[Cafebabe]

I am finally starting to reverse engineering this client and it has been quite fun so far

As mentioned in the other thread b.o class handles the encryption/decryption and if you apply the string decryption method you get the following:

Code:

Class: b.o
z[0] = CB13370FDC5197B54FA4D269D5A80ACD
z[1] = AES/CBC/PKCS5Padding
z[2] = AES
z[3] = 747DA8F0024ABFE26AA49B6C3285CC47
z[4] = native
z[5] = file
z[6] = lib
z[7] = .class

As you can see it is using AES encryption and AES/CBC/PKCS5Padding for the cipher stream. The values in z[0] and z[3] is really what interests me so i started working on them and i got them figured out:

z[3] = IvParameterSpec after DatatypeConverter.parseHexBinary (so z[3] is the IV for the aes decryption and is encoded with HexBinary as well.)
z[0] = SecretKeySpec this is the key for AES after DatatypeConverter.parseHexBinary (So z[0] is the actual key for the aes decryption it is just encoded with HexBinary sequence)

Basically to reproduce the information:

Code:

Cipher.getInstance("AES/CBC/PKCS5Padding").init(Cipher.DECRYPT_MODE, new SecretKeySpec(DatatypeConverter.parseHexBinary("CB13370FDC5197B54FA4D269D5A80ACD"), "AES"), new IvParameterSpec(DatatypeConverter.parseHexBinary("747DA8F0024ABFE26AA49B6C3285CC47")));

That is the Cipher stream you will use to decrypt the information.

Upon further inspection of the code i have learned that they are using Pack200 [java.util.jar packer] to unpack the jar file:

Code:

Pack200.newUnpacker().unpack(new GZipInputStream(data), JarOutputStream);

Code:

private static byte[] b(String s, byte abyte0[])
    {
        byte abyte1[];
        byte abyte2[];
        s = new d(s.getBytes());
        String s1;
        abyte1 = DatatypeConverter.parseHexBinary(s1 = z[3]);
        s.c(abyte1);
        abyte2 = DatatypeConverter.parseHexBinary(s1 = z[0]);
        s.c(abyte2);
        (s = Cipher.getInstance(z[1])).init(2, new SecretKeySpec(abyte2, z[2]), new IvParameterSpec(abyte1));
        return s.doFinal(abyte0);
        JVM INSTR dup ;
        s;
        printStackTrace();
        return null;
    }

This is the method in the b.o class that handles the decryption of information and where the information above comes from. Parameter abyte0[] is the encrypted information. abyte1 is the unencoded IV, abyte2 is the unencoded SecretKey.


I will keep working on this and see what else i can do. I will start working on dumping the actual jar from memory and hopefully i can find the method that will load the cache .