前言：在bugku上把能写的逆向都写了，由于大佬们的writeup太深奥或者说太简洁了让我(小白)看得云里雾里。所以我写了这个详细点的writeup（理解错的地方望指出），尽量让大家都看得懂。最近比较忙先写到了这里，未完待续
入门逆向下载后ida打开,双击_mail函数里就有flag
下载后ida打开,往下翻里就有flag
提交flag出错，将MCTF改成flag即可。
Easy_Re下载后ida打开，双击_mail函数 ，F5翻译为伪C代码
strcmp()对面输入的值是否等于xmmword_413E34位置的值，双击跟过去，发现了flag
小端存储的问题，看起来反了而已。
下载后ida打开，看到函数比较多，分享一种快速找关键函数的方法。
首先就是看运行遍程序，了解下程序流程以及关键字符串。然后打开ida
1.Shift+F12查看下字符串。
2.然后双击过去。
3.再按Cirt+X交叉引用显示调用位置
然后F5看下伪代码
打印出done!!! the flag is 然后有两个数组按位异或再和0x13异或生成flag
#!usr/bin/env python #!coding=utf-8 __author__ = 'zhengjim' array1 = [18,64,98,5,2,4,6,3,6,48,49,65,32,12,48,65,31,78,62,32,49,32,1,57,96,3,21,9,4,62,3,5,4,1,2,3,44,65,78,32,16,97,54,16,44,52,32,64,89,45,32,65,15,34,18,16,0] array2 = [123,32,18,98,119,108,65,41,124,80,125,38,124,111,74,49,83,108,94,108,84,6,96,83,44,121,104,110,32,95,117,101,99,123,127,119,96,48,107,71,92,29,81,107,90,85,64,12,43,76,86,13,114,1,117,126,0] flag = '' for i in range(len(array1)): flag+= chr(array1[i] ^ array2[i] ^ 0x13 ) print flag Timer(阿里CTF)下载文件发现是apk ，先安装运行下发现有一个倒计时，只是时间为200000秒。猜测是让时间走完获取flag。
用jadx-gui反编译，双击看MainActivity查看
package net.bluelotus.tomorrow.easyandroid; import android.os.Bundle; import android.os.Handler; import android.support.v7.app.AppCompatActivity; import android.view.Menu; import android.view.MenuItem; import android.widget.TextView; public class MainActivity extends AppCompatActivity { int beg = (((int) (System.currentTimeMillis() / 1000)) + 200000); int k = 0; int now; long t = 0; public native String stringFromJNI2(int i); public static boolean is2(int n) { if (n <= 3) { if (n > 1) { return true; } return false; } else if (n % 2 == 0 || n % 3 == 0) { return false; } else { int i = 5; while (i * i <= n) { if (n % i == 0 || n % (i + 2) == 0) { return false; } i += 6; } return true; } } protected void onCreate(Bundle savedInstanceState) { super.onCreate(savedInstanceState); setContentView((int) R.layout.activity_main); final TextView tv1 = (TextView) findViewById(R.id.textView2); final TextView tv2 = (TextView) findViewById(R.id.textView3); final Handler handler = new Handler(); handler.postDelayed(new Runnable() { public void run() { MainActivity.this.t = System.currentTimeMillis(); MainActivity.this.now = (int) (MainActivity.this.t / 1000); MainActivity.this.t = 1500 - (MainActivity.this.t % 1000); tv2.setText("AliCTF"); if (MainActivity.this.beg - MainActivity.this.now <= 0) { tv1.setText("The flag is:"); tv2.setText("alictf{" + MainActivity.this.stringFromJNI2(MainActivity.this.k) + "}"); } MainActivity mainActivity; if (MainActivity.is2(MainActivity.this.beg - MainActivity.this.now)) { mainActivity = MainActivity.this; mainActivity.k += 100; } else { mainActivity = MainActivity.this; mainActivity.k--; } tv1.setText("Time Remaining(s):" + (MainActivity.this.beg - MainActivity.this.now)); handler.postDelayed(this, MainActivity.this.t); } }, 0); } public boolean onCreateOptionsMenu(Menu menu) { getMenuInflater().inflate(R.menu.menu_main, menu); return true; } public boolean onOptionsItemSelected(MenuItem item) { if (item.getItemId() == R.id.action_settings) { return true; } return super.onOptionsItemSelected(item); } static { System.loadLibrary("lhm"); } }首先初始化了beg为当前时间加上200000。(System.currentTimeMillis() / 1000)是获得系统的时间，单位为毫秒,转换为秒。