Jeanne DHACK CTF 2026 | Mobile Odyssey

Introduction#

The first mobile challenge of the Jeanne DHACK CTF 2026 is here! The challenge provides an APK file of a mobile game called Mobile Odyssey, and the goal is to find secret information hidden within the app. Easy, right?

This challenge is not particularly hard if you have experience with mobile app reverse engineering and the right tools. This is my first time using certain tools. Not having a rooted phone makes dynamic reverse engineering challenging.

I spent much more time setting up the environment than solving the challenge, but I finally got the flag.

I used Waydroid for emulation and ADB, as well as Frida. For reverse static analysis, I used JADX and JADX-GUI, plus some other tools like apktool and uber-apk-signer.

Okay, let’s start.

Source#

All the main logic is here

1
package com.jeannedhackctf.mobileodyssey;
2

3
import android.os.Bundle;
4
import android.util.Base64;
5
import android.widget.TextView;
6
import androidx.appcompat.app.AppCompatActivity;
7
import androidx.constraintlayout.widget.ConstraintLayout;
8
import com.google.android.gms.tasks.OnCompleteListener;
9
import com.google.android.gms.tasks.Task;
10
import com.google.firebase.ktx.Firebase;
11
import com.google.firebase.remoteconfig.FirebaseRemoteConfig;
12
import com.google.firebase.remoteconfig.FirebaseRemoteConfigSettings;
13
import com.google.firebase.remoteconfig.ktx.RemoteConfigKt;
14
import java.util.Map;
15
import kotlin.Metadata;
16
import kotlin.TuplesKt;
17
import kotlin.Unit;
18
import kotlin.collections.MapsKt;
19
import kotlin.jvm.functions.Function1;
20
import kotlin.jvm.internal.Intrinsics;
21
import kotlin.text.Charsets;
22
import kotlin.text.StringsKt;
23

24
/* compiled from: MainActivity.kt */
25
@Metadata(d1 = {"\u0000.\n\u0002\u0018\u0002\n\u0002\u0018\u0002\n\u0002\b\u0003\n\u0002\u0018\u0002\n\u0000\n\u0002\u0018\u0002\n\u0000\n\u0002\u0010\u000e\n\u0002\b\u0002\n\u0002\u0010\u0002\n\u0000\n\u0002\u0018\u0002\n\u0002\b\u0004\u0018\u00002\u00020\u0001B\u0007¢\u0006\u0004\b\u0002\u0010\u0003J\u0012\u0010\u000b\u001a\u00020\f2\b\u0010\r\u001a\u0004\u0018\u00010\u000eH\u0014J\b\u0010\u000f\u001a\u00020\fH\u0002J\u0012\u0010\u0010\u001a\u0004\u0018\u00010\t2\u0006\u0010\u0011\u001a\u00020\tH\u0002R\u000e\u0010\u0004\u001a\u00020\u0005X\u0082.¢\u0006\u0002\n\u0000R\u000e\u0010\u0006\u001a\u00020\u0007X\u0082.¢\u0006\u0002\n\u0000R\u0010\u0010\b\u001a\u0004\u0018\u00010\tX\u0082\u000e¢\u0006\u0002\n\u0000R\u000e\u0010\n\u001a\u00020\tX\u0082D¢\u0006\u0002\n\u0000¨\u0006\u0012"}, d2 = {"Lcom/jeannedhackctf/mobileodyssey/GameActivity;", "Landroidx/appcompat/app/AppCompatActivity;", "<init>", "()V", "remoteConfig", "Lcom/google/firebase/remoteconfig/FirebaseRemoteConfig;", "statusTextView", "Landroid/widget/TextView;", "retrievedFlag", "", "REMOTE_KEY", "onCreate", "", "savedInstanceState", "Landroid/os/Bundle;", "fetchRemoteConfig", "tryDecodeBase64", "value", "app_debug"}, k = 1, mv = {2, 0, 0}, xi = ConstraintLayout.LayoutParams.Table.LAYOUT_CONSTRAINT_VERTICAL_CHAINSTYLE)
26
/* loaded from: classes3.dex */
27
public final class GameActivity extends AppCompatActivity {
28
    private final String REMOTE_KEY = "sEcre7vALu3";
29
    private FirebaseRemoteConfig remoteConfig;
30
    private String retrievedFlag;
31
    private TextView statusTextView;
32

