4 ms·
“decrypt” function just decoding base64 is almost too difficult to believe but the amount of times ive run into people that should know better think base64 is a
by JohnMakin 1y ago
“decrypt” function just decoding base64 is almost too difficult to believe but the amount of times ive run into people that should know better think base64 is a secure string tells me otherwise
- pvtmert 1y agonot very much surprising given they left the adb debugging on...
- crtasm 1y ago>However, there is a second stage which is handled by a native library which is obfuscated to hell
- zihotki 1y agoThat native obfuscated crap still has to do an HTTP request, that's essentially a base64
- qoez 1y agoThey should have off-loaded security coding to the OAI agent.
- java-man 1y agothey probably did.
- jcul 1y agoThe raw crypt data is base64 encoded, probably just for ease of embedding the strings. There is a decryption function that does the actual decryption. Not to say it wouldn't be easy to reverse engineer or just run and check the return, but it's not just base64.
- _carbyau_ 1y agoSo easy a fancy webpage could do it. https://gchq.github.io/CyberChef/ https://gchq.github.io/CyberChef/ I mean, it's from gchq so it is a bit fancy. It's got a "magic" option! Cool thing being you can download it and run it yourself locally in your browser, no comms required.