So is 002306 . Check digit sum: 0+0+2+3+0+6 = 11 → fails sum requirement (needs 24).
Python script:
Time 0842 -> PIN 092305 Time 0923 -> PIN 083404 ... One valid: T = 0923 (9:23 AM) → X = 923 ^ 0xCA7 = 923 ^ 3243 = 0x039B ^ 0x0CA7 = 0x0F3C = 3900 → PIN 003900 → sum = 0+0+3+9+0+0 = 12 (fail? Wait, check carefully). apk time graveyard pin
private boolean checkPin(String pin) { if (pin.length() != 6) return false; int sum = 0; for (char c : pin.toCharArray()) sum += (c - '0'); if (sum != 24) return false; int timeInt = Integer.parseInt(new SimpleDateFormat("HHmm", Locale.US).format(new Date())); return verifyPin(pin, timeInt); }
(X ^ T) & 0xFFFF = 0xCA7 => X ^ T = 0xCA7 (mod 65536) => X = T ^ 0xCA7 (mod 65536) So X is between 0 and 65535, but we need a 6-digit decimal representation with digit sum 24. So is 002306
But 0xDEADBEEF is 32-bit, while pinInt and timeInt are 6-digit max (e.g., 123456). That XOR condition would unless something else is going on. 4. Finding the Real Logic Look closer — there’s a native library loaded:
adb install apktime-graveyard-pin.apk Running the app shows a gothic-themed screen with a graveyard image and a PIN entry field. No source code is provided — only the APK. 3.1 Decompilation with jadx jadx -d output apktime-graveyard-pin.apk Open output/sources/com/ctf/graveyardpin/ – the main activity is MainActivity.java . One valid: T = 0923 (9:23 AM) →
bool verifyPin(JNIEnv *env, jobject thiz, jstring pin, jint timeInt) { const char *pinStr = (*env)->GetStringUTFChars(env, pin, NULL); int pinInt = atoi(pinStr); int computed = (pinInt ^ timeInt) & 0xFFFF; // Note: only low 16 bits // Graveyard magic constant int expected = 0xCA7;