Reverse Engineering API Call

[TA2k]

1. Encrypt Payload via AES

AES/CBC/PKCS5Padding mode:  encryption 
AES/CBC/PKCS5Padding key Base64:OlLzwi7W/N5b9pamwCyecw==
AES/CBC/PKCS5Padding key Hex:3a52f3c22ed6fcde5bf696a6c02c9e73
AES/CBC/PKCS5Padding key Utf8:
AES/CBC/PKCS5Padding iv Base64:AAAAAAAAAAAAAAAAAAAAAA==
AES/CBC/PKCS5Padding iv Hex:00000000000000000000000000000000
AES/CBC/PKCS5Padding iv Utf8:

AES/CBC/PKCS5Padding doFinal param Utf8:{"countryCode":"DE","deviceType":"0","imeiMD5":"2EA5EAF78EA945204E99E1BA9ED74B83","networkType":"wifi","random":"0532A56F28264E8D98E239A52B0DC57C","timeStamp":"1698864439417","version":"201"}
AES/CBC/PKCS5Padding doFinal result Base64:SXH+7fhEGZgKiODFLHfdf7JdSnbLn0miRsWOwJgpbvmxKG1r7pu2J9mykv8Q3KuPz45A0CRuY/+mrAfxgk0OFLrDSSsrZzhmo7DuXQ+wUitafRK8DuoNBNxIyzHXwQZJEjvSPfGFkWhQiqw/BHRheM6VM26irV6QNhgDo9uOM0cZct2d929qez//mkNOQrBgH8EQ5yx0aIIpF9zeb7XtPb5tLq09VKLMyrb1aqHs3x8A3hMzBIq2eU0XDWUBFGaT
AES/CBC/PKCS5Padding doFinal result Hex:4971feedf84419980a88e0c52c77dd7fb25d4a76cb9f49a246c58ec098296ef9b1286d6bee9bb627d9b292ff10dcab8fcf8e40d0246e63ffa6ac07f1824d0e14bac3492b2b673866a3b0ee5d0fb0522b5a7d12bc0eea0d04dc48cb31d7c10649123bd23df1859168508aac3f04746178ce95336ea2ad5e90361803a3db8e33471972dd9df76f6a7b3fff9a434e42b0601fc110e72c7468822917dcde6fb5ed3dbe6d2ead3d54a2cccab6f56aa1ecdf1f00de1333048ab6794d170d6501146693

2. Create a signature via SHA1

SHA-1 update param Utf8:countryCode=DE&deviceType=0&identifier=DE&identifierType=0&imeiMD5=8CCEE4915065D29CCD911DA5DC9C28D3&language=de&networkType=wifi&random=B0E25FF696AF46D2A04D8261AEDEA174&reqTimestamp=1698919441358&timeStamp=1698919441358&version=201&password=3A52F3C22ED6FCDE5BF696A6C02C9E73

SHA-1 digest result Hex:178b71f44aa7b036da503c513bebb167f057c4d0

3. Encrypt with secneo library or other custom library

{"encryData":"4971FEEDF84419980A88E0C52C77DD7FB25D4A76CB9F49A246C58EC098296EF9B1286D6BEE9BB627D9B292FF10DCAB8FFCF16567F8B3A3E37F9D632EAFC41C208D0A805908BFDA5DCEE5AFEBAC217DF2E71C6DF4B2CFC64AC94C73AA442F9DB28524A8A2909A09F7489B9B8F3F2657CD5726DEF972CB8699145FF5FA18A8FBB8E7CCC16351879764EF5C60D874DD7AD7AACCB242B6646EDED7EFBC21AB3A787D5C9DC5C5D33A2AF08345B36F7E473CC83096E1847F74C54B0280AD02B891436A","identifier":"DE","identifierType":"0","imeiMD5":"8CCEE4915065D29CCD911DA5DC9C28D3","language":"de","reqTimestamp":"1698918141562","sign":"178b71f44aa7b036da503c513bebb167f057c4d0"}

