- Use jadx to decompile the app and extract assets
-> It's a React Native app using Hermes - the actual challenge code is in Hermes Bytecode
- Use hbctool to disassemble the index.android.bundle
- Username "admin" is hardcoded, password and flag are decoded from static buffers
- Extract buffers from the metadata.json generated by hbctool
-> password and flag