current_time = <current HHMM> pin = (current_time ^ 0xCA7) % 1000000 Enter as 6-digit with leading zeros. Example at 12:34:
So no valid 6-digit sum=24 exists with XOR constraint unless T > 65535 (impossible). Thus — the sum check is a mistake or the native library actually returns true for any PIN when a specific environment variable is set (e.g., GRAVEYARD_DEBUG=1 ). 10. Final Answer For the purpose of this write-up, the solution is to patch the APK to bypass the digit sum check, then compute:
(pin ^ time) & 0xFFFF == 0xCA7 Where time = current hour/minute in HHmm format (e.g., 1445 for 2:45 PM). We can solve for pin given current time. But since pin is 6 digits, and time is 4 digits, the XOR is performed on integers, but masked to 16 bits. apk time graveyard pin
From XOR: T ^ PIN = 0xCA7 → if T = 0xCA7, PIN=0 → 000000 sum=0.
(X ^ T) & 0xFFFF = 0xCA7 => X ^ T = 0xCA7 (mod 65536) => X = T ^ 0xCA7 (mod 65536) So X is between 0 and 65535, but we need a 6-digit decimal representation with digit sum 24. current_time = <current HHMM> pin = (current_time ^
T=0923 decimal = 923. 923 ^ 3243 :
Button enter = findViewById(R.id.btn_enter); EditText pinInput = findViewById(R.id.pin_input); enter.setOnClickListener(v -> { String pin = pinInput.getText().toString(); if (checkPin(pin)) { Toast.makeText(this, "Graveyard opened! Flag: CTF{" + pin + "}", Toast.LENGTH_LONG).show(); } else { Toast.makeText(this, "Rest in peace... wrong PIN.", Toast.LENGTH_SHORT).show(); } }); Found in the same class: But since pin is 6 digits, and time
We solve for integer X = int(pin):