Freeda Not Root - HeroCTF Writeup

Challenge Info

Field	Details
CTF	HeroCTF
Challenge	Freeda Not Root
Category	Android / Reverse Engineering

Description

Try to find the password to open this vault!

I was told that it was dangerous to let my application install on a rooted machine. I fixed the problem!

Don't waste too much time statically analyzing the application; there are much faster ways.

Solution

We can install and open the app in our emulator

We are instantly thrown out with a pop-up saying Rooted Devices Detected Now, we can inspect the APK in Jadx,

We see that the APK has native library libtoolChecker.so which is probably a libary used for detecting rooted devices, We can open the native lib in Ghidra to understand more about it

As suspected, it is a standard libary rootbeer which is used for detection of root devices, This libary particularly checks for root binaries for that We can use an anti-root bypass script to bypass this check, I used antiroot from Frida CodeShare
Source: https://codeshare.Frida.re/@dzonerzy/Fridantiroot/ We can load this script, to bypass the check -

Here on now, the logic is same as the level before
logic is somewhere else –> it calls Checkflag() –> get_flag() is to be called –> log the return value

// after the bypass script
Java.perform(() => {
    var Interceptor = Java.use("com.heroctf.freeda2.utils.Vault");
    console.log(Interceptor.get_flag())

})

Now, we can load both the scripts

Flag

FLAG:HERO{D1D_Y0U_U53_0BJ3C71ON?}