I have been trying to reverse-engineer an Android application using Jadx for static analysis and Frida for dynamic analysis. The end goal is to be able to re-create the request signature, sent as a "x-signature" header, to replicate the API requests programmatically.
I am trying to figure out how a function, given an app key and a HashMap of request parameters as input, manages to output the signature "ab21c1009004ad4c88477eef2340998bb6f8c774732e1e9e03".
This hexadecimal string is of length 50 so, since a hexadecimal represents four bits, it means the hashing algorithm that generates it must create 200 bits (right?). However, according to https://en.wikipedia.org/wiki/List_of_hash_functions, there is none, and especially not the most well-known ones, such as SHA1, SHA-256 or MD5, that the code seems to be using very often, especially MD5.
What am I missing please? I don't know much about truncating and folding but I believe it's unlikely to be the issue here, since I've spent a lot of time getting familiar with the source code and nowhere has one of these techniques appeared, unless hidden in a common library's method.