Overview
An Android APK challenge where the flag is compiled into a native C++ shared library (.so file). We must locate the library, reverse the JNI functions, and decrypt the flag payload.
Reconnaissance
Unpacking the APK using unzip or apktool, we find a native library under lib/x86_64/libballoonbang.so.
Running strings on the shared library reveals an interesting JNI function name: Java_com_crackon_balloonbang_MainActivity_stringFromJNI.
We also found an audio file pop.mp3, but spectral analysis confirmed it was a red herring.
Exploitation Strategy
We disassembled the JNI function using objdump or opened it in IDA Pro/Ghidra.
The function loads 34 encrypted bytes into memory, loops through them, and XORs each byte with a constant key: 0x5A.
We extracted the raw encrypted bytes from the binary offsets and wrote a quick Python script to decrypt them.
Solution Code
with open('libballoonbang.so', 'rb') as f:
data = f.read()
block1 = data[0x13040:0x13050] # 16 bytes
block2 = data[0x13050:0x13060] # 16 bytes
word = bytes([0x23, 0x27]) # 2 bytes from movw
combined = block1 + block2 + word
flag = bytes([b ^ 0x5A for b in combined])
print(flag.decode())
# Flag: CrackOn{Andr0id_D3bugg1ng_1s_3asy}Flag
CrackOn{Andr0id_D3bugg1ng_1s_3asy}