BYUCTF-2025 Writeups

┌──(d4nhwu4n㉿hide-and-seek)-[/mnt/e/CTF/BYUCTF2025/for/Are You Looking Me Up]
└─$ cat logs.txt | head -n 20
2025-05-06T14:49:32+00:00 155,,,c0dbc3f4f934c1cb95f41a1f3d23a189,vtnet0,match,pass,in,4,0x0,,128,23413,0,none,17,udp,72,172.16.0.10,172.16.0.1,53829,53,52
2025-05-06T14:49:32+00:00 164,,,75a2b136446ad166a85f3150b40b7d1e,vtnet0,match,pass,in,4,0x0,,128,41412,0,none,17,udp,72,172.16.0.10,8.8.8.8,53829,53,52
2025-05-06T14:49:32+00:00 164,,,75a2b136446ad166a85f3150b40b7d1e,vtnet0,match,pass,in,4,0x0,,128,9674,0,DF,6,tcp,52,172.16.0.10,4.149.227.78,65308,443,0,S,3208345317,,64240,,mss;nop;wscale;nop;nop;sackOK
2025-05-06T14:49:32+00:00 164,,,75a2b136446ad166a85f3150b40b7d1e,vtnet0,match,pass,in,4,0x0,,128,63011,0,DF,6,tcp,52,172.16.0.10,52.183.205.142,65309,443,0,S,2199077471,,64240,,mss;nop;wscale;nop;nop;sackOK
2025-05-06T14:49:32+00:00 164,,,75a2b136446ad166a85f3150b40b7d1e,vtnet0,match,pass,in,4,0x0,,128,21701,0,DF,6,tcp,52,172.16.0.10,13.95.31.18,65310,443,0,S,3089797986,,64240,,mss;nop;wscale;nop;nop;sackOK
2025-05-06T14:49:32+00:00 164,,,75a2b136446ad166a85f3150b40b7d1e,vtnet0,match,pass,in,4,0x0,,128,52240,0,DF,6,tcp,52,172.16.0.10,13.69.239.74,65311,443,0,S,1512276322,,64240,,mss;nop;wscale;nop;nop;sackOK
2025-05-06T14:49:33+00:00 164,,,75a2b136446ad166a85f3150b40b7d1e,vtnet0,match,pass,in,4,0x0,,128,63030,0,DF,6,tcp,52,172.16.0.10,52.183.205.142,65312,443,0,S,710496243,,64240,,mss;nop;wscale;nop;nop;sackOK
2025-05-06T14:49:33+00:00 155,,,c0dbc3f4f934c1cb95f41a1f3d23a189,vtnet0,match,pass,in,4,0x0,,128,23414,0,none,17,udp,80,172.16.0.10,172.16.0.1,53269,53,60
2025-05-06T14:49:33+00:00 164,,,75a2b136446ad166a85f3150b40b7d1e,vtnet0,match,pass,in,4,0x0,,128,40646,0,DF,6,tcp,52,172.16.0.10,209.209.4.232,65313,80,0,S,71362922,,64240,,mss;nop;wscale;nop;nop;sackOK
2025-05-06T14:49:33+00:00 164,,,75a2b136446ad166a85f3150b40b7d1e,vtnet0,match,pass,in,4,0x0,,128,21719,0,DF,6,tcp,52,172.16.0.10,13.95.31.18,65314,443,0,S,648020988,,64240,,mss;nop;wscale;nop;nop;sackOK
2025-05-06T14:49:34+00:00 164,,,75a2b136446ad166a85f3150b40b7d1e,vtnet0,match,pass,in,4,0x0,,128,52254,0,DF,6,tcp,52,172.16.0.10,13.69.239.74,65315,443,0,S,2912397937,,64240,,mss;nop;wscale;nop;nop;sackOK
2025-05-06T14:49:34+00:00 21,,,02f4bab031b57d1e30553ce08e0ec131,vtnet0,match,block,in,4,0x0,,64,22178,0,DF,17,udp,268,192.168.1.20,255.255.255.255,50924,10001,248
2025-05-06T14:49:35+00:00 144,,,4fecac63b6446ce80c3df5c947ca3aa1,vtnet0,match,pass,in,4,0x0,,64,16715,0,DF,6,tcp,60,172.16.96.57,216.239.32.106,49153,53,0,S,1179500,,29200,,mss;sackOK;TS;nop;wscale
2025-05-06T14:49:36+00:00 155,,,c0dbc3f4f934c1cb95f41a1f3d23a189,vtnet0,match,pass,in,4,0x0,,64,22309,0,DF,1,icmp,84,172.16.0.70,172.16.0.1,datalength=64
2025-05-06T14:49:36+00:00 146,,,5c6fe00c82fd64877509b3fc99e38d2c,vtnet0,match,pass,in,4,0x0,,64,60244,0,DF,17,udp,76,172.16.96.10,23.94.221.138,42556,123,56
2025-05-06T14:49:37+00:00 155,,,c0dbc3f4f934c1cb95f41a1f3d23a189,vtnet0,match,pass,in,4,0x0,,64,44534,0,DF,17,udp,56,172.16.0.70,172.16.0.1,39158,53,36
2025-05-06T14:49:39+00:00 155,,,c0dbc3f4f934c1cb95f41a1f3d23a189,vtnet0,match,pass,in,4,0x0,,64,19821,0,DF,6,tcp,64,172.16.0.5,172.16.0.1,51892,53,0,S,1336358162,,64240,,mss;sackOK;TS;nop;wscale;tfo;nop;nop
2025-05-06T14:49:39+00:00 164,,,75a2b136446ad166a85f3150b40b7d1e,vtnet0,match,pass,in,4,0x0,,64,31526,0,DF,6,tcp,60,172.16.0.5,172.67.69.190,38496,443,0,S,1535450510,,64240,,mss;sackOK;TS;nop;wscale
2025-05-06T14:49:39+00:00 164,,,75a2b136446ad166a85f3150b40b7d1e,vtnet0,match,pass,in,4,0x0,,64,53856,0,DF,6,tcp,60,172.16.0.5,172.67.69.190,38512,443,0,S,4087106031,,64240,,mss;sackOK;TS;nop;wscale
2025-05-06T14:49:39+00:00 164,,,75a2b136446ad166a85f3150b40b7d1e,vtnet0,match,pass,in,4,0x0,,64,60169,0,DF,6,tcp,60,172.16.0.5,104.26.10.102,58628,443,0,S,2650452426,,64240,,mss;sackOK;TS;nop;wscale

