Android逆向题解-boomshakalaka-3-难度5

这个app 是一个cocos游戏，没有用脚本实现，纯c++实现。
题目描述:play the game, get the highest score
题目要求是玩游戏得到最高分就可以得到flag，是写到配置文件的，初始flag值看着是base编码的。


核心代码在so里面的ControlLayer::updateScore函数
判断a2的值然后往配置文件DATA字段写入数据

if ( a2 <= 0x3B9ACA00 ){v4 = cocos2d::CCUserDefault::sharedUserDefault(this);sub_3A34D8(v21, &byte_3F92A0, v19);cocos2d::CCUserDefault::getStringForKey(v20, v4, &v33, v21);v5 = sub_3A1DDC(v21);if ( a2 == &dword_64 ){v6 = cocos2d::CCUserDefault::sharedUserDefault(v5);std::operator+<char>(v22, v20, "MW");cocos2d::CCUserDefault::setStringForKey(v6, &v33, v22);v7 = v22;}else if ( a2 == &stru_254.st_value ){v8 = cocos2d::CCUserDefault::sharedUserDefault(v5);std::operator+<char>(v23, v20, "Rf");cocos2d::CCUserDefault::setStringForKey(v8, &v33, v23);v7 = v23;}else if ( a2 == &stru_2B4.st_size ){v9 = cocos2d::CCUserDefault::sharedUserDefault(v5);std::operator+<char>(v24, v20, "Rz");cocos2d::CCUserDefault::setStringForKey(v9, &v33, v24);v7 = v24;}else if ( a2 == &stru_BB4.st_value ){v10 = cocos2d::CCUserDefault::sharedUserDefault(v5);std::operator+<char>(v25, v20, "Bt");cocos2d::CCUserDefault::setStringForKey(v10, &v33, v25);v7 = v25;}else if ( a2 == &stru_15D4.st_info ){v11 = cocos2d::CCUserDefault::sharedUserDefault(v5);std::operator+<char>(v26, v20, "RV");cocos2d::CCUserDefault::setStringForKey(v11, &v33, v26);v7 = v26;}else if ( a2 == &stru_26A4.st_size ){v12 = cocos2d::CCUserDefault::sharedUserDefault(v5);std::operator+<char>(v27, v20, "9Z");cocos2d::CCUserDefault::setStringForKey(v12, &v33, v27);v7 = v27;}else if ( a2 == &stru_4644.st_info ){v13 = cocos2d::CCUserDefault::sharedUserDefault(v5);std::operator+<char>(v28, v20, "b1");cocos2d::CCUserDefault::setStringForKey(v13, &v33, v28);v7 = v28;}else if ( a2 == &stru_15AD4.st_info ){v14 = cocos2d::CCUserDefault::sharedUserDefault(v5);std::operator+<char>(v29, v20, "Vf");cocos2d::CCUserDefault::setStringForKey(v14, &v33, v29);v7 = v29;}else if ( a2 == &stru_18694.st_info ){v15 = cocos2d::CCUserDefault::sharedUserDefault(v5);std::operator+<char>(v30, v20, "S2");cocos2d::CCUserDefault::setStringForKey(v15, &v33, v30);v7 = v30;}else{if ( a2 != 1000000000 ){
LABEL_25:v17 = cocos2d::CCString::createWithFormat("%d", a2);(*(**(v18 + 66) + 428))(*(v18 + 66), *(v17 + 20));return sub_3A1DDC(v20);}v16 = cocos2d::CCUserDefault::sharedUserDefault(v5);std::operator+<char>(v31, v20, "4w");cocos2d::CCUserDefault::setStringForKey(v16, &v33, v31);v7 = v31;}

逻辑就是根据玩游戏的得分拼接上面函数里面的的字符串；
玩几次之后查看配置文件数据base64解码可以看到出现了部分flag，对比上面的代码补齐字段；
base64解码就出来了。