0

It's been a few days I'm working on an application to find out about an encryption it is using on a few strings received from API, but no success so far.

These are the strings:

QVZZRUNpOVRQUlYvWGhOUmZVbzlRUnA5TzBSZFdsa0JQMnByUmx4VmNBcG9CRlZLSFhFRkRFVmFLaXA0REJFREtCWTRYd0JhUmdGU1JWVUhMbDVnUzFVUFdnb3ZWejRNU0hNNEMxSVFLUU1TVnp0RUFGcEI6Wm9xdVFCb0JVbg

Base64 Decode:
AVYECi9TPRV/XhNRfUo9QRp9O0RdWlkBP2prRlxVcApoBFVKHXEFDEVaKip4DBEDKBY4XwBaRgFSRVUHLl5gS1UPWgovVz4MSHM4C1IQKQMSVztEAFpB:ZoquQBoBUn
QVFSVEJ5OVlWRklvQzNSVGJ3QlVBMnRRVWxNcEFXZ1VDbDUyQVhrRWFVSlljRGxkQUZ0WUNqOHlVQXQzWGc0PTpGR2lBcnlubUpx
Base64 Decode:
AQRTBy9YVFIoC3RTbwBUA2tQUlMpAWgUCl52AXkEaUJYcDldAFtYCj8yUAt3Xg4=:FGiArynmJq

The application converts them to readable human text in Arabic. When I try to base64 decode one more time, I get non-readable bytes, these bytes are decoded/decrypted somehow to become readable by the application.

When I hook android.util.Base64's methods using Frida, it only shows a few result upon the application loading. but it doesn't output anything when the application decodes/decrypts them.

So far I have found out that it uses MessageDigest MD5, upon receiving the strings from related API calls. My guess is it uses MD5 in conjunction with another algorithm to decode/decrypt the strings.

I also tried modifiying the API response and those strings, to see if the application fires any errors, but it did not. It stuck instead.

The application is obfuscated hardly, even tried to find out about any dex files it uses, I only got one, which wasn't the application code, but a few plugins. I tried hooking java.lang.StringBuilder, there were tracks of dex files, but I couldn't understand:

dalvik.system.DexFile@41ae7d00
dex file "dalvik.system.DexFile@41ae7d00"
dalvik.system.DexFile@41cd2ba0
dex file "dalvik.system.DexFile@41cd2ba0"

What should I do next?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.