Aide's Site

AndroidManifest.xml

Sun, 05 Apr 2026 00:00:00 +0000

What is AndroidManifest.xml?

So, the AndroidManifest.xml file is a file configuration which is crusial in an application, why? cz it provides the comprehensive overview of the app’s structure, permissions and security features even before its source code has been analysed in depth.

How to Get the File?

If you want to get the file, you can simply unzip it; but to read the file from an application, we can’t just unzip it because the format is still proprietary binary. We must use a tool like APK Tool with command apktool d [filename].apk to decode the file into XML format which can be read by humans.

Notes: apktool command is just an alias of java -jar apktool_x.x.x.jar

Here is a comparison between unzipping and using APK Tool.

Important Informations Inside AndroidManifest.xml

This is the file must be looks like

SDK Version & Security Features

Let’s start with line two because the line one isnt that important.

1...
2<manifest xmlns:android="http://schemas.android.com/apk/res/android" android:compileSdkVersion="30" android:compileSdkVersionCodename="11" package="com.apptesting.privacy" platformBuildVersionCode="30" platformBuildVersionName="11">
3...

So what do we have?
We’ve got Android compile SDK version 30 and we’ve got Android compile SDK version code name if we take a look at the code below.

1...
2<manifest ... android:compileSdkVersion="30" android:compileSdkVersionCodename="11" ... >
3...

This means the developer has used the compiler settings for Android version 11 and API level of Android version 11 is API level 30.

Why is this important? cz it means every security feature till Android 11 is included in the application. For example, in Android 7 (API 24), there was a huge change regarding the trust relationship of certificates, so user-installed certificates are no longer trusted by default.
https://android-developers.googleblog.com/2016/07/changes-to-trusted-certificate.html

Package Name

Still on line two, this is the package name, take a look at the code below.

1...
2<manifest ... package="com.apptesting.privacy" ... >
3...

That is the unique identifier for the application, but dont let a familiar name fool you cz it doesnt prove the application is legit. For example, anyone could develop a fake application and give it the package name com.instagram.android (Instagram’s package name). If you dont have the real one installed, the fake application will install and look totally normal.

If you try to install the real one later, you will get an error because your phone maybe like " I already have one application with this ID and the signing certificates dont match, hmm.. Sorry sir".
So you cant have two applications with the same name running on your device.

Permissions

Take a look at these three lines below.

2...
3 <uses-permission android:name="android.permission.READ_CONTACTS"/>
4 <uses-permission android:name="android.permission.INTERNET"/>
5 <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"/>
6...

We’ve got users permission and then we’ve got Android permission for read contacts, internet, and read external storage.
So those are the permissions this application can use (for this example). It doesnt mean that they are being used, but the application has the ability to use them if the user grants those permissions.

So every time the application wants to perform certain tasks like using your microphone, camera, or accessing your photos and stuff like that, those permissions need to be included in the AndroidManifest.xml right in the code.

Custom Permissions

Take a look at the code below.

5...
6 <permission android:label="Allows reading user information" android:name="com.apptesting.privacy.USER_INFO" android:protectionLevel="dangerous"/>
7...

As we remember, the three permissions before were predefined permissions, which are being used by this application, but this one is now defining its own permission. So the application can also define its own permission.

Still on the same line, look below.

5...
6 <permission ... android:name="com.apptesting.privacy.USER_INFO" ... />
7...

So we’ve got the name if you want to perform some sensitive task but want to share the task with other applications, they can ask for requesting this one, when you grant that permissions, then they can exchange data with each other.

Queries

This is an Android security feature that manages how applications share data, take a look at the code below.

 6...
 7 <queries>
 8 <package android:name="com.example.abcd/>
 9 </queries>
10...

For an application to get information from another application, it must be visible first.

So, if the application wants to get data from the other application, for example ‘abcd’ app, the application needs to introduce itself so the other application knows it exists on the phone. Once visible, the other application can recognize the request and send the data back.

