Hacker App – Reverse Engineering Challenge Writeup | BDSec CTF 2025

The following problem is a static analysis problem of a app called "hacker_app.apk" Using jadex I navigated through the source code of the package and arrived at the MainActivity class.

Source code -> com -> nomanprodhan.hackerapp -> MainActivity

There I saw all the possible outputs triggered by given inputs , and noticed a unique output with a suspicious string-

if ("2025.bdsec-ctf.com".equals(d0M1a)) {
            aU1dG9.add("[SUCCESS] Root Account Password: ioFOE6/xXoxB5M02UsaVQAhuQVC5f8+PMMgwOwGbmE0R7n6qyRQ9qwCzCgDVYWc6");
        }

The String in question is "ioFOE6/xXoxB5M02UsaVQAhuQVC5f8+PMMgwOwGbmE0R7n6qyRQ9qwCzCgDVYWc6" . Which is trigger by a specific website link "2025.bdsec-ctf.com"

Then I noticed multiple encryption method for a variable-

    private static byte[] iP7sV3(byte[] d, int k1) {
        return yW0qH1(uE9rC5(oX8jZ6(d, k1)));
    }

1)First encryption is xor-

private static byte[] oX8jZ6(byte[] d, int k) {
        int n = d.length;
        byte[] tmp = (byte[]) d.clone();
        for (int i = 0; i < n / 2; i++) {
            byte t = tmp[i];
            tmp[i] = tmp[(n - 1) - i];
            tmp[(n - 1) - i] = t;
        }
        for (int i2 = 0; i2 < n; i2++) {
            int s = (i2 % 4) * 8;
            tmp[i2] = (byte) (tmp[i2] ^ ((byte) ((k >>> s) & 255)));
        }
        return tmp;
    }

1. Second encryption is Tea encryption-

private static byte[] uE9rC5(byte[] d) {
        int pad = 8 - (d.length % 8);
        int L = d.length + pad;
        byte[] b = new byte[L];
        System.arraycopy(d, 0, b, 0, d.length);
        Arrays.fill(b, d.length, L, (byte) pad);
        byte[] o = new byte[L];
        for (int off = 0; off < L; off += 8) {
            int v0 = aP4wK7(b, off);
            int v1 = aP4wK7(b, off + 4);
            int sum = 0;
            for (int r = 0; r < 16; r++) {
                sum -= 1640531527;
                v0 += (((v1 << 4) ^ (v1 >>> 5)) + v1) ^ (vY7kD3[sum & 3] + sum);
                v1 += (((v0 << 4) ^ (v0 >>> 5)) + v0) ^ (vY7kD3[(sum >>> 11) & 3] + sum);
            }
            gF6mD2(o, off, v0);
            gF6mD2(o, off + 4, v1);
        }
        return o;
    }

1. Third encryption is Byte transformation-

private static byte[] yW0qH1(byte[] d) {
        byte[] o = new byte[d.length];
        for (int i = 0; i < d.length; i++) {
            int x = jN5fC2[d[i] & 255];
            o[i] = (byte) (((x << 5) & 255) | (x >>> 3));
        }
        return o;
    }

4)And lastly turning that into Base64.

Reverseing this encrytion manually using the given variables and table for the byte transformation will give up the flag .

or just make a script . I would recommand that .