Just another Cracking the Uncrackable

Cracking OWASP’s Android Uncrackable Level 2

While spending some time developing some modules for MEDUSA, I decided to give a try and see how I could use this tool in order to crack some of the popular OWASP’s Android Crackmes. I will try to keep this post as short as possible, so lets get right to the point…

Download and Install

Assuming that the reader has already install MEDUSA, lets download the crackme and install it using the apkutils.py script:

That wasn’t hard I guess, but when we try to run the application we got our first wall:

I didn’t even “open” the apk, but this can’t be that hard so I decided to use MEDUSA’s anti_debug module and see how it goes:

Excellent, wall Number 1 down:

Native Stuff

Just type ‘e’ to exit the session and let’s have a look to the app’s native libraries. Typing “list <package name> path” will yield the app’s installation directory:

Back to the apkutils (I hope you haven’t exit), to see whats there:

libfoo ? lets extract it from the device:

Cant avoid Ghidra

Let’s open libfoo.so and search for a “Java_” function:

Starting from the CodeCheck_bar, it seems that we are right to the point:

Line 24: Will return the Byte array elements representing the user’s input

Line 25: Will return the size of the input byte array

Line 26: There will check if the size is equal to 0x17 and if true will proceed on checking what seems to be the secret. If the comparison is successful it will return True or otherwise false.

Notice the content at lines 21–23 ?

Lets use some CyberChef magic:

Excellent !

Thanks for the fish !!

Ah… not to forget to clean the device ;) :