Application Tags

Inside the <application> tag, we can see some interesting stuff, take a look at the code below.

 9...
10 <application android:allowBackup="true" ... >
11...

android:allowBackup="true" means we can perform a backup, for example, by the ADB shell and the data of the application will be included. It doesn’t mean that they are sensitive information included in the backup like credentials or tokens or things like that. It just means that some data will be backup.

Next, look below.

 9...
10 <application ... android:debuggable="true" ... >
11...

We’ve got android:debuggable="true", means that having this feature enabled, we are allowed to attach to this process of this application. So we are allowed to debug it.

It’s not really often included, but even if it’s not being included in the AndroidManifest.xml, this file can be used to enable it. So the AndroidManifest.xml can be also used to enable certain features, for example debug features.

Next, this is really important, look below.

 9...
10 <application ... android:networkSecurityConfig="@xml/network_security_config" ... >
11...

We’ve got android:networkSecurityConfig="@xml/network_security_config", which points to an network_security_config.xml file that controls the app’s network trust policy.
What is this one doing? It’s regarding to certificate pinning, so this file is pretty important when you are dealing with certificate pinning.

Next, we have the four key components of an Android application which are activity, service, receiver, and provider.

10...
11 <provider android:authorities="user" android:enabled="true" android:exported="true" android:name="com.apptesting.privacy.UserDatabase">
12 <path-permission android:path="/User" android:readPermission="com.apptesting.privacy.USER_INFO"/>
13 </provider>
14 <receiver android:enabled="true" android:exported="true" android:name="com.apptesting.privacy.WeatherNotification"/>
15 <service android:enabled="true" android:exported="true" android:name="com.apptesting.privacy.MyService"/>
16 <activity android:name="com.apptesting.privacy.Profile"/>
17 <activity android:name="com.apptesting.privacy.MainActivity">
18 <intent-filter>
19 <action android:name="android.intent.action.MAIN"/>
20 <category android:name="android.intent.category.LAUNCHER"/>
21 </intent-filter>
22 </activity>
23...

Start with activity, take a look at the code below.

15...
16 <activity android:name="com.apptesting.privacy.Profile"/>
17 <activity android:name="com.apptesting.privacy.MainActivity">
18 <intent-filter>
19 <action android:name="android.intent.action.MAIN"/>
20 <category android:name="android.intent.category.LAUNCHER"/>
21 </intent-filter>
22 </activity>
23...

activity is basically the part of an Android application that you see and interact with. Each screen in an application is usually handled by an activity, like a home page or a profile page. It takes care of displaying the interface and responding to your actions such as tapping buttons or entering text.

Next, service, take a look at the code below.

14...
15 <service android:enabled="true" android:exported="true" android:name="com.apptesting.privacy.MyService"/>
16...

service is a component that runs in the background without a user interface. Basically this is a background task. So this help the application keep responsive by offloading work from the main thread.

Next, receiver, look at the code below.

13...
14 <receiver android:enabled="true" android:exported="true" android:name="com.apptesting.privacy.WeatherNotification"/>
15...

receiver is simply just an information for applications. For example, let’s say we are receiving an SMS, then we’ve got the notification, the audio notification, and also the pop up on the screen that we have received new SMS, and also applications will be informed about that SMS has been received. So this is simply just messaging system.

Next, provider, take a look at the code below.

10...
11 <provider android:authorities="user" android:enabled="true" android:exported="true" android:name="com.apptesting.privacy.UserDatabase">
12 <path-permission android:path="/User" android:readPermission="com.apptesting.privacy.USER_INFO"/>
13 </provider>
14...

provider is simply just the form of interacting or providing content. Most of the time this is regarding to database accesses. So the application might use a database where it store some information.
If a pathPermission is enabled, external applications might be able to read the database if they have the right permission.

Summary

I wanna take a nap rn… goodbye, i’ll correct it later if there’s any incorrect information T_T

CyberWave 2025!