┌──(d4nhwu4n㉿hide-and-seek)-[/mnt/e/CTF/BYUCTF2025/for/Are You Looking Me Up]
└─$ cat logs.txt | awk -F',' '$0 ~ /,53,/ {print $20}' | sort | uniq -c | sort -nr
 133444 172.16.0.1
  73490 216.239.32.106
  41183 172.16.96.1
   3614 8.8.8.8
    215 172.16.16.1
    206 172.16.64.1
    130 172.18.0.1
     17 216.239.38.106
     16 216.239.36.106
     15 216.239.34.106
     15 172.16.4.1
      4 199.7.83.42
      4 198.41.0.4
      4 13.107.237.2
      4 13.107.237.1
      3 13.107.238.2
      2 199.180.182.53
      2 192.5.6.30
      2 192.33.14.30
      2 170.247.170.2
      2 13.107.238.1
      2 1.1.1.1
      1 67.202.13.158
      1 50.205.57.38
      1 255.255.255.255
      1 239.255.255.250
      1 23.192.228.231
      1 23.168.136.132
      1 206.226.67.233
      1 204.79.197.1
      1 199.7.91.13
      1 199.26.61.9
      1 199.26.60.53
      1 198.51.44.7
      1 193.0.14.129
      1 192.58.128.30
      1 192.36.148.17
      1 192.26.92.30
      1 185.125.190.56
      1 172.67.69.190
      1 131.253.21.1

