[DFC 2021] 204 Slack Off

과제1. (5개중 3개 이상 해결)

(1)해당 게임을 처음으로 시작한 시간은?
(2)사용자의 구글 플레이 계정은?
(3)게임을 실행할 때 사용한 IP 주소는? (218.... 로 시작하는)
(4)게임 결제 내역을 시간 순서대로 나열하라
(5)사용자가 첫번째로 플레이한 캐릭터의 ID, 레벨, VIP 레벨, 전투력을 확인하라

 

2021 DFC 204 Slack Off 문제인 것 같다.

 

[2021 DFC] 2021 디지털포렌식 챌린지 - 204 - Slack Off (system32.kr)

를 참고.

 

\data\com.android.vending\databases\library.db

 

https://sqlitebrowser.org/dl/

 

db browser for sqlite를 다운받아주자.

 

7행:

 

8행:

 

\data\com.coc.kr.cocmsl.google\shared_prefs\com.google.android.gms.measurement.prefs.xml

 

\data\com.monawa.chosun\shared_prefs\com.google.android.gms.measurement.prefs.xml

 

(1) 해당 게임을 처음으로 시작한 시간은?

멸망록	2021년 4월 12일 월요일 오후 10:56:41 GMT+09:00
조선협객전M	2021년 4월 26일 월요일 오후 6:44:29 GMT+09:00

 

\data\com.android.vending\databases\localappstate.db

주어진 localappstate.db 파일 내 appstate 테이블중 account 칼럼을 확인해 보면 dfc202n@gmail.com 이라는 구글 계정을 확인할 수 있다. 

 

멸망록 게임의 로그를 확인하면 사용자가 멸망록 게임을 하기 위해 이용한 계정과 IP 주소를 확인할 수 있다.

 

\data\com.coc.kr.cocmsl.google\app_webview\Local Storage\leveldb\000003.log

 

틇�y


�VERSION
1
META:https://www.chaseol.com謐�륉洑�$
_https://www.chaseol.com
user�${"accessToken":"d014a6594fc74ff1bfb1631f37f98c54","accountName":"dfc202n","address":"","ageRange":"","apps":"","area":"","areaCode":"","areaDesc":"krly","auth_code":"","authed":"false","bindEfunAccount":true,"bindEmail":"1","birthday":null,"birthdayStr":"","city":"","code":"1000","createdTime":null,"csReplyCount":0,"currentExp":0,"deleted":"0","email":"dfc2****@gmail.com","encryptEmail":"8209755ddb0eed1f6f4b704cec41bace","expPercentage":0,"experienceValue":0,"favoriteGames":"","from":"","gameCode":"cocmsl","getSigninGift":false,"giftUnReadCount":0,"goldValue":0,"gotExp":0,"gotGold":0,"icon":"","id":"","idCard":"","ip":"218.50.143.55","isAccept":"0","isAuthIdCard":"","isAuthPhone":"0","isFinished":false,"isGetAward":false,"isGetBindPhoneGift":false,"isSendGold":"0","isSignin":false,"isTodayHasSigninGift":false,"isVip":"1","isVipShow":0,"item08_21":false,"language":"ko_KR","levelupExp":100,"line":"","loginType":"efun","md5Phone":"","memberLevel":1,"message":"�gb�b웂","modifiedTime":null,"nextGotGold":0,"nextLevelExp":0,"nickname":"","packageVersion":"","phone":"","privilege":"0","profession":"","rango":"","rangoLevel":"","realName":"","settedSecurityAnswers":false,"sex":"","siginDaysGetGameGift":false,"sign":"8CCA9F820511FEA1A56EAEA02061A79F","signinDays":0,"telecomOperator":"","thirdId":"","timestamp":"1618828629008","uid":4001887726,"unionId":"","urlParamString":"accessToken=d014a6594fc74ff1bfb1631f37f98c54&ip=218.50.143.55&loginType=efun&email=dfc2****@gmail.com&code=1000&message=�gb�b웂&authed=false&isSettedSecurityAnswers=false&sign=8CCA9F820511FEA1A56EAEA02061A79F&timestamp=1618828629008&gameCode=cocmsl&isSignin=false&isGetSigninGift=false&signinDays=0&bindEmail=1&isAuthPhone=0&areaCode=&birthdayStr=&isFinished=false&isGetAward=false&isGetBindPhoneGift=false&from=&language=ko_KR&packageVersion=&isBindEfunAccount=true&csReplyCount=0&giftUnReadCount=0&nickname=&isTodayHasSigninGift=false&siginDaysGetGameGift=false&item08_21=false&expPercentage=0&levelupExp=100&nextLevelExp=0&currentExp=0&isVip=1&isAccept=0&privilege=0&encryptEmail=8209755ddb0eed1f6f4b704cec41bace&uid=4001887726&accountName=dfc202n&rango=&rangoLevel=&memberLevel=1&experienceValue=0&goldValue=0&address=&icon=&deleted=0&areaDesc=krly&isVipShow=0&vipLikes=0&","username":"","vipLikes":0,"vipShow":false,"vipType":""}�K쟮

