Classdump

spbctf

Task: iOS app (GimmeFlag.ipa) with class dump showing FirstFlagViewController with a 'secret' property; demo video shows correct secret entered but flag hidden by simulator detection. Solution: disassembled the init method with radare2 to find the hardcoded 19-byte secret string 'REDACTED' at address 0x100011f40, which is concatenated into the flag format.