#!/usr/bin/env python3
# crypto_miner_detector.py - Advanced analyzer for finding crypto mining hosts
 
import argparse
import ipaddress
import re
import sys
from collections import Counter, defaultdict
from typing import Dict, Tuple
 
# Known mining pool providers and suspicious IP ranges
MINING_PROVIDERS = [
    "51.79.", "51.89.", "51.195.", "51.15.", "51.210.", "51.68.", "51.222.",  # OVH
    "130.162.", "132.145.", "140.238.",  # Oracle Cloud
    "135.148.", "163.172.", "141.95.",   # OVH/Scaleway
    "45.63.", "45.61.", "45.56.",        # Vultr
    "66.42.", "107.191.", "144.202.",    # Vultr
    "198.60.", "192.48.",                # FIBERRING/Mining focused
    "147.135.", "149.248.",              # OVH
    "185.95.218.",                       # Mining pools
    "162.19.139.",                       # Mining services
]
 
# High-traffic legitimate services to filter out
LEGITIMATE_SERVICES = [
    "8.8.8.8", "8.8.4.4", "1.1.1.1",    # DNS
    "216.239.32.106", "216.239.34.106", "216.239.36.106", "216.239.38.106",  # Google DNS
    "104.26.", "172.67.", "104.21.",     # Cloudflare CDN
    "172.217.", "142.250.", "74.125.",   # Google services
    "13.107.", "20.44.", "52.96.",       # Microsoft services
    "151.101.", "199.232.",              # Reddit/Fastly CDN
    "239.255.255.250",                   # Multicast
    "224.0.0.",                          # Multicast
]
 
IP_RE = re.compile(r"\b(?:\d{1,3}\.){3}\d{1,3}\b")
 
 
def is_private(ip_str: str) -> bool:
    """Return True if ip_str is a private / RFC1918 / link-local IPv4 address."""
    try:
        ip_obj = ipaddress.ip_address(ip_str)
        return ip_obj.is_private or ip_obj.is_loopback or ip_obj.is_link_local
    except ValueError:
        return True
 
 
def parse_line(line: str) -> Tuple[str, str]:
    """Extract source and destination IPv4 addresses from log line."""
    ips = IP_RE.findall(line)
    if len(ips) >= 2:
        return ips[0], ips[1]
    return None, None
 
 
def is_mining_pool_ip(ip: str) -> bool:
    """Check if IP belongs to known mining pool providers."""
    return any(ip.startswith(prefix) for prefix in MINING_PROVIDERS)
 
 
def is_legitimate_service(ip: str) -> bool:
    """Check if IP belongs to known legitimate services."""
    return any(ip.startswith(prefix) for prefix in LEGITIMATE_SERVICES)
 
 
def calculate_mining_indicators(src_connections: Dict[str, int]) -> Dict[str, float]:
    """Calculate various mining indicators for a source IP."""
    total_connections = sum(src_connections.values())
    unique_destinations = len(src_connections)
 
    # Count connections to mining pools
    mining_pool_connections = sum(
        count for dst, count in src_connections.items()
        if is_mining_pool_ip(dst)
    )
 
    # Count connections to legitimate services (to filter them out)
    legitimate_connections = sum(
        count for dst, count in src_connections.items()
        if is_legitimate_service(dst)
    )
 
    # Calculate suspicious connection ratio (excluding legitimate services)
    suspicious_connections = total_connections - legitimate_connections
    mining_ratio = (mining_pool_connections / suspicious_connections) if suspicious_connections > 0 else 0
 
    # Check for concentrated traffic patterns (mining typically connects to few pools repeatedly)
    top_destinations = sorted(src_connections.items(), key=lambda x: x[1], reverse=True)[:5]
    top_5_traffic = sum(count for _, count in top_destinations)
    concentration_ratio = (top_5_traffic / total_connections) if total_connections > 0 else 0
 
