NeoQuest 2017: Реверс андроид приложения в задании «Почини вождя!»11.03.2017 02:18

package com.neobit.neoquest;

import android.app.Activity;
import android.content.res.AssetManager;
import android.os.Bundle;
import android.telephony.TelephonyManager;
import android.util.Base64;
import android.view.View;
import android.view.View.OnClickListener;
import android.widget.TextView;
import dalvik.system.DexClassLoader;
import java.io.ByteArrayOutputStream;
import java.io.File;
import java.io.FileOutputStream;
import java.io.InputStream;
import java.lang.reflect.Method;
import java.util.Arrays;

public class MainActivity extends Activity implements OnClickListener {
    private Method f1373a;

    static {
        System.loadLibrary("neolib");  // Подгружается внешняя so библиотека
    }
    // Объявление функций из подгруженной либы
    public native byte[] decrypt(String str, byte[] bArr);

    public native int nativeCRC32sum(byte[] bArr);

    public void onClick(View view) {
        int i = 0;
        CharSequence charSequence = "";
        try {
            InputStream open = getAssets().open("cred");
            ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
            byte[] bArr = new byte[1024];
            // Считываем содержимое файла cred
            while (true) {
                int read = open.read(bArr, 0, 1024);
                if (read == -1) {
                    break;
                }
                byteArrayOutputStream.write(bArr, 0, read);
            }
            byteArrayOutputStream.flush();
            byte[] toByteArray = byteArrayOutputStream.toByteArray();
            byteArrayOutputStream.close();
            open.close();
            while (i < 1024 && bArr[i] != (byte) 10) {
                i++;
            }
            // Разбиваем содержимое файла на строки
            String login = new String(toByteArray, 0, i - 1, "UTF-8");
            int i2 = i + 1;
            i = i2;
            while (i < toByteArray.length && bArr[i] != (byte) 10) {
                i++;
            }
            String key = new String(toByteArray, i2, (i - i2) - 1, "UTF-8");
            String comment = Base64.encodeToString(Arrays.copyOfRange(toByteArray, i + 1, toByteArray.length), 2);
            byteArrayOutputStream.close();
            // Высчитываем CRC32 для всего содержимого файла cred
            String crc32 = Integer.toHexString(nativeCRC32sum(toByteArray)).toUpperCase();
            // Отправляем данные на сервер
            charSequence = (String) this.f1373a.invoke(null, new Object[]{login, key, comment, crc32});
        } catch (Exception e) {
        }
        ((TextView) findViewById(2131492970)).setText(charSequence);
    }

    protected void onCreate(Bundle bundle) {
        super.onCreate(bundle);
        setContentView(2130968601);
        AssetManager assets = getAssets();
        try {
            // Получаем текущий IMEI девайса
            String deviceId = ((TelephonyManager) getSystemService("phone")).getDeviceId();
            // Считываем содержимое файла 1.dex
            InputStream open = assets.open("1.dex");
            ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
            byte[] bArr = new byte[1024];
            while (true) {
                int read = open.read(bArr);
                if (read != -1) {
                    byteArrayOutputStream.write(bArr, 0, read);
                } else {
                    // Расшифровываем 1.dex
                    byte[] decrypt = decrypt(deviceId, byteArrayOutputStream.toByteArray());
                    File file = new File(getCacheDir(), "1.dex");
                    file.delete();
                    FileOutputStream fileOutputStream = new FileOutputStream(file, false);
                    fileOutputStream.write(decrypt);
                    fileOutputStream.close();
                    // Грузим метод get из класса com.neobit.neoquest.Server
                    this.f1373a = new DexClassLoader(file.getAbsolutePath(), getDir("outdex", 0).getAbsolutePath(), null, getClassLoader()).loadClass("com.neobit.neoquest.Server").getMethod("get", new Class[]{String.class, String.class, String.class, String.class});
                    findViewById(2131492969).setOnClickListener(this);
                    return;
                }
            }
        } catch (Throwable th) {
            // В случае ошибки ругаемся на IMEI
            ((TextView) findViewById(2131492970)).setText("Phone IMEI is not correct");
        }
    }
}

package com.neobit.neoquest;

import android.os.AsyncTask;
import java.io.BufferedInputStream;
import java.io.ByteArrayOutputStream;
import java.io.DataOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.net.HttpURLConnection;
import java.net.URL;
import java.util.concurrent.ExecutionException;

public class Server {
    private static final String address = "http://213.170.100.214/neoquest.php";

    /* renamed from: com.neobit.neoquest.Server.1 */
    static final class C00001 extends AsyncTask {
        final /* synthetic */ String val$comment;
        final /* synthetic */ String val$crc32;
        final /* synthetic */ String val$keyWorld;
        final /* synthetic */ String val$login;

        C00001(String str, String str2, String str3, String str4) {
            this.val$login = str;
            this.val$keyWorld = str2;
            this.val$comment = str3;
            this.val$crc32 = str4;
        }

        protected String doInBackground(Void... voidArr) {
            try {
                HttpURLConnection httpURLConnection = (HttpURLConnection) new URL(Server.address).openConnection();
                httpURLConnection.setRequestMethod("POST");
                httpURLConnection.addRequestProperty("Content-Type", "application/json");
                DataOutputStream dataOutputStream = new DataOutputStream(httpURLConnection.getOutputStream());
                dataOutputStream.writeBytes(String.format("{\"login\":\"%s\",\"key_word\":\"%s\",\"comment\":\"%s\",\"crc32\":\"%s\"}", new Object[]{this.val$login, this.val$keyWorld, this.val$comment, this.val$crc32}));
                dataOutputStream.flush();
                dataOutputStream.close();
                InputStream inputStream = httpURLConnection.getInputStream();
                String access$000 = Server.isToString(inputStream);
                inputStream.close();
                httpURLConnection.disconnect();
                return access$000;
            } catch (Exception e) {
                e.printStackTrace();
                return "";
            }
        }
    }

    public static String get(String str, String str2, String str3, String str4) throws ExecutionException, InterruptedException {
        return (String) new C00001(str, str2, str3, str4).execute(new Void[0]).get();
    }

    private static String isToString(InputStream inputStream) throws IOException {
        BufferedInputStream bufferedInputStream = new BufferedInputStream(inputStream);
        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
        for (int read = bufferedInputStream.read(); read != -1; read = bufferedInputStream.read()) {
            byteArrayOutputStream.write((byte) read);
        }
        return byteArrayOutputStream.toString();
    }
}

Admin
26892263f3d18dfabb665e2d2a680899b2577f0f4daa77287fadb3e4ae581ec1
NeoQuestNeoQuestNeoQuestNeoQuestNeoQuestNeoQuestNeoQuestNeoQuestNeoQuest