0

Using a forward proxy, I have logged two payloads that are POST requests to a site, and I was curious as to what the best way to determine how a particular attribute in the payloads was generated. Below are the two payloads:

dedup_counter=2&leaderboard=2&scores=3563736&session=4FMzmwStjaRC&verifier=7e9282dbce68fe787be15f6633246fcd8297eb18

 

dedup_counter=3&leaderboard=4&scores=10448&session=4FMzmwStjaRC&verifier=07bdb58cb2147b4ef0ca01110a74e4fb4c8e99c1

I believe that the verifier attribute is an SHA-1 checksum since that's the most common 20-byte hashing method, though I cannot confirm this. The issue is, I don't know what it's a checksum of and I'd like to know how to go about determining the process that was used for generating it. Any advice? I'll be happy to provide more specific information upon request.

Improve this question
6
  • 1
    You really need to reverse engineer the software that generates these requests. Hashes like SHA-1 are designed to be trapdoor functions, i.e. you can't get the "original" from the hash, and if the software creates the hash from a moderately long string, to which the score and possibly leaderboard and dedup_counter are appended, there's just no way to "crack" the hash. How to reverse the software is probably too broad for a good answer, but we might be able to give you some pointers if you tell us what kind of software it is - browser game? android app? compiled game?
    – Guntram Blohm
    Dec 30, 2015 at 10:54
  • It's an iOS app. I'm not sure how I'd even obtain a binary for the game.
    – Patrick Roberts
    Dec 30, 2015 at 10:55
  • 2
    This might get you started, as well as this, or just google for "extract binary from ios app".
    – Guntram Blohm
    Dec 30, 2015 at 12:18
  • @GuntramBlohm Would it be possible to use my forward proxy and log the request made from my iPhone to download the application, then replicate the request and reverse-engineer the application on my laptop computer? It has OS X 10.9.5 and uses an Intel i7 processor.
    – Patrick Roberts
    Dec 30, 2015 at 16:24
  • I'm not an apple expert, i could tell you more if this was android. I'd assume you should be able to tell your proxy to save everything it downloads to a file, to get the app. But from the linked documents, if the file is encrypted, you need to run it on a jailbroken iOS device and dump the memory, so the laptop alone might not be sufficient.
    – Guntram Blohm
    Dec 31, 2015 at 10:28

1 Answer 1

Reset to default
1

Unique key names come in handy here. Short search on some of the names suggest that this is coming from the Pankia gaming SDK. Quick review confirms that verifier is SHA1 of some kind of game secret and a UUID.

Improve this answer
2
  • Nice research, I'm impressed that you figured out the game. And thanks for confirming the hash algorithm as SHA1. I'm going to see if I can figure out the input used for the hash.
    – Patrick Roberts
    Dec 31, 2015 at 19:39
  • I suppose my success will depend on how responsible the game developer was adhering to the wiki's advice.
    – Patrick Roberts
    Dec 31, 2015 at 19:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.