to a request like this. This is not the matching request
{
    "request": "F1whE9TJ/js738h9X4pf815gVlcElQWSvkXsTTl9iESDQIa8mEEafEds572XK/rOU17EWIjDrx7gUEJIMxJNEsHt94DQ/zJMNfVZXIqdRwEyUP5P6JYbrWBpTNrRFWf7osI6mA8XhfGPVn/uhKM73LsrLMoLFhVgvc53/7b5ewdGMEaprEJ5Mj3XkhB/e9RLtmOSaX4bGx0JzuU2Vkv6XSCcYY+AM6qNLuA0/mpXNfiMbsl6Ew4k38P40A/n1D93eBHcoKpYkDdj5KBoMWTMuHXrLtwKG4lZF2nCGQ7z9rMwHK28DTP6TdbzwU6NelGMIAr6EpcwWSXLsUyNjzRUiEke5wBH0vXLtCVaOcfe6LzWy5gdLv+kM9rgEbVnvEWfACycxRRHoUiUVhLMUbJWLd9E/RZPGlMsdKT+lCGQ+z9bu8GxyxmTZiuUal69/QjyQFSRq0wgVEJucLigVQhhPPrkQUZptAnGe/GVCLSBZe7PPWt/YZaadTgT2z0ZI2LG1Xl8dQ8V8ZDmSPrlJEIkZqW6TzaoA0aZmJT9eOXgjmq+508y3opvm24vHqJ0wvsm+fORIW4q02dzlXNUlPe0oU6OpYMdc125qrrcRk4vQpidPvUwRGzETlJw1sOFMrPI3EjLj0QZwJRQD0W26oAvL+iUpTfMa0rAzlKEKJht3dqN2BbeUykpHA4qpn5iUW1ByPQRKmXvO7X2zb9Mj1EtGM+PRE04hAYMlzi/QB6JPRgf00/Ch8h/BmLd0eQuSDu4wYoDWvhhLg4qoEB7ZaFdmMQLMZdkSwBbWldelgXVHyDMmUv5x+7G+y0uyN5URgXr5A8qVSHS2Zghe8VKrSFtlWo44kGZv1n7Z+xYe26nt/NS69/bUCjdEcpn0xNgzDZ11m4xqwKkQT2vXsG52EA23ErpYB9tw7KGbTdELeEVI4oglzOBPRJmzMPPop0Wh20ZQEwM+wKqVIVAuxmavIBPC5fZfTb2UYcuPrrYPcJZw4Lu0NwjbLh4UL0TQl4kDPbsX"
}

APK dex file:
https://send.cm/lxtd9ikduztn
https://www.mirrored.to/files/0DHI0EGH/class.zip_links

class.zip

com.byd.bydautolink.repository.util.CommonRequestUtil
 public final CommonTypeRequest
com.byd.bydautolink.repository.param.request.CommonTypeRequest
 public CommonTypeRequest(@e String str, @e String str2, @e String str3, @e String str4, @e String str5, @e String str6, @e String str7) {
        JniLib.cV(new Object[]{this, str, str2, str3, str4, str5, str6, str7, 481});
    }
import com.fort.andjni.JniLib;
libdexjni.so

Response:

{
    "response": "F+Is4sfuTVp28SE2x3HAuHENczYnXHFRB1LODDN7a0j8JxXhttviQZLg4aEoWoZPvkqfyVBUWxS4m9Y/ngaj59kC/ikXLyuMZbsEcM6er/8TwqyINKNXYyuoqjaZeg+/e8s/KF0VavqPK4wdX8VULfFd5hCHE9yWVZAmN+MvRyo05cUyYZVL5cDYXAe7MxkL1YchBNxPOQf7dCVnlxmtvd4dtRE/DQ9k205ydpGI+DkE0n+yCAF1ytjR5GWiHwImTDhaWXpaJOpNKOBKRou8RqbUv2hmhfFD10cvgEEjPzZ0t5kKiqp+vaoWYfOV4Ujj+45OhKPWro9b7bvHT3IIgsHa+GgeZIVtFGksDe0QzBkLsZK4wGHdIbEiVoQxHfEfWrp0Vm1p1CQ/paNyFfVC/DttJD+VITpROACepEfTJK+McB6soCbHgAWFHdaZ7yAMa0w0Vlt/Qbg2G3MviRZes/lAPTm90tcU1mNwX/xzAqRrpGID7g7f+s8oEivjLMcEMqb5aysoWlOdtJ2s1bjdJUmELX8h+MH0Cz921sVUBaIQENfEjnNqpa5Cz1RNm8DEDguA5UsahpgZshBR7U9fQyBauolMbtXTbY+fIDrcn8BRk/Dz9YZYgcbN9JQawK/GgLUWwHG8WjUNqQvW5WiuRwVvZN8uCt17ytcjKKSlBlLBz5Ok5OarHyW0gx5G5TRiAt3DslixtHyYZ7/1uK0JC8GFIdEe/TF82f7TygGE8fSM="
}

{"code":"0","identifier":"DE","message":"成功","respondData":"6841A86D6CA727BD43A3CBAA102705528B95498A2545559576CCCBD46ADE835E23972F46AB202DBDD5407F2D8E7390E4B7205C2C53A3B407FEE76F2B09480C726535BA8DF017D0D9FA377AC876A9528C2EFC3D6F72AF939AD8568CC28788F0FD88475F667F39C0A4F9099A9889385348D5A2141DA5E0BA59BD933C20CAE189E5DE2CF3AE7CCEF1363B115A0F7E20032E6B154F13636054BBCD87308EE0335DA042AA3162B3FBEF7F441CCA0955A1A504479A04026808C165B9290E5CB5E3B221ED5AD64709723C53B9A1C6B0321A4240320CD0790FC108FF4EC544756E78E1DAE5CCBB40C47CDD1AF0890DFBD7AB63B6"}

The missing link is the final encryption with non standard tools. Maybe you have an idea.

