As per the title, I have an encrypted text file that is generated by an Android app. I then have to send that off to the people whom made the app for them to decode it and send it back. Not ideal as they can sometimes take days to reply.

If I have both pre and post text files what would be the best way to find the key/decrypt them myself in the future?

Thanks guys

  • Do you also have the application itself? Reading the application's code would probably be the easiest way. – NirIzr Apr 26 '17 at 8:48
  • Sure do! It's nothing overly special just an OBD reader for a car – OzKnucklehead Apr 26 '17 at 8:50

This is a slightly broad question, so the answer will be as well. I suggest you ask additional, specific, questions as you continue your process.

First steps would probably be to get the apk, extract the java & native code from it and reverse your way to the encryption algorithm. Once you figure out what's the encryption algorithm and protocol you can see if the application can technically decrypt data it previously encrypted.

There are already questions here on how to start reverse engineering Android APKs.

Once you have the java code decompiled, you can search for that code that actually performs the encryption and see what are the functions it calls and the input it receives.

This is not necessarily possible because some encryption models (such as private/public encryption) only allow one side to decrypt.

| improve this answer | |
  • Copy that. I'll pull the APK and start decompiling it and chase the encrypting function. Yeah I am hoping that it is a simple encryption key and not hash based. Thank you for getting back to me, much appreciated! I'll let you know how I go. – OzKnucklehead Apr 26 '17 at 9:20

What you are trying to do is called a chosen ciphertext attack. This is a well known attack model, and any decent symmetric encryption algorithm is expected to withstand it, though it's possible they're using a homegrown or broken algorithm. If they're using asymmetric crypto, there's no chance.

As mentioned above, you should start by reversing the application itself. That will hopefully tell you which algorithm they are using, and if they are using symmetric crypto, it will probably tell you the key as well.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.