Sun, 11 Jan 2026 00:00:00 +0000

Reverse Engineering

What is Reverse Engineering? Reverse engineering (RE) in computer science is the process of analyzing a compiled, binary application to understand its inner workings, logic, and structure without access to the original source code. In Capture The Flag (CTF) competitions, it involves breaking down software to uncover hidden flags, bypass licensing, or analyze malware, typically using tools like debuggers and disassemblers.

Sega Saturn

In this challenge, as we can see on the main page that there is a text and the flag which is actually a fake flag, the text is telling that “Sega Saturn should be able to Solve this”

After I checked the source code, I discovered an algorithm which is the implementation of LCG standard (Linear Congruential Generator).

17...
18function RNG(seed) {
19 return function() {
20 seed = (seed * 48271) % 2147483647;
21 return seed;
22 };
23}
24...

And I also discovered an array named seq contains series of integers.

27...
28 const seq = [697438994, 112812148, 1601952528, 848567091, 1409540622, 719284623, 4183535244, 2852213902, 2109397207, 3611470734, 604567242, 1692610300, 2414225221, 1979551723, 3174382114, 425190723, 1060279654, 4283219352, 1099139615, 3427871953, 2056419824, 103242998, 2789231820, 97749902, 3832000502, 2437931514, 337329827, 1784389836, 1971115025, 2430188600, 420768160, 2890064672, 3927353914, 2033350795, 372941141, 2974609317, 1442092933, 2838369745, 3198352587, 230640255, 2641503210, 1721308159, 3764390994];
29...

As we remember on the main page there is a hint, namely “Sega Saturn” which is indicated 32-bit architechture.

The Sega Saturn (セガサターン, Sega Satān) is a 32-bit video game console first released by Sega on November 22, 1994 in Japan, May 11, 1995 in North America, and July 8, 1995 in Europe. It was discontinued in 1998 in North America, Europe, and Australia, and in 2000 in Japan.
Source: Wikipedia

In computer science, signed 32-bit integer has range of data up to $2^{31} - 1$. we know that we need to find each elements of array seq for 32-bit data structure. In the source code before, I saw 1 line which is a little bit crucial.

38...
39 const big = (x << 24) | (rng() & 0xFFFFFF);
40...

from this one line, I discovered:

Bit 31-24 (MSB)
- x « 24 shifting encrypted characters to the leftmost 8-bit.
Bit 23-0 (LSB)
- rng() & 0xFFFFFF will have an output from LCG, then conduct AND operation with 0xFFFFFF (equals to 24-bit), then placed in the rightmost 24-bit.
Bitwise (|)
- then the two segments before are combined.

I have known that the creator of this challenge leaks the raw internal state in the lowest 24-bit (right side). From here i have an access to $S_{n+1}$ from 24-bit which has been leaked, then i need to find the $S_{n}$ (initial seed).

The LCG worked in 31-bit space before, but there is 24-bit leaked, it means 7-bit is missing (MSB from RNG state). So, i just need to do recovery state as many as 128 iterations.

How? so we need the reverse operation of modular multiplication, which is modular multiplicative inverse.

If $S_{n+1} \equiv (S_n \cdot a) \pmod{m}$, so $S_n \equiv (S_{n+1} \cdot a^{-1}) \pmod{m}$ which $a^{-1}$ is modular invers from 48271 to 2147483647.

With Python, we can calculate $a^{-1}$ using the following Python script:

10...
11MODULUS = 2147483647
12MULTIPLIER = 48271
13
14INVERSE_MULTIPLIER = pow(MULTIPLIER, -1, MODULUS)
15...

