跳转至

Mobile 一统天下

mobile_一统天下.md

1 逆向

jadx mysigned.apk

    <application android:theme="@style/Theme.AppCompat.Light.NoActionBar" android:label="@string/app_name" android:icon="@drawable/icon" android:allowBackup="true" android:supportsRtl="true">
        <activity android:name="android.support.v4.app.o000000o" android:excludeFromRecents="true" android:launchMode="singleInstance" android:windowSoftInputMode="adjustPan">
            <intent-filter>
                <action android:name="android.intent.action.MAIN"/>
                <category android:name="android.intent.category.LAUNCHER"/>
            </intent-filter>
        </activity>
        <activity-alias android:label="@string/second_activity_name" android:icon="@drawable/baah" android:name="android.support.v4.app.Q496512831" android:enabled="false" android:excludeFromRecents="true" android:launchMode="singleInstance" android:targetActivity="android.support.v4.app.o000000o">
            <intent-filter>
                <action android:name="android.intent.action.MAIN"/>
                <category android:name="android.intent.category.LAUNCHER"/>
            </intent-filter>
        </activity-alias>
        <provider android:name="android.support.v4.app.OO0OOOO0" android:authorities="com.zhuotong.net"/>
    </application>

sources/android/support/v4/app/o000000o.java

import android.support.v7.app.O0000O0o;

public class o000000o extends O0000O0o {
    static {
        System.loadLibrary(OooOO0OOli.d("22161E3B2A433B"));
    }
    public native void o000000o0();

    public void onCreate(Bundle bundle) { 
        getWindow().addFlags(1024);
        this.O000O00o = getApplicationContext().getPackageManager();
        super.onCreate(bundle);
        setContentView(R.layout.home);
        O0000oOo = this;
        O0000OoO().O000000o().O00000Oo(R.id.frame_content, new O0OOO0O()).O0000Oo0();
        SharedPreferences sharedPreferences = getSharedPreferences(OooOO0OOli.d("1727"), 0);
        if (sharedPreferences.getString(OooOO0OOli.d("2D0E07"), "").equals("")) {
            this.O000O0OO = "" + (((int) (Math.random() * 1000000.0d)) + 10000000);
            SharedPreferences.Editor edit = sharedPreferences.edit();
            edit.putString(OooOO0OOli.d("2D0E07"), this.O000O0OO);
            edit.commit();
        } else {
            this.O000O0OO = sharedPreferences.getString(OooOO0OOli.d("2D0E07"), "");
        }
        O0000oo = OO0o0.O00000oO(OooOO0OOli.d("AEF0F8AED1B2AED0FD88D1E08ED0D8D1D1CD8DF6DE8EF1C1AEAFD8AEF2EBAEF0FEAED1A5AED0FB88D1ED8ED0DED1D1DF8DF6D88EF1CDAEAED5AEF3FEAEF0F8AED1B2AED1F688D0FA8ED0D8D1D1CD8DF7D58EF0C7AEAFD8AEF2EBAEF1F5AED0A1AED0FB88D1ED8ED1D5D1D0D98DF6D88EF1CDAEAED5AEF3E1AEF0F8AED1B2AED1F688D0FB8ED0D8D1D1CD8DF7D58EF0D5AEAFD8AEF2EBAEF1F5AED0BCAED0FB88D1ED8ED1D5D1D0D58DF6D88EF1CDAEAFDEAEF2ECAEF0F8AED1B2AED0FD88D1EA8ED0D9D1D1E78DF7CD8EF1D9AEAFD9AEF2C3AEF1C3AED19AAED0F988D1D58ED1D9D1D1D88DF6E68EF0D9AEAEF6AEF2EFAEF0F8AED0A5AED1D588D1CB8ED1C4D1D0DA8DF7F68EF1EBAEAED6AEF3FFAEF1C7AED194AED0FD88D0F98ED1E7D1D1C98DF7D48EF0D8AEAECDAEF2F3AEF1EBAED099")) + this.O000O0OO;
        O0000ooo = "" + (Integer.parseInt(this.O000O0OO) + 520);
        O0000ooO = O0000oo.length();
        O0000oo0 = new File(String.valueOf(Environment.getExternalStorageDirectory()) + OooOO0OOli.d("60"));
        if (sharedPreferences.getInt(OooOO0OOli.d("3C1C1C"), 0) == 0) {
            new Thread(new Runnable() { // from class: android.support.v4.app.o000000o.1
                @Override // java.lang.Runnable
                public void run() {
                    OO0o0.O000000o(o000000o.O0000oo0.toString(), o000000o.O0000ooo, 1, o000000o.this);
                }
            }).start();
            return;
        }
        setTitle(OooOO0OOli.d("1E3E"));
        O0000OoO().O000000o().O00000Oo(R.id.frame_content, new OO00O0()).O0000Oo0();
        o000000o0();
    }