    # Mining pools typically have sustained connections
    high_volume_destinations = sum(1 for _, count in src_connections.items() if count > 1000)
 
    return {
        'total_connections': total_connections,
        'unique_destinations': unique_destinations,
        'mining_pool_connections': mining_pool_connections,
        'legitimate_connections': legitimate_connections,
        'suspicious_connections': suspicious_connections,
        'mining_ratio': mining_ratio,
        'concentration_ratio': concentration_ratio,
        'high_volume_destinations': high_volume_destinations,
    }
 
 
def analyze_log(log_path: str) -> Tuple[Dict, Dict]:
    """Analyze log file to identify crypto miners."""
    connection_counts = defaultdict(Counter)
 
    print("Analyzing log file...")
    with open(log_path, 'r', errors='ignore') as fp:
        for line_num, line in enumerate(fp, 1):
            if line_num % 100000 == 0:
                print(f"Processed {line_num} lines...")
 
            src, dst = parse_line(line)
            if not src or not dst or is_private(dst):
                continue
 
            connection_counts[src][dst] += 1
 
    print(f"Analysis complete. Found {len(connection_counts)} internal hosts.")
 
    # Calculate mining scores for each host
    mining_analysis = {}
    for src, dst_counts in connection_counts.items():
        indicators = calculate_mining_indicators(dict(dst_counts))
 
        # Calculate composite mining score
        # Weight factors: mining ratio (40%), concentration (30%), volume (20%), mining connections (10%)
        mining_score = (
            indicators['mining_ratio'] * 0.4 +
            indicators['concentration_ratio'] * 0.3 +
            min(1.0, indicators['total_connections'] / 50000) * 0.2 +
            min(1.0, indicators['mining_pool_connections'] / 10000) * 0.1
        ) * 100
 
        # Bonus for high mining pool connections
        if indicators['mining_pool_connections'] > 5000:
            mining_score += 20
 
        # Bonus for multiple high-volume destinations (typical of mining)
        if indicators['high_volume_destinations'] >= 3:
            mining_score += 15
 
        indicators['mining_score'] = mining_score
        mining_analysis[src] = indicators
 
    return connection_counts, mining_analysis
 
 
def print_detailed_analysis(connection_counts, mining_analysis):
    """Print detailed analysis results."""
    print("\n" + "="*80)
    print("CRYPTOCURRENCY MINING DETECTION RESULTS")
    print("="*80)
 
    # Sort by mining score
    sorted_hosts = sorted(mining_analysis.items(), key=lambda x: x[1]['mining_score'], reverse=True)
 
    print(f"\nTop 10 Most Suspicious Hosts:")
    print("-" * 80)
    print(f"{'Host IP':<15} {'Score':<7} {'Total':<8} {'Mining':<8} {'Legit':<8} {'Unique':<7} {'Conc%':<6}")
    print("-" * 80)
 
    for src, indicators in sorted_hosts[:10]:
        score = indicators['mining_score']
        total = indicators['total_connections']
        mining = indicators['mining_pool_connections']
        legit = indicators['legitimate_connections']
        unique = indicators['unique_destinations']
        conc = indicators['concentration_ratio'] * 100
 
        print(f"{src:<15} {score:<7.1f} {total:<8} {mining:<8} {legit:<8} {unique:<7} {conc:<6.1f}")
 
    print("\n" + "="*80)
    print("DETAILED ANALYSIS OF TOP 2 SUSPECTS")
    print("="*80)
 
    # Detailed analysis of top 2
    for i, (src, indicators) in enumerate(sorted_hosts[:2], 1):
        print(f"\n{i}. HOST: {src} (Mining Score: {indicators['mining_score']:.1f})")
        print("-" * 60)
        print(f"   Total Connections: {indicators['total_connections']:,}")
        print(f"   Mining Pool Connections: {indicators['mining_pool_connections']:,}")
        print(f"   Legitimate Service Connections: {indicators['legitimate_connections']:,}")
        print(f"   Unique Destinations: {indicators['unique_destinations']}")
        print(f"   Traffic Concentration: {indicators['concentration_ratio']*100:.1f}%")
        print(f"   High-Volume Destinations: {indicators['high_volume_destinations']}")
 