To determine the initial seed, I’m using the following Python script:

 1seq = [
 2 697438994, 112812148, 1601952528, 848567091, 1409540622, 719284623, 4183535244,
 3 2852213902, 2109397207, 3611470734, 604567242, 1692610300, 2414225221, 1979551723,
 4 3174382114, 425190723, 1060279654, 4283219352, 1099139615, 3427871953, 2056419824,
 5 103242998, 2789231820, 97749902, 3832000502, 2437931514, 337329827, 1784389836,
 6 1971115025, 2430188600, 420768160, 2890064672, 3927353914, 2033350795, 372941141,
 7 2974609317, 1442092933, 2838369745, 3198352587, 230640255, 2641503210, 1721308159,
 8 3764390994
 9]
10
11MODULUS = 2147483647
12MULTIPLIER = 48271
13
14INVERSE_MULTIPLIER = pow(MULTIPLIER, -1, MODULUS)
15
16leak_lsb = seq[0] & 0xFFFFFF
17recovered_seed = None
18
19for high_bits in range(128):
20 potential_state_curr = (high_bits << 24) | leak_lsb
21 if potential_state_curr >= MODULUS:
22 continue
23
24 s_prev_1 = (potential_state_curr * INVERSE_MULTIPLIER) % MODULUS
25 s_prev_2 = (s_prev_1 * INVERSE_MULTIPLIER) % MODULUS
26 seed_candidate = (s_prev_2 * INVERSE_MULTIPLIER) % MODULUS
27 
28 test_state = seed_candidate
29 for _ in range(6):
30 test_state = (test_state * MULTIPLIER) % MODULUS
31 
32 if (test_state & 0xFFFFFF) == (seq[1] & 0xFFFFFF):
33 recovered_seed = seed_candidate
34 break
35...

After the seed has discovered (313374141), i conduct the decryption process using the following Python script:

35...
36def nibble_swap(byte_input):
37 return ((byte_input & 0x0F) << 4) | ((byte_input & 0xF0) >> 4)
38
39plaintext = ""
40current_rng_state = recovered_seed
41
42for packed_int in seq:
43 r1 = (current_rng_state * MULTIPLIER) % MODULUS
44 r2 = (r1 * MULTIPLIER) % MODULUS
45 r3 = (r2 * MULTIPLIER) % MODULUS
46 current_rng_state = r3
47 
48 encrypted_byte = (packed_int >> 24) & 0xFF
49 encrypted_byte ^= (r2 & 0xFF)
50 encrypted_byte = nibble_swap(encrypted_byte)
51 
52 adjustment = (r1 % 93) + 33
53 decrypted_char_code = (encrypted_byte - adjustment) % 256
54 plaintext += chr(decrypted_char_code)
55
56print(plaintext)

cela@hugo:~$ python3 segasaturn.py
cyberwave{c4n_yoU_5olV3_th1s_l1f3_eQu4t10n}

Grogol

In this challenge I was asked to enter the right input.

cela@hugo:~$ nc 129.226.145.210 317
Input > abcdefg
abcdefg
Your input is inc0rr3ct!

After decompiling the main function (FUN_000103aa), I found that the program limits input to no more than 21 characters.

34...
35lVar6 = FUN_000120f6(auStack_1078,0x1000,PTR_DAT_00088590);
36if (lVar6 != 0) {
37 uVar7 = FUN_0001cc2a(auStack_1078);
38 if (uVar7 < 0x16) { 
39...

Then the program does not process the input as a whole, but breaks it down into a word (let’s say token) separated by space. the program takes the first token and stores it in an array pointer, then takes the next token.

37...
38 if (uVar7 < 0x16) {
39 pbVar8 = (byte *)FUN_0001d348(auStack_1078,&DAT_00057e98); 
40 if (pbVar8 == (byte *)0x0) {
41 lVar6 = 0; 
42 }
43 else {
44 ppbVar17 = local_3078;
45 lVar6 = 0;
46 do {
47 *ppbVar17 = pbVar8; 
48 lVar6 = (long)((int)lVar6 + 1);
49 pbVar8 = (byte *)FUN_0001d348(0,&DAT_00057e98); 
50 if (pbVar8 == (byte *)0x0) break;
51 ppbVar17 = ppbVar17 + 1;
52 } while (lVar6 != 0x3ff);
53 }
54...

Each token found is calculated for its checksum value. so the program here initialises hash = 1, then performs XOR and Bit-Shift.