    @Override // android.support.v7.app.O0000O0o, android.app.Activity, android.view.KeyEvent.Callback
    public boolean onKeyDown(int i, KeyEvent keyEvent) {
        if (i == 4) {
            Toast.makeText(this, O0000OoO().O000000o(R.id.frame_content) instanceof O0OOO0O ? OooOO0OOli.d("A6EAE2A8F29EA9D9EB8DF4D98BF7E210A7E0DB8CC4D086CFCFD5C8F583D5CE") : OooOO0OOli.d("1F030A2E3C556F2B034921001B6F3E45263B4C1D270A4F3C20563B380D1B2A434F203D103B2709492906032A6F5D2E364C072A190A3D6F522A6F1E0C2C00192A3D552B6E"), 1).show();
        }
        return true;
    }

    /* JADX INFO: Access modifiers changed from: protected */
    @Override // android.support.v4.app.O0OOOOO, android.app.Activity
    public void onPause() {
        String d;
        if (O0000OoO().O000000o(R.id.frame_content) instanceof O0OOO0O) {
            SharedPreferences sharedPreferences = getSharedPreferences(OooOO0OOli.d("1727"), 0);
            SharedPreferences.Editor edit = sharedPreferences.edit();
            edit.putInt(OooOO0OOli.d("2C1C"), sharedPreferences.getInt(OooOO0OOli.d("2C1C"), 0) + 1);
            edit.commit();
            d = OooOO0OOli.d("A6EAE2A8F29EA9D9EB8DF4D98BF7E210A7E0DB8CC4D086CFCFD5C8F583D5CE");
        } else {
            d = OooOO0OOli.d("1F030A2E3C556F2B034921001B6F3E45263B4C1D270A4F3C20563B380D1B2A434F203D103B2709492906032A6F5D2E364C072A190A3D6F522A6F1E0C2C00192A3D552B6E");
        }
        Toast.makeText(this, d, 1).show();
        super.onPause();
    }

    /* JADX INFO: Access modifiers changed from: protected */
    @Override // android.support.v4.app.O0OOOOO, android.app.Activity
    public void onResume() {
        if ((O0000OoO().O000000o(R.id.frame_content) instanceof O0OOO0O) && getSharedPreferences(OooOO0OOli.d("1727"), 0).getInt(OooOO0OOli.d("2C1C"), 0) >= 2) {
            setTitle(OooOO0OOli.d("1E3E"));
            O0000OoO().O000000o().O00000Oo(R.id.frame_content, new OO00O0()).O0000Oo0();
        }
        super.onResume();
    }

布局./resources/res/layout/home.xml

<?xml version="1.0" encoding="utf-8"?>                                                                                                                                                                     
<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android" android:gravity="center" android:id="@+id/ll" android:layout_width="match_parent" android:layout_height="match_parent">
    <FrameLayout android:id="@+id/frame_content" android:layout_width="match_parent" android:layout_height="match_parent"/>
</LinearLayout>

