function retrieveencryptedKey() {
var keyInput = document.getElementById("encryptedKey");
var encryptedKey = keygen();
keyInput.value = encryptedKey;
document.getElementById("message").innerText = "Please use your standalone decryption device to complete the recovery!";
document.getElementById("message").style.color = "blue";
}
It looks something like this (the UI and encrypted format changed a bit but I cba booting android-studio in my VM lol).
But that's no use, we want the decrypted key! Lets check the keygen() function.
Ewww.. obfuscation 🤮 There's a lot of approaches here. You might try to manually reverse, or throw it into some de-obfuscation tool 🤔
You could also paste it into the console, then just run keygen(). It will give us abf6c8abb5daabc8ab69d7846def17b19c6dae843a6dd7e1b1173ae16db184e0b86dd7c5843ae8dee15f again, but with some breakpoints you can trace through the logic.
Maybe you focus on values you can see in the original code, e.g. what is 9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5 when unhexed? Unfortunately, not plaintext!
function affineEncrypt(_0x1930bc, _0x36e79b, _0x33477e) {
return (_0x36e79b * _0x1930bc + _0x33477e) % 0x100;
}
function xor(_0x3a38fa, _0x3c3309) {
return _0x3a38fa ^ _0x3c3309;
}
function hexToBytes(_0x1d9eb0) {
let _0x2ac99a = [];
for (let _0x2363dc = 0x0; _0x2363dc < _0x1d9eb0.length; _0x2363dc += 0x2) {
_0x2ac99a.push(parseInt(_0x1d9eb0.substr(_0x2363dc, 0x2), 0x10));
}
return _0x2ac99a;
}
function reverseString(_0x22dcba) {
return _0x22dcba.split("").reverse().join("");
}
function keygen() {
let _0x19eb60 = [
"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(0x0, 0xe),
"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(0xe, 0x1c),
"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(0x1c, 0x2a),
"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(0x2a, 0x38),
"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(0x38, 0x46),
"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(0x46, 0x54),
];
let _0x4c2f5e = [_0x19eb60[0x3], _0x19eb60[0x5], _0x19eb60[0x1], _0x19eb60[0x4], _0x19eb60[0x2], _0x19eb60[0x0]];
let _0x22e526 = _0x4c2f5e.join("").split("").reverse().join("");
let _0x2051e9 = hexToBytes(_0x22e526);
let _0x351569 = _0x2051e9.map((_0x585a6f) => (0x9 * _0x585a6f + 0x7) % 0x100 ^ 0x33);
return _0x351569.map((_0x5ca89b) => ("0" + _0x5ca89b.toString(0x10)).slice(-0x2)).join("");
}
Much better! I'll also ask ChatGPT to further deobfuscate, including variable renaming, comments etc.
// Function to perform Affine encryption on a single byte
function affineEncrypt(inputByte, multiplier, increment) {
return (multiplier * inputByte + increment) % 256;
}
function xor(byte1, byte2) {
return byte1 ^ byte2;
}
function hexToBytes(hexString) {
let byteArray = [];
// Loop through the hex string, two characters at a time
for (let i = 0; i < hexString.length; i += 2) {
// Convert each pair of hex characters to a byte and add to the array
byteArray.push(parseInt(hexString.substr(i, 2), 16));
}
return byteArray;
}
function reverseString(str) {
return str.split("").reverse().join("");
}
function keygen() {
// Split the long hex string into six parts
let parts = [
"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(0, 14),
"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(14, 28),
"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(28, 42),
"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(42, 56),
"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(56, 70),
"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(70, 84),
];
// Reorder parts and join them into a single string
let reordered = [parts[3], parts[5], parts[1], parts[4], parts[2], parts[0]].join("");
// Reverse the string and convert it to bytes
let byteArray = hexToBytes(reverseString(reordered));
// Apply affine transformation and XOR to each byte
let transformedArray = byteArray.map((byte) => (9 * byte + 7) % 256 ^ 0x33);
// Convert the transformed bytes back to a hex string
return transformedArray.map((byte) => ("0" + byte.toString(16)).slice(-2)).join("");
}
We can paste that into the devtools console and print out each step.
function keygen() {
// Split the long hex string into six parts
let parts = [
"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(0, 14),
"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(14, 28),
"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(28, 42),
"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(42, 56),
"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(56, 70),
"9425749445e494332757363353f5d6f50353b79445d7336343270373270366f586365753f546c60336f5".slice(70, 84),
];
// Reorder parts and join them into a single string
let reordered = [parts[3], parts[5], parts[1], parts[4], parts[2], parts[0]].join("");
console.log("Reordered hex string:", reordered);
// Convert reordered and reversed hex string to bytes
let byteArray = hexToBytes(reverseString(reordered));
console.log("Byte array (ASCII):", byteArray.map((byte) => String.fromCharCode(byte)).join(""));
// Apply affine transformation and XOR to each byte
let transformedArray = byteArray.map((byte) => (9 * byte + 7) % 256 ^ 0x33);
console.log("Transformed byte array (ASCII):", transformedArray.map((byte) => String.fromCharCode(byte)).join(""));
// Return the transformed bytes as a hex string
return transformedArray.map((byte) => ("0" + byte.toString(16)).slice(-2)).join("");
}
// Call the keygen function
keygen();
We get our flag!
Flag: INTIGRITI{50_much_f0r_53cur3_c0ld_570r463}
You will find it is a and in the index.html is the pin, simplez!