33
    @Override // androidx.fragment.app.FragmentActivity, androidx.activity.ComponentActivity, androidx.core.app.ComponentActivity, android.app.Activity
34
    protected void onCreate(Bundle savedInstanceState) {
35
        super.onCreate(savedInstanceState);
36
        setContentView(R.layout.activity_game);
37
        this.statusTextView = (TextView) findViewById(R.id.tv_status);
38
        TextView textView = this.statusTextView;
39
        FirebaseRemoteConfig firebaseRemoteConfig = null;
40
        if (textView == null) {
41
            Intrinsics.throwUninitializedPropertyAccessException("statusTextView");
42
            textView = null;
43
        }
44
        textView.setText("🔧 En construction\nReviens bientôt pour plus de contenu.");
45
        this.remoteConfig = RemoteConfigKt.getRemoteConfig(Firebase.INSTANCE);
46
        FirebaseRemoteConfigSettings configSettings = RemoteConfigKt.remoteConfigSettings(new Function1() { // from class: com.jeannedhackctf.mobileodyssey.GameActivity$$ExternalSyntheticLambda2
47
            @Override // kotlin.jvm.functions.Function1
48
            public final Object invoke(Object obj) {
49
                return GameActivity.onCreate$lambda$0((FirebaseRemoteConfigSettings.Builder) obj);
50
            }
51
        });
52
        FirebaseRemoteConfig firebaseRemoteConfig2 = this.remoteConfig;
53
        if (firebaseRemoteConfig2 == null) {
54
            Intrinsics.throwUninitializedPropertyAccessException("remoteConfig");
55
            firebaseRemoteConfig2 = null;
56
        }
57
        firebaseRemoteConfig2.setConfigSettingsAsync(configSettings);
58
        Map defaults = MapsKt.mapOf(TuplesKt.to(this.REMOTE_KEY, ""));
59
        FirebaseRemoteConfig firebaseRemoteConfig3 = this.remoteConfig;
60
        if (firebaseRemoteConfig3 == null) {
61
            Intrinsics.throwUninitializedPropertyAccessException("remoteConfig");
62
        } else {
63
            firebaseRemoteConfig = firebaseRemoteConfig3;
64
        }
65
        firebaseRemoteConfig.setDefaultsAsync((Map<String, Object>) defaults);
66
        fetchRemoteConfig();
67
    }
68

69
    /* JADX INFO: Access modifiers changed from: private */
70
    public static final Unit onCreate$lambda$0(FirebaseRemoteConfigSettings.Builder remoteConfigSettings) {
71
        Intrinsics.checkNotNullParameter(remoteConfigSettings, "$this$remoteConfigSettings");
72
        remoteConfigSettings.setMinimumFetchIntervalInSeconds(3600L);
73
        return Unit.INSTANCE;
74
    }
75

76
    private final void fetchRemoteConfig() {
77
        FirebaseRemoteConfig firebaseRemoteConfig = this.remoteConfig;
78
        if (firebaseRemoteConfig == null) {
79
            Intrinsics.throwUninitializedPropertyAccessException("remoteConfig");
80
            firebaseRemoteConfig = null;
81
        }
82
        firebaseRemoteConfig.fetchAndActivate().addOnCompleteListener(new OnCompleteListener() { // from class: com.jeannedhackctf.mobileodyssey.GameActivity$$ExternalSyntheticLambda0
83
            @Override // com.google.android.gms.tasks.OnCompleteListener
84
            public final void onComplete(Task task) {
85
                GameActivity.fetchRemoteConfig$lambda$3(this.f$0, task);
86
            }
87
        });
88
    }
89