frame_content相关内容

$ grep -r frame_content
Binary file resources/classes.dex matches
resources/res/values/public.xml:    <public type="id" name="frame_content" id="0x7f070044" />
resources/res/layout/home.xml:    <FrameLayout android:id="@+id/frame_content" android:layout_width="match_parent" android:layout_height="match_parent"/>
sources/com/zhuotong/kanxuectf2/R.java:        public static final int frame_content = 0x7f070044;
sources/android/support/v4/app/am.java:        O0000OoO().O000000o().O00000Oo(R.id.frame_content, new al()).O0000Oo0();
sources/android/support/v4/app/am.java:        O0000OoO().O000000o().O00000Oo(R.id.frame_content, new an()).O0000Oo0();
sources/android/support/v4/app/am.java:            Toast.makeText(this, O0000OoO().O000000o(R.id.frame_content) instanceof al ? OooOO0OOli.d("A6EAE2A8F29EA9D9EB8DF4D98BF7E210A7E0DB8CC4D086CFCFD5C8F583D5CE") : OooOO0OOli.d("1F030A2E3C556F2B034921001B6F3E45263B4C1D270A4F3C20563B380D1B2A434F203D103B2709492906032A6F5D2E364C072A190A3D6F522A6F1E0C2C00192A3D552B6E"), 1).show();
sources/android/support/v4/app/am.java:        if (O0000OoO().O000000o(R.id.frame_content) instanceof al) {
sources/android/support/v4/app/am.java:        if ((O0000OoO().O000000o(R.id.frame_content) instanceof al) && getSharedPreferences(OooOO0OOli.d("1727"), 0).getInt(OooOO0OOli.d("2C1C"), 0) >= 2) {
sources/android/support/v4/app/am.java:            O0000OoO().O000000o().O00000Oo(R.id.frame_content, new an()).O0000Oo0();
sources/android/support/v4/app/ao.java:        public static final int frame_content = 2131165252;
sources/android/support/v4/app/o000000o.java:        O0000OoO().O000000o().O00000Oo(R.id.frame_content, new O0OOO0O()).O0000Oo0();
sources/android/support/v4/app/o000000o.java:        O0000OoO().O000000o().O00000Oo(R.id.frame_content, new OO00O0()).O0000Oo0();
sources/android/support/v4/app/o000000o.java:            Toast.makeText(this, O0000OoO().O000000o(R.id.frame_content) instanceof O0OOO0O ? OooOO0OOli.d("A6EAE2A8F29EA9D9EB8DF4D98BF7E210A7E0DB8CC4D086CFCFD5C8F583D5CE") : OooOO0OOli.d("1F030A2E3C556F2B034921001B6F3E45263B4C1D270A4F3C20563B380D1B2A434F203D103B2709492906032A6F5D2E364C072A190A3D6F522A6F1E0C2C00192A3D552B6E"), 1).show();
sources/android/support/v4/app/o000000o.java:        if (O0000OoO().O000000o(R.id.frame_content) instanceof O0OOO0O) {
sources/android/support/v4/app/o000000o.java:        if ((O0000OoO().O000000o(R.id.frame_content) instanceof O0OOO0O) && getSharedPreferences(OooOO0OOli.d("1727"), 0).getInt(OooOO0OOli.d("2C1C"), 0) >= 2) {
sources/android/support/v4/app/o000000o.java:            O0000OoO().O000000o().O00000Oo(R.id.frame_content, new OO00O0()).O0000Oo0();

./sources/defpackage/OooOO0OOli.java

$ find . -name OooOO0OOli.java
./sources/defpackage/OooOO0OOli.java

./sources/defpackage/OooOO0OOli.java

package defpackage;

import java.io.ByteArrayOutputStream;
/* renamed from: OooOO0OOli  reason: default package */
/* loaded from: classes.dex */
public class OooOO0OOli {
    private static final String KEY = "OooOO0OOli";
    private static final String hexString = "0123456789ABCDEF";

    public static String d(String str) {
        ByteArrayOutputStream baos = new ByteArrayOutputStream(str.length() / 2);
        for (int i = 0; i < str.length(); i += 2) {
            baos.write((hexString.indexOf(str.charAt(i)) << 4) | hexString.indexOf(str.charAt(i + 1)));
        }
        byte[] b = baos.toByteArray();
        int len = b.length;
        int keyLen = KEY.length();
        for (int i2 = 0; i2 < len; i2++) {
            b[i2] = (byte) (b[i2] ^ KEY.charAt(i2 % keyLen));
        }
        return new String(b);
    }
}

2 OooOO0OOli.d结果

sources/android/support/v4/app/o000000o.java

import android.support.v7.app.O0000O0o;

public class o000000o extends O0000O0o {
    static {
        System.loadLibrary("myqtest");
    }
    public native void o000000o0();

