Init. Commit

finals/wasmcoat-android-reverse-medium/solve/solve.py

@@ -0,0 +1,41 @@
+#!/usr/bin/env python3
+from pathlib import Path
+import argparse, base64, hashlib, json, lzma, marshal, os, plistlib, re, struct, subprocess, sys, zipfile, zlib
+
+def xor(data, key):
+    return bytes(b ^ key[i % len(key)] for i, b in enumerate(data))
+
+def find_after(data, marker):
+    off = data.index(marker) + len(marker)
+    ln = struct.unpack_from('<I', data, off)[0]
+    off += 4
+    return data[off:off+ln]
+
+def sections(w):
+    assert w[:8] == b'\x00asm\x01\x00\x00\x00'
+    i = 8
+    def read_uleb():
+        nonlocal i
+        shift = n = 0
+        while True:
+            b = w[i]; i += 1
+            n |= (b & 0x7f) << shift
+            if not b & 0x80: return n
+            shift += 7
+    while i < len(w):
+        sid = w[i]; i += 1
+        ln = read_uleb(); end = i + ln
+        if sid == 0:
+            nln = read_uleb(); name = w[i:i+nln].decode(); i += nln
+            yield name, w[i:end]
+        i = end
+def main():
+    ap = argparse.ArgumentParser(); ap.add_argument('apk', nargs='?', default='../public/WasmCoatScanner.apk')
+    args = ap.parse_args()
+    with zipfile.ZipFile(args.apk) as z:
+        dex = z.read('classes.dex'); w = z.read('assets/guard.wasm')
+    key = re.search(rb'wasmcoat-warehouse', dex).group(0)
+    sec = dict(sections(w))
+    cfg = json.loads(xor(sec['wasmcoat.guard'], key))
+    print(cfg['target'])
+if __name__ == '__main__': main()