> For the complete documentation index, see [llms.txt](https://hacktricks.xsx.tw/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacktricks.xsx.tw/mobile-pentesting/android-app-pentesting/google-ctf-2018-shall-we-play-a-game.md).

# Google CTF 2018 - Shall We Play a Game?

<details>

<summary><strong>从零开始学习AWS黑客技术，成为专家</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE（HackTricks AWS红队专家）</strong></a><strong>！</strong></summary>

支持HackTricks的其他方式：

* 如果您想在HackTricks中看到您的**公司广告**或**下载PDF格式的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
* 获取[**官方PEASS & HackTricks周边产品**](https://peass.creator-spring.com)
* 探索[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们独家的[**NFTs**](https://opensea.io/collection/the-peass-family)收藏品
* **加入** 💬 [**Discord群组**](https://discord.gg/hRep4RUj7f) 或 [**电报群组**](https://t.me/peass) 或在**Twitter**上关注我们 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**。**
* 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。

</details>

在此下载APK：

我将上传APK到[https://appetize.io/](https://appetize.io)（免费账户）以查看APK的行为：

![](https://615200056-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1DLBZdNLkY4FUHtMnjPr%2Fuploads%2Fgit-blob-c4dc346914413de85014339700c0f76a7b3337be%2Fimage%20\(46\).png?alt=media)

看起来您需要赢得1000000次才能获得flag。

按照[Android应用渗透测试](/mobile-pentesting/android-app-pentesting.md)中的步骤，您可以反编译应用程序以获取smali代码，并使用jadx阅读Java代码。

阅读Java代码：

![](https://615200056-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1DLBZdNLkY4FUHtMnjPr%2Fuploads%2Fgit-blob-8f87ed9e5987c295f6d299cc376333c7858add1e%2Fimage%20\(47\).png?alt=media)

看起来打印flag的函数是 **m().**

## **Smali更改**

### **第一次调用m()**

让应用程序在变量 *this.o != 1000000* 时调用m()，为此，只需更改条件：

```
if-ne v0, v9, :cond_2
```

## Google CTF 2018: Shall we play a game?

***

### Task 1: Install the APK

Download the APK from the challenge page and install it on your Android device.

### Task 2: Analyze the APK

#### Step 1: Decompile the APK

Use JADX or apktool to decompile the APK.

#### Step 2: Analyze the source code

Look for interesting parts in the source code, such as API endpoints, sensitive information handling, etc.

### Task 3: Find the flag

Search for the flag within the APK or by analyzing the app's behavior.

### Task 4: Submit the flag

Submit the flag to the CTF platform to earn points.

***

Happy hacking! 🚀

```
if-eq v0, v9, :cond_2
```

![之前](https://615200056-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1DLBZdNLkY4FUHtMnjPr%2Fuploads%2Fgit-blob-8f87ed9e5987c295f6d299cc376333c7858add1e%2Fimage%20\(48\).png?alt=media)

![之后](https://615200056-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1DLBZdNLkY4FUHtMnjPr%2Fuploads%2Fgit-blob-a75850811fb84537bc05fc4e39d0033864ba2f4f%2Fimage%20\(49\).png?alt=media)

按照[Android渗透测试](/mobile-pentesting/android-app-pentesting.md)的步骤重新编译并签署APK。然后，将其上传到[https://appetize.io/](https://appetize.io)，看看会发生什么：

![](https://615200056-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1DLBZdNLkY4FUHtMnjPr%2Fuploads%2Fgit-blob-a8cfa5b773303edb184e1e0eac4f0ba47f67677c%2Fimage%20\(50\).png?alt=media)

看起来旗标未完全解密就被写入。可能应该调用m()函数1000000次。

**另一种**方法是不更改指令，而是更改比较指令：

![](https://615200056-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1DLBZdNLkY4FUHtMnjPr%2Fuploads%2Fgit-blob-b38f1e7c33a457a514f7c74612639d5252f62631%2Fimage%20\(55\).png?alt=media)

**另一种**方法是将值设置为1，这样this.o将与1进行比较：

![](https://615200056-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1DLBZdNLkY4FUHtMnjPr%2Fuploads%2Fgit-blob-0d52048cb066f7c7b8ba357aa09445dffa6c902e%2Fimage%20\(57\).png?alt=media)

第四种方法是添加一条指令将v9(1000000)的值移动到v0 *(this.o)*：

![](https://615200056-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1DLBZdNLkY4FUHtMnjPr%2Fuploads%2Fgit-blob-bc4b76df180ba97e862f730d4bc9ca931d889dfe%2Fimage%20\(58\).png?alt=media)

![](https://615200056-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1DLBZdNLkY4FUHtMnjPr%2Fuploads%2Fgit-blob-8190e06a75ffa491e447ad9278cb40312d5e82b5%2Fimage%20\(52\).png?alt=media)

## 解决方案

当您第一次获胜时，使应用程序运行循环100000次。为此，您只需要创建\*\*：goto\_6**循环，并使应用程序**跳转到那里，如果`this.o`\*\*的值不是100000\：

![](https://615200056-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1DLBZdNLkY4FUHtMnjPr%2Fuploads%2Fgit-blob-d74f017539be0862274e615ceda294fca87f15e2%2Fimage%20\(59\).png?alt=media)

您需要在物理设备内执行此操作，因为（我不知道为什么）在模拟设备中无法正常工作。