yoghurtbot / akamai-bmp-rsa-aes-frida-hook

A frida script that can be used to find the public RSA key used in the native libakamaibmp.so shared library, seen in version 3.3.0 of Akamai BMP

Akamai BMP - RSA/AES Frida Hook

This Frida script can be used to find the public RSA key used in the encryption process in Akamai BMP 3.3.0. Since version 3.3.0, Akamai uses a shared library to handle the encryption process, rather than in Java.

It can also be used to inspect the sensor data before it goes through the AES-CBC-128 encryption routine.

The public key is encrypted inside the shared library, and a function called rotate_string decrypts it into the public key. This Frida scripts hooks into a function called Crypto::RSAEncrypt that takes the clear text RSA key as a parameter, and dumps it out.

How to use the script

This script assumes that you have already rooted and installed Frida on your Android device.

$ frida -l "D:\akamai-bmp-rsa-hook.js" -f com.ihg.apps.android -U --no-pause

Output

Below is an example of the output from the script (screenshot purposly cropped to stop you being lazy...)

akamai-bmp-rsa-aes-frida-hook's Issues

How to get final Sensor Data generated?

Hey mate!
I have been working in a project and if you could help me, I appreciate.

I'm using python to hook these methods from your repository, and I noticed the function is called before script Python is running. Is there a way to call initializeKeyN multiple times?

Last question, Do you have any clue, what method build the final sensor data after encoded?