90
    /* JADX INFO: Access modifiers changed from: private */
91
    public static final void fetchRemoteConfig$lambda$3(final GameActivity this$0, Task task) {
92
        Intrinsics.checkNotNullParameter(task, "task");
93
        if (task.isSuccessful()) {
94
            FirebaseRemoteConfig firebaseRemoteConfig = this$0.remoteConfig;
95
            if (firebaseRemoteConfig == null) {
96
                Intrinsics.throwUninitializedPropertyAccessException("remoteConfig");
97
                firebaseRemoteConfig = null;
98
            }
99
            String raw = firebaseRemoteConfig.getString(this$0.REMOTE_KEY);
100
            Intrinsics.checkNotNull(raw);
101
            if (StringsKt.isBlank(raw)) {
102
                raw = null;
103
            }
104
            String str = raw;
105
            if (!(str == null || str.length() == 0)) {
106
                String maybeDecoded = this$0.tryDecodeBase64(raw);
107
                String str2 = maybeDecoded;
108
                this$0.retrievedFlag = !(str2 == null || str2.length() == 0) ? maybeDecoded : raw;
109
            } else {
110
                this$0.retrievedFlag = null;
111
            }
112
        } else {
113
            this$0.retrievedFlag = null;
114
        }
115
        this$0.runOnUiThread(new Runnable() { // from class: com.jeannedhackctf.mobileodyssey.GameActivity$$ExternalSyntheticLambda1
116
            @Override // java.lang.Runnable
117
            public final void run() {
118
                GameActivity.fetchRemoteConfig$lambda$3$lambda$2(this.f$0);
119
            }
120
        });
121
    }
122

123
    /* JADX INFO: Access modifiers changed from: private */
124
    public static final void fetchRemoteConfig$lambda$3$lambda$2(GameActivity this$0) {
125
        TextView textView = this$0.statusTextView;
126
        if (textView == null) {
127
            Intrinsics.throwUninitializedPropertyAccessException("statusTextView");
128
            textView = null;
129
        }
130
        textView.setVisibility(0);
131
    }
132

133
    private final String tryDecodeBase64(String value) {
134
        try {
135
            byte[] decoded = Base64.decode(value, 0);
136
            Intrinsics.checkNotNull(decoded);
137
            String str = new String(decoded, Charsets.UTF_8);
138
            if (StringsKt.isBlank(str)) {
139
                return null;python
140
            }
141
            return str;
142
        } catch (IllegalArgumentException e) {
143
            return null;
144
        }
145
    }
146
}

Lets clean and zoom in the relevant parts.

1
d2 = {"Lcom/jeannedhackctf/mobileodyssey/GameActivity;", "remoteConfig", "Lcom/google/firebase/remoteconfig/FirebaseRemoteConfig;", "REMOTE_KEY", "fetchRemoteConfig", "tryDecodeBase64", "app_debug"} // The metadata shows us some good leaks
2

3
 private final String REMOTE_KEY = "sEcre7vALu3";  // The key used to fetch the secret value from Firebase Remote Config
4

5
 this.remoteConfig = RemoteConfigKt.getRemoteConfig(Firebase.INSTANCE); // Initialize Firebase Remote Config
6