[jkaberg]

@TA2k Very interesting, and thanks for the dex dump, that will probably help. I'm currently traveling abroad but will dig into this when I get back home.

ping @codyc1515 - I guess you'd be interested in following this

[codyc1515]

Fantastic. @TA2k would you mind to please share how you performed the encryption / decryption? I am having no luck with the examples you provided, unfortunately.

[jkaberg]

@TA2k perhaps the answer lies here (follow the functions)

[codyc1515]

I'm simply trying (and failing!) to reverse the doFinal result hex back to base64 :(

[codyc1515]

Looks like most of the good stuff is in here:

com\byd\bydautolink\repository\param\request
com\byd\bydautolink\repository\util\a.java

[TA2k]

I use normal Frida with this script
https://github.com/ppwang06/frida_js/blob/main/apps/hook_base64.js
I recommend to use jadx gui for better overview
https://github.com/skylot/jadx

I assume the code you referencing is only checking the response json and parsing the json
I think the last part is in
com.byd.bydautolink.repository.util.CommonRequestUtil
public final CommonTypeRequest
com.byd.bydautolink.repository.param.request.CommonTypeRequest

[codyc1515]

I wasn't able to get Frida working with my device, so appreciate the help there. I am using jadx GUI but found a lot of the classes are still heavily obfuscated. Notably, I cannot work out how we might even decrypt your example yet alone begin to think about even sending / receiving an API request.

[codyc1515]

com.byd.service.util.AESUtils appears to have two functions which reference CryptoTools.laesDecryptStringWithBase64 and CryptoTools.laesEncryptStringWithBase64. I cannot find these classes, however.

[codyc1515]

Base64:SXH+7fhEGZgKiODFLHfdf7JdSnbLn0miRsWOwJgpbvmxKG1r7pu2J9mykv8Q3KuPz45A0CRuY

This doesn't look right. The Base64 string should be starting with eyJ.

[TA2k]

It is the base64 encoded hex value of the encryption result

[codyc1515]

I'm not able to get same result from encrypting the utf-8 value either. There are no details provided on how you did this. Without further information, this is a dead end for me - sorry.

[TA2k]

The output from Frida was incorrect I added the correct key

import crypto from "crypto";
const payload ='{"countryCode":"DE","deviceType":"0","imeiMD5":"2EA5EAF78EA945204E99E1BA9ED74B83","networkType":"wifi","random":"0532A56F28264E8D98E239A52B0DC57C","timeStamp":"1698864439417","version":"201"}'
let cipher = crypto.createCipheriv(
  "aes-128-cbc",
  Buffer.from("OlLzwi7W/N5b9pamwCyecw==", "base64"),
  Buffer.from("00000000000000000000000000000000", "hex")
);
console.log(cipher.update(payload, "utf8", "hex"));

[jkaberg]

Just a small side note and I'll investigate this later, but our friends over at Hassbian (Chinese site) has earlier uncovered an API used with Wechat to interact with the car - this requires an valid Wechat account and refetching cookies every now and then from the GUI Wechat application, and not really feasible for us none Chinese residents.

However they have implemented an crude flow in Node-red which fetches data from the Wechat api (https://bydcloud.byd.com/wechat/) and returns it over MQTT to HASS (see attached file for config flow - byd_car_flows.json). One note on this API is that it uses obfuscated commands to control various aspects of the car, eg for "flash light" the command is "B6D767D2F8ED5D21A44B0E5886680CB9" or for lock doors the command is "8F14E45FCEEA167A5A36DEDD4BEA2543".

[codyc1515]

Just a small side note and I'll investigate this later, but our friends over at Hassbian (Chinese site) has earlier uncovered an API used with Wechat to interact with the car

Last I checked this, I was not able to get my car working with the WeChat conversation (even directly). Chinese cars appear to use a totally separate set of software (same as they don't have Android Auto, for example) which is why you don't even see China as a selection available in the BYD app.

[codyc1515]

I made a sample library for the preamble but don't understand how the encryData / secneo part is working. I'm unable to see this part in jadx-gui as it's heavily obfuscated. Did you happen to have a sample code for this?

https://gist.github.com/codyc1515/8d1074233b6aa10d3ccbc074f39446d7