Awesome work! How did you extract that logic from the apk?

[yhazrati]

I found it very interesting, so I tried to do it myself (i'm a developer so all this research thing is kind of new to me)
I managed to find the getToken function in the apk using JADX, and I saw it uses the FaceDetectNative.getFacialLandmarks from the native .so file.
I opened it using Ghidra to decompile the compiled code - and it looks totally Gibberish to me, I'm curious to know how did you understand and re-write it in python.
Thanks a lot

[DonutByte]

Hi,
I have basically used IDA (similar to Ghidra) and Frida for dynamic analysis, through a lot of trial and error, and help from ChatGPT to re-write the logic in Python.

Hopefully I can write a more detailed write-up this weekend (though it would assume basic knowledge of the tools I have used)

As to your journey, I can try to help you but you need to provide more specific information. Where are you stuck? What are you trying to find in said function/place?

I opened it using Ghidra to decompile the compiled code - and it looks totally Gibberish to me

What looks gibberish? Which function? Is it the Assembly or decompiled code? Specific instructions or the general flow?

Good luck!

[yhazrati]

Thank you for your answer!
Basically i'm trying to understand how could I do it myself if I wanted to, actually I did try to do it but then I came accross your repo and you solved my problem (:

The decompiled code is too hard for me to understand, perhaps IDA is better than Ghidra in that case, I'll give that a try.
I see 3 main functions: getFacialLandmarks (the main function), which calls aes_enc_dec and setCustomArray.
The functions use some constants like T_C_KEY, sbox, rsbox and Rcon - which you also reverse engineered their values, how did you know the length of them? did you assume a basic/normal AES encryption?

Hopefully I can write a more detailed write-up this weekend (though it would assume basic knowledge of the tools I have used)

I will really appreciate this.

[DonutByte]

I wasn't able to finish writing this weekend, hopefully I can publish it in the next one.

The decompiled code is too hard for me to understand

You'll see that I haven't needed to understand most of it myself 😅 (without spoiling the details - Frida is your friend)

did you assume a basic/normal AES encryption?

Yes. Then I have verified that it's really the case.

[DonutByte]

Here's my write-up: https://github.com/DonutByte/pylgate/wiki/Reverse-Engineering-PalGate-Token-Generation

Hope it helps 😃

[yhazrati]

Thank you, appreciate it!