CTF droids1

I decompiled the apk file using http://www.javadecompilers.com/apk.

After checking the sources I found:

    public static String getFlag(String input, Context ctx) {
        if (input.equals(ctx.getString(R.string.password))) {
            return fenugreek(input);
        }
        return "NOPE";
    }

and figured out I have to search for a password.

I found it using a grep on all the files.

cheepsss@:~/Documents/picoctf/droids1$ grep -r password
grep: one.apk: binary file matches
sources/com/hellocmu/picoctf/FlagstaffHill.java:        if (input.equals(ctx.getString(R.string.password))) {
sources/com/hellocmu/picoctf/R.java:        public static final int password = 2131427375;
sources/androidx/core/view/accessibility/AccessibilityNodeInfoCompat.java:    public void setPassword(boolean password) {
sources/androidx/core/view/accessibility/AccessibilityNodeInfoCompat.java:        this.mInfo.setPassword(password);
sources/androidx/core/view/accessibility/AccessibilityNodeInfoCompat.java:        builder.append("; password: ");
resources/res/values/public.xml:    <public type="string" name="password" id="2131427375" />
resources/res/values/strings.xml:    <string name="password">opossum</string>
grep: resources/classes.dex: binary file matches

After this, I opened the app in a emulator, entered the password and got the flag.

The emulator used:https://appetize.io/