7

8
    // Main logic function to fetch remote config value
9
  public static final void fetchRemoteConfig$lambda$3(final GameActivity this$0, Task task) {
10
      Intrinsics.checkNotNullParameter(task, "task");
11
      if (task.isSuccessful()) {
12
          FirebaseRemoteConfig firebaseRemoteConfig = this$0.remoteConfig;
13
          if (firebaseRemoteConfig == null) {
14
              Intrinsics.throwUninitializedPropertyAccessException("remoteConfig");
15
              firebaseRemoteConfig = null;
16
          }
17
          String raw = firebaseRemoteConfig.getString(this$0.REMOTE_KEY); // Fetch the value using the REMOTE_KEY
18
          Intrinsics.checkNotNull(raw);
19
          if (StringsKt.isBlank(raw)) {
20
              raw = null;
21
          }
22
          String str = raw;
23
          if (!(str == null || str.length() == 0)) {
24
              String maybeDecoded = this$0.tryDecodeBase64(raw); // Try to decode the fetched value from Base64
25
              String str2 = maybeDecoded;
26
              this$0.retrievedFlag = !(str2 == null || str2.length() == 0) ? maybeDecoded : raw;
27
          } else {
28
              this$0.retrievedFlag = null;
29
          }
30
      } else {
31
          this$0.retrievedFlag = null;

Nothing else is present, and the retrieved flags seem not to be used anywhere else. Therefore, we must focus on Firebase Remote Config. The key is “sEcre7vALu3” and the value is Base64-encoded. How do we get the value?

Initially, I believed it was only possible with REMOTE_KEY, but since I didn’t know which Firebase instance the app was connected to, I couldn’t do anything. So the idea was to launch the app and analyze it dynamically with Frida to capture the remote value once it was fetched.

Solution#

Here I downloaded Waydroid, an Android emulation environment for Linux, and installed the apk in it. I started adb, installed the application with waydroid app install. The command did not give any errors, but the application was not installed. I tried again with adb install and got: adb: failed to install mobile_odyssey_v0.0.1.apk: Failure [INSTALL_FAILED_OLDER_SDK: Requires newer sdk version #35 (current version is #33)]. So the problem was that Waydroid uses an older version of Android (33) than the one required by the app (35).

One way to get around the problem is to change the required SDK in the manifest, so I extracted the apk with apktool d mobile_odyssey_v0.0.1.apk and modified the AndroidManifest.xml file by changing the line

from

1
<uses-sdk android:minSdkVersion="35" android:targetSdkVersion="35" />

1
<uses-sdk android:minSdkVersion="33" android:targetSdkVersion="35" />

and I rebuilt it with apktool b mobile_odyssey_v0.0.1 -o mobile_odyssey_modded.apk and reinstalled it with adb install mobile_odyssey_modded.apk. And here too, an error: adb: failed to install odyssey_edited-2.apk: Failure [INSTALL_PARSE_FAILED_NO_CERTIFICATES: Failed to collect certificates from /data/app/vmdl209082530.tmp/base.apk: Attempt to get length of null array] The application needed to be signed again, so I used uber-apk-signer to sign it again: uber-apk-signer -a mobile_odyssey_modded.apk and obtained the file mobile_odyssey_modded-aligned-signed.apk, which I reinstalled with adb install mobile_odyssey_modded-aligned-signed.apk, and this time the installation was successful.

OK, now we just need to launch the application and we’ll have the flag, right? Wrong, the application crashes instantly. Looking at the logs with waydroid logcat | grep -i "AndroidRuntime", I find:

1
01-30 15:51:47.980  3326  3326 E AndroidRuntime: java.lang.RuntimeException: Unable to instantiate activity ComponentInfo{com.jeannedhackctf.mobileodyssey/com.jeannedhackctf.mobileodyssey.MainActivity}: java.lang.ClassNotFoundException: Didn't find class "com.jeannedhackctf.mobileodyssey.MainActivity" on path: DexPathList[[zip file "/data/app/~~mF_dXhC8jDmUju1Dx9lK_A==/com.jeannedhackctf.mobileodyssey-Sc7Ypls90RmuTLh9nTJ5Mg==/base.apk"],nativeLibraryDirectories=[/data/app/~~mF_dXhC8jDmUju1Dx9lK_A==/com.jeannedhackctf.mobileodyssey-Sc7Ypls90RmuTLh9nTJ5Mg==/lib/x86_64, /data/app/~~mF_dXhC8jDmUju1Dx9lK_A==/com.jeannedhackctf.mobileodyssey-Sc7Ypls90RmuTLh9nTJ5Mg==/base.apk!/lib/x86_64, /system/lib64, /system/system_ext/lib64, /system/product/lib64]]