        print(f"\n   Top Destinations:")
        top_dests = sorted(connection_counts[src].items(), key=lambda x: x[1], reverse=True)[:10]
        for dst, count in top_dests:
            is_mining = "🔥 MINING POOL" if is_mining_pool_ip(dst) else "✓ Legitimate" if is_legitimate_service(dst) else "❓ Unknown"
            print(f"     {dst:<15} {count:>8,} connections  [{is_mining}]")
 
    print("\n" + "="*80)
    print("FINAL VERDICT")
    print("="*80)
    print("The following hosts are CONFIRMED cryptocurrency miners:")
    for i, (src, indicators) in enumerate(sorted_hosts[:2], 1):
        print(f"  {i}. {src} (Score: {indicators['mining_score']:.1f})")
        mining_destinations = [dst for dst, count in connection_counts[src].items() if is_mining_pool_ip(dst)]
        if mining_destinations:
            print(f"     → Connected to {len(mining_destinations)} different mining pools")
            print(f"     → Total mining connections: {indicators['mining_pool_connections']:,}")
 
 
def main():
    parser = argparse.ArgumentParser(description="Advanced cryptocurrency mining detection")
    parser.add_argument("logfile", help="Path to the network log file")
    args = parser.parse_args()
 
    try:
        connection_counts, mining_analysis = analyze_log(args.logfile)
        print_detailed_analysis(connection_counts, mining_analysis)
    except Exception as e:
        print(f"Error: {e}")
        sys.exit(1)
 
 
if __name__ == "__main__":
    main()

danhq@hide-and-seek E:\....\Mine over matter python .\crypto_miner_detector.py .\logs.txt
Analyzing log file...
Processed 100000 lines...
Processed 200000 lines...
Processed 300000 lines...
Processed 400000 lines...
Processed 500000 lines...
Processed 600000 lines...
Processed 700000 lines...
Processed 800000 lines...
Analysis complete. Found 88 internal hosts.
 
================================================================================
CRYPTOCURRENCY MINING DETECTION RESULTS
================================================================================
 
Top 10 Most Suspicious Hosts:
--------------------------------------------------------------------------------
Host IP         Score   Total    Mining   Legit    Unique  Conc%
--------------------------------------------------------------------------------
172.16.0.5      121.2   71588    24825    44146    76      66.7
172.16.0.10     115.9   91915    49806    33939    461     55.1
172.16.96.86    96.3    7544     6868     21       16      99.5
172.16.96.80    69.1    4347     3672     21       15      99.1
172.16.96.84    68.7    4223     3547     21       15      99.1
172.16.96.112   65.1    3167     2489     21       16      98.9
172.16.0.70     51.9    18913    0        11       28      97.7
172.16.0.4      50.0    130831   0        129554   3       100.0
172.16.96.68    48.0    2992     1197     21       17      98.4
172.16.96.109   46.9    42252    0        36752    2       100.0
 
================================================================================
DETAILED ANALYSIS OF TOP 2 SUSPECTS
================================================================================
 
1. HOST: 172.16.0.5 (Mining Score: 121.2)
------------------------------------------------------------
   Total Connections: 71,588
   Mining Pool Connections: 24,825
   Legitimate Service Connections: 44,146
   Unique Destinations: 76
   Traffic Concentration: 66.7%
   High-Volume Destinations: 13
 
   Top Destinations:
     1.1.1.1           17,752 connections  [✓ Legitimate]
     104.26.11.102      8,757 connections  [✓ Legitimate]
     172.67.69.190      8,746 connections  [✓ Legitimate]
     104.26.10.102      8,655 connections  [✓ Legitimate]
     185.95.218.42      3,815 connections  [🔥 MINING POOL]
     162.19.139.119     3,795 connections  [🔥 MINING POOL]
     185.95.218.43      3,782 connections  [🔥 MINING POOL]
     130.162.153.207    2,000 connections  [🔥 MINING POOL]
     51.89.99.172       1,999 connections  [🔥 MINING POOL]
     51.79.229.21       1,330 connections  [🔥 MINING POOL]
 
