Android packageInfo signature

Question

Are there anyways I can learn what packageInfo.signatures[0] is so I can use it to apply the same algorithm in Python.

To further explain:

    private static SecretKeySpec a(Context context) {
        try {
            PackageInfo packageInfo = context.getPackageManager().getPackageInfo(context.getPackageName(), 64);
            if (!(packageInfo == null || packageInfo.signatures == null || packageInfo.signatures.length <= 0)) {
                return new SecretKeySpec(Arrays.copyOf(packageInfo.signatures[0].toByteArray(), 16), "AES");
            }
        } catch (NameNotFoundException e2) {
            ThrowableExtension.a(e2);
        }
        return null;
    }

This android app is sending some sort of a key that is changing based on timestamp with every request it is sending. And it is using the above code for creating a SecretKeySpec which then gets used in below.

    @NonNull
    private synchronized String d(String str) {
        byte[] digest;
        try {
            byte[] bytes = str.getBytes("UTF-8");
>>>>>>>     this.r.init(2, this.l);
            byte[] doFinal = this.r.doFinal(this.k);
            byte[] a2 = Bytes.a(doFinal, this.j, bytes, doFinal, this.n.a().getBytes("UTF-8"));
            digest = this.q.digest(a2);
            Arrays.fill(a2, 0);
            Arrays.fill(doFinal, 0);
        } catch (Exception e2) {
            throw new RuntimeException(e2);
        }
        return jl.a(digest);
    }

So, I know that the function argument str is for some reason currentTimeMillis * 1151 which gets used in byte[] a2 = ... line then gets hashed with sha1 there comes the time based changing part. What I can't find is what signatures[0] is in this context and how can I achieve it, in the construction of the class, this.l is assigned with SecretKeySpec ( signature[0] ). this.r is an AES Cipher. From the readings I made, I think the "2" in init(2, this.l) means decode mode.

And Can you please explain to me what is the effect of filling a2 and doFinal variables with 0(zeroes) in this context as it doesn't get used anywhere else.

Answer 1

In this instance, packageInfo.signatures is the first signature that you find in the APK. Meaning, this is the first signature file that the Android system has read from the META-INF/ folder inside the APK.

Basically, what you'll need to do is unzip the APK, look inside the META-INF/ and grab whatever file has the extension .RSA (unlikely, but it could be .DSA). This essentially what the packageInfo.signatures[0] is returning, with the .toByteArray() making a ByteArray object of the data.

If you have any doubts, or are having issues further, I'd sugged using Frida to hook this function call and watch what is actually returned.