When running the application in an emulator and executing

```
adb shell am broadcast \
-a com.example.oxidized_intentions.TICKET \
-n com.example.oxidized_intentions/.TicketReceiver \
--es seed "testseed123"
```

Following logs are written:

```
08-30 16:28:14.359  6201  6201 D OXI     : Got broadcast, seed=testseed123
08-30 16:28:15.550  6201  6201 D OXI     : Required seed is: fe2o3rust
08-30 16:28:15.562  6201  6201 D OXI     : Computing flag for seed='testseed123' ...
08-30 16:28:15.563  6201  6201 D OXI     : Seed 'testseed123' is not expected; required seed is 'fe2o3rust'
08-30 16:28:15.585  6201  6201 D OXI     : FLAG=FAKE{wrong_seed}
```

When using `fe2o3rust` as the seed output looks like this:

```
08-30 16:34:30.981  7429  7429 D OXI     : Got broadcast, seed=fe2o3rust
08-30 16:34:30.991  7429  7429 D OXI     : Computing flag for seed='fe2o3rust' ...
08-30 16:34:32.021  7429  7429 D OXI     : anti_hook_check elapsed=1007ms
```

Next idea: Just increase the anti_hook_check limit and see what happens

Patching the binary:
https://book.jorianwoltjer.com/mobile/patching-apks

Patched Bytes:
`00000000000047AD	0x1	68 	6D` This is a marker to test if the right patched library is loaded (just change a letter in a log entry)
`0000000000011D2A	0x1	07 	3F` anti_hook_check now tests if execution took >4000ms and not only 500ms

Current progress:
```
❯ adb logcat | rg OXI
08-30 19:02:05.234  9868  9868 D OXI     : Got broadcast, seed=fe2o3rust
08-30 19:02:05.397  9868  9868 D OXI     : Required seed is: fe2o3rust
08-30 19:02:05.400  9868  9868 D OXI     : Computing flag for seed='fe2o3rust' ...
08-30 19:02:06.403  9868  9868 D OXI     : anti_mook_check elapsed=1000ms
08-30 19:02:06.437  9868  9868 D OXI     : FLAG=FAKE{0000000358f228d7}
```

From where does the FAKE flag come from?

The program checks if a magic number is set. Just invert the branch condition

`0000000000011DE0	0x1	E1 	E0` Changes B.NE to B.EQ