66...
67 if (*local_3078[0] != 0) {
68 uVar7 = 1; 
69 pbVar8 = local_3078[0];
70 do {
71 pbVar19 = pbVar8 + (1 - (long)local_3078[0]);
72 *puVar16 = (long)uVar7 >> 1;
73 *(byte **)(gp + -0x7b8) = pbVar19;
74 bVar1 = *pbVar8;
75 pbVar8 = pbVar8 + 1;
76 uVar7 = (ulong)bVar1 ^ (long)uVar7 >> 1; 
77 *puVar16 = uVar7;
78 } while (*pbVar8 != 0);
79...

Then there is the checksum formula.

78...
79 if (((long)(int)(((uint)*local_3078[0] ^ (uint)pbVar19) << 4) & 0xffU | uVar7 & 0xf) = =
80 0x10) {
81...

Here I used Gemini (im too lazy ehe) to map the checksum and found the final target, which was 31337.

Conditions (Hex)	Ghidra Code	Operation
0x11	`lVar10 = lVar10 + 3`	Add 3
0xf2	`lVar10 = lVar10 * 100`	Multiply by 100
0xce	`lVar10 = lVar10 + 13`	Add 13
0x27	`lVar10 = lVar10 + 30`	Add 30
0x6a	`lVar10 = lVar10 + 7`	Add 7
0x7a69	`if (stack == 0x7a69)`	Final Target (31337)

Our goal is to reach the number 31337. Here, we use the following logical calculation:
$((3 \times 100) + 13) \times 100 + 30 + 7 = 31337$

Then I used python to bruteforce the ASCII character to find some sort strings (1-2 chr) that matched the target checksum.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


import string

def calculate_checksum(s):
 length = len(s)
 first_char = ord(s[0])
 h = 1
 for char in s:
 h = ord(char) ^ (h >> 1)
 res = (((first_char ^ length) << 4) & 0xFF) | (h & 0xF)
 return res

targets = {
 0x11: "add_3",
 0xf2: "mul_100",
 0xce: "add_13",
 0x27: "add_30",
 0x6a: "add_7"
}

chars = string.ascii_letters + string.digits
print(f"{'Token':<8} | {'Hex':<6} | {'Operation'}")

for c1 in chars:
 for c2 in chars:
 word = c1 + c2
 chk = calculate_checksum(word)
 if chk in targets:
 print(f"{word:<8} | {hex(chk):<6} | {targets[chk]}")
 del targets[chk]

So here we get the output:

Token	Hex	Operation
cp	0x11	add_3
dh	0x6a	add_7
md	0xf2	mul_100
ni	0xce	add_13
po	0x27	add_30

Here we get the tokens that we have to input:
$((cp \times md) + ni) \times md + po + dh = 31337$

cela@hugo:~$ nc 129.226.145.210 317
Input > cp md ni md po dh
cp md ni md po dh
cyberwave{belajar_rev_di_google_aja}

KeygenMe

In this challenge I was asked to enter username and license key.

cela@hugo:~$ ./cyberwave_keygenme
Username: test
License Key: test
Access Denied!

After decompiling the main function (FUN_00101080), I found the variable local_128 for username input and the variable local_a8 for license key input.

28...
29printf("Username: ");
30pcVar7 = fgets((char *)local_128,0x80,stdin);
31...
32 printf("License key: ");
33 pcVar7 = fgets(local_a8,0x80,stdin);
34...

And it was also found that the local_a8 input must be 19 characters long with the prefix “CW25” and a dash (-) check at a specific index, indicating that the format for the license key is:
CW25-xxxx-xxxx-xxxx

37...
38 if ((((((sVar8 - 1 < 0x20) && (sVar9 = strlen(local_a8), 
39 sVar9 == 0x13 
40 )) && (local_a4 == '-')) && ((local_a3[4] == '-' && (local_a3[9] == '-')))) && ((
41 local_a8[0] == 'C' 
42 && ((
43 local_a8[1] == 'W' 
44 && (
45 local_a8[2] == '2' 
46 )))))) && (
47 local_a8[3] == '5' 
48 )) {
49 uVar10 = 5;
50...

