droids3
Problem
Find the pass, get the flag. Check out this file. You can also find the file in /problems/droids3_0_b475775d8018b2a030a38c40e3b0e25c.
Solution
The
FlagstaffHill
class (containsgetFlag()
function) is as follows:We can see that
getFlag()
callsnope()
.yep()
is never called. Theyep()
function most likely returns the flag.Run
apktool d three.apk --no-res
to decompile without resources (decompiling resources was causing build errors).Edit
three/smali/com/hellocmu/picoctf/FlagstaffHill.smali
: Changeinvoke-static {p0}, Lcom/hellocmu/picoctf/FlagstaffHill;->nope(Ljava/lang/String;)Ljava/lang/String;
toinvoke-static {p0}, Lcom/hellocmu/picoctf/FlagstaffHill;->yep(Ljava/lang/String;)Ljava/lang/String;
Rebuild the application:
apktool b three -o recompiled/recompiled_three.apk
Use patrickfav/uber-apk-signer latest release to sign the app:
This produces the
recompiled_three-aligned-debugSigned.apk
file, which can be installed.
Flag
picoCTF{tis.but.a.scratch}
Last updated