鲁大师Android跑分结果解密

LudashiScoreDecrypt.java

//import com.alibaba.fastjson.JSON;
//import com.alibaba.fastjson.JSONObject;
//import com.alibaba.fastjson.JSONReader;

import org.w3c.dom.Document;
import org.w3c.dom.Element;
import org.w3c.dom.Node;
import org.w3c.dom.NodeList;

import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import java.io.File;
import java.util.Base64;

public class Main {
    private static int TotalScore = 0;
    private static String KeyScore;
    private static String KeyData;

    public static void main(String[] args) {

        if (args.length != 1) {
            System.out.println("请输入鲁大师benchScore.xml文件路径");
            System.out.println("导出命令：adb pull /data/data/com.ludashi.benchmark/shared_prefs/benchScore.xml");
            return;
        }

        if (parseXml(args[0])) {
//            JSONObject score_json = JSON.parseObject(decode(KeyScore, TotalScore));
//            JSONObject data_json = JSON.parseObject(decode(KeyData, TotalScore));
            String score = decrypt(KeyScore, TotalScore);
            String data = decrypt(KeyData, TotalScore);
            System.out.println(score);
            System.out.println(data);
        } else {
            System.out.println("解析失败");
        }
    }

    private static boolean parseXml(String file) {
        File xmlFile = new File(file);
        if (!xmlFile.isFile() || !xmlFile.exists()) {
            System.out.println(file + " 文件不存在");
        }

        try {
            DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
            DocumentBuilder builder = factory.newDocumentBuilder();

            Document document = builder.parse(xmlFile);
            Element root = document.getDocumentElement();
            NodeList nodes = root.getChildNodes();
            for (int i = 0; i < nodes.getLength(); i++) {
                Node node = nodes.item(i);
                if (node.getNodeType() == Node.ELEMENT_NODE) {
                    Element element = (Element) node;
                    String name = element.getAttribute("name");
                    if ("key_total_score_v4".equals(name)) {
                        TotalScore = Integer.parseInt(element.getAttribute("value"));
                        System.out.println("TotalScore = " + TotalScore);
                    } else if ("key_score_v4".equals(name)) {
                        KeyScore = element.getTextContent();
                    } else if ("key_data_v4".equals(name)) {
                        KeyData = element.getTextContent();
                    }
                }
            }
        } catch (Exception e) {
            System.out.println(file + " 不是正确的文件");
            e.printStackTrace();
        }

        return TotalScore != 0 || KeyData.length() != 0 || KeyScore.length() != 0;
    }


    private static String decrypt(String key, int total_score) {
        byte[] decode;

        decode = Base64.getDecoder().decode(key.getBytes());
        LFSR(decode, total_score);
        return new String(decode);
    }

    // 这段代码看起来是一个类似 LFSR（线性反馈移位寄存器）的加密算法。它通过一个特定的位运算来生成一个伪随机序列，然后用这个序列与原数组进行异或运算来加密原数组。
    public static void LFSR(byte[] bArr, int i2) {
        if (bArr == null || bArr.length == 0) {
            return;
        }
        int length = bArr.length;
        for (int i3 = 0; i3 < 64; i3++) {
            i2 <<= 1;
            if (1 == (((((i2 >> 3) & 1) ^ ((i2 >> 15) & 1)) ^ ((i2 >> 23) & 1)) ^ ((i2 >> 7) & 1))) {
                i2 |= 1;
            }
        }
        for (int i4 = 0; i4 < length; i4++) {
            byte b2 = 0;
            for (int i5 = 0; i5 < 8; i5++) {
                if (1 == ((i2 >> 31) & 1)) {
                    b2 = (byte) (b2 | 1);
                }
                b2 = (byte) (b2 << 1);
                i2 <<= 1;
                if (1 == (((((i2 >> 3) & 1) ^ ((i2 >> 15) & 1)) ^ ((i2 >> 23) & 1)) ^ ((i2 >> 7) & 1))) {
                    i2 |= 1;
                }
            }
            bArr[i4] = (byte) (bArr[i4] ^ b2);
        }
    }
}