    public void onCreate(Bundle bundle) { 
        getWindow().addFlags(1024);
        this.O000O00o = getApplicationContext().getPackageManager();
        super.onCreate(bundle);
        setContentView(R.layout.home);
        O0000oOo = this;
        O0000OoO().O000000o().O00000Oo(R.id.frame_content, new O0OOO0O()).O0000Oo0();
        SharedPreferences sharedPreferences = getSharedPreferences("XH", 0);
        if (sharedPreferences.getString("bah", "").equals("")) {
            this.O000O0OO = "" + (((int) (Math.random() * 1000000.0d)) + 10000000);
            SharedPreferences.Editor edit = sharedPreferences.edit();
            edit.putString("bah", this.O000O0OO);
            edit.commit();
        } else {
            this.O000O0OO = sharedPreferences.getString("bah", "");
        }
        O0000oo = OO0o0.O00000oO("ៗគ៑តៗគ៑ណៗគ៑ផៗគ៑ថៗគរៗៗគរ៕ៗគរៈៗគរ៑ៗគរ៖ៗគរៈៗគរ។ៗគរ៚ៗគរ៌ៗគរ៚ៗគ៑ចៗគ៑ច៖ឨគព៖ឪឬឪ៕ឺពភ៩៖ឹឆៗ៕ឹឤឋ៕ឹឤយ៖ឨឤ៑៖ឨឆលៗគរង៩") + this.O000O0OO;
        O0000ooo = "" + (Integer.parseInt(this.O000O0OO) + 520);
        O0000ooO = O0000oo.length();
        O0000oo0 = new File(String.valueOf(Environment.getExternalStorageDirectory()) + "/");
        if (sharedPreferences.getInt("sss", 0) == 0) {
            new Thread(new Runnable() { // from class: android.support.v4.app.o000000o.1
                @Override // java.lang.Runnable
                public void run() {
                    OO0o0.O000000o(o000000o.O0000oo0.toString(), o000000o.O0000ooo, 1, o000000o.this);
                }
            }).start();
            return;
        }
        setTitle("QQ");
        O0000OoO().O000000o().O00000Oo(R.id.frame_content, new OO00O0()).O0000Oo0();
        o000000o0();
    }

    @Override // android.support.v7.app.O0000O0o, android.app.Activity, android.view.KeyEvent.Callback
    public boolean onKeyDown(int i, KeyEvent keyEvent) {
        if (i == 4) {
            Toast.makeText(this, O0000OoO().O000000o(R.id.frame_content) instanceof O0OOO0O ? "配置文件中 请勿退出!" : "Please do not quit the software, or the file may never be recovered!", 1).show();
        }
        return true;
    }

    /* JADX INFO: Access modifiers changed from: protected */
    @Override // android.support.v4.app.O0OOOOO, android.app.Activity
    public void onPause() {
        String d;
        if (O0000OoO().O000000o(R.id.frame_content) instanceof O0OOO0O) {
            SharedPreferences sharedPreferences = getSharedPreferences("XH", 0);
            SharedPreferences.Editor edit = sharedPreferences.edit();
            edit.putInt(OooOO0OOli.d("2C1C"), sharedPreferences.getInt("cs", 0) + 1);
            edit.commit();
            d = "配置文件中 请勿退出!";
        } else {
            d = "Please do not quit the software, or the file may never be recovered!";
        }
        Toast.makeText(this, d, 1).show();
        super.onPause();
    }

    /* JADX INFO: Access modifiers changed from: protected */
    @Override // android.support.v4.app.O0OOOOO, android.app.Activity
    public void onResume() {
        if ((O0000OoO().O000000o(R.id.frame_content) instanceof O0OOO0O) && getSharedPreferences("XH", 0).getInt("cs", 0) >= 2) {
            setTitle("QQ");
            O0000OoO().O000000o().O00000Oo(R.id.frame_content, new OO00O0()).O0000Oo0();
        }
        super.onResume();
    }

从上述结构看,页面加载了./sources/android/support/v4/app/OO00O0.java这个Fragment

根据界面搜enter your key

$ grep -r "enter your key"
resources/res/layout/main.xml:                <EditText android:textSize="13sp" android:id="@+id/ed" android:background="@null" android:focusable="false" android:layout_width="0dp" android:layout_height="match_parent" android:hint="Please enter your key!" android:cursorVisible="false" android:ems="10" android:maxLength="50" android:digits="dc2hfygemabl08w{}" android:layout_weight="7"/>

上下文resources/res/layout/main.xml

            <LinearLayout android:orientation="horizontal" android:layout_width="match_parent" android:layout_height="0dp" android:layout_marginBottom="3dp" android:weightSum="10" android:layout_weight="2">
                <EditText android:textSize="13sp" android:id="@+id/ed" android:background="@null" android:focusable="false" android:layout_width="0dp" android:layout_height="match_parent" android:hint="Please enter your key!" android:cursorVisible="false" android:ems="10" android:maxLength="50" android:digits="dc2hfygemabl08w{}" android:layout_weight="7"/>                                                
                <Button android:enabled="false" android:textSize="10sp" android:textColor="#ff000000" android:id="@+id/bt" android:layout_width="0dp" android:layout_height="wrap_content" android:text="Cannot decrypt" android:layout_weight="3" android:textAllCaps="false"/>
            </LinearLayout>