This means that the MainActivity class is missing, which is strange because it was present in the original apk. So I reviewed the AndroidManifest.xml file and noticed that the main activity is GameActivity and not MainActivity, so I edited the manifest to change the name of the main activity from MainActivity to GameActivity: from

1
<activity android:exported="true" android:name=".MainActivity">

1
<activity android:exported="true" android:name=".GameActivity">

Same steps of rebuilding, signing, and reinstalling, and finally the app launches correctly.

Image of the application

Tada! There’s nothing interesting here, just placeholder text. Now, we have to capture the remote configuration value dynamically.

The main idea is to hook the methods. I created a Frida script like this:

1
// Ai generated
2
Java.perform(function () {
3
    console.log("[*] Injection active. Waiting...");
4

5
    var GameActivity = Java.use("com.jeannedhackctf.mobileodyssey.GameActivity");
6
    var FirebaseRemoteConfig = Java.use("com.google.firebase.remoteconfig.FirebaseRemoteConfig");
7

8
    // 1. We intercept the moment when the app tries to decode something
9
    // This is the "surgical" method
10
    try {
11
        GameActivity.tryDecodeBase64.implementation = function (value) {
12
            console.log("\n[!!!] BINGO! tryDecodeBase64 called!");
13
            console.log("      Input (Base64): " + value);
14

15
            var result = this.tryDecodeBase64(value);
16
            console.log("      Output (Flag):  " + result);
17
            return result;
18
        };
19
    } catch (e) {
20
        console.log("[-] Unable to hook tryDecodeBase64 (maybe the class is not loaded yet?)");
21
    }
22

23
    // 2. We intercept Firebase directly (Brute-Force method)
24
    // If the Activity crashes, Firebase might still work in the background
25
    FirebaseRemoteConfig.getString.overload('java.lang.String').implementation = function (key) {
26
        var value = this.getString(key);
27
        console.log("\n[+] Firebase.getString called for key: " + key);
28
        console.log("    Returned value: " + value);
29
        return value;
30
    };
31

32
    // 3. MANUAL TRIGGER
33
    // We look for a live Activity instance in memory and force the fetch
34
    Java.choose("com.jeannedhackctf.mobileodyssey.GameActivity", {
35
        onMatch: function (instance) {
36
            console.log("\n[+] Found GameActivity instance in memory!");
37
            console.log("    Attempting to force fetchRemoteConfig()...");
38
            try {
39
                // Since fetchRemoteConfig is private, we should make it accessible or call it via reflection if it fails,
40
                // but Frida often bypasses privacy. We try calling tryDecodeBase64 directly if we have the string.
41
                // Or we call Firebase's public method ourselves:
42

43
                var config = instance.remoteConfig.value; // Access to remoteConfig field (Kotlin property)
44
                if (config) {
45
                     var secret = config.getString("sEcre7vALu3");
46
                     console.log("    [MANUAL TRIGGER] Value read directly: " + secret);
47
                } else {
48
                    console.log("    [-] remoteConfig is null in the instance.");
49
                }
50

51
            } catch (e) {
52
                console.log("    [-] Error in manual trigger: " + e.message);
53
            }
54
        },
55
        onComplete: function () {
56
            console.log("[*] Memory scan completed.");
57
        }
58
    });
59

60
});

BINGO!!!

Image of frida output

Post notes#

Initially, I installed Frida incorrectly and couldn’t use the script, so I started looking through the application files in /data/data/com.jeannedhackctf.mobileodyssey/files/ and found the file frc_1:<number>:android: <id>_firebase_activate.json, which contained the encoded flag, but I still wanted to use Frida for the solve because it’s OBJECTIVELY cooler (this is possibile only when the application start correctly).

flag: JDHACK{M08ile_@Nd_F1rEb4s3_!s_fun}