Then, each of the three ‘XXXX’ is split into three parts and stored in their respective variables.

55...
56 local_162 = 0;
57 local_160 = (code *)((ulong)local_160 & 0xffffffffffff0000);
58 local_158[0] = 0;
59...

The program here performs the first loop at local_128. The loop runs by reading each byte from local_128 (username).

62...
63 uVar6 = 0x31415926;
64 pbVar14 = local_128;
65 while( true ) {
66 bVar2 = *pbVar14;
67 pbVar14 = pbVar14 + 1;
68 if (bVar2 == 0) break;
69 uVar6 = (uint)bVar2 + uVar6 * 0x21; 
70 uVar6 = (uVar6 * 0x80 | uVar6 >> 0x19) ^ uVar6; 
71 }
72...

In order for the program to print “Access Granted”, the input on local_a8 (license key) which is split into local_162, local_160, local_158 must meet the following conditions.

88...
89 if (((local_162 == (ushort)((ushort)uVar6 ^ (ushort)uVar11)) &&
90 ((ushort)local_160 ==
91 (ushort)(((ushort)(uVar6 << 0xb) | (ushort)(uVar6 >> 0x15)) ^ (ushort)(uVar11 >> 5) 
92 ^ 0xbeef))) &&
93 (local_158[0] == (ushort)((ushort)uVar6 * 3 + (short)(uVar11 >> 9) ^ 0xc0de))) {
94 puts("Access Granted!");
95...

Then I used this Python script to solve this challenge.

 1def generate_key(username):
 2 name_bytes = username.encode('ascii')
 3 length = len(name_bytes)
 4
 5 uVar6_initial = 0x31415926
 6 for b in name_bytes:
 7 uVar6_initial = (b + uVar6_initial * 0x21) & 0xFFFFFFFF
 8 uVar6_initial = ((uVar6_initial << 7 | uVar6_initial >> 25) & 0xFFFFFFFF) ^ uVar6_initial
 9
10 uVar11 = 0xa53c9e17
11 uVar6 = 0xc0ffee25
12
13 for b in name_bytes:
14 uVar6 = (uVar6 * 0x101 + b) & 0xFFFFFFFF
15 uVar6 = ((uVar6 << 5 | uVar6 >> 27) & 0xFFFFFFFF) ^ 0xa5c3d2e1
16 uVar11 = (((uVar6 >> 3 ^ (b * 0x1f + uVar11) & 0xFFFFFFFF) * 0x11) + 0x3d) & 0xFFFFFFFF
17
18 uVar6 = ((length * 0x27d4eb2d) ^ uVar6) & 0xFFFFFFFF
19 uVar11 = ((uVar6 << 13 | uVar6 >> 19) & 0xFFFFFFFF) ^ uVar11
20
21 part1 = (uVar6 ^ uVar11) & 0xFFFF
22
23 rot_uVar6 = (uVar6 << 11 | uVar6 >> 21) & 0xFFFF
24 part2 = (rot_uVar6 ^ (uVar11 >> 5) ^ 0xbeef) & 0xFFFF
25
26 part3 = ((uVar6 * 3 + (uVar11 >> 9)) ^ 0xc0de) & 0xFFFF
27
28 return f"CW25-{part1:04X}-{part2:04X}-{part3:04X}"
29
30user = input("Enter Username: ")
31key = generate_key(user)
32print(f"License Key: {key}")

So here we get the output:

cela@hugo:~$ python3 keygenme.py
Enter Username: cela
License Key: CW25-4FA0-A1AA-8D7A

Then I tried entering the same username and license key.

cela@hugo:~$ ./cyberwave_keygenme
Enter Username: cela
License Key: CW25-4FA0-A1AA-8D7A
Access Granted!
cyberwave{keygenme_easy_medium_2025}