github-such-software/hash-wallet
1
0
Fork 1
mirror of https://github.com/Such-Software/hash-wallet.git synced 2026-10-17 05:41:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: add 1.0.0 (build 9/10) legacy secret candidates recovered from the Play AAB

Browse Source 
Cross-referencing both shipped binaries' string tables also separates
per-build randoms from shared library constants, trimming false candidates.
This commit is contained in:
jwinterm
2026-08-29 14:58:58 -04:00
parent d8aab70fa7
commit 7fcef4e4ce
1 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/entities/encrypt.dart
+15 -6
View File
@@ -71,19 +71,28 @@ String decodeWalletPassword({required String password}) {
// self-heals on its first successful unlock. A wrong key can slip past // self-heals on its first successful unlock. A wrong key can slip past
// PKCS7 unpadding (~0.4%), so decoded output is validated before acceptance. // PKCS7 unpadding (~0.4%), so decoded output is validated before acceptance.
// 32-hex `key` candidates (PIN blobs). Includes every plausible constant from // 32-hex `key` candidates (PIN blobs), recovered from the shipped Android
// the 1.0.1 Android string table; wrong entries fail validation harmlessly. // binaries' string tables. Values present in BOTH binaries are library
// constants and excluded; wrong entries fail validation harmlessly.
const _legacyPinKeys = [ const _legacyPinKeys = [
// 1.0.0 (Play build 9/10)
'0412c5758f2daac3937a67f4254ba23b',
'78bcd8e2ae16cd49fdff3a4b15f94a24',
'd3fa832318c19c65a706032eb5bf3c38',
// 1.0.1 (Play build 11)
'51f918406bc771b5827e2479ce24dae0', '51f918406bc771b5827e2479ce24dae0',
'5a0e830aa102994045c19a4fef0d3156',
'76d489cc1eb5704e6e4bea65bb2618b3', '76d489cc1eb5704e6e4bea65bb2618b3',
'bba3031d10f37f741c9bcd2b26227cba', 'bba3031d10f37f741c9bcd2b26227cba',
'd6031998d1b3bbfebf59cc9bbff9aee1',
'5eeefca380d02919dc2c6558bb6d8a5d',
]; ];
// shortKey+walletSalt concatenations (wallet-password blobs), 1.0.1 Android. // shortKey+walletSalt concatenations (wallet-password blobs).
const _legacyWalletPasswordKeys = [ const _legacyWalletPasswordKeys = [
// 1.0.0 (2 shortKey x 2 walletSalt candidates)
'18cfc5c2438f9db902ade81f96b5ee0b',
'18cfc5c2438f9db902ade81fa70fe053',
'98cc2fc78b56148a67fa442b96b5ee0b',
'98cc2fc78b56148a67fa442ba70fe053',
// 1.0.1
'b77ed95e692db912ff0463821f37e159', 'b77ed95e692db912ff0463821f37e159',
'be2a818b190ab41010f0e2871f37e159', 'be2a818b190ab41010f0e2871f37e159',
]; ];