> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/reverse-engineering/droids4.md).

# droids4

In this challenge, I opened the APK using JADX and checked the `getFlag()` function.

The code creates four strings: `ace`, `jack`, `queen`, and `king`, all starting with `"aaa"`. Then it modifies each character using simple additions.

Instead of calculating manually, I copied the logic into a small Java program and ran it. This gave the password:

```id="g1p3zs"
alphabetsoup
```

#### Step 1: Get the password

Run the app and enter:

```id="t7xk2m"
alphabetsoup
```

But it only returns `"call it"` instead of the flag.

#### Step 2: Modify the app

So the app is not directly returning the flag. It returns a dummy string.

Looking at the code, there is another function:

```java
public static native String cardamom(String str);
```

This likely returns the real flag.

#### Step 3: Decompile APK

```bash
apktool d four.apk --no-res
```

#### Step 4: Edit smali code

Go to:

```id="k9z2ad"
smali/com/hellocmu/picoctf/FlagstaffHill.smali
```

Replace this:

```smali
const-string v5, "call it"
return-object v5
```

With this:

```smali
invoke-static {p0}, Lcom/hellocmu/picoctf/FlagstaffHill;->cardamom(Ljava/lang/String;)Ljava/lang/String;
move-result-object v0
return-object v0
```

This makes the app call the real function that returns the flag.

#### Step 5: Rebuild APK

```bash
apktool b four -o recompiled_four.apk
```

#### Step 6: Sign APK

```bash
java -jar uber-apk-signer.jar --apks recompiled_four.apk
```

#### Step 7: Run app

* Install modified APK
* Enter password: `alphabetsoup`
* Click button

Now the app shows the flag.

#### Final Flag

picoCTF{not.particularly.silly}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/reverse-engineering/droids4.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.