# Chasing a lock writeup

This challange is very similar to Strong padlock one
**We will use Frida and Jadx in this challange**

# Frida framework installation
Let's setup Frida on our Android device like in this link:
https://frida.re/docs/android/

And then install Frida tools on our pc:
`pip3 install frida-tools`
Let's now verify our installation:
`frida-ps -U`
If output is:
` PID NAME
12345 com.example.app
`
...you installed Frida correctly!

# Jadx decompiler installation
Let's visit Jadx releases page on Github
https://github.com/skylot/jadx/releases/

Download latest binary and open it!

# Now let's begin!
First, let's locate apk's Main activity class
Do it by writing
`frida-ps -U`
You'll see
`
PID NAME
12345 com.example.xyz.Main
XXXXX com.example.razictf_2.MainActivity
67890 com.modern.app.App
`
Now open apk in Jadx and go to
`com.example.razictf_2.MainActivity`

We notice onClick method and inside of it
code changing our clicks left number **and this line**
`String run = new switcher().run(i);` *which btw isn't best solution to call .run method*
Now lets see for what `run` string is being used
it shows us something when its not null, hmmm
Maybe visiting switcher.run will tell us more?
Aha! This looks like code containing our flag parts

Now lets make frida script
So we know what is giving us flag, lets try calling it
I wrote this code to print flag for us:
`
console.log(console.log(Java.use("com.example.razictf_2.switcher").$new().run(0)));
`

It doesn't tell you anything? Let me explain this simple code
`Java.use("com.example.razictf_2.switcher")` gives us access to this class from frida api
`.$new()` makes an instance of this class, now we have access to object from frida api
`.run(0)` calls .run method of this object with 0 as argument
`console.log(console.log(Java.use("com.example.razictf_2.switcher").$new().run(0)));` prints whole flag for us

Lets launch Frida now!
Go to terminal/cmd and write this command:
`frida -U -f com.example.razictf_2 --no-pause`
Paste our code, and get the flag!