Android CTF Reverse-Engineering Android APK 1[binary][100]

[SECCON2015]Reverse-Engineering Android APK 1[binary][100]

6 DECEMBER 2015 ASCOPECTFLEAVE A COMMENT
SECCON 2015 – CTF [Jeopardy]

Reverse-Engineering Android APK 1 [binary] – 100 pts

DESCRIPTION OF THE CHALLENGE

Please win 1000 times in rock-paper-scissors
rps.apk
How do we solve it?

We download the apk and extract it :

~/Bureau/resapk » ls
AndroidManifest.xml META-INF classes.dex lib res resources.arsc
Then we open the jar file with JD-GUI and open the MainActivity source code :

private final Runnable showMessageTask = new Runnable()
{
public void run()
{
TextView localTextView = (TextView)MainActivity.this.findViewById(2131492946);
MainActivity localMainActivity;
if (MainActivity.this.n – MainActivity.this.m == 1)
{
localMainActivity = MainActivity.this;
localMainActivity.cnt += 1;
localTextView.setText(“WIN! +” + String.valueOf(MainActivity.this.cnt));
}
while (true)
{
if (1000 == MainActivity.this.cnt)
localTextView.setText(“SECCON{” + String.valueOf((MainActivity.this.cnt + MainActivity.this.calc()) * 107) + “}”);
MainActivity.this.flag = 0;
return;
if (MainActivity.this.m – MainActivity.this.n == 1)
{
MainActivity.this.cnt = 0;
localTextView.setText(“LOSE +0”);
}
else if (MainActivity.this.m == MainActivity.this.n)
{
localTextView.setText(“DRAW +” + String.valueOf(MainActivity.this.cnt));
}
else if (MainActivity.this.m < MainActivity.this.n)
{
MainActivity.this.cnt = 0;
localTextView.setText(“LOSE +0”);
}
else
{
localMainActivity = MainActivity.this;
localMainActivity.cnt += 1;
localTextView.setText(“WIN! +” + String.valueOf(MainActivity.this.cnt));
}
}
}
};

static
{
System.loadLibrary(“calc”);
}

The interesting part is when the player won 1000 times :

  if (1000 == MainActivity.this.cnt)
localTextView.setText(“SECCON{” + String.valueOf((MainActivity.this.cnt + MainActivity.this.calc()) * 107) + “}”);

The flag is “SECCON{ “+ (cnt(=1000)+(calc())*107 + “}”

We just have to find the result of the calc() function.

In the source code we can see :

  static
{
System.loadLibrary(“calc”);
}

so the calc is in a external library lets open “libcalc.so” in the “lib” folder with IDA … We’ve found the “Java_com_example_seccon2015_rock_1paper_1scissors_MainActivity_calc” function :

mov eax,7

The calc function return the integer 7.

So the flag is : The flag is “SECCON{ “+ (ctn+calc())*107 + “}”

cnt=1000 , calc() = 7

(1000+7)*107=107749

The flag is “SECCON{107749}“