tl;dr: hardcoded flag in resources. another approach is to use dumpsys. [https://blackbeard666.github.io/pwn_exhibit/content/2021_CTF/bsidesSFCTF/android_charge_writeup.html](https://blackbeard666.github.io/pwn_exhibit/content/2021_CTF/bsidesSFCTF/android_charge_writeup.html)