3

EDIT: Here is some more background. I am basically trying to reproduce this the method outlined here I have been able to hit everything up until the paragraph regarding the decrypting of the data file in the raw folder. That site pretty much outlines everything.

The file was encrypted using a random number via the java random number generator. The random number was generated via a seed (located in the manifest file). I tracked down the seed and built a random number generator. I fed it the seed which supplied me with the key for the encrypted file in the raw folder.

Now I am left with they key to an encrypted file, however I am unfamiliar with decrypting a file in this fashion. That is my question. In what way would one go about decrypting a file that was encrypted in this manner.

Is it done with a software tool, or can it be done via the linux terminal?

@Gilles

Unfortunately I am not that advanced in computer forensics (but you can tell I'm attempting to learn)

Here is the output of hexdump from the terminal. 

0000000 5194 1748 f896 bd6c fdf9 0d72 617e 7714
0000010 2221 4b77 a96b d327 1e2a 67d7 6e91 1720
0000020

Here is what shows up when I open the file with a text editor. 

QHølœùýr
~aw!"wKk©'Ó*×gn
KDEx
  • 4,981
  • 2
  • 20
  • 34
  • 3
    Your link describes how to generate the key (in broad terms), but it doesn't say what the encryption algorithm is. Without this crucial piece of information, we can't tell you how to decrypt it. – Gilles 'SO- stop being evil' Mar 20 '12 at 21:51
  • 1
    Note that due to a bug in Android, it *used to be the case* that the seed given to the RNG was the only source of entropy. This has been fixed in later versions of Anroid. So if this code is using the Java API, it might be the case that it generated undecryptable cipher text on newer Android versions. – Maarten Bodewes Mar 20 '12 at 23:29
  • @owlstead The min sdk is 3 and the target sdk is version 8 for this application. – KDEx Mar 21 '12 at 13:51

1 Answers1

2

This should answer your question and how to reverse engineer it:

http://resources.infosecinstitute.com/rootsmart-android-malware/

Basically; it was encrypted with AES 128 and points to a Chinese URL (go.docrui.com).

dr jimbob
  • 38,768
  • 8
  • 92
  • 161