De4flag

1
python3 -m http.server 8000
2
adb reverse tcp:8000 tcp:8000

1
3331  3331 I System.out: [Request] Sending login request to http://localhost:8000/login
2
3331  3331 I System.out: [Request] Failed to connect: Cleartext HTTP traffic to localhost not permitted

1
Java.perform(() => {
2
    const clsName = 'com.main.de4flagnative.DevCheck';
3
    try {
4
        const DevCheck = Java.use(clsName);
5

6
        DevCheck.SecretVerify.overload('java.lang.String').implementation = function (value) {
7
            console.log('[*] SecretVerify(String) ENTER');
8
            console.log("[*] User: ", value);
9

10
            return true;
11
        };
12

13
        console.log('[*] Hooked:', clsName + '.decodePromo(Context)');
14
    } catch (e) {
15
        console.log('[-] Hook setup error:', e);
16
    }
17
});

1
frida -U -f com.main.de4flagnative -l ./de4flag.js

1
private boolean SecretVerify(String str) throws IOException {
2
        if (!this.isDevDebug || this.authFailCount != 0) {
3
            SendToServer(str);
4
            this.authFailCount++;
5
            return false;
6
        }
7
        if (str.equals("pass9876::myuser5555")) {
8
            System.out.println("Secret value printed via Console Log");
9
            new SecretFlag().print(str, this);
10
        }
11
        return true;
12
    }

1
Java.perform(() => {
2
    const clsName = 'com.main.de4flagnative.DevCheck';
3
    try {
4
        const DevCheck = Java.use(clsName);
5
        let SecretFlag = Java.use("com.main.de4flagnative.SecretFlag");
6

7
        DevCheck.SecretVerify.overload('java.lang.String').implementation = function (value) {
8
            console.log('[*] SecretVerify(String) ENTER');
9
            console.log("[*] User: ", value);
10

11
            const pass = "pass9876::myuser5555";
12
            let flag;
13

14
            // Correct overload with two params
15
            const p = SecretFlag.print.overload('java.lang.String', 'com.main.de4flagnative.DevCheck');
16

17
            try {
18
                // If print is static: receiver is the class wrapper; second arg is the *instance* (this)
19
                flag = p.call(SecretFlag, pass, this);
20
            } catch (e1) {
21
                // If print is an instance method: create an instance and use that as receiver
22
                try {
23
                    const sf = SecretFlag.$new();
24
                    flag = p.call(sf, pass, this);
25
                } catch (e2) {
26
                    console.log('[-] Failed to invoke SecretFlag.print:', e1, e2);
27
                    return this.SecretVerify(value); // fallback to original if you want
28
                }
29
            }
30

31
            console.log('[*] Flag =>', flag);
32
            return true;
33
        };
34

35
        console.log('[*] Hooked:', clsName + '.decodePromo(Context)');
36
    } catch (e) {
37
        console.log('[-] Hook setup error:', e);
38
    }
39
});

1
STH{6ea68d9d69ead13e0a08c6b08a53a38f}