Jadx

A single APK whose UI claims there’s nothing to see — the flag is split into three pieces hidden in a MainActivity field, a string resource, and a Compose theme getter.

Reversing a Javalin app whose real password validator lives in an AOT/CDS cache that overrides the jar — dumping the loaded class with the HotSpot Serviceability Agent unlocks a file-read to /flag.