# Lightbulb (rev)Writeup by: [xlr8or](https://ctftime.org/team/235001)
As part of this challenge we get an apk file.My go-to tool for apks is `jadx-gui`, so I loaded this file into it.
First let's search for the flag prefix, maybe we get lucky. There's a single hit for it in the `LightSwitchingActivity` class. Let's see the code around this area:
```javaString string = sharedPreferences.getString("secret_key", "");Log.d("LIGHTSWITCH", "the sk was " + string);Intrinsics.checkNotNull(string);
byte[] bytes = string.getBytes(Charsets.UTF_8);Intrinsics.checkNotNullExpressionValue(bytes, "this as java.lang.String).getBytes(charset)");
APIKeyHash aPIKeyHash = new APIKeyHash(bytes);StringBuilder sb = new StringBuilder("CSR{");
byte[] bytes2 = "APIKEY".getBytes(Charsets.UTF_8);Intrinsics.checkNotNullExpressionValue(bytes2, "this as java.lang.String).getBytes(charset)");
this.apiKey = sb.append(LightSwitchingActivityKt.toHex(aPIKeyHash.hash(bytes2))).append('}').toString();```
* We get a `secret_key` from shared preferences and convert it to a byte array* We initialize `APIKeyHash` based on the key* We hash the string `APIKEY` and concatenate it with the flag prefix and suffix
So we just need to get the hash value of `APIKEY` in order to solve this challenge.Let's quickly take a look at the hash function:```java    Intrinsics.checkNotNullParameter(plaintext, "plaintext");    byte[] bArr = new byte[plaintext.length];    int length = plaintext.length;    int i = 0;    int i2 = 0;    for (int i3 = 0; i3 < length; i3++) {        i = (i + 1) & 255;        byte[] bArr2 = this.s;        byte b = bArr2[i];        i2 = (i2 + b) & 255;        byte b2 = bArr2[i2];        bArr2[i2] = b;        bArr2[i] = b2;        bArr[i3] = (byte) (bArr2[(b2 + bArr2[i2]) & 255] ^ plaintext[i3]);    }    return bArr;```
This looks familiar... It looks like RC4 encrypt/decrypt, although if I didn't recognize the algorithm I could have translated it from scratch and would have still been able to recover the flag.
Equipped with this knowledge we only need to find the `secret_key` in order to recover the flag. And a simple text search helps me out again.In `MainActivity` we find the following code:```javaif (!Intrinsics.areEqual(PreferenceManager.getDefaultSharedPreferences(this).getString("secret_key", ""), "583908295080")) {            startActivity(new Intent(getApplicationContext(), LoginActivity.class));        } else {            startActivity(new Intent(getApplicationContext(), LightSwitchingActivity.class));        }```
If the `secret_key` is not the constant value there, then the login screen is shown, otherwise we proceed to the code path which constructs the flag.
Now we know everything to construct the flag:```pythonfrom Crypto.Cipher import ARC4
secret_key = '583908295080'
cipher = ARC4.new(secret_key.encode('utf-8'))print(cipher.encrypt('APIKEY'.encode('utf-8')).hex().upper())```