sadly it’s a third-party legacy app. we just have the files it generates, and parts of it’s source.
so how do you know what the contents of the file mean?
We can see how the files are constructed from the legacy java source.
The content layout is a java Hashmap with binary data written under three string keys written to file.
If i can read back the parts of the hashmap … then i’ve effectively solved this problem.
Java’s FileOutputStream writes raw bytes. What you write is what you get.
Would you consider publishing 1-2 unencrypted files with the raw Java HashMaps as their contents?
I’d be interested in trying to reverse-engineer them.
sure, see the links:
http://paperlesssolutionsltd.com.ng/sample1.zip
http://paperlesssolutionsltd.com.ng/sample2.zip
The zip files are encrypted, then the encrypted bits are packed together as a Hashmap. and written to file.
IF i can simply read back the hashmap from the given files, then getting them decrypted is the easier part
Yes.
We should be able to read the binary content: it is 3 parts:
localHashMap.put("SecretKey", someBytes);
localHashMap.put("EncryptedData", localList1);
localHashMap.put("IVSpec", someMoreBytes);
The sample files are just a java Hashmap written to files saved as “sample1.zip” etc
Can we readback the “sample1.zip” binary and read out the three parts under each of the keys, as described in the sample code
https://paperlesssolutionsltd.com.ng/RSASecImpl.java.txt
That’s the source
We’re having some miscommunication here.
If I open the sample1.zip it looks like those are not a zip format at all? It’s really just binary output but named .zip?
Also, by googling a bit I found: InfoWorld | Technology insight for the enterprise and this indeed matches the binary format of the sample1.zip file provided.
You could have a look at this site to check how to reverse engineer the binary format. But I still think it would be simpler to write a basic java utility that reads the sample1.zip file and writes it to json/…
correct, they are not zip files at all.
The original zip file was encrypted and put under the key: “EncryptedData”
some aditional data was then put under two aditional keys as follows in a HashMap:
localHashMap.put("SecretKey", someBytes);
localHashMap.put("EncryptedData", localList1);
localHashMap.put("IVSpec", someMoreBytes);
The entire content was then saved as a binary with the name “sample1.zip”
sample1.zip is not a .zip file
I’ve looked at the article @tcoopman linked and while it’s very possible to make a relatively tidy Erlang/Elixir mode that utilizes binary pattern matching, I believe it would be brittle and would surely not cover all cases.
I’d recommend, just as @tcoopman said, you write a small Java utility that reads those serialized HashMaps and dump them in JSON. From then on, every normal language could work with them.
I am usually very interested in inter-operability between languages but in this case you’d be taking the much longer road if you don’t translate the Java serialized objects to JSON using Java itself.
And if it’s not JSON because of space restrictions, BERT or something similar could be used, it supports compression out of the box and is not restricted to printable characters.
I’m pretty sure there is a Java implementation out there…
You can even make this converter a port, or use jerlang or what was its name to call Java code directly…