2. HOST: 172.16.0.10 (Mining Score: 115.9)
------------------------------------------------------------
   Total Connections: 91,915
   Mining Pool Connections: 49,806
   Legitimate Service Connections: 33,939
   Unique Destinations: 461
   Traffic Concentration: 55.1%
   High-Volume Destinations: 20
 
   Top Destinations:
     51.79.229.21      15,930 connections  [🔥 MINING POOL]
     104.26.11.102     10,221 connections  [✓ Legitimate]
     104.26.10.102      9,953 connections  [✓ Legitimate]
     172.67.69.190      9,762 connections  [✓ Legitimate]
     130.162.153.207    4,782 connections  [🔥 MINING POOL]
     51.89.99.172       4,773 connections  [🔥 MINING POOL]
     8.8.8.8            3,282 connections  [✓ Legitimate]
     135.148.55.16      3,180 connections  [🔥 MINING POOL]
     51.222.200.133     2,188 connections  [🔥 MINING POOL]
     51.79.71.77        2,185 connections  [🔥 MINING POOL]
 
================================================================================
FINAL VERDICT
================================================================================
The following hosts are CONFIRMED cryptocurrency miners:
  1. 172.16.0.5 (Score: 121.2)
     → Connected to 23 different mining pools
     → Total mining connections: 24,825
  2. 172.16.0.10 (Score: 115.9)
     → Connected to 25 different mining pools
     → Total mining connections: 49,806

# The target values
targets = [12838, 1089, 16029, 13761, 1276, 14790, 2091, 17199, 2223, 2925,
           17901, 3159, 18135, 18837, 3135, 19071, 4095, 19773, 4797, 4085,
           20007, 5733, 20709, 17005, 2601, 9620, 3192, 9724, 3127, 8125]
 
# Calculate the powers of 3
powers = [pow(3, i, 256) for i in range(256)]
powers = powers[3:3+len(targets)]  # Only keep the ones I need
 
# Build the flag character by character
flag = ""
for i in range(len(targets)):
    # Try each printable ASCII character (32-126)
    for char_val in range(32, 127):
        if powers[i] * char_val == targets[i]:
            flag += chr(char_val)
            break
 
print(flag)

┌──(d4nhwu4n㉿hide-and-seek)-[/mnt/e/CTF/BYUCTF2025/rev/u]
└─$ python solve.py
byuctf{u_are_good_with_math}

┌──(d4nhwu4n㉿hide-and-seek)-[/mnt/e/CTF/BYUCTF2025/rev/LLDR]
└─$ llvm-as checker.ll -o checker.bc
 
┌──(d4nhwu4n㉿hide-and-seek)-[/mnt/e/CTF/BYUCTF2025/rev/LLDR]
└─$ ./llvm-cbe/build/tools/llvm-cbe/llvm-cbe checker.bc

from z3 import BitVec, Solver, sat
 
flag = [BitVec(f'f{i}', 8) for i in range(37)]
s = Solver()
 
for c in flag:
    s.add(c >= 32, c <= 126)
 
for i, ch in enumerate("byuctf"):
    s.add(flag[i] == ord(ch))
s.add(flag[6] == ord('{'))
s.add(flag[36] == ord('}'))
 
s.add(flag[4] == flag[14])
s.add(flag[14] == flag[17])
s.add(flag[17] == flag[23])
s.add(flag[23] == flag[25])
s.add(flag[9] == flag[20])
s.add(flag[10] == flag[18])
s.add(flag[11] == flag[15])
s.add(flag[15] == flag[24])
s.add(flag[24] == flag[31])
s.add(flag[31] == flag[27])
s.add(flag[13] == flag[26])
s.add(flag[16] == flag[29])
s.add(flag[19] == flag[28])
s.add(flag[28] == flag[32])
s.add(flag[22] == flag[28] * 2)
s.add(flag[33] == flag[32] + 1)
s.add(flag[34] == flag[32] + 4)
s.add(flag[30] == flag[7] + 1)
s.add(flag[8] == flag[7] - 32)
s.add(flag[9] + flag[20] == flag[31] + 3)
s.add(flag[0] == flag[31] + 3)
s.add(flag[10] == flag[7] + 6)
s.add(flag[8] == flag[9] + 27)
s.add(flag[12] == flag[13] - 1)
s.add(flag[13] == flag[10] - 3)
s.add(flag[10] == flag[16] - 1)
s.add(flag[16] == flag[14] - 1)
s.add(flag[35] == flag[5] - 2)
s.add(flag[5] == flag[21] - 1)
s.add(flag[21] == flag[22] - 1)
 
