notes on extracting api key from secretd binary

[sbellem]

The API KEY and SPID are compressed (gzipped) using some go tool, go-bindata such that the data ends up in a go file:

• ias_bin_dev.go for testnet
• ias_bin_prod.go for mainnet

For instance, the string "3Dprintedchips" will be encoded as

var _api_key_txt = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x32\x76\x29\x28\xca\xcc\x2b\x49\x4d\x49\xce\xc8\x2c\x28\xe6\x02\x04\x00\x00\xff\xff\x4e\x49\xa9\x5f\x0f\x00\x00\x00")

It is possible to pass -no-compress to go-bindata such that the data will not be compressed, and in that case the resulting go file (e.g. ias_bin_dev.go) would contain:

var _api_key_txt = []byte(`3Dprintedchips`)

(note the backticks surrounding the plain text)

[sbellem]

var _api_key_txt = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x2a\x4e\x2d\x4a\xcd\x4b\xc9\x2c\xc8\x2c\xa9\xc4\xce\xe4\x02\x04\x00\x00\xff\xff\xc0\x01\x10\xbe\x22\x00\x00\x00")

# .noptrdata section
0x035263d0 00000000 00000000 00000000 00000000 ................                                                                     
0x035263e0 1f8b0800 00000000 00ff2a4e 2d4acd4b ..........*N-J.K                                                                        0x035263f0 c92cc82c a9c4cee4 02040000 ffffc001 .,.,............                                                                     
0x03526400 10be2200 00000000 00000000 00000000 ..".............        

[sbellem]

api key & spid

they start with padding 00000000 00ff and towards the end there's 0000ffff plus one more xxxxxxxx

the data is compressed, but we know the testnet api key and can therefore use it to check that decompression is done correctly

testnet

 # secretd-1.8.0-testnet.noptrdata
 0x03529980 1f8b0800 00000000 00ff3230 32494a4b ..........202IJK
 0x03529990 49324ab5 48b23031 4a34b74c 31323236 I2J.H.01J4.L1226
 0x035299a0 4f34b234 b534334a 4d4b0604 0000ffff O4.4.43JMK......
 0x035299b0 e4410b82 20000000 00000000 00000000 .A.. ...........
 0x035299c0 1f8b0800 00000000 00ff7231 70347531 ..........r1p4u1
 0x035299d0 70743374 35323171 75367775 34323437 pt3t521qu6wu4247
 0x035299e0 75723672 353632b0 34760204 0000ffff ur6r562.4v......
 0x035299f0 70a10dd3 20000000 00000000 00000000 p... ...........

mainnet

 # secretd-1.8.0-mainnet.noptrdata
 0x035299a0 1f8b0800 00000000 00ff04c0 81010020 ............... 
 0x035299b0 0444d199 84629caf 6eff157a 152cfcf5 .D...b..n..z.,..
 0x035299c0 ecc96818 95671f30 24b3fb03 0000ffff ..h..g.0$.......
 0x035299d0 82b3946e 20000000 00000000 00000000 ...n ...........
 0x035299e0 1f8b0800 00000000 00ff32b7 30763637 ..........2.0v67
 0x035299f0 75733130 317435b2 70747534 72717276 us101t5.ptu4rqrv
 0x03529a00 31b13033 34373537 77730504 0000ffff 1.034757ws......
 0x03529a10 ebc0c339 20000000 00000000 00000000 ...9 ...........

[sbellem]

gzip.decompress(unhexlify(api_key))

[sbellem]

this can be automated by reading the file (with mmap for efficiency) and locating the beginning byte repr of the hex string 1f8b0800 00000000 00ff (i.e.: \x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff) and reading the following lines up to 0000ffff hhhhhhhh hhhhhhhh (\x00\x00\xff\xff...) and passing it to gzip.decompress()

[sbellem]

Not sure if it still works, but for previous versions, see https://github.com/sbellem/secretelf