Find a string in an object file

Question

I have a libcocos2djs.so file, which presumably is a mobile game using Cocos2d. Result of file:

ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /system/bin/linker, stripped

The game sends HTTP requests to the game server. For each request, the program adds an integer timestamp query parameter to the request URL, then calculates the MD5 hash of the URL concatenated with a secret string, and then adds this MD5 hash as a query parameter to the URL.

Example:

Original URL: /some_endpoint

With timestamp: /some_endpoint&time=324234243

With hash (MD5 the above string concatenated with a secret string): /some_endpoint&time=324234243&hash=870839dba52a8fc6f47f44742116a40b

This secret string is what I want to find out.

I learnt to use a version of objdump that supports ARM to disassemble this object file, but since my assembly knowledge is limited, I don't know where to start and it would be great if someone can point me to the right direction. I just need one secret string.

The old versions of the game were using Unity, which could be easily decompiled, and I found the secret string was hard-coded in the source code. They use a new secret string for the new version and it's very likely the secret string is still hard-coded in the source code. Not sure if this information is helpful.

Answer 1

I Know IDA-PRO has some good plugins to find Crypt algorithms such as AES, DES, Triple DES and others..

As well as cryptography algorithms, it can find Hashing algorithms as well as MD5, this is pretty easy because the MD5 algorithm has couple of static intiatiors which are easy to look for in the memory (0x67452301 0xefcdab89, 0x98badcfe, 0x10325476). Anyways i would open up the SharedObject in IDA pro, look for the MD5 algorithm, and then look for the string attached to the sent data as a salting mechanism. So if ill have to put the reversing technique into steps it would be:

1. Find the MD5 hash function
2. Look for the function calling the MD5 function, and with what parameters (One of the parameters should be the data to hash - The data containing the MagicString)
3. If you still dont know which part of the string is the MagicString, Try understanding what changed the current string and added the Salting MagicString i would look for strcat variants

Answer 2

If you have the patience to sort the output, try running the file through the strings utility (if you're on Linux or Mac, it's probably already installed, just type strings --version in the terminal to test it).

This tool is not super fancy, so it will print a lot of junk together with any other text strings found. If you're certain the text you're looking for is there, it shouldn't take too long to manually sort through the output and find it.