if s.check() == sat:
    m = s.model()
    output = ''.join([chr(m[c].as_long()) for c in flag])
    print("[+] Flag:", output)

┌──(d4nhwu4n㉿hide-and-seek)-[/mnt/e/CTF/BYUCTF2025/rev/LLDR]
└─$ python solve.py
[+] Flag: byuctf{lL1r_not_str41ght_to_4sm_458d}

┌──(d4nhwu4n㉿hide-and-seek)-[/mnt/e/CTF/BYUCTF2025/rev/baby and 2]
└─$ sudo jadx --show-bad-code -d . /mnt/e/CTF/BYUCTF2025/rev/baby\ and\ 2/baby_android-2.apk
INFO  - loading ...
INFO  - processing ...
ERROR - finished with errors, count: 20

┌──(d4nhwu4n㉿hide-and-seek)-[/mnt/e/CTF/BYUCTF2025/rev/baby and 2/baby_android-2.apk_decompiled]
└─$ grep -R byuctf
resources/AndroidManifest.xml:<manifest xmlns:android="http://schemas.android.com/apk/res/android" android:versionCode="1" android:versionName="1.0" android:compileSdkVersion="34" android:compileSdkVersionCodename="14" package="byuctf.babyandroid" platformBuildVersionCode="34" platformBuildVersionName="14">
resources/AndroidManifest.xml:    <permission android:name="byuctf.babyandroid.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION" android:protectionLevel="signature"/>
resources/AndroidManifest.xml:    <uses-permission android:name="byuctf.babyandroid.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION"/>
resources/AndroidManifest.xml:        <activity android:name="byuctf.babyandroid.MainActivity" android:exported="true">
resources/AndroidManifest.xml:        <provider android:name="androidx.startup.InitializationProvider" android:exported="false" android:authorities="byuctf.babyandroid.androidx-startup">
grep: resources/classes2.dex: binary file matches
grep: resources/classes3.dex: binary file matches
grep: resources/classes4.dex: binary file matches
grep: resources/lib/arm64-v8a/libbabyandroid.so: binary file matches
grep: resources/lib/armeabi-v7a/libbabyandroid.so: binary file matches
grep: resources/lib/x86/libbabyandroid.so: binary file matches
grep: resources/lib/x86_64/libbabyandroid.so: binary file matches
# ... and many more matches

__int64 __fastcall Java_byuctf_babyandroid_FlagChecker_check(__int64 a1, __int64 a2, __int64 a3)
{
  __int64 StringUTFChars; // rax
  int i; // [rsp+10h] [rbp-50h]
  unsigned __int8 v6; // [rsp+3Fh] [rbp-21h]
  _BYTE v7[24]; // [rsp+40h] [rbp-20h] BYREF
  unsigned __int64 v8; // [rsp+58h] [rbp-8h]
 
  v8 = __readfsqword(0x28u);
  StringUTFChars = _JNIEnv::GetStringUTFChars(a1, a3, 0LL);
  std::string::basic_string<decltype(nullptr)>(v7, StringUTFChars);
  if ( sub_206F0(v7) == 23 )
  {
    for ( i = 0; i < 23; ++i )
    {
      if ( *(char *)sub_20710(v7, i) != aBycnuAacglyTtM[i * i % 47] )
      {
        v6 = 0;
        goto LABEL_9;
      }
    }
    v6 = 1;
  }
  else
  {
    v6 = 0;
  }
LABEL_9:
  std::string::~string(v7);
  return v6;
}

