A Strange Door - Payatu Hiring CTF Writeup

Challenge Info

Field	Details
CTF	Payatu Hiring CTF
Challenge	A Strange Door
Category	Android / Reverse Engineering

Solution

We can start by inspecting the APK in Jadx,

We have to input a pincode, which is passed to a native function checkPasscode and then if its correct the other activity is launched also another native function decryptflag() is called and passed along as an intent extra.

The second Activity(launched if the passcode is correct) gets the flag from the intent and displays it in a textview One way of solving this, is to hook the checkPasscode() and modify the return value to 1, so that no matter what we input..checkPasscode() will return true and decryptflag() will be called and the flag will be displayed in the following activity screen

const NativeMethod = Process.getModuleByName('libctf.so');
const f = NativeMethod.getExportByName('Java_com_payatu_astragedoor_LoginActivity_checkPasscode');
Interceptor.attach(f, {
  onEnter(args) {
    console.log(' inside the native')
    },
    onLeave(retval){
      retval.replace(1);
    }
  });

We can load this Frida script,

Flag

FLAG:PAYATU{ASDS73V3NS7R@NG3P0P}