2

An android app loads a native library (.so) using System.loadLibrary. It then calls a specific function, which takes 3 input variables, and returns a string containing a MD5 hash.

You can see the relevant part of the function below:

enter image description here

I want to be able to see the original, "unhashed" message (which is of course derived from the 3 input variables), instead of it's md5 hash. Is this possible in any way?

|improve this question
  • 2
    You can use Frida to hook the MD5_Update function. – 0xec Nov 25 '17 at 7:11
  • @0xec this worked perfectly. Please post an answer so I can accept it. – technology Nov 25 '17 at 12:14
  • @0xes I'm trying to reverse engineer hash generation in an Android app. I suppose Frida is the right tool for this too? I was able to hook to the app. But there are some things I'm a bit confused about. How would I find out which function is doing it? After I have the function name, how would I get the contents of the function? – Arya Dec 27 '17 at 6:05
  • Any news about this? I am trying to do samething. – Berkay Yıldız Jun 5 at 23:21
  • @BerkayYıldız there already is an accepted answer – technology Jun 6 at 19:02
4

You can use Frida.

Frida is a dynamic binary instrumentation tool that allows you to intercept, trace, modify, ... of a running application using a JavaScript debugging logic.

For your purpose, you need to hook the MD5_Update function using the Interceptor API.

The JavaScript code may look like the following. [Warning: Untested]

// Use the mangled form of name MD5_Update below
Interceptor.attach(Module.findExportByName("mylib.so", "MD5_Update"), {
    onEnter: function (args) 
    {
        var ptr_data = args[1];
        var length = args[2];    

        var data = Memory.readByteArray(ptr_data, length);
        console.log(data);
    }
});

Further reference:

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.