http://qtnes.com/tags/native/Recent content in Native on QtnesHugoen-usTue, 14 Apr 2026 00:00:00 +0000http://qtnes.com/posts/1---ghostmode---reversing-a-native-android-ctf-library/Tue, 14 Apr 2026 00:00:00 +0000http://qtnes.com/posts/1---ghostmode---reversing-a-native-android-ctf-library/<h2 id="overview">Overview</h2> <p>GhostMode was the workshop&rsquo;s first foray into native code. The APK itself was thin — the interesting logic lived entirely in <code>libctflib.so</code>, a stripped ELF64 shared library loaded at runtime. The challenge name already telegraphed the approach: you were not meant to find the flag through static analysis alone.</p> <p>The fake flag was there to remind you of that.</p> <h2 id="first-look--the-stub-and-the-taunt">First Look — The Stub and the Taunt</h2> <p>Decompiling the APK with JADX produced a small <code>FlagManager</code> class with a single JNI method:</p>