spellbound

orion, hpmv

(adj.) spell•bound (spel'bound') : held by or as if by a spell.

Submit your APK here: spellbound.mc.ax

The evaluation process is as follows. A fresh Android emulator is started using the Docker image us-docker.pkg.dev/android-emulator-268719/images/30-google-x64:30.1.2 and the DictionaryService, DictionaryApp, and your APK are installed. It then launches your APK with the command am start -n com.dicectf2024.attackerapp/com.dicectf2024.attackerapp.MainActivity waits for 20 seconds, and then returns you the output of logcat -d dicectf:V *:S Make sure you sign your APK, or else it will not install.

Your goal is to access the random flag generated by the DictionaryService, and log it to logcat so that you can see the random flag. Then, exchange that flag for a real flag using the "get flag" page. The random flag is different for every submission. You must submit the correct random flag generated for that submission in order to get the real flag. DO NOT attack anything outside of the Android emulator. This includes the CTF infrastructure, the UI for submitting APKs, viewing the results, etc. Also, the Android emulator does not have any network access. This is purely an Android challenge.