这个app 是一个cocos游戏，没有用脚本实现，纯c++实现。
题目描述:play the game, get the highest score
题目要求是玩游戏得到最高分就可以得到flag，是写到配置文件的，初始flag值看着是base编码的。


核心代码在so里面的ControlLayer::updateScore函数
判断a2的值然后往配置文件DATA字段写入数据

if ( a2 <= 0x3B9ACA00 )
  {
    v4 = cocos2d::CCUserDefault::sharedUserDefault(this);
    sub_3A34D8(v21, &byte_3F92A0, v19);
    cocos2d::CCUserDefault::getStringForKey(v20, v4, &v33, v21);
    v5 = sub_3A1DDC(v21);
    if ( a2 == &dword_64 )
    {
      v6 = cocos2d::CCUserDefault::sharedUserDefault(v5);
      std::operator+<char>(v22, v20, "MW");
      cocos2d::CCUserDefault::setStringForKey(v6, &v33, v22);
      v7 = v22;
    }
    else if ( a2 == &stru_254.st_value )
    {
      v8 = cocos2d::CCUserDefault::sharedUserDefault(v5);
      std::operator+<char>(v23, v20, "Rf");
      cocos2d::CCUserDefault::setStringForKey(v8, &v33, v23);
      v7 = v23;
    }
    else if ( a2 == &stru_2B4.st_size )
    {
      v9 = cocos2d::CCUserDefault::sharedUserDefault(v5);
      std::operator+<char>(v24, v20, "Rz");
      cocos2d::CCUserDefault::setStringForKey(v9, &v33, v24);
      v7 = v24;
    }
    else if ( a2 == &stru_BB4.st_value )
    {
      v10 = cocos2d::CCUserDefault::sharedUserDefault(v5);
      std::operator+<char>(v25, v20, "Bt");
      cocos2d::CCUserDefault::setStringForKey(v10, &v33, v25);
      v7 = v25;
    }
    else if ( a2 == &stru_15D4.st_info )
    {
      v11 = cocos2d::CCUserDefault::sharedUserDefault(v5);
      std::operator+<char>(v26, v20, "RV");
      cocos2d::CCUserDefault::setStringForKey(v11, &v33, v26);
      v7 = v26;
    }
    else if ( a2 == &stru_26A4.st_size )
    {
      v12 = cocos2d::CCUserDefault::sharedUserDefault(v5);
      std::operator+<char>(v27, v20, "9Z");
      cocos2d::CCUserDefault::setStringForKey(v12, &v33, v27);
      v7 = v27;
    }
    else if ( a2 == &stru_4644.st_info )
    {
      v13 = cocos2d::CCUserDefault::sharedUserDefault(v5);
      std::operator+<char>(v28, v20, "b1");
      cocos2d::CCUserDefault::setStringForKey(v13, &v33, v28);
      v7 = v28;
    }
    else if ( a2 == &stru_15AD4.st_info )
    {
      v14 = cocos2d::CCUserDefault::sharedUserDefault(v5);
      std::operator+<char>(v29, v20, "Vf");
      cocos2d::CCUserDefault::setStringForKey(v14, &v33, v29);
      v7 = v29;
    }
    else if ( a2 == &stru_18694.st_info )
    {
      v15 = cocos2d::CCUserDefault::sharedUserDefault(v5);
      std::operator+<char>(v30, v20, "S2");
      cocos2d::CCUserDefault::setStringForKey(v15, &v33, v30);
      v7 = v30;
    }
    else
    {
      if ( a2 != 1000000000 )
      {
LABEL_25:
        v17 = cocos2d::CCString::createWithFormat("%d", a2);
        (*(**(v18 + 66) + 428))(*(v18 + 66), *(v17 + 20));
        return sub_3A1DDC(v20);
      }
      v16 = cocos2d::CCUserDefault::sharedUserDefault(v5);
      std::operator+<char>(v31, v20, "4w");
      cocos2d::CCUserDefault::setStringForKey(v16, &v33, v31);
      v7 = v31;
    }

逻辑就是根据玩游戏的得分拼接上面函数里面的的字符串；
玩几次之后查看配置文件数据base64解码可以看到出现了部分flag，对比上面的代码补齐字段；
base64解码就出来了。