[CTT2023] hello flutter — 100 pts

This is the first mobile challenge.

We will be given with zip containing apk file. Along with some clues stating that the app is in debug mode.

Before we can do anything, let’s decompile the app with jadx

It might be my habit but I like to check whether the app is written in flutter or not. In my case, I always check the /lib directory to see if there is any libflutter.so or not:

So, it is written in Flutter. We also have one other clue about “debug” mode.

One relation about debug and flutter is that kernel_blob.bin is generated in debug mode when compiling source code.

Reference:

Flutter Hackers: Uncovering the Dev’s Myopia (Part 1)

The location of it is in assets/flutter_assets . It mostly contain the untouched source code.

Let’s search for main() to find main logic:

The flag is: CTT23{l3t_st@rt_w1th_th3_m@n1f3st}