2

An android app loads a native library (.so) using System.loadLibrary. It then calls a specific function, which takes 3 input variables, and returns a string containing a MD5 hash.

You can see the relevant part of the function below:

enter image description here

I want to be able to see the original, "unhashed" message (which is of course derived from the 3 input variables), instead of it's md5 hash. Is this possible in any way?

Improve this question
5
  • 2
    You can use Frida to hook the MD5_Update function. – 0xec Nov 25 '17 at 7:11
  • @0xec this worked perfectly. Please post an answer so I can accept it. – user22348 Nov 25 '17 at 12:14
  • @0xes I'm trying to reverse engineer hash generation in an Android app. I suppose Frida is the right tool for this too? I was able to hook to the app. But there are some things I'm a bit confused about. How would I find out which function is doing it? After I have the function name, how would I get the contents of the function? – Arya Dec 27 '17 at 6:05
  • Any news about this? I am trying to do samething. – Berkay Yıldız Jun 5 '19 at 23:21
  • @BerkayYıldız there already is an accepted answer – user22348 Jun 6 '19 at 19:02
3

You can use Frida.

Frida is a dynamic binary instrumentation tool that allows you to intercept, trace, modify, ... of a running application using a JavaScript debugging logic.

For your purpose, you need to hook the MD5_Update function using the Interceptor API.

The JavaScript code may look like the following. [Warning: Untested]

// Use the mangled form of name MD5_Update below
Interceptor.attach(Module.findExportByName("mylib.so", "MD5_Update"), {
    onEnter: function (args) 
    {
        var ptr_data = args[1];
        var length = args[2];    

        var data = Memory.readByteArray(ptr_data, length);
        console.log(data);
    }
});

Further reference:

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy