> For the complete documentation index, see [llms.txt](https://docs.cooku222.kr/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cooku222.kr/security/mobile/frida-lab/frida-labs-0x6.md).

# Frida-Labs 0x6

​\
출처 :<https://github.com/DERE-ad2001/Frida-Labs/tree/main/Frida%200x6>

***

<figure><img src="https://blog.kakaocdn.net/dna/bo9d2o/dJMcadOsEGs/AAAAAAAAAAAAAAAAAAAAACyhFvwR4lWyVV0ayP7xvSFjZgzAqX_guX1B43zRTuog/img.png?credential=yqXZFxpELC7KVnFOS48ylbz2pIh7yKj8&#x26;expires=1782831599&#x26;allow_ip=&#x26;allow_referer=&#x26;signature=2WmHCVYi4OIbC8MI%2FR0rUjri3Tg%3D" alt="" height="767" width="1407"><figcaption></figcaption></figure>

이전 문제들과 유사하게 애플리케이션 어디에도 호출되지 않는 get\_flag() 메서드가 존재한다. 이 메서드를 호출하면 AES로 플래그를 복호화 하고 이 값을 TextView에 설정한다. \
get\_flag()를 살펴보면 Checker 클래스의 인스턴스 하나만 받는다. 이 인자의 이름은 A 이고 타입은 Checker이다. 메서드 내부에서는 A.num1이 1234와 같은지 그리고 A.num2이 4321과 같은지 확인한다.

<figure><img src="https://blog.kakaocdn.net/dna/yuobh/dJMcacoxk38/AAAAAAAAAAAAAAAAAAAAAGJjcMrRIGj6Jb9NGdLaLZTFbr7ui_zAX0M3XF80ps_I/img.png?credential=yqXZFxpELC7KVnFOS48ylbz2pIh7yKj8&#x26;expires=1782831599&#x26;allow_ip=&#x26;allow_referer=&#x26;signature=5mUeNXE2OnL68p0lXnPWmLNmTSQ%3D" alt="" height="200" width="435"><figcaption></figcaption></figure>

&#x20;\
Checker 클래스에는 두 개의 변수가 있다.

* num1
* num2

if 조건을 만족해 플래그를 복호화하고 설정하는 코드 블록이 실행되려면 num1은 1234, num2는 4321이어야 한다.\
그리고 이 클래스의 인스턴스 역시 애플리케이션 어디에서도 생성되지 않는다.\
따라서 Checker 클래스의 인스턴스를 생성하고 num1을 1234로, num2를 4321로 설정한다. 그리고 MainActivity의 인스턴스를 가져온다. 해당 인스턴스를 인자로 사용해 get\_flag()를 호출한다.&#x20;

```
C:\Users\after\Downloads>adb install Challenge_0x6.apk
Performing Streamed Install
Success
```

```
C:\Users\after>frida -U -f com.ad2001.frida0x6
     ____
    / _  |   Frida 17.5.1 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to Android Emulator 5554 (id=emulator-5554)
Spawned `com.ad2001.frida0x6`. Resuming main thread!
[Android Emulator 5554::com.ad2001.frida0x6 ]-> Java.performNow(function() {
  Java.choose('com.ad2001.frida0x6.MainActivity', {
    onMatch: function(instance) {
      console.log("Instance found");

      var checker = Java.use("com.ad2001.frida0x6.Checker");
      var checker_obj  = checker.$new();  // Class Object
      checker_obj.num1.value = 1234; // num1
      checker_obj.num2.value = 4321; // num2
      instance.get_flag(checker_obj); // invoking the get_flag method

    },
    onComplete: function() {}
  });
});
Instance found
```

<figure><img src="https://blog.kakaocdn.net/dna/4SONj/dJMcadHHXQx/AAAAAAAAAAAAAAAAAAAAAMaUf-8BoSKlG8tf1zo5yu7HC45cMq6GD0XGR_bq6MJ8/img.png?credential=yqXZFxpELC7KVnFOS48ylbz2pIh7yKj8&#x26;expires=1782831599&#x26;allow_ip=&#x26;allow_referer=&#x26;signature=CUnLp%2FmbJ1SaGKQF0i%2Fcsm76HYk%3D" alt="" height="553" width="280"><figcaption></figcaption></figure>

플래그가 출력된다.

<br>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.cooku222.kr/security/mobile/frida-lab/frida-labs-0x6.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.