# [rev] HeyImAB - Tamil CTF 2021 ###### tags: `TamilCTF2021` `rev` At first, I have investigated the format of file using `file` command. ``` $ file backup.ab backup.ab: Android Backup, version 5, Compressed, Not-Encrypted ``` Android Backup file, so we can look into depth using tool like [android-backup-extractor](https://github.com/nelenkov/android-backup-extractor). ``` > java -jar .\abe.jar unpack .\HeyImAB\backup.ab out.tar 0% 1% 2% 3% 4% 5% 6% 7% 8% 9% 10% 11% 12% 13% 14% 15% 16% 17% 18% 19% 20% 21% 22% 23% 24% 25% 26% 27% 28% 29% 30% 31% 32% 33% 34% 35% 36% 37% 38% 39% 40% 41% 42% 43% 44% 45% 46% 47% 48% 49% 50% 51% 52% 53% 54% 55% 56% 57% 58% 59% 60% 61% 62% 63% 64% 65% 66% 67% 68% 69% 70% 71% 72% 73% 74% 75% 76% 77% 78% 79% 80% 81% 82% 83% 84% 85% 86% 87% 88% 89% 90% 91% 92% 93% 94% 95% 96% 97% 98% 99% 100% 39148544 bytes written to out.tar. ``` By searching `TamilCTF{` inside `apps\com.example.devpack\r\app_flutter\flutter_assets\kernel_blob.bin`, I have obtained a flag. ``` class Homepage extends StatelessWidget { const Homepage({Key? key}) : super(key: key); @override Widget build(BuildContext context) { return Scaffold( appBar: AppBar( title: Text('TamilCTF{1_l0v3_y0u_AB}'), ), ); } } ```