Demystifying CTFs - manipulating Android apps
summary
Downloads the APK, decompiles it with jadx and apktool, and runs static inspection to spot an intent check that requires a crafted ADB intent. Moves into native code in native lib "libdefault", reverses a bitwise string transform to produce the secret input, launches the app, enters the string, then pulls a dynamically created file and runs strings on created file "H" to reveal the flag. Uses optional Frida/IDA hints; the repack is unnecessary because the dynamic file contains the answer.
AI-written summary · about
chapters (19)
- 0:00Android security and CTFs
- 1:12CTF challenges importance
- 2:17Android vulnerabilities OWASP
- 4:43Mobile malware stats trends
- 9:47Security testing limits
- 13:46Why developers should understand security testing
- 16:16OWASP mobile testing guide
- 18:03What is a CTF
- 20:35Solving CTF step by step
- 24:28Android CTF tools
- 27:19Android code execution layers
- 28:24Static analysis of APK
- 31:42Dynamic analysis bypass
- 34:14Native layer decompilation
- 37:08Bitwise operation logic
- 40:25Input validation flag
- 42:53CTF lessons learned
- 43:54Securing Android apps best practices
- 44:15CTF training resources
related talks
47mAttacking Android Applications
43mAttacking Android Applications
01h 07mHow to attack (and secure) an Android app: an introduction
45mReverse engineering mobile apps: how, why, and what now?
29mA day in the life of a mobile reverse engineer
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
37mThe Art of Hiding Sensitive Info in Plain Sight
49mAll Your Code Belongs To Us (Dismantling Android Secrets With CodeInspect)