Aes-128 encryption method

[Aljoberg]

I made a python tool that checks for certain keywords in all three classes.dex file and found quite a bit of stuff, including a string that says something about AES-128 encryption method, so now we know what to focus on.

[Aljoberg]

I've inspected the source code and found some interesting stuff, and I'm very close to finding the key. Wish me good luck!

[Noobgamer0111]

Sounds great, keep at it.

[Aljoberg]

Ive found where things are located (like where it decrypts, where it inputs and things) but i need to connect all those functions now. Should probably be done tomorrow, we'll see lol

[Aljoberg]

Okay, I think I've found an AES-256 key, but I'm not sure if that only unlocks another key or is that it .. I'll search more.
The key is C38FB23A402222A0C17D34A92F971D1F.
For now, we know that it's AES and that the key is in the code somewhere, possibly decrypted by base64 and that there's probably multiple decryptions / encryptions
Also, the "Ieg/Y21" is possibly a specific character encrypted (like { for starting the json object)
And also, the key i provided above might just be an encrypted hex .. you never know.

[Noobgamer0111]

Yeah I tried the key using an online decrypter, you might want to look for an initialisation vector (IV) as well.

[Aljoberg]

Mhm, that's visible there as well. I'll try to look into the JSON objects (yes, we are decrypting an JSON object) to see if they're correct, and I'll look into the initialization vector as well 👍

[Aljoberg]

Okay, that key IS THE KEY indeed since the code passes it to the Cipher (which decrypts it) at multiple places, but it's still bad decrypt. The string is probably faulty (the JSON object that we're decrypting is taken from a GET request) but i cannot get all the methods lined up since it always reports "unused" at the end. Will try to dig in further!

[Aljoberg]

Also, SUMMARY for all of you:
(note that I used a gradle project convert tool so some files may not be named the same)
IronSourceAES.java decrypts / encrypts the aes things. The methods are used in a lot of files, mostly C1515h.java.
The first argument of the decrypt method is the key, which is the key i provided above in most cases (also seems to be in hex, not sure) except for one occurence where it can also generate a random set of characters.
The second argument is the JSONObject as a string, which is from the GET request from an url which i cannot get access to.
There's also some RSA things, the key seems to be the random string i explained about above and I've also got the public key, but that doesn't seem to be working anyway.
The thing now is, IN THE CODE it "decrypts" the string using the key I provided above, but it doesn't work when I literally copy paste the same code inside my app. Weird
I can also share the gradle project if anyone wants
Edit: checked the old version without encrypting, the aes things are still there, so this may not be the thing. although, classes3.dex arent there as well so maybe its something there..

[Noobgamer0111]

Any luck so far?

[arhi998]

Dang bro I wish y'all the best of luck! I have no idea what's going on but I'm here to see it happen lol.

[Aljoberg]

I don't really know what to do anymore ..
Have you two got something that checks two folders' files and compare them to the other folder?
So I can get the differences made in the older and newer versions
Otherwise, I don't really know what to do .. but I guess comparing the two versions (one without the encryption and one with it) would get me to something

[Noobgamer0111]

@Aljoberg I seem to have deleted my old unencrypted save files (but I'm sure someone has some lying around), however, I think it'll be good if you added your Gradle project.

[Aljoberg]

Great! I can get the unencrypted APK from uptodown, and then decompile it if I wanted
But sure, I'll share the Gradle project as soon as possible

[Aljoberg]

Hey yall, sorry for taking so long but school's been hard
So I figured out that I was only decrypting the dex files, and left the .so files alone but they seem to reveal some info. The most info I've found tho is in assets/bin/Data/Managed/Metadata/global-metadata.dat
It seems to include things like promo codes, "wallet.json" keywords, but it's kind of unreadable .. I'll try to decode it and hopefully figure something out.

[Noobgamer0111]

Keep going, you're doing great.

[Aljoberg]

Maybe the key is "b77a5c561934e089" too, no idea. Now we just have to find the data to be decrypted (it can be anything, base64 encoded maybe, without the y21 part, we never know ...) will try to make it debuggable

[Aljoberg]

Okay, i clicked on this after a long time, and we probably need to decrypt the .so files (csharp i think since this was made in unity and unity uses cs for coding) because there's the only place where I've found "wallet.json" and also metadata.dat file. I'll try my best :)

[Onizuka893]

Hello, if you need any help with the CS hit me up. So far I tried to reverse engineer the APK and II2cpp but haven't had any luck. But I have found the class where the profile encryption takes place. But I think as you mentioned the app needs to be in a debuggable state to be able to see how and when the key gets generated and where it saves it. Good Luck!