XCTF novice area of mobile Ph0en1x-100

Andrews native title is really more. . . . .

The JEB the APK:

看onclick方法：
public void onGoClick(View arg5) {
        if(this.getSecret(this.getFlag()).equals(this.getSecret(this.encrypt(this.etFlag.getText().toString())))) {
            Toast.makeText(((Context)this), "Success", 1).show();
        }
        else {
            Toast.makeText(((Context)this), "Failed", 1).show();
        }
    }

On both sides getSecrect method, then this method temporarily do not read.

Look getFlag () and encrypt (), but also to see native method, which is much loved IDA. . . .

IDA dragged into the brain without F5:

encrypt：

//点击a1,按下y,输入JNIEnv*就能得到以下伪代码效果
int __cdecl Java_com_ph0en1x_android_1crackme_MainActivity_encrypt(JNIEnv *a1, int a2, int a3)
{
  size_t v3; // esi
  const char *s; // edi

  v3 = 0;
  for ( s = (*a1)->GetStringUTFChars(a1, (jstring)a3, 0); v3 < strlen(s); --s[v3++] )
    ;
  return (*a1)->NewStringUTF(a1, s);
}

S bold speculation pointer is passed in a string.

See for loop: s when v3 less than the length of the loop is executed, followed by a semicolon --s [v3 ++]

Here you can see the s [v3 ++] 1. from the Save ascii code is equivalent to 1 minus each character.

Look getFlag method:

int __cdecl Java_com_ph0en1x_android_1crackme_MainActivity_getFlag(JNIEnv *a1)
{
  signed int v1; // esi
  char *v2; // edi
  char v3; // al
  int result; // eax
  int v5; // [esp+26h] [ebp-46h]
  int v6; // [esp+2Ah] [ebp-42h]
  int v7; // [esp+2Eh] [ebp-3Eh]
  __int16 v8; // [esp+32h] [ebp-3Ah]
  int v9; // [esp+34h] [ebp-38h]
  int v10; // [esp+38h] [ebp-34h]
  int v11; // [esp+3Ch] [ebp-30h]
  int v12; // [esp+40h] [ebp-2Ch]
  int v13; // [esp+44h] [ebp-28h]
  int v14; // [esp+48h] [ebp-24h]
  int v15; // [esp+4Ch] [ebp-20h]
  int v16; // [esp+50h] [ebp-1Ch]
  int v17; // [esp+54h] [ebp-18h]
  int v18; // [esp+58h] [ebp-14h]
  unsigned int v19; // [esp+5Ch] [ebp-10h]

  v1 = 38;
  v2 = (char *)&v18 + 2;
  v9 = 1279407662;
  v10 = 987807583;
  v19 = __readgsdword(0x14u);
  v11 = 1663091624;
  v12 = 482391945;
  v13 = 683820061;
  v14 = 235072895;
  v15 = -1735432611;
  v16 = 382777269;
  v17 = -67599539;
  v18 = 4670209;
  v5 = 1819043144;
  v6 = 1750081647;
  v7 = 829318448;
  v8 = 120;
  do
  {
    v3 = *v2--;
    v2[1] = (*((_BYTE *)&v5 + v1-- % 13) ^ (v3 + 1 - *v2)) - 1;
  }
  while ( v1 );
  LOBYTE(v9) = (v9 ^ 0x48) - 1;
  result = (int)(*a1)->NewStringUTF(a1, (const char *)&v9);
  if ( __readgsdword(0x14u) != v19 )
    sub_4B0();
  return result;
}

This chicken dish is very poor for a large lump of code that I learned C compilation of early return is impossible and the teacher, I do not know what it is to write, try to see dynamic debugging:

The next wave of learning dynamic debugging.

To be continued ------ ---------