#aBycnuAacglyTtM
lookup_table = "bycnu)_aacGly~}tt+?=<_ML?f^i_vETkG+b{nDJrVp6=)="
 
# Create array for flag
flag = ['_'] * 23
 
# Reverse the formula
for i in range(23):
    index = (i * i) % 47
    if index < len(lookup_table):
        flag[i] = lookup_table[index]
 
print(''.join(flag))

┌──(d4nhwu4n㉿hide-and-seek)-[/mnt/e/CTF/BYUCTF2025/rev/baby and 2]
└─$ python solve.py
byuctf{c++_in_an_apk??}

### IMPORTS ###
import flask, redis, os
 
 
### INITIALIZATIONS ###
app = flask.Flask(__name__)
app.config['SECRET_KEY'] = os.urandom(32).hex()
HOST = "redthis-redis"
 
 
### HELPER FUNCTIONS ###
def getData(key):
    db = redis.Redis(host=HOST, port=6379, decode_responses=True)
    value = db.get(key)
    return value
 
def getAdminOptions(username):
    adminOptions = []
    if username != None and username == "admin":
        db = redis.Redis(host=HOST, port=6379, decode_responses=True)
        adminOptions = db.json().get("admin_options", "$")[0]
    return adminOptions
 
 
 
### ROUTES ###
@app.route('/', methods=['GET'])
def root():
    username = flask.session.get('username')
    adminOptions = getAdminOptions(username)
    return flask.render_template('index.html', adminOptions=adminOptions)
 
 
# get quote
@app.route('/get_quote', methods=['POST'])
def getQuote():
    username = flask.session.get('username')
    person = flask.request.form.get('famous_person')
    quote = [person, '']
    if "flag" in person and username != "admin":
        quote[1] = "Nope"
    else:
        quote[1] = getData(person)
    adminOptions = getAdminOptions(username)
    return flask.render_template('index.html', adminOptions=adminOptions, quote=quote)
 
 
@app.route('/register', methods=['POST', 'GET'])
def register():
    # return register page
    if flask.request.method == 'GET':
        error = flask.request.args.get('error')
        return flask.render_template('register.html', error=error)
 
    username = flask.request.form.get("username").lower()
    password = flask.request.form.get("password")
 
    ## error check
    if not username or not password:
        return flask.redirect('/register?error=Missing+fields')
 
    ## if username already exists return error
    isUser = getData(username)
    if isUser:
        return flask.redirect('/register?error=Username+already+taken')
    else:
        # insert new user and password
        db = redis.Redis(host=HOST, port=6379, decode_responses=True)
        # db.set(username, "User") # nah, we don't want to let you write to the db :)
        passwordKey = username + "_password"
        # db.set(passwordKey, password) # nah, we don't want to let you write to the db :)
        flask.session['username'] = username
        return flask.redirect('/')
 
@app.route('/login', methods=['POST', 'GET'])
def login():
     # return register page
    if flask.request.method == 'GET':
        error = flask.request.args.get('error')
        return flask.render_template('login.html', error=error)
 
    username = flask.request.form.get("username").lower()
    password = flask.request.form.get("password")
 
    ## error check
    if not username or not password:
        return flask.redirect('/login?error=Missing+fields')
 
    # check username and password
    dbUser = getData(username)
    dbPassword = getData(username + "_password")
 
    if dbUser == "User" and dbPassword == password:
        flask.session['username'] = username
        return flask.redirect('/')
    return flask.redirect('/login?error=Bad+login')
 
 
if __name__ == "__main__":
    app.run(host="0.0.0.0", port=1337, debug=False, threaded=True)

if "flag" in person and username != "admin":
    quote[1] = "Nope"

if username != None and username == "admin":
    db = redis.Redis(host=HOST, port=6379, decode_responses=True)
    adminOptions = db.json().get("admin_options", "$")[0]