Hook-me write up

Syria National CTF (Finals)

Hook-me challenge

we had an android app named hook-me, back to the time of the competition we solved the challenge by de-compiling the apk and patching the smali code then recompile the app and signing it to get the flag , since that time i felt there should be another way to solve it using hooking so  i decide to write this write-up after finding the second way to solve this hook-me .

by de-compiling the apk and viewing its source code using apktool and dex2jar or simply using Jadx

if you have no idea what i'm talking about then i recommend you read this guide

Android App Reverse Engineering 101

then back to continue reading this post.

when you view the source code you will see the following :

as you see we have to change DoSomeMagic(55); to DoSomeMagic(256);

then the flag will be displayed so to do this without patching the apk we can use a great tool called Frida but i never used it before so i have to read the documentation

https://frida.re/docs/android/

after spending some time reading the doc i could solve it by hooking the DoSomeMagic function and changing the argument (55) to (256)

first we have to install Frida-tools to python using the following command :

pip install frida-tools

then we have to install frida-server to the emaluater we will use or to your own device but make sure first to have a rooted one in order to avoid some issues that might happen on un-rooted androids .

you can install the frida server by downloading it from

https://github.com/frida/frida/releases

and uncompress it.

after that you have to push it to the device using adb then run it as follow   :

now we should have our frida server runing and we are ready to inject our script into hook-me app

that will be done using java script

and for injecting the js script i used python (you can inject it directly using frida commands )

now lets see the injecting in action ^_* :