[Mobile] Thai Guardian

1
WANLAI{3f651648INVALID_FRIDA_DETECTED}

1
Java.perform(function () {
2
    console.log("[*] Starting ThaiGuardian CTF Bypass (V2)...");
3

4
    const GuardianChecker = Java.use('com.ctf.songkran.hard.GuardianChecker');
5

6
    // 1. บายพาส Java Layer (เพิ่ม .overload() ป้องกัน TypeError)
7
    GuardianChecker.environmentCheck.overload().implementation = function () {
8
        console.log("[+] Java: Bypassed environmentCheck()");
9
        return true;
10
    };
11

12
    // 2. บายพาส Native Layer
13
    const moduleName = "libnative-lib.so";
14
    const detectorSymbol = "_ZN13FridaDetector6detectEv";
15

16
    // const detectorPtr = Module.findExportByName(moduleName, detectorSymbol);
17
    const detectorPtr = Process.getModuleByName(moduleName).findExportByName(detectorSymbol);
18

19
    if (detectorPtr) {
20
        console.log("[+] Native: Found FridaDetector::detect() at " + detectorPtr);
21

22
        // เขียนทับฟังก์ชันให้ Return 0 (False) เสมอ
23
        Interceptor.replace(detectorPtr, new NativeCallback(function () {
24
            console.log("[!] Native: Blocked FridaDetector::detect()!");
25
            return 0;
26
        }, 'int', []));
27
    } else {
28
        console.log("[-] Native: detector symbol not found (or library not loaded yet).");
29
    }
30

31
    // 3. ใช้ Java.choose เพื่อหา Instance ใน Memory แทนการใช้ INSTANCE.value
32
    console.log("[*] Scanning memory for GuardianChecker instance...");
33

34
    setTimeout(function() {
35
        Java.choose('com.ctf.songkran.hard.GuardianChecker', {
36
            onMatch: function (instance) {
37
                console.log("[+] Found GuardianChecker in memory!");
38
                // เรียก getCompleteFlag ผ่าน Instance ที่หาเจอ
39
                const flag = instance.getCompleteFlag();
40
                console.log("\n==============================");
41
                console.log("🎉 FLAG: " + flag);
42
                console.log("==============================\n");
43
            },
44
            onComplete: function () {
45
                console.log("[*] Memory scan complete.");
46
            }
47
        });
48
    }, 1500); // ดีเลย์ 1.5 วิ ให้แอปโหลดเสร็จสมบูรณ์
49
});

1
WANLAI{3f65164863c251e7604c9c2351f1ae7d}