Overview
An Android APK hides a flag behind credential inputs and a custom crypto routine.
Reconnaissance
Decompiling the APK using jadx reveals credentials checks inside PipelineKt.java against two Base32-encoded integer arrays.
Exploitation Strategy
Decoding the Base32 strings yields the login credentials. On successful login, the app executes a XOR encryption routine. Using known-plaintext parameters (first character of flag must be 'K'), we calculate the dynamic XOR key to be 27 instead of the hardcoded default of 9.
Solution Code
encrypted = [80,122,122,119,96,42,68,112,117,45,109,109,68,98,45,110,68,112,115,40,47,44,40,127,68,99,127,117,102]
flag = "".join([chr(i ^ 27) for i in encrypted])
print(flag)Flag
Kaal{1_kn6vv_y6u_kh3473d_xdn}