I have an Android app for which I need to mock an API call outside of that environment. I successfully killed the certificate pinning on this app with Frida in order to access the URL and more, but now I face another obstacle.
The information on the POST request is encrypted or hashed with something in the client, I just don’t know what is it.
This is the view (it's in Spanish so I leaved the text as it is in order to search through its labels):
This is how the POST request looks when its sent from the app when I enter an amount to send (think of it as app currency) to another peer registered in this same app. So I suppose it's encrypting the contact data and the amount:
{
“content”: “a1b80843068b4ba6e99eb13e165e907695884416c2365a713d3805c1a1b62f45ad13b623b04a93aac19daf5d9280f6b0d0ab96fcce312fefc7f1e53ec3705917b2f5dbb867030006de295053bfc1c8efad9d255aa05a21be4f3da1b4eb3d0448d215e4f47cad89a1d91a3e255fcb5d9f6d3418d33c91e7d3e91404b9a4d8596fe80bffb31509a22958070893eef18a088764155d3a”,
“tag”: “1beede6ca014d893e234a1ff6d1dc317”,
“iv”: “e5391ed0df5cd71b3472d93b”
}
I managed to found the smali code where this is done by searching the JSON labels, I used jadx-gui for this, here is the apk used (is an app bundle so I only included the base.apk), it can be opened with jadx-gui:
https://www.mediafire.com/file/myzjnoim974x107/base.apk/file
Here it is the decompiler jadx version of it:
https://www.mediafire.com/file/3gupjge3l2h0hpb/decompiled-with-jadx.zip/file
And this is the Google Play Store link:
https://play.google.com/store/apps/datasafety?id=cl.bci.sismo.mach&hl=en&gl=UK
As I’m reading through this code (at sources\p427p7\MessageEncryptedModel.java) I can see that is converting the strings into this encrypted format, but I don’t understand how when looking at the package imported, which is being used for this:
package p427p7;
import com.google.gson.annotations.Expose;
import com.google.gson.annotations.SerializedName;
import ia0.C8465k;
/* renamed from: p7.a */
/* loaded from: classes.dex */
public final class MessageEncryptedModel {
@SerializedName("content")
@Expose
/* renamed from: a */
private String f36230a;
@SerializedName("tag")
@Expose
/* renamed from: b */
private String f36231b;
@SerializedName("iv")
@Expose
/* renamed from: c */
private String f36232c;
public MessageEncryptedModel(String str, String str2, String str3) {
C8465k.m23334f(str, "content");
C8465k.m23334f(str2, "tag");
C8465k.m23334f(str3, "iv");
this.f36230a = str;
this.f36231b = str2;
this.f36232c = str3;
}
/* renamed from: a */
public final String m11426a() {
return this.f36230a;
}
/* renamed from: b */
public final String m11425b() {
return this.f36232c;
}
/* renamed from: c */
public final String m11424c() {
return this.f36231b;
}
}
Does anyone have an idea of how this JSON data is being encrypted before being sent? I have tried to understand through the package code by replicating it but I can't find a hardcoded key
Cipher.init(opmode, key)
and other cryptographic calls to get the used secret key, assuming the app uses the standard Java crypto implementations.com.google.gson.JsonSerializer
, if the class names aren't obfuscated it should be easy to find.ia0.C8465k.m23334f()
? .. it looks like this is doing the string conversion.