> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/reverse-engineering/droids3.md).

# droids3

In this challenge, the app always shows “don’t wanna” when the button is clicked. The hint says “make this app your own”, which suggests we need to modify the app.

#### Step 1: Analyze the code

I opened the APK in JADX and checked the `FlagstaffHill` class.

I found that:

* `getFlag()` calls a method named `nope()`
* `nope()` always returns “don’t wanna”
* There is another method called `yep()` which likely contains the real flag

So the goal is: → change the app so `getFlag()` calls `yep()` instead of `nope()`

#### Step 2: Decompile APK

Using Apktool:

```bash
apktool d -r three.apk
```

This creates a folder with the app’s smali code.

#### Step 3: Modify smali code

Go to:

```
smali/com/hellocmu/picoctf/FlagstaffHill.smali
```

Inside the `getFlag()` method:

* Find where `nope()` is called
* Replace it with `yep()`

This forces the app to return the real flag.

#### Step 4: Rebuild APK

```bash
apktool b three -o three_modified.apk
```

#### Step 5: Fix install error

The APK won’t install because it is not signed.

Error:

```
INSTALL_PARSE_FAILED_NO_CERTIFICATES
```

#### Step 6: Create keystore

```bash
keytool -genkey -v -keystore pico.keystore -keyalg RSA -keysize 2048 -validity 10000 -alias pico
```

#### Step 7: Align APK

```bash
zipalign -p 4 three_modified.apk three_aligned.apk
```

#### Step 8: Sign APK

```bash
apksigner sign --ks-key-alias pico --ks pico.keystore three_aligned.apk
```

Verify:

```bash
apksigner verify three_aligned.apk
```

#### Step 9: Run app

* Install the modified APK on emulator
* Enter anything in input
* Click button

Now it shows the flag.

#### Final Flag

picoCTF{tis.but.a.scratch}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/reverse-engineering/droids3.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.