#Crack Me If You Can
**Category:** Reversing**Points:** 100**Description:**
> John bets nobody can find the passphrase to login!
> GPG key: viphHowrirOmbugTudIbavMeuhacyet
> [Crack Me If You Can](crack-me-if-you-can_d4e396383e3f64ec7698efaf42f7f32b.tar.gz.gpg)
##Write-up> To start, we are given an apk to reverse.  The first thing I did was attempt to decompile the code.  To do this I used a few different tools.  The first thing we need to do is unzip the apk into a dex file.  After that we can use dex2jar to convert this into a jar file.  Finally, we can use luyten to open the jar and inspect the code.
>```>$ unzip crack-me-if-you-can.apk classes.dex> Archive: crack-me-if-you-can.apk>  inflating: classes.dex>$ ~/dex2jar-0.0.9.15/dex2jar.sh classes.dex> this cmd is deprecated, use the d2j-dex2jar if possible> dex2jar version: translator-0.0.9.15> dex2jar classes.dex -> classes_dex2jar.jar> Done.>$ java -jar ~/luyten-0.4.3/luyten-0.4.3.jar classes_dex2jar.jar>```>![Image of luyten](./luyten.tiff)>> The first thing I noticed in the it.polictf2015 package was the string>>```> flagging{It_cannot_be_easier_than_this}>```>> I tried this with the correct flag{.*} format but it didn't work.  After looking through the layers of classes, all of which had a.b, b.c, b.d, c.a style structures I landed on the following chunk of java.>>```java>private boolean a(final String s) {>        if (s.equals(c.a(it.polictf2015.b.a(it.polictf2015.b.b(it.polictf2015.b.c(it.polictf2015.b.d(it.polictf2015.b.g(it.polictf2015.b.h(it.polictf2015.b.e(it.polictf2015.b.f(it.polictf2015.b.i(c.c(c.b(c.d(this.getString(2131492920)))))))))))))))) {>            Toast.makeText(this.getApplicationContext(), (CharSequence)this.getString(2131492924), 1).show();>            return true;>        }>        return false;>    }>```> This looks promising, but we need to find out what the following string is.>```java> this.getString(2131492920)>```> > Already having the android-sdk installed, I went into the build-tools directory and grepped the output from aapt looking for the hex representation of the string reference.>>```>$ ./aapt d --values resources ~/Dropbox/crack-me-if-you-can.apk | grep 0x7f0c0038>      spec resource 0x7f0c0038 it.polictf2015:string/àè: flags=0x00000000>        resource 0x7f0c0038 it.polictf2015:string/àè: t=0x03 d=0x0000017b (s=0x0008 r=0x00)>```>> We can see that we got a hit on the it.polictf2015:string/àè string.  Now to get the strings.xml file.  For this, we'll use apktool to open up the apk.>>```>$ java -jar apktool_2.0.0.jar d ~/Dropbox/crack-me-if-you-can.apk >I: Using Apktool 2.0.0 on crack-me-if-you-can.apk>I: Loading resource table...>I: Decoding AndroidManifest.xml with resources...>I: Loading resource table from file: /Users/haylesr/Library/apktool/framework/1.apk>I: Regular manifest package...>I: Decoding file-resources...>I: Decoding values */* XMLs...>I: Baksmaling classes.dex...>I: Copying assets and libs...>I: Copying unknown files...>I: Copying original files...>```>> In the res/values directory we find strings.xml.  Below is a snippet with the important stuff.>>```xml>><resources>>    <string name="prompt">Crack me!</string>>    <string name="store_picture_message">Allow Ad to store image in Picture gallery?</string>>    <string name="store_picture_title">Save image</string>>    <string name="wallet_buy_button_place_holder">Buy with Google</string>>    <string name="à">Incorrect!</string>>    <string name="àè" formatted="false">[[c%l][c{g}[%{%Mc%spdgj=]T%aat%=O%bRu%sc]c%ti[o%n=Wcs%=No[t=T][hct%=buga[d=As%=W]e=T%ho[u%[%g]h%t[%}%</string>>    <string name="àò" formatted="false">[[c%l][c{g}[%{%Mc%spdggfdj=]T%aat%=O%bRu%sc]c%ti[o[t=T][hct%=budsga[d=As%=W]e=T%ho[u%[%g]h%t[%}%T[]e3</string>>    <string name="àù">Your device looks good :)</string>>    <string name="è">Empty!</string>>    <string name="ìò">Good to go! =)</string>>    <string name="ù">"Nice emulator, I'm watching you ;)"</string>>    <string name="ùò">Hello!</string>></resources>>```>> We see our string reference matches up and we are left with the following:>>```> [[c%l][c{g}[%{%Mc%spdggfdj=]T%aat%=O%bRu%sc]c%ti[o[t=T][hct%=budsga[d=As%=W]e=T%ho[u%[%g]h%t[%}%T[]e3>```>> I turned to python to recreate the b.java and c.java that we were able to see using the luyten tool.  These classes basically just did a bunch of replacements on a given String value.
>```python>def ca(text):>	return text.replace("aa","ca")>def cb(text):>	return text.replace("aat","his")>def cc(text):>	return text.replace("buga","Goo")>def cd(text):>	return text.replace("spdgj","yb%e")>def ba(text):>	return text.replace("c","a")>def bb(text):>	return text.replace("%","")>def bc(text):>	return text.replace("[","")>def bd(text):>	return text.replace("]","")>def be(text):>	return text.replace("\\{","")>def bf(text):>	return text.replace("\\}","")>def bg(text):>	return text.replace("c","f")>def bh(text):>	return text.replace("R","f")>def bi(text):>	return text.replace("=","_")>>flag="[[c%l][c{g}[%{%Mc%spdgj=]T%aat%=O%bRu%sc]c%ti[o%n=Wcs%=No[t=T][hct%=buga[d=As%=W]e=T%ho[u%[%g]h%t[%}%">print ca(ba(bb(bc(bd(bg(bh(be(bf(bi(cc(cb(cd(flag)))))))))))))>```>> Running this code produced the following:>>```>$ python ~/Dropbox/crackme.py > flf{g}{Mfybe_This_Obfusfftion_Wfs_Not_Thft_Good_As_We_Thought}>```>> Bravo! We got the flag, but with some obvious mistakes. I'm sure I screwed up my python somewhere, but the flag is close enough that we can translate it to the correct value.  I never went back to find the mistake.  We submitted the flag and moved on.>>```> flag{Maybe_This_Obfuscation_Was_Not_That_Good_As_We_Thought}>```