考点：找（功能代码定位），base64

Problem: [SWPUCTF 2024 秋季新生赛]合成大硅胶

思路

• 解题大致思路

关键代码一

 private void createEndGameStates(Canvas canvas, boolean win, boolean showButton) {
        int width = this.endingX - this.startingX;
        int length = this.endingY - this.startingY;
        int middleX = width / 2;
        int middleY = length / 2;
        if (win) {
            this.lightUpRectangle.setAlpha(WorkQueueKt.MASK);
            drawDrawable(canvas, this.lightUpRectangle, 0, 0, width, length);
            this.lightUpRectangle.setAlpha(255);
            this.paint.setColor(getResources().getColor(C0496R.color.text_white));
            this.paint.setAlpha(255);
            this.paint.setTextSize(this.gameOverTextSize);
            this.paint.setTextAlign(Paint.Align.CENTER);
            int textBottom = middleY - centerText();
            canvas.drawText(getResources().getString(C0496R.string.you_win), middleX, textBottom, this.paint);
            this.paint.setTextSize(this.flagTextSize);
            canvas.drawText(new StringBuilder(new String(Base64.decode("ZmxhZ19mYWtlezFzX3RoaXNfNF9yM2FsX2ZsYWc/fQ==", 0))).toString(), middleX, ((this.textPaddingSize + textBottom) - centerText()) + 2, this.paint);
            int[][] iArr = this.game.storeField;
            this.paint.setTextSize(18.0f);
            new StringBuilder(showButton ? getResources().getString(C0496R.string.go_on) : getResources().getString(C0496R.string.for_now));
            StringBuilder text = new StringBuilder();
            for (int i = 0; i < 10; i++) {
                for (int j = 0; j < 12; j++) {
                    text.append(Integer.toHexString(iArr[i][j]));
                }
            }
            canvas.drawText(text.toString(), middleX, ((this.textPaddingSize * 2) + textBottom) - (centerText() * 2), this.paint);
            return;
        }

关键代码二

 this.storeField = (int[][]) Array.newInstance((Class<?>) Integer.TYPE, 10, 12);
        for (int i = 0; i < 12; i++) {
            int[] array = new int[10];
            switch (i) {
                case 0:
                    array = new int[]{5, 4, 6, 12, 4, 14, 5, 4, 5, 1};
                    break;
                case 1:
                    array = new int[]{3, 1, 5, 2, 4, 7, 6, 5, 7, 10};
                    break;
                case 2:
                    array = new int[]{5, 1, 3, 2, 4, 14, 5, 4, 4, 10};
                    break;
                case 3:
                    array = new int[]{6, 10, 4, 13, 6, 10, 5, 10, 6, 12};
                    break;
                case 4:
                    array = new int[]{4, 12, 5, 7, 4, 9, 3, 1, 4, 14};
                    break;
                case 5:
                    array = new int[]{6, 13, 5, 5, 7, 4, 4, 14, 4, 4};
                    break;
                case 6:
                    array = new int[]{5, 5, 7, 8, 5, 10, 6, 9, 3, 1};
                    break;
                case 7:
                    array = new int[]{6, 9, 4, 14, 6, 13, 5, 9, 3, 0};
                    break;
                case 8:
                    array = new int[]{4, 12, 5, 7, 4, 13, 3, 0, 4, 14};
                    break;
                case 9:
                    array = new int[]{6, 10, 5, 6, 6, 9, 4, 15, 4, 4};
                    break;
                case 10:
                    array = new int[]{4, 13, 7, 7, 4, 15, 5, 7, 4, 10};
                    break;
                case 11:
                    array = new int[]{6, 10, 4, 14, 5, 8, 3, 0, 3, 13};
                    break;
            }
            for (int j = 0; j < 10; j++) {
                this.storeField[j][i] = array[j];
            }
        }

EXP

• 具体攻击代码
  546c4e54541315247657a31524e5444a6a4d6a5a6c46c5a6d4a4e6d5574e4e55a785a6e9d5a6d93e4a4d6a5a6d93e4e46a56696e94f4446d7774f574a3e4a1aace410e44d
  十六进制转字符串，再base64解密两次

总结

• 对该题的考点总结