ctf-android

Files (1)

• SKILL.md

SKILL.md (first lines)

# CTF Android — APK Reverse Engineering

Jadx, APKTool, ADB, Frida. Full static+dynamic workflow.

## Install

```bash
# Jadx (latest):
wget https://github.com/skylot/jadx/releases/latest/download/jadx-1.5.0.zip
unzip jadx-1.5.0.zip -d jadx && echo "export PATH=$PATH:$PWD/jadx/bin" >> ~/.bashrc

# APKTool:
wget https://raw.githubusercontent.com/iBotPeaches/Apktool/master/scripts/linux/apktool
wget https://github.com/iBotPeaches/Apktool/releases/latest/download/apktool_2.9.3.jar
chmod +x apktool && sudo mv apktool /usr/local/bin/ && sudo mv apktool_2.9.3.jar /usr/local/bin/apktool.jar

# ADB:
sudo apt-get install adb

# Frida:
pip install frida-tools --break-system-packages
# Push frida-server to emulator:
# adb push frida-server /data/local/tmp/ && adb shell chmod 755 /data/local/tmp/frida-server
```

---

## Phase 1: Reconnaissance

```bash
# Unzip APK (it's a ZIP):
unzip challenge.apk -d apk_contents/
ls apk_contents/  # AndroidManifest.xml, classes.dex, lib/, assets/, res/

# Check manifest for exported components:
apktool d challenge.apk -o apk_decoded/
cat apk_decoded/AndroidManifest.xml | grep -E "exported|Activity|Provider|Receiver"

# Find interesting strings:
strings apk_contents/classes.dex | grep -i "flag\|secret\|pass\|key\|encrypt"

# Check assets for plaintext:
find apk_contents/assets/ -type f | xargs strings | grep -i "flag\|CTF"
cat apk_decoded/res/values/strings.xml | grep -i "flag\|secret"
```

---

## Phase 2: Static Analysis with Jadx

```bash
# Decompile to Java:
jadx -d jadx_out/ challenge.apk

# Search for flag logic:
grep -r "flag\|Flag\|FLAG" jadx_out/sources/ --include="*.java"
grep -r "checkFlag\|verify\|validate\|password" jadx_out/sources/ --include="*.java"

# Find crypto usage:
grep -r "AES\|DES\|Base64\|SecretKeySpec\|Cipher" jadx_out/sources/ --include="*.java"

# Find hardcoded keys/values:
grep -r "BuildConfig\|const String" jadx_out/sources/ --include="*.java"
grep -r "SharedPreferences\|openDatabase\|SQLite" jadx_out/sources/ --include="*.java"

# Native calls:
grep -r "native \|System.loadLibrary\|loadLibrary" jadx_out/sources/ --include="*.java"
```

---

## Phase 3: Smali Analysis

```bash
# Disassemble to Dalvik bytecode:
apktool d challenge.apk -o smali_out/

# Find main activity:
grep -r "onCreate\|onStart" smali_out/smali/ | head -10

# Read flag check class:
cat smali_out/smali/com/ctf/challenge/FlagChecker.smali

# Key smali instructions:
# const-string v0, "expected_value"   → hardcoded strings
# invoke-virtual {v0, v1}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
# if-eqz v0, :cond_fail              → conditional jumps

# Search for comparisons:
grep -n "if-eqz\|if-nez\|equals\|const-string" smali_out/smali/com/ctf/challenge/*.smali
```

---

## Phase 4: Native Library Analysis

```bash
LIB="apk_contents/lib/x86_64/libchallenge.so"  # or armeabi-v7a, arm64-v8a

# Basic analysis:
strings "$LIB" | grep -i "flag\|secret\|CTF"
nm -D "$LIB" | grep "Java_"  # JNI function exports

# Radare2 analysis:
r2 "$LIB" -A
# Commands:
# afl        — list functions
# pdf @sym.Java_com_ctf_FlagChecker_checkNative  — disassemble
# iz         — list all strings
# iE         — list exports

# JNI function naming convention:
# Java_<package_dots_to_underscores>_<ClassName>_<methodName>
# Java_com_ctf_challenge_FlagActivity_checkFlag

# Check for embedded key in .rodata:
objdump -s -j .rodata "$LIB" | head -50
```

From Yoraexe/ceobe, MIT.

More from Yoraexe/ceobe