It's been a few days I'm working on an application to find out about an encryption it is using on a few strings received from API, but no success so far.
These are the strings:
QVZZRUNpOVRQUlYvWGhOUmZVbzlRUnA5TzBSZFdsa0JQMnByUmx4VmNBcG9CRlZLSFhFRkRFVmFLaXA0REJFREtCWTRYd0JhUmdGU1JWVUhMbDVnUzFVUFdnb3ZWejRNU0hNNEMxSVFLUU1TVnp0RUFGcEI6Wm9xdVFCb0JVbg Base64 Decode: AVYECi9TPRV/XhNRfUo9QRp9O0RdWlkBP2prRlxVcApoBFVKHXEFDEVaKip4DBEDKBY4XwBaRgFSRVUHLl5gS1UPWgovVz4MSHM4C1IQKQMSVztEAFpB:ZoquQBoBUn
QVFSVEJ5OVlWRklvQzNSVGJ3QlVBMnRRVWxNcEFXZ1VDbDUyQVhrRWFVSlljRGxkQUZ0WUNqOHlVQXQzWGc0PTpGR2lBcnlubUpx Base64 Decode: AQRTBy9YVFIoC3RTbwBUA2tQUlMpAWgUCl52AXkEaUJYcDldAFtYCj8yUAt3Xg4=:FGiArynmJq
The application converts them to readable human text in Arabic. When I try to base64 decode one more time, I get non-readable bytes, these bytes are decoded/decrypted somehow to become readable by the application.
When I hook
android.util.Base64's methods using Frida, it only shows a few result upon the application loading. but it doesn't output anything when the application decodes/decrypts them.
So far I have found out that it uses MessageDigest MD5, upon receiving the strings from related API calls. My guess is it uses MD5 in conjunction with another algorithm to decode/decrypt the strings.
I also tried modifiying the API response and those strings, to see if the application fires any errors, but it did not. It stuck instead.
The application is obfuscated hardly, even tried to find out about any dex files it uses, I only got one, which wasn't the application code, but a few plugins. I tried hooking
java.lang.StringBuilder, there were tracks of dex files, but I couldn't understand:
dalvik.system.DexFile@41ae7d00 dex file "dalvik.system.DexFile@41ae7d00" dalvik.system.DexFile@41cd2ba0 dex file "dalvik.system.DexFile@41cd2ba0"
What should I do next?