“decrypt” function just decoding base64 is almost too difficult to believe but t...

jcul · 2025-07-02T23:52:11 1751500331

The raw crypt data is base64 encoded, probably just for ease of embedding the strings.

There is a decryption function that does the actual decryption.

Not to say it wouldn't be easy to reverse engineer or just run and check the return, but it's not just base64.

crtasm · 2025-07-02T14:29:18 1751466558

>However, there is a second stage which is handled by a native library which is obfuscated to hell

zihotki · 2025-07-02T14:41:29 1751467289

That native obfuscated crap still has to do an HTTP request, that's essentially a base64

qoez · 2025-07-02T14:29:18 1751466558

They should have off-loaded security coding to the OAI agent.

java-man · 2025-07-02T14:55:36 1751468136

they probably did.

pvtmert · 2025-07-02T14:21:17 1751466077

not very much surprising given they left the adb debugging on...

_carbyau_ · 2025-07-02T23:57:00 1751500620

So easy a fancy webpage could do it. https://gchq.github.io/CyberChef/

I mean, it's from gchq so it is a bit fancy. It's got a "magic" option!

Cool thing being you can download it and run it yourself locally in your browser, no comms required.