Trend Micro CTF 2015 Offensive 200¶

Note: For this challenge, we need install some things into our Android 5.1 device with Genymotion. For example, an ARM Translator. https://github.com/m9rco/Genymotion_ARM_Translation

Download APK: https://lautarovculic.com/my_files/VirusClicker.apk

Install the apk with adb

adb install -r VirusClicker.apk

And decompile with apktool

apktool d VirusClicker.apk

We can notice that the app isn't responding. So I need install this app into an Android API29 Let's inspect the source code with jadx (GUI version) We have the SplashActivity, MainActivity, and some other Activities. Launching the app, we can see an button and a counter until 10.000.000

So, we need a way for get the flag that we'll receive when we reach this number. We can see in the XML file MainPreferences.xml saved into /data/data/com.tm.ctf.clickerfolder in the device

<?xml version='1.0' encoding='utf-8' standalone='yes' ?>
<map>
    <string name="DATA">Q</string>
    <int name="COUNT" value="1" />
</map>

I try override the file, but I don't have success. So, maybe we can modify the CongratulationsActivity

package com.tm.ctf.clicker.activity;  

import android.app.Activity;  
import android.graphics.Bitmap;  
import android.graphics.BitmapFactory;  
import android.os.Bundle;  
import android.util.Log;  
import com.tm.ctf.clicker.p004a.C0238a;  
import java.io.IOException;  
import java.io.InputStream;  
import java.nio.ByteBuffer;  

/* loaded from: classes.dex */  
public class CongraturationsActivity extends Activity {  

    /* renamed from: b */  
    private static final String f563b = CongraturationsActivity.class.getSimpleName();  

    /* renamed from: c */  
    private static final byte[] f564c = {-119, 80, 78, 71, 13, 10, 26, 10};  

    /* renamed from: a */  
    SurfaceHolderCallbackC0240b f565a = null;  

    /* renamed from: a */  
    private Bitmap m921a() {  
        try {  
            InputStream open = getResources().getAssets().open("f.png");  
            byte[] bArr = new byte[open.available()];  
            open.read(bArr);  
            ByteBuffer allocate = ByteBuffer.allocate(bArr.length + 8);  
            allocate.put(f564c);  
            allocate.put(bArr);  
            return BitmapFactory.decodeByteArray(allocate.array(), 0, bArr.length + 8);  
        } catch (IOException e) {  
            e.printStackTrace();  
            return null;  
        }  
    }  

    @Override // android.app.Activity  
    protected void onCreate(Bundle bundle) {  
        super.onCreate(bundle);  
        getActionBar().hide();  
        if (10000000 != C0238a.m918c()) {  
            finish();  
        }  
        this.f565a = new SurfaceHolderCallbackC0240b(this, String.valueOf(getIntent().getStringExtra("data")) + "Nf");  
        Bitmap m921a = m921a();  
        setContentView(this.f565a);  
        Log.i("VirusClicker", "width=" + m921a.getWidth() + ", height=" + m921a.getHeight());  
    }  
}

In this code we can see that the flag is showed. The flag is created in the method m924a

private void m924a(Canvas canvas, Paint paint) {  
        canvas.drawText("Conguraturations!", (this.f572c - ((int) paint.measureText("Conguraturations!"))) / 2, (this.f573d / 6) * 2, paint);  
        canvas.drawText("The flag is ...", (this.f572c - ((int) paint.measureText("The flag is ..."))) / 2, (this.f573d / 6) * 3, paint);  
        m925a();  
        String obj = C0246b.m933b(this.f575f.getBytes(), "click_machine").toString();  
        canvas.drawText("TMCTF{" + this.f575f + "}", (this.f572c - ((int) paint.measureText(r1))) / 2, (this.f573d / 6) * 4, paint);  
        Log.i("VirusClicker", "length=" + obj.length());  
    }

But there aren't nothing that we can do.

So, I found this code in ScoreBroadcastReceiver

This code send the data score for some checks to the app. So, get }