search

technicaljicama / Reddit-NDK

A educational reverse engineering project targetting libreddit-ndk.so
5 stars 1 forks source link

Need your help in generating "X-hmac-signed-body" and "X-hmac-signed-result" #1

Open waysiPire0 opened 1 year ago

waysiPire0 commented 1 year ago

Hi @PSVita-Dev

You did a very good job. i am working on creating python wrapper for reddit, by inspecting api endpoints of reddit using android. i am working on generating "X-hmac-signed-body" and "X-hmac-signed-result" parameters, Can you please help me with generating these 2 parameters. below is the apk source code of reddit and these parameters are generating in file "/base_source_from_JADX/sources/p013e/p551a/p787h/p788a/p789a/p792j/C8975c.java" and in function mo26422c.

app source code https://drive.google.com/file/d/1s5xvwd3hR5BQ5zhDl826UR3-JzD25m0c/view?usp=sharing

Picture image

Looking forward to hear from you. thank you so much

technicaljicama commented 1 year ago

Hello, first of all sorry that I havent seen this issue sooner. Basically (for hmac body) the string "Epoch:timestamp|Body:request body" gets hmac sha256 hashed with the key from this repo. If you got any questions, i will try to answer them asap

Kangaroo69 commented 1 year ago

What is User-Agent supposed to be in Hmac Result? I put in the correct one from request header but the hmac hash don't match, is the User-Agent hashed before it is generated?

technicaljicama commented 1 year ago

You hash the whole string, so "Epoch:timestamp|User-Agent:Reddit v..."

morris90901 commented 9 months ago

You hash the whole string, so "Epoch:timestamp|User-Agent:Reddit v..."

Hi i'm doing it like you suggested but the value isn't matching for some reason here is an example maybe I'm doing it wrong image