HackTricks
Search…
🤩
Generic Methodologies & Resources
🐧
Linux Hardening
🍏
MacOS Hardening
🪟
Windows Hardening
📱
Mobile Pentesting
👽
Network Services Pentesting
🕸
Pentesting Web
⛈
Cloud Security
😎
Hardware/Physical Access
🦅
Reversing & Exploiting
🔮
Crypto & Stego
🧐
External Platforms Reviews/Writeups
✍
TODO
Google CTF 2018 - Shall We Play a Game?
Support HackTricks and get benefits!
Download the APK here:
Looks like you need to win 1000000 times to get the flag.
Following the steps from pentesting Android you can decompile the application to get the smali code and read the Java code using jadx.
Reading the java code:
It looks like the function that is going print the flag is m().
Smali changes
Call m() the first time
Lets make the application call m() if the variable this.o != 1000000 to do so, just cange the condition:
1
if-ne v0, v9, :cond_2
Copied!
to:
1
if-eq v0, v9, :cond_2
Copied!
Before
After
Follow the steps of pentest Android to recompile and sign the APK. Then, upload it to https://appetize.io/ and lets see what happens:
Looks like the flag is written without being completely decrypted. Probably the m() function should be called 1000000 times.
Other way to do this is to not change the instrucction but change the compared instructions:
Another way is instead of comparing with 1000000, set the value to 1 so this.o is compared with 1:
A forth way is to add an instruction to move to value of v9(1000000) to v0 (this.o):
Solution
Make the application run the loop 100000 times when you win the first time. To do so, you only need to create the :goto_6 loop and make the application junp there if _this.o_** does not value 100000**:
You need to do this inside a physical device as (I don't know why) this doesn't work in an emulated device.
Support HackTricks and get benefits!
Last modified 2mo ago
Copy link