META:https://www.chaseol.com샮콖創��$
_https://www.chaseol.com
user�${"accessToken":"d014a6594fc74ff1bfb1631f37f98c54","accountName":"dfc202n","address":"","ageRange":"","apps":"","area":"","areaCode":"","areaDesc":"krly","auth_code":"","authed":"false","bindEfunAccount":true,"bindEmail":"1","birthday":null,"birthdayStr":"","city":"","code":"1000","createdTime":null,"csReplyCount":0,"currentExp":0,"deleted":"0","email":"dfc2****@gmail.com","encryptEmail":"8209755ddb0eed1f6f4b704cec41bace","expPercentage":0,"experienceValue":0,"favoriteGames":"","from":"","gameCode":"cocmsl","getSigninGift":false,"giftUnReadCount":0,"goldValue":0,"gotExp":0,"gotGold":0,"icon":"","id":"","idCard":"","ip":"218.50.143.55","isAccept":"0","isAuthIdCard":"","isAuthPhone":"0","isFinished":false,"isGetAward":false,"isGetBindPhoneGift":false,"isSendGold":"0","isSignin":false,"isTodayHasSigninGift":false,"isVip":"1","isVipShow":0,"item08_21":false,"language":"ko_KR","levelupExp":100,"line":"","loginType":"efun","md5Phone":"","memberLevel":1,"message":"�gb�b웂","modifiedTime":null,"nextGotGold":0,"nextLevelExp":0,"nickname":"","packageVersion":"","phone":"","privilege":"0","profession":"","rango":"","rangoLevel":"","realName":"","settedSecurityAnswers":false,"sex":"","siginDaysGetGameGift":false,"sign":"8CCA9F820511FEA1A56EAEA02061A79F","signinDays":0,"telecomOperator":"","thirdId":"","timestamp":"1618828629008","uid":4001887726,"unionId":"","urlParamString":"accessToken=d014a6594fc74ff1bfb1631f37f98c54&ip=218.50.143.55&loginType=efun&email=dfc2****@gmail.com&code=1000&message=�gb�b웂&authed=false&isSettedSecurityAnswers=false&sign=8CCA9F820511FEA1A56EAEA02061A79F&timestamp=1618828629008&gameCode=cocmsl&isSignin=false&isGetSigninGift=false&signinDays=0&bindEmail=1&isAuthPhone=0&areaCode=&birthdayStr=&isFinished=false&isGetAward=false&isGetBindPhoneGift=false&from=&language=ko_KR&packageVersion=&isBindEfunAccount=true&csReplyCount=0&giftUnReadCount=0&nickname=&isTodayHasSigninGift=false&siginDaysGetGameGift=false&item08_21=false&expPercentage=0&levelupExp=100&nextLevelExp=0&currentExp=0&isVip=1&isAccept=0&privilege=0&encryptEmail=8209755ddb0eed1f6f4b704cec41bace&uid=4001887726&accountName=dfc202n&rango=&rangoLevel=&memberLevel=1&experienceValue=0&goldValue=0&address=&icon=&deleted=0&areaDesc=krly&isVipShow=0&vipLikes=0&","username":"","vipLikes":0,"vipShow":false,"vipType":""}�#켍
　META:https://www.chaseol.com_https://www.chaseol.com
user

 

(2) 사용자의 구글 플레이 계정은?

dfc202n@gmail.com

(3) 게임을 실행할 때 사용한 IP 주소는? (218.... 로 시작하는)

218.50.143.55

 

과제2. (Monthly Report파일)
(1) something을 분석하라
(2) name을 분석하라 “Get (something) from (name) at (location) at (date & time).”

 

이 부분에 뭐가 있는거 같긴 한데... 뭔지 모르겠다.

 

이름, 장소, 날짜, 시간이 나오는걸 보면 Workshop Program 표를 말하는거 같긴 한데...