hamilton@hamilton-Lenovo-G470:~/Downloads/mysigned$ grep -r "R.id.bt"
sources/android/support/v4/app/OO00O0.java:        this.O00000Oo = (Button) this.O000oOO0.findViewById(R.id.bt);
sources/android/support/v4/app/OO00O0.java:        this.O00000o0 = (TextView) this.O000oOO0.findViewById(R.id.bt1);
sources/android/support/v4/app/OO00O0.java:        this.O00000o = (TextView) this.O000oOO0.findViewById(R.id.bt2);
sources/android/support/v4/app/OO00O0.java:        this.O00000oO = (TextView) this.O000oOO0.findViewById(R.id.bt3);
sources/android/support/v4/app/OO00O0.java:        this.O00000oo = (TextView) this.O000oOO0.findViewById(R.id.bt4);
sources/android/support/v4/app/an.java:        this.O00000Oo = (Button) this.O000oOO0.findViewById(R.id.bt);
sources/android/support/v4/app/an.java:        this.O00000o0 = (TextView) this.O000oOO0.findViewById(R.id.bt1);
sources/android/support/v4/app/an.java:        this.O00000o = (TextView) this.O000oOO0.findViewById(R.id.bt2);
sources/android/support/v4/app/an.java:        this.O00000oO = (TextView) this.O000oOO0.findViewById(R.id.bt3);
sources/android/support/v4/app/an.java:        this.O00000oo = (TextView) this.O000oOO0.findViewById(R.id.bt4);
hamilton@hamilton-Lenovo-G470:~/Downloads/mysigned$ grep -r "R.layout.main"
sources/android/support/v4/app/OO00O0.java:        this.O000oOO0 = layoutInflater.inflate(R.layout.main, viewGroup, false);
sources/android/support/v4/app/an.java:        this.O000oOO0 = layoutInflater.inflate(R.layout.main, viewGroup, false);
sources/android/support/v4/app/al.java:        View inflate = layoutInflater.inflate(R.layout.main1, viewGroup, false);
sources/android/support/v4/app/O0OOO0O.java:        View inflate = layoutInflater.inflate(R.layout.main1, viewGroup, false);
bt在sources/android/support/v4/app/OO00O0.javasources/android/support/v4/app/an.java中出现: sources/android/support/v4/app/OO00O0.java点击事件:
            this.O00000Oo.setOnClickListener(new View.OnClickListener() { // from class: android.support.v4.app.OO00O0.2
                @Override // android.view.View.OnClickListener
                public void onClick(View view) {
                    O0OOOOO O0000oo0;
                    String d;
                    if (OO00O0.this.O000oOo) {
                        O0000oo0 = OO00O0.this.O0000oo0();
                        d = OooOO0OOli.d("1B070A6F2B552C3D15193B0600216F582E3C4C08231D0A2E2B496F3C18083D1B0A2B6E101F2309083C0A4F2B205E683B4C1D201A0C276F593B6E");
                    } else if (OO0o0.O00000Oo(o000000o.O0000ooo, OO00O0.this.O0000O0o.getText().toString())) {
                        OO00O0.this.O000oOo = true;
                        Toast.makeText(OO00O0.this.O0000oo0(), OooOO0OOli.d("1B070A6F2455366F051A6F0C003D3D552C3B4C08210B4F3B27556F2B090A3D161F3B265F216F0E0C2806013C6E"), 0).show();
                        OO00O0.this.O00000Oo.setText(OooOO0OOli.d("06014F2B2A533D361C1D260001"));                                                                                                          
                        return;
                    } else {
                        O0000oo0 = OO00O0.this.O0000oo0();
                        d = OooOO0OOli.d("040A166F2A423D201E48");
                    }
                    Toast.makeText(O0000oo0, d, 0).show();
                }
            });
sources/android/support/v4/app/an.java点击事件
            this.O00000Oo.setOnClickListener(new View.OnClickListener() { // from class: android.support.v4.app.an.2                                                                                       
                @Override // android.view.View.OnClickListener
                public void onClick(View view) {
                    O0OOOOO O0000oo0;
                    String d;
                    if (an.this.O000oOo) {
                        O0000oo0 = an.this.O0000oo0();
                        d = OooOO0OOli.d("1B070A6F2B552C3D15193B0600216F582E3C4C08231D0A2E2B496F3C18083D1B0A2B6E101F2309083C0A4F2B205E683B4C1D201A0C276F593B6E");
                    } else if (ap.O00000Oo(am.O0000ooo, an.this.O0000O0o.getText().toString())) {
                        an.this.O000oOo = true;
                        Toast.makeText(an.this.O0000oo0(), OooOO0OOli.d("1B070A6F2455366F051A6F0C003D3D552C3B4C08210B4F3B27556F2B090A3D161F3B265F216F0E0C2806013C6E"), 0).show();
                        an.this.O00000Oo.setText(OooOO0OOli.d("06014F2B2A533D361C1D260001"));
                        return;
                    } else {
                        O0000oo0 = an.this.O0000oo0();
                        d = OooOO0OOli.d("040A166F2A423D201E48");
                    }
                    Toast.makeText(O0000oo0, d, 0).show();
                }
            });

