2

I have an Android app for which I need to mock an API call outside of that environment. I successfully killed the certificate pinning on this app with Frida in order to access the URL and more, but now I face another obstacle.

The information on the POST request is encrypted or hashed with something in the client, I just don’t know what is it.

This is the view (it's in Spanish so I leaved the text as it is in order to search through its labels):

This is how the POST request looks when its sent from the app when I enter an amount to send (think of it as app currency) to another peer registered in this same app. So I suppose it's encrypting the contact data and the amount:

{
  “content”: “a1b80843068b4ba6e99eb13e165e907695884416c2365a713d3805c1a1b62f45ad13b623b04a93aac19daf5d9280f6b0d0ab96fcce312fefc7f1e53ec3705917b2f5dbb867030006de295053bfc1c8efad9d255aa05a21be4f3da1b4eb3d0448d215e4f47cad89a1d91a3e255fcb5d9f6d3418d33c91e7d3e91404b9a4d8596fe80bffb31509a22958070893eef18a088764155d3a”,
    
      “tag”: “1beede6ca014d893e234a1ff6d1dc317”,
    
      “iv”: “e5391ed0df5cd71b3472d93b”
}

I managed to found the smali code where this is done by searching the JSON labels, I used jadx-gui for this, here is the apk used (is an app bundle so I only included the base.apk), it can be opened with jadx-gui:

https://www.mediafire.com/file/myzjnoim974x107/base.apk/file

Here it is the decompiler jadx version of it:

https://www.mediafire.com/file/3gupjge3l2h0hpb/decompiled-with-jadx.zip/file

And this is the Google Play Store link:

https://play.google.com/store/apps/datasafety?id=cl.bci.sismo.mach&hl=en&gl=UK

As I’m reading through this code (at sources\p427p7\MessageEncryptedModel.java) I can see that is converting the strings into this encrypted format, but I don’t understand how when looking at the package imported, which is being used for this:

package p427p7;

import com.google.gson.annotations.Expose;
import com.google.gson.annotations.SerializedName;
import ia0.C8465k;

/* renamed from: p7.a */
/* loaded from: classes.dex */
public final class MessageEncryptedModel {
    @SerializedName("content")
    @Expose

    /* renamed from: a */
    private String f36230a;
    @SerializedName("tag")
    @Expose

    /* renamed from: b */
    private String f36231b;
    @SerializedName("iv")
    @Expose

    /* renamed from: c */
    private String f36232c;

    public MessageEncryptedModel(String str, String str2, String str3) {
        C8465k.m23334f(str, "content");
        C8465k.m23334f(str2, "tag");
        C8465k.m23334f(str3, "iv");
        this.f36230a = str;
        this.f36231b = str2;
        this.f36232c = str3;
    }

    /* renamed from: a */
    public final String m11426a() {
        return this.f36230a;
    }

    /* renamed from: b */
    public final String m11425b() {
        return this.f36232c;
    }

    /* renamed from: c */
    public final String m11424c() {
        return this.f36231b;
    }
}

Does anyone have an idea of how this JSON data is being encrypted before being sent? I have tried to understand through the package code by replicating it but I can't find a hardcoded key

4
  • You already got a lot of information by static analysis. May be it is time to switch over to a dynamic analysis (if possible)? Using frida.re you could try to hook Cipher.init(opmode, key) and other cryptographic calls to get the used secret key, assuming the app uses the standard Java crypto implementations.
    – Robert
    Commented Jun 27, 2022 at 10:16
  • Yes, I forgot to mention that I already tried that with the standard crypto implementations, and it only uses them for accessing the app. For the send which is what I'm looking for I can't find what is it.
    – Miguel
    Commented Jun 27, 2022 at 18:55
  • I don't know of a solution which automatically encrypts something by just serializing it. As the annotations belong to GSON I would assume a custom serializer is used. For Gson this should be a class that extends com.google.gson.JsonSerializer, if the class names aren't obfuscated it should be easy to find.
    – Robert
    Commented Jun 28, 2022 at 7:03
  • Have you looked at the code for ia0.C8465k.m23334f() ? .. it looks like this is doing the string conversion. Commented Jul 1, 2022 at 12:11

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.