[BeginCTF]真龙之力-分析程序源代码

入口是MainActivity直接进入查看

两个按钮的监听事件，

button1

点击后直接如下类

这个encryptString()方法在最开始被注册，来自于native层

也就是在native层验证KEY是否正确

button2

使用了一系列算法如下

package com.example.dragon;

import java.util.Arrays;
import java.util.function.ToIntFunction;

/* compiled from: MainActivity.java */
/* loaded from: classes3.dex */
class DragonSwap {
    private static final int BLOCK_SIZE = 16;
    private static final int[] S_BOX = {9, 11, 25, 20, 15, 30, 24, 23, 2, 26, 28, 13, 16, 19, 29, 31, 5, 4, 17, 12, 14, 8, 27, 21, 22, 3, 7, 0, 18, 6, 10, 1};

    private static byte[] encrypt1(byte[] message, String KEY) {
        A a = new A();
        B b = new B();
        long KEY2 = b.math(KEY);
        int[] B_BOX = a.rand(KEY2).stream().mapToInt(new ToIntFunction() { // from class: com.example.dragon.DragonSwap$$ExternalSyntheticLambda0
            @Override // java.util.function.ToIntFunction
            public final int applyAsInt(Object obj) {
                Integer valueOf;
                valueOf = Integer.valueOf(((Integer) obj).intValue());
                return valueOf.intValue();
            }
        }).toArray();
        for (int i = 0; i < message.length; i += 16) {
            byte[] block = Arrays.copyOfRange(message, i, i + 16);
            for (int j = 0; j < 16; j++) {
                int aa = (B_BOX[j] * j) % 16;
                byte tmp = block[j];
                block[j] = block[aa];
                block[aa] = tmp;
            }
            System.arraycopy(block, 0, message, i, 16);
        }
        return message;
    }

    private static byte[] SSBBOOXX(byte[] message) {
        byte[] encryptedMessage = new byte[message.length];
        for (int i = 0; i < message.length; i++) {
            encryptedMessage[i] = message[S_BOX[i]];
        }
        return encryptedMessage;
    }

    private static String encrypt2(byte[] message) {
        for (int i = 0; i < 16; i++) {
            message = SSBBOOXX(message);
        }
        StringBuilder sb = new StringBuilder();
        for (byte b : message) {
            sb.append(String.format("%02X", Byte.valueOf(b)));
        }
        return sb.toString();
    }

    public String finalenc(String ID, String KEY) {
        byte[] flag = ID.getBytes();
        byte[] paddedFlag = new byte[(((flag.length + 16) - 1) / 16) * 16];
        System.arraycopy(flag, 0, paddedFlag, 0, flag.length);
        byte[] encrypted1 = encrypt1(paddedFlag, KEY);
        return encrypt2(encrypted1);
    }
}

可以发现算法只是涉及到了密文的位置置换，不涉及任何的加密等。
具体逻辑就是通过填充00然后置换之后与密文进行比较，正确则输出”YOU GET IT“不正确则输出交换的结果。