search
LinkedInGithub

Epoch Seal

Reverse Engineering

Given a file named ZXBvY2gg.apk, so I proceed to extract the file using apktool

Then, cause the title of the challenge is epoch seal, I proceed to decompile the libepochseal.so:

mainActivity_checkPinActive:

sub_21DE0:

in short, checkPinActive's flow is like this:

  1. in the beginning, there's a function called C_D(), it checks whether we are using a debugger or not and also it detects frida. If detected, then sleep(69) then gives FekFlag.

  2. PIN validation: checks whether PIN is equal to sub_21DE0 or not. if not "Try again".

  3. For the valid PIN, the PIN is converted to a string and hashed using 64-bit FNV-1. The result is XORed with a constant and then 'premixed' using the SplitMix64 transformation within a large loop. From this process, four QWORDs (v43, v44, v45, v46) are derived to serve as key material.

  4. Then, the state array s[256] is initialized using a static ASCII table and undergoes an RC4-like KSA. Afterward, the PRGA generates a 49-byte keystream which is XORed with enkbyte to yield the plaintext (flag).

  5. The plaintext result is copied to heap buffer, passed to callback through JNI, then all allocation is cleaned

Then to get the PIN from sub_21DE0:

  • sub_21EC0(): Calls timegm on a fixed date: 2025-03-14 06:58:44 UTC.

  • sub_21F60(out, in): Divides decimal string in by 2 via long division, then strips leading zeros.

  • sub_22120(s): Reverses string s in-place.

  • sub_221A0(s): If len(s) > 3, takes substring s[0:len-3] and converts it via stoul (base 10). Otherwise, returns 0.

so:

  1. Epoch: 1741935524

  2. “1741935524” // 2 = “870967762”

  3. Reverse = 267769078

  4. remove last 3= “267769”. So the PIN is 267769

solver.py:

if we run it:

hashtag
Flag: SCH25{wah_kau_benar-benar_REVERSE_chall_ini!-0_o}

PreviousSchematics 2025NextHarderBetterFasterStronger

Last updated