functionretrieveencryptedKey() {var keyInput =document.getElementById("encryptedKey");var encryptedKey =keygen();keyInput.value = encryptedKey;document.getElementById("message").innerText ="Please use your standalone decryption device to complete the recovery!";document.getElementById("message").style.color ="blue";}
It looks something like this (the UI and encrypted format changed a bit but I cba booting android-studio in my VM lol).
But that's no use, we want the decrypted key! Lets check the keygen() function.
Ewww.. obfuscation 🤮 There's a lot of approaches here. You might try to manually reverse, or throw it into some de-obfuscation tool 🤔
You could also paste it into the console, then just run keygen(). It will give us abf6c8abb5daabc8ab69d7846def17b19c6dae843a6dd7e1b1173ae16db184e0b86dd7c5843ae8dee15f again, but with some breakpoints you can trace through the logic.
Maybe you focus on values you can see in the original code, e.g. what is 9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5 when unhexed? Unfortunately, not plaintext!
Much better! I'll also ask ChatGPT to further deobfuscate, including variable renaming, comments etc.
// Function to perform Affine encryption on a single bytefunctionaffineEncrypt(inputByte, multiplier, increment) {return (multiplier * inputByte + increment) %256;}functionxor(byte1, byte2) {return byte1 ^ byte2;}functionhexToBytes(hexString) {let byteArray = [];// Loop through the hex string, two characters at a timefor (let i =0; i <hexString.length; i +=2) {// Convert each pair of hex characters to a byte and add to the arraybyteArray.push(parseInt(hexString.substr(i,2),16)); }return byteArray;}functionreverseString(str) {returnstr.split("").reverse().join("");}functionkeygen() {// Split the long hex string into six partslet parts = ["9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(0,14),"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(14,28),"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(28,42),"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(42,56),"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(56,70),"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(70,84), ];// Reorder parts and join them into a single stringlet reordered = [parts[3], parts[5], parts[1], parts[4], parts[2], parts[0]].join("");// Reverse the string and convert it to byteslet byteArray =hexToBytes(reverseString(reordered));// Apply affine transformation and XOR to each bytelet transformedArray =byteArray.map((byte) => (9* byte +7) %256^0x33);// Convert the transformed bytes back to a hex stringreturntransformedArray.map((byte) => ("0"+byte.toString(16)).slice(-2)).join("");}
We can paste that into the devtools console and print out each step.
functionkeygen() {// Split the long hex string into six partslet parts = ["9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(0,14),"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(14,28),"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(28,42),"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(42,56),"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(56,70),"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(70,84), ];// Reorder parts and join them into a single stringlet reordered = [parts[3], parts[5], parts[1], parts[4], parts[2], parts[0]].join("");console.log("Reordered hex string:", reordered);// Convert reordered and reversed hex string to byteslet byteArray =hexToBytes(reverseString(reordered));console.log("Byte array (ASCII):",byteArray.map((byte) =>String.fromCharCode(byte)).join(""));// Apply affine transformation and XOR to each bytelet transformedArray =byteArray.map((byte) => (9* byte +7) %256^0x33);console.log("Transformed byte array (ASCII):",transformedArray.map((byte) =>String.fromCharCode(byte)).join(""));// Return the transformed bytes as a hex stringreturntransformedArray.map((byte) => ("0"+byte.toString(16)).slice(-2)).join("");}// Call the keygen functionkeygen();
