我一直在对 Yikyak 应用程序进行逆向工程,我遇到了这个功能
使用一个特定的函数来验证 API 调用的完整性。反编译器无法弄清楚字节码发生了什么(下面提供),所以我写了我认为等效的字节码(这是我第一次使用 Java 字节码,我对任何错误表示歉意)。
我坚持的一件事是弄清楚如何确定常量池中引用的值。
/* Error */
/* public static String a(String paramString, byte[] paramArrayOfByte)
* Generates a hash to verify the integrity of the API call based on the time (param1 as String) and YikYak.uniqueMD5Hash.getBytes()
*/
public static String hashApiCall(String paramString, byte[] paramArrayOfByte)
{
// Possible values for hash algo: HmacMD5, HmacSHA1, HmacSHA256, HmacSHA384, HmacSHA512
SecretKeySpec localSecretKeySpec = new SecretKeySpec(paramArrayOfByte, (String hash algo)ldc 179);
Mac localMac = Mac.getInstance((String hash aglo)ldc 179);
localMac.init(localSecretKeySpec);
localMac.doFinal(byte[] ?);
String str2 = Base64.encodeToString(?);
String str3 = str2.trim();
return str3;
// Byte code:
// 0: new 177 javax/crypto/spec/SecretKeySpec
// 3: dup
// 4: aload_1
// 5: ldc 179
// 7: invokespecial 182 javax/crypto/spec/SecretKeySpec:<init> ([BLjava/lang/String;)V
// 10: astore_2
// 11: ldc 179
// 13: invokestatic 188 javax/crypto/Mac:getInstance (Ljava/lang/String;)Ljavax/crypto/Mac;
// 16: astore 8
// 18: aload 8
// 20: aload_2
// 21: invokevirtual 192 javax/crypto/Mac:init (Ljava/security/Key;)V
// 24: aload 8
// 26: aload_0
// 27: invokevirtual 136 java/lang/String:getBytes ()[B
// 30: invokevirtual 196 javax/crypto/Mac:doFinal ([B)[B
// 33: iconst_0
// 34: invokestatic 202 android/util/Base64:encodeToString ([BI)Ljava/lang/String;
// 37: astore 9
// 39: aload 9
// 41: invokevirtual 205 java/lang/String:trim ()Ljava/lang/String;
// 44: astore 12
// 46: aload 12
// 48: astore 4
// 50: aload 4
// 52: areturn
// 53: astore 6
// 55: aconst_null
// 56: astore 4
// 58: aload 6
// 60: astore 7
// 62: aload 7
// 64: invokevirtual 208 java/security/NoSuchAlgorithmException:printStackTrace ()V
// 67: goto -17 -> 50
// 70: astore_3
// 71: aconst_null
// 72: astore 4
// 74: aload_3
// 75: astore 5
// 77: aload 5
// 79: invokevirtual 209 java/security/InvalidKeyException:printStackTrace ()V
// 82: goto -32 -> 50
// 85: astore 11
// 87: aload 9
// 89: astore 4
// 91: aload 11
// 93: astore 5
// 95: goto -18 -> 77
// 98: astore 10
// 100: aload 9
// 102: astore 4
// 104: aload 10
// 106: astore 7
// 108: goto -46 -> 62
// Local variable table:
// start length slot name signature
// 0 111 0 paramString String
// 0 111 1 paramArrayOfByte byte[]
// 10 11 2 localSecretKeySpec javax.crypto.spec.SecretKeySpec
// 70 5 3 localInvalidKeyException1 java.security.InvalidKeyException
// 48 55 4 str1 String
// 75 19 5 localObject1 Object
// 53 6 6 localNoSuchAlgorithmException1 java.security.NoSuchAlgorithmException
// 60 47 7 localObject2 Object
// 16 9 8 localMac javax.crypto.Mac
// 37 64 9 str2 String
// 98 7 10 localNoSuchAlgorithmException2 java.security.NoSuchAlgorithmException
// 85 7 11 localInvalidKeyException2 java.security.InvalidKeyException
// 44 3 12 str3 String
// Exception table:
// from to target type
// 11 39 53 java/security/NoSuchAlgorithmException
// 11 39 70 java/security/InvalidKeyException
// 39 46 85 java/security/InvalidKeyException
// 39 46 98 java/security/NoSuchAlgorithmException
}
有没有办法确定常量池中的值(特别是 179)以确定正在使用的散列算法?
提前致谢!