0

I have been trying to reverse-engineer an Android application using Jadx for static analysis and Frida for dynamic analysis. The end goal is to be able to re-create the request signature, sent as a "x-signature" header, to replicate the API requests programmatically.

I am trying to figure out how a function, given an app key and a HashMap of request parameters as input, manages to output the signature "ab21c1009004ad4c88477eef2340998bb6f8c774732e1e9e03".

This hexadecimal string is of length 50 so, since a hexadecimal represents four bits, it means the hashing algorithm that generates it must create 200 bits (right?). However, according to https://en.wikipedia.org/wiki/List_of_hash_functions, there is none, and especially not the most well-known ones, such as SHA1, SHA-256 or MD5, that the code seems to be using very often, especially MD5.

What am I missing please? I don't know much about truncating and folding but I believe it's unlikely to be the issue here, since I've spent a lot of time getting familiar with the source code and nowhere has one of these techniques appeared, unless hidden in a common library's method.

Improve this question
8
  • May be you don't need to recreate the algorithm. Have you tried to process the Apk via dex2jar and then check the jar file. May be you can directly use the generated class file in a custom Java application? You can use Frida to hook the hash generation method and collect input/output samples to verify if the converted algorithm in the class file outputs the same.
    – Robert
    May 6, 2020 at 9:03
  • If the dex2jar does not work I would use Frida Python binding (use Frida from within Python) to create a "hashing service" that uses the original app. in a Frida script define a Frida rpc method that sends the input data to the original method in the app. From within Python you could then directly use the original algorithm on a device/emulator. If you need the data in a different language Python could expose this service via Flask as HTTP rest service on your PC.
    – Robert
    May 6, 2020 at 9:22
  • Thank you so much for your response! The first point you make would be the best solution indeed but, after a full week of investigating, I have been unable to find the right class with Jadx (an alternative to dex2jar). It seems like it's not in the source code. I've also encountered "antidex2jar" classes that are used as protection apparently. Your second point is a really interesting approach I have been thinking about. It's the last resort because it would still require running an emulator all the time. If I can reproduce the algorithm in my javascript application, that'd be optimal :)
    – Kévin
    May 6, 2020 at 9:46
  • Actually I just realized what you meant when you talked about exporting the function with the rpc method. It wouldn't require running an emulator at all. That's something worth considering I'll check this out thanks! :)
    – Kévin
    May 6, 2020 at 9:56
  • If the has algorithm requires only a few classes you could also decompile the app using apktool, then remove all classes you don't need (especially those with antidex2jar code), recompile it via apktool and then try dex2jar.
    – Robert
    May 6, 2020 at 10:20

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.