Reverse-Engineering Android APK 1[binary][100]

SECCON 2015 – CTF [Jeopardy]

Reverse-Engineering Android APK 1 [binary] – 100 pts

Description of the challenge

Please win 1000 times in rock-paper-scissors
rps.apk

How do we solve it?

We download the apk and extract it :

~/Bureau/resapk » ls
AndroidManifest.xml  META-INF  classes.dex  lib  res  resources.arsc

Then we open the jar file with JD-GUI and open the MainActivity source code :

private final Runnable showMessageTask = new Runnable()
{
public void run()
{
TextView localTextView = (TextView)MainActivity.this.findViewById(2131492946);
MainActivity localMainActivity;
if (MainActivity.this.n – MainActivity.this.m == 1)
{
localMainActivity = MainActivity.this;
localMainActivity.cnt += 1;
localTextView.setText(“WIN! +” + String.valueOf(MainActivity.this.cnt));
}
while (true)
{
if (1000 == MainActivity.this.cnt)
localTextView.setText(“SECCON{” + String.valueOf((MainActivity.this.cnt + MainActivity.this.calc()) * 107) + “}”);
MainActivity.this.flag = 0;
return;
if (MainActivity.this.m – MainActivity.this.n == 1)
{
MainActivity.this.cnt = 0;
localTextView.setText(“LOSE +0”);
}
else if (MainActivity.this.m == MainActivity.this.n)
{
localTextView.setText(“DRAW +” + String.valueOf(MainActivity.this.cnt));
}
else if (MainActivity.this.m < MainActivity.this.n)
{
MainActivity.this.cnt = 0;
localTextView.setText(“LOSE +0”);
}
else
{
localMainActivity = MainActivity.this;
localMainActivity.cnt += 1;
localTextView.setText(“WIN! +” + String.valueOf(MainActivity.this.cnt));
}
}
}
};

static
{
System.loadLibrary(“calc”);
}

The interesting part is when the player won 1000 times :

  if (1000 == MainActivity.this.cnt)
localTextView.setText(“SECCON{” + String.valueOf((MainActivity.this.cnt + MainActivity.this.calc()) * 107) + “}”);

The flag is “SECCON{ “+ (cnt(=1000)+(calc())*107 + “}”

We just have to find the result of the calc() function.

In the source code we can see :

  static
{
System.loadLibrary(“calc”);
}

so the calc is in a external library lets open “libcalc.so” in the “lib” folder with IDA … We’ve found the “Java_com_example_seccon2015_rock_1paper_1scissors_MainActivity_calc” function :

screenshot

The calc function return the integer 7.

So the flag is : The flag is “SECCON{ “+ (ctn+calc())*107 + “}”

cnt=1000 , calc() = 7

(1000+7)*107=107749

The flag is “SECCON{107749}

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s