printf("%s\\n",ida_chars5);\n    int k = 0;\n    v3 = 36;\n    v5 = (char *)malloc(v3);\n    v6 = (char *)malloc(v3);\n    v4 = (char *)malloc(v3);\n    if(v3)\n    {\n        v7 = 0;\n        v8 = v3;\n        v9 = ida_chars5;\n        do\n        {\n            v10 = *v9++;\n            if(v10!=45)\n            {\n                *(v5 + v7++) = v10;\n            }\n            --v8;\n\n        }while(v8);\n        if ( v7 >= 1 )\n        {\n            v11 = v7 - 1;\n            v12 = -8;\n            v13 = 0;\n            v14 = 0;\n            do\n            {\n                if ( (v13 | (v12 >> 2)) > 3 )\n                {\n                  v15 = v14;\n                }\n                else\n                {\n                  v15 = v14 + 1;\n                  v4[v14] = '-';\n                }\n                v16 = *(v5 + v11--);\n                v13 += 0x40000000;\n                v4[v15] = v16;\n                ++v12;\n                v14 = v15 + 1;\n          }while ( v11 != -1 );\n        }\n\n        for(int i = 0 ; i < 36 ; i ++ )\n        {\n            if((unsigned char)(v4[i]-'a') <= 5u )\n            {\n                v4[i] = vs16[v4[i]-'a'+10];\n            }else if((unsigned char)(v4[i]-'0') <= 9u )\n            {\n                v4[i]= vs16[v4[i]-'0'];\n            }\n        }\n        printf("%s\\n",v4);\n    }\n     char s[257]={0};\n    unsigned char K[257]={0};\n    \/\/v4="09f09b0c-ae0e-baa9-4f2a-4be4e9d9cdc2";\n    memcpy(&s[0],&ida_chars[0],0x100);\n    for(int i = 0 ; i < 256 ; i ++ )\n    {\n        K[i]=v4[i%36];\n        \/\/printf("%d,",K[i]);\n    }\n    int j = 0;\n\n    j = (unsigned char)(K[0] - 41);\n    s[0]=s[j];\n    s[j]=0xd7;\n    for(int i = 1 ; i<256 ; i ++ )\n    {\n        int tmp = (unsigned char)s[i];\n        j =(j+(unsigned char)K[i]+tmp)%256;\n        s[i]=s[j];\n        s[j]=tmp;\n    }\n    for(int i=0;i<0x100;i++){\n        printf("%02X ",(unsigned char)s[i]);\n        if((i+1)%16==0){\n            printf("\\n");\n        }\n    }\n    int txi = 0 , txj = 0;\n    unsigned char tx =0;\n    for(int i = 0 ; i < 16 ; i ++ )\n    {\n        txi = (txi+1)%256;\n        tx = (unsigned char)s[txi];\n        txj=(txj+tx)%256;\n        s[txi]=s[txj];\n        s[txj]=tx;\n    \/\/  printf("%X,",s[tx+s[txi]]);\n        printf("%c",s[(tx+s[txi])%256]^debase[i]);\n    }\n}\n<\/code><\/pre>\n
      \u8f93\u51fa:<\/p>\n
      650f909c-7217-3647-9331-c82df8b98e98\n!:#$%&()+-*\/`~_[]{}?<>,.@^abcdefghijklmnopqrstuvwxyz0123456789\\';\nandroid\/support\/v7\/app\/AppCompiatActivity\neq"bbb(Ljava\/lang\/String;)Z\n650f909c-7217-3647-9331-c82df8b98e98\n36f36b3c-a03e-4996-8759-8408e626c215\nF0 37 E1 9B 2A 15 17 9F D7 58 4D 6E 33 A0 39 AE\n04 D0 BE ED F8 66 5E 00 D6 91 2F C3 10 4C F7 A6\nC1 EC 6D 0B 50 65 BB 34 FA A4 2D 3B 23 A1 96 D5\n1D 38 56 0A 5D 4F E4 CC 24 0D 12 87 35 85 8E 6F\nC6 13 9A D3 FC E7 08 AC B7 E9 B0 E8 41 AA 55 53\nC2 42 BC E6 0F 8A 86 A8 CF 84 C5 48 74 36 07 EB\n88 51 F6 7F 57 05 63 3E FE B8 C9 F5 AF DF EA 82\n44 F9 CD 06 BA 30 47 40 DE FD 1C 7C 11 5C 02 31\n2C 9C 5F 46 27 C4 83 73 16 90 20 76 7B F2 E3 F3\n77 52 80 25 09 26 3F C7 18 1B A3 FF FB CB A9 8C\n54 7A 68 B4 70 4B E2 49 22 7E A5 B6 81 9D 4E 67\nF1 A7 3C D9 94 EF 32 6B 1F B1 60 B9 64 59 01 B3\n7D E0 6C AD 97 19 B5 3A F4 D8 8D 98 03 93 1A DC\n1E 4A C0 5A E5 D1 3D 14 C8 79 BD 43 DB 69 D2 61\n95 9E 21 45 89 2B AB 29 A2 8B 2E D4 0E 62 CA 28\nDA 5B 72 8F 99 75 EE 78 0C 71 BF DD CE 92 6A B2\nfu0kzHp2aqtZAuY6<\/code><\/pre>\n
      \u7136\u540e\u6211\u4eec\u5c06fu0kzHp2aqtZAuY6\u8f93\u5165\u5230\u8f6f\u4ef6\u4e2d\u5c31\u53ef\u4ee5\u62ff\u5230flag\u4e86<\/p>\n
      \u603b\u7ed3<\/h2>\n
      \u6536\u76ca\u826f\u591a<\/p>\n","protected":false},"excerpt":{"rendered":"
      Transformer\u9898\u89e3 \u524d\u8a00 \u672c\u9898\u662f\u6211\u76ee\u524d\u505a\u8fc7\u52a0\u5bc6\u6b65\u9aa4\u6700\u7e41\u6742\u7684\u9898\u76ee\uff0c\u5199\u4e00\u7bc7wp\u8bb0\u5f55\u4e00\u4e0b\u3002 \u6d89\u53ca\u77e5\u8bc6\u70b9 \u200b  […]<\/p>\n","protected":false},"author":1,"featured_media":156,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-404","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/404","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/comments?post=404"}],"version-history":[{"count":2,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/404\/revisions"}],"predecessor-version":[{"id":513,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/404\/revisions\/513"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/media\/156"}],"wp:attachment":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/media?parent=404"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/categories?post=404"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/tags?post=404"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}