Category: Reverse engineering
Points: 300
Author: Prince Niyonshuti N.
Get ready for a mischievous adventure with your favorite Minions! 🕵️♂️💥 They’ve been up to their old tricks, and this time, they've hidden the flag in a devious way within the Android source code. Your task is to channel your inner Minion and dive into the disassembled or decompiled code. Watch out, because these little troublemakers have hidden the flag in multiple sneaky spots or maybe even pulled a fast one and concealed it in the same location! Put on your overalls, grab your magnifying glass, and get cracking. The Minions have left clues, and it's up to you to follow their trail and uncover the flag. Can you outwit these playful pranksters and find their secret? Let the Minion mischief begin! Find the android apk here Minions Mobile Application and try to get the flag.
1: Do you know how to disassemble an apk file?
2: Any interesting source files?
My first apk hacking. We download the APK file and run it with Android Studio.
To learn how to install and root the emulator we can follow the video of the Youtuber UnderSecured.
After installing the application:
After running the application:
So we need to find the value of a variable named banana in the code. To do this, we can use jadx or apktool to disassemble the apk and search for the banana variable with grep. The difference between jadx and apktool:
-
jadx→ decompiles into readable Java (ideal for reading logic quickly). -
apktool→ decompiles to smali + resources (ideal for patching/rebuilding, and for seeing low-level details).
We will use jadx.
Syntax: jadx -d $HOME/extracted $HOME/minions.apk
The last step is to search for the banana variable in the source code of the APK file with grep.
According to dcode, the value of Banana is encoded in base32
Let's decode:
GG!