How to calculate the digest / Which algorithm will be used? - c++

Question

I've found an C++ API there was called from Java JNI. The libcma.so contains the method Java_com_smule_android_network_core_NetworkUtils_makeDigest which will create an Digest - I Think it's MD5.
Here is the reversed source:
https://raw.githubusercontent.com/Bizarrus/Sing/master/cma.cpp
And here is the JNI definition:
https://github.com/Bizarrus/Sing/blob/7ef0e748bae710bde2d07111bd66f1e7fc0810b4/com/smule/android/network/core/NetworkUtils.java#L53
Can anyone tell me, which Algorithm will be used?
Edit
Following HTTP-Request will be made:
POST http://api-sing.smule.com/v2/login/guest?msgId=1776&appVersion=5.7.5&app=sing_google&appVariant=1&digest=179645edb702ce4a57197141522d848145f8861f HTTP/1.1
User-Agent: com.smule.singandroid/5.7.5 (6.0,F3311,de_DE)
Content-Type: application/json; charset=UTF-8
Content-Length: 501
Host: api-sing.smule.com
Connection: Keep-Alive
Accept-Encoding: gzip
{
"common": {
"advId": "e133b6d9-25b1-4651-b4b8-94d80fa25ed9",
"automaticLogin": true,
"device": {
"carrierCountry": "de",
"country": "DE",
"deviceId": "a:e133b6d9-25b1-4651-b4b8-94d80fa25ed9",
"deviceType": "AND",
"googlePlayServices": "12.6.85 (040306-197041431)",
"hasMail": true,
"lang": "de",
"limitAdTrack": false,
"locale": "de_DE",
"machine": "F3311",
"manufacturer": "Sony",
"os": "6.0",
"product": "F3311",
"screenSize": "normal",
"script": ""
},
"pulp": 17,
"tzOffset": 3600,
"vorgom": true
},
"forceNewPlayer": true,
"lookupAccount": true
}
with following Response:
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Sun, 24 Jun 2018 16:27:31 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
X-Smule-Host: a155.sf.smle.co
X-Smule-Digest: 64dc15893bbf43240798c73ae652bfb80e848f57
Set-Cookie: L=N; Max-Age=172800; Expires=Tue, 26 Jun 2018 16:27:31 GMT; Path=/; Domain=.smule.com; Secure
Cache-Control: no-cache
Content-Encoding: gzip
{
"data": {
"loginResult": {
"elControl": {
"npt": false
},
"handleNew": false,
"handlePrefill": true,
"language": "de",
"loginCount": 1,
"playerId": 1762444898,
"playerNew": true,
"playerNewlyRegistered": false,
"playerStat": {
"installDate": 1529857651000
},
"policyUrl": "https://www.smule.com/privacy/embed/20180523",
"policyVersion": "PRIVACY_POLICY_20180523",
"serverTime": 1529857651,
"sessionToken": "g4_10_wma5HOX13kDeho2gvEuIQyf5EnUaAp0Uw3C24O5w9s9xUB1U0JOC0w==",
"sessionTtl": 86400,
"showEmailOpt": true,
"termUrl": "https://www.smule.com/termsofservice/embed/20180523"
},
"settings": {}
},
"status": {
"code": 0,
"message": "ok",
"version": 1
}
}
On the POST request, the Query-Argument **digestis theHashof the request. TheseDigestwill be created byJava_com_smule_android_network_core_NetworkUtils_makeDigest(i think). I don't know, which data will be used for theHashing-Algorithm- I've tried to reproduce theDigest` with following parameters:
Only all Query-Parameters, sorted alphabetically, exclude the digest-Argument (These method will be used on the Website under JavaScript`
Only the Content-Body, in JSON-String (tried as pretty-printed and comprimized)
Content-Body and Query-Parameters expected as above
I've tried some combinations of data to reproduce the digest, but i've found no solutions, which data reprensent the original digest.
From the Response on the X-Smule-Digest header will be hashed by MD5, that i had reproducted last week. Here (in PHP) a working sample to calculate the X-Smule-Digest:
$string = sprintf('%s=%s', 'secret', 'M=|ZUyMu^-qWb}VL^jJd}Mv)8y%bQWXf>IFBDcJ>%4zg2Ci|telj`dVZ#');
$string .= sprintf('&%s=%s', 'path', '/user/json/login'); // sample url-path
$string .= sprintf('&%s=%s', 'csrf', $this->csrf); // from Website, <meta content="([^"]+)" name="csrf-token" or from Header "x-csrf-token"
$string .= sprintf('&%s', http_build_query($this->data)); // POST-Body
$array = explode('&', $string);
sort($array); // Alphabetical sort
$x_smule_digest = md5(implode('&', $array));

Answer 1

1 . The digest you indicate is 40 characters long, and contains numbers from 0 to 9 and letters from a to f. So it is 40 hex values. So it is most probably created using SHA-1 digest function.
2 . The C++ function you indicate has the following signature :
int32_t Java_com_smule_android_network_core_NetworkUtils_makeDigest(int32_t * a1, int32_t a2, int32_t a3)
And the corresponding signature in the Java source code is :
private static native String makeDigest(String str, byte[] bArr);
The first argument a1 may be a pointer reserved by the JNI environment. So, input a1 input set aside, the function takes two arguments : a string and an array of byte, and return one string : the digest. The C++ code itself is too complex for me to dig in.
3 . This JNI function is used twice in the Java file you indicate. In functions m18107a and m18106a. Let's add some comments to the source code :
// Function that takes three arguments :
// - a list of pairs of string we will call the "json pairs"
// - a string we will call the "secret"
// - an other string we will call the "optional token"
// and return the returned string of makeDigest which may be the digest.
public static String m18107a(List<Pair<String, String>> list, String str, String str2)
{
// Sort the json pairs alphabetically according to the first string of each pairs.
// (Check the source code of C35442 to verify my statement, I may be wrong )
Collections.sort(list, new C35442());
// Create a single string, that concatenate all the json pairs.
// ( I guess { age : 21, name : "bob" } becomes "age21namebob" )
// We will call that the "digest input"
StringBuilder stringBuilder = new StringBuilder();
for (Pair pair : list) {
stringBuilder.append((String) pair.first).append((String) pair.second);
}
// Append the "digest input" just created with the "optional token" if it exists.
if (str2 != null) {
stringBuilder.append(str2);
}
// Send the "secret" string, and the "digest input" as BYTES (may be important)
// Return the digest computed as returned string of the function.
return makeDigest(str, stringBuilder.toString().getBytes());
}
// Function that takes four arguments :
// - a string str
// - a number j
// - a string str2
// - a string str3 (can be null, as seen later)
// and return the returned string of makeDigest which may be the digest.
public static String m18106a(String str, long j, String str2, String str3)
{
// Create a single string, that concatenate j and str2.
// We will call that the "digest input"
StringBuilder append = new StringBuilder().append("").append(j).append(str2);
// If str3 is null, make it empty.
if (str3 == null) {
str3 = "";
}
// Send the "secret" string, and the "digest input" concatenated with str3, as BYTES (may be important).
// Return the digest computed as returned string of the function.
return makeDigest(str, append.append(str3).toString().getBytes());
}
It will be hard to go further. Try to dig few things :
Where are these functions m18107a and m18106a called ? Can you at least find what are the inputs of these ? So you can play with the good inputs.
Can you put breakpoints around these functions ? To track inputs and outputs and try to reproduce ?
From all the suspected inputs, can you find a way to modify only one per one and check if the digest changes ? To eliminate suspected inputs.