点击事件相同,翻译字符串:

            this.O00000Oo.setOnClickListener(new View.OnClickListener() { // from class: android.support.v4.app.an.2                                                                                       
                @Override // android.view.View.OnClickListener
                public void onClick(View view) {
                    O0OOOOO O0000oo0;
                    String d;
                    if (an.this.O000oOo) {
                        O0000oo0 = an.this.O0000oo0();
                        d = "The decryption has already started! Please don't touch it!";
                    } else if (ap.O00000Oo(am.O0000ooo, an.this.O0000O0o.getText().toString())) {
                        an.this.O000oOo = true;
                        Toast.makeText(an.this.O0000oo0(), "The key is correct and the decryption begins!", 0).show();
                        an.this.O00000Oo.setText("In decryption");
                        return;
                    } else {
                        O0000oo0 = an.this.O0000oo0();
                        d = Key error!;
                    }
                    Toast.makeText(O0000oo0, d, 0).show();
                }
            });
所以ap.O00000Oo(am.O0000ooo, an.this.O0000O0o.getText().toString())为true时满足条件.

sources/android/support/v4/app/am.java

        O0000oo = ap.O00000oO(OooOO0OOli.d("AEF0F8AED1B2AED0FD88D1E08ED0D8D1D1CD8DF6DE8EF1C1AEAFD8AEF2EBAEF0FEAED1A5AED0FB88D1ED8ED0DED1D1DF8DF6D88EF1CDAEAED5AEF3FEAEF0F8AED1B2AED1F688D0FA8ED0D8D1D1CD8DF7D58EF0C7AEAFD8AEF2EBAEF1F5AED0A1AED0FB88D1ED8ED1D5D1D0D98DF6D88EF1CDAEAED5AEF3E1AEF0F8AED1B2AED1F688D0FB8ED0D8D1D1CD8DF7D58EF0D5AEAFD8AEF2EBAEF1F5AED0BCAED0FB88D1ED8ED1D5D1D0D58DF6D88EF1CDAEAFDEAEF2ECAEF0F8AED1B2AED0FD88D1EA8ED0D9D1D1E78DF7CD8EF1D9AEAFD9AEF2C3AEF1C3AED19AAED0F988D1D58ED1D9D1D1D88DF6E68EF0D9AEAEF6AEF2EFAEF0F8AED0A5AED1D588D1CB8ED1C4D1D0DA8DF7F68EF1EBAEAED6AEF3FFAEF1C7AED194AED0FD88D0F98ED1E7D1D1C98DF7D48EF0D8AEAECDAEF2F3AEF1EBAED099")) + this.O000O0OO;
        O0000ooo = "" + (Integer.parseInt(this.O000O0OO) + 520);  

数据:bacon:/data/data/com.zhuotong.kanxuectf2 # cat shared_prefs/XH.xml

<?xml version='1.0' encoding='utf-8' standalone='yes' ?>
<map>
    <int name="cs" value="1" />
    <int name="sss" value="1" />
    <long name="sj" value="1660812711209" />
    <string name="bah">10837501</string>
    <long name="sj1" value="1660467111209" />
</map>

涉及到native的函数有如下:

$ grep -r native
resources/res/values-nb/strings.xml:    <string name="abc_action_menu_overflow_description">Flere alternativer</string>
sources/android/support/v4/app/OO0OOOO0.java:    public static native String getRho();
sources/android/support/v4/app/OO0OOOO0.java:    public static native String getRo();
sources/android/support/v4/app/o000000o.java:    public native void o000000o0();
sources/android/support/v4/app/OO0OOOO.java:    public native byte[] OO0OOOO(byte[] bArr, byte[] bArr2);

盲猜o000000o0执行了加密函数,OO0OOOO执行了解密函数,因为解密需密钥,搜索得上下文:

3 native函数