Category - 第五空间2021

[RE] uniapp - cew

解压出apps__UNI__14D1880\www\app-service.js
主要逻辑在这
enter image description here
f["encrypt"](c)调用类似chacha加密的函数，依葫芦画瓢解密即可

  1. iv = [0, 0, 0, 0, 0, 0, 0, 74, 0, 0, 0, 0]
  2. key = [_ for _ in range(32)]              
  3. def _get32(t, e):
  4.     return t[e] ^ t[e+1] << 8 ^ t[e+2] << 16 ^ t[e+3] << 24
  6. n = 1
  7. _rounds = 20
  8. _sigma = [1634760805, 857760878, 2036477234, 1797285236]
  9. _param = [_sigma[0], _sigma[1], _sigma[2], _sigma[3], _get32(key, 0), _get32(key, 4), _get32(key, 8), _get32(key, 12), _get32(key, 16), _get32(key, 20), _get32(key, 24), _get32(key, 28), n, _get32(iv, 0), _get32(iv, 4), _get32(iv, 8)]
  10. _keystream = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
  11. _byteCounter = 0
  13. def _rotl(num, e):
  14.     return (num << e | num >> 32 - e) & 0xffffffff
  16. def _quarterround(t, e, n, r, o):
  17.     print(t)
  18.     t[e] += t[n]
  19.     t[e] &= 0xffffffff
  20.     t[o
More »

[RE] capp - cew

从capp.apk提取出app.exe，将ida f5后的伪代码复制另存为cpp文件，编译为exe方便windows上debug

  1. #define _CRT_SECURE_NO_WARNINGS
  2. #include <cstdio>
  3. #include <cstdlib>
  5. unsigned char input[38] = { 0 };
  6. unsigned char ctr = 0;
  8. char my_getchar() {
  9.     return input[ctr++];
  10. }
  12. int main(int argc, const char** argv, const char** envp)
  13. {
  14.     int result; // w0
  15.     long long v4; // [xsp+0h] [xbp+0h] BYREF
  16.     int* v5; // [xsp+20h] [xbp+20h]
  17.     long long v6; // [xsp+28h] [xbp+28h]
  18.     int v7; // [xsp+34h] [xbp+34h]
  19.     int i; // [xsp+38h] [xbp+38h]
  20.     int j; // [xsp+3Ch] [xbp+3Ch]
  22.     v7 = 1000;
  23.     v6 = 999LL;
  24.     //   v5 = (int *)(4 * (((unsigned __int64)&v4 + 3) >> 2));
  25.     v5 = (int*)malloc(4 * 10000);
  26.     i = 0;
  27.     //   slogan();
  28.     scanf("%s", (char*)input);
  29.     for (i = 0; i < v7; ++i)
  30.         v5[i] = 0;
  31.     for (j = 43; v5[j]; --v5[j])
  32.         ;
  33.     ++j;
  34.     --j;
  35.     ++j;
  36.     while (v5[j])
  37.         --v5[j];
  38.     for (j -= 43; v5[j]; --v5[j])
  39.         ;
  40.     for (j += 42; v5[j]; --v5[j])
  41.     {
  42.
More »