Keystore password?

[DaniGuardiola]

I don't know much about how keystores work, I'm just trying to do some reverse engineering.

I used this to generate a keystore: https://gist.github.com/chtz/4e3f503bae5eb21783e6

It asked for a password and I entered 'aaaaaa' because I didn't know what to write and it didn't let me enter an empty password. But then, when executing this with that keystore file, I got this error:

jarsigner error: java.lang.RuntimeException: keystore load: Keystore was tampered with, or password was incorrect

What should I do?

Thanks

[levyitay]

User your androidDebug.keystore
it's being generated when you install the Android SDK.
You will need the password of the original keystore you generated.
If you want just to see the apk's code, the debug Keystore should be enough

[DaniGuardiola]

I'm trying to do this:

keytool -import -trkeytool -import -trustcacerts -keystore debug.keystore -storepass android -alias androiddebugkey -keypass android -file ~/.mitmproxy/mitmproxy-ca-cert.cer -keystore mitmproxy.keystoreustcacerts -keystore debug.keystore -storepass android -alias androiddebugkey -keypass android -file ~/.mitmproxy/mitmproxy-ca-cert.cer -keystore mitmproxy.keystore

And then this:

./addSecurityExceptions.sh ~/Downloads/org.example.app.apk mitmproxy.keystore

This is the log:

I: Using Apktool 2.2.4 on org.example.app.apk
I: Loading resource table…
I: Decoding AndroidManifest.xml with resources…
I: Loading resource table from file: /home/dani/.local/share/apktool/framework/1.apk
I: Regular manifest package…
I: Decoding file-resources…
I: Decoding values / XMLs…
I: Baksmaling classes.dex…
I: Copying assets and libs…
I: Copying unknown files…
I: Copying original files…
I: Removing 1.apk framework file…
Building new APK org.example.app_new.apk
I: Using Apktool 2.2.4
I: Checking whether sources has changed…
I: Smaling smali folder into classes.dex…
I: Checking whether resources has changed…
I: Building resources…
I: Building apk file…
I: Copying unknown files/dir…
jarsigner: Certificate chain not found for: androiddebugkey. androiddebugkey must reference a valid KeyStore key entry containing a private key and corresponding public key certificate chain.

[DaniGuardiola]

I really don't know what I'm doing, just trying pretty much random stuff that seems to make sense 😅

This is what I'm trying to pull off: mitmproxy/mitmproxy#2054 (comment)

[DaniGuardiola]

My goal is to use the mitmproxy in a third party app to inspect SSL traffic

[DaniGuardiola]

@levyitay I did the following:

I installed android studio and the SDK to get that default keystore file. Then I ran your script and it seemed to work:

What is your first and last name?
  [Unknown]:  
What is the name of your organizational unit?
  [Unknown]:  
What is the name of your organization?
  [Unknown]:  
What is the name of your City or Locality?
  [Unknown]:  
What is the name of your State or Province?
  [Unknown]:  
What is the two-letter country code for this unit?
  [Unknown]:  
Is CN=Unknown, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown correct?
  [no]:  yes

Generating 2,048 bit RSA key pair and self-signed certificate (SHA256withRSA) with a validity of 10,000 days
	for: CN=Unknown, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown
[Storing /home/dani/.android/debug.keystore]

Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore /home/dani/.android/debug.keystore -destkeystore /home/dani/.android/debug.keystore -deststoretype pkcs12".
I: Using Apktool 2.2.4 on com.cita.apk
I: Loading resource table...
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: /home/dani/.local/share/apktool/framework/1.apk
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values */* XMLs...
I: Baksmaling classes.dex...
I: Copying assets and libs...
I: Copying unknown files...
I: Copying original files...
I: Removing 1.apk framework file...
Building new APK com.cita_new.apk
I: Using Apktool 2.2.4
I: Checking whether sources has changed...
I: Smaling smali folder into classes.dex...
I: Checking whether resources has changed...
I: Building resources...
I: Building apk file...
I: Copying unknown files/dir...
   adding: META-INF/MANIFEST.MF
   adding: META-INF/ANDROIDD.SF
   adding: META-INF/ANDROIDD.RSA
  signing: AndroidManifest.xml
  signing: assets/www/cordova-js-src/android/nativeapiprovider.js
  signing: assets/www/cordova-js-src/android/promptbasednativeapi.js
  signing: assets/www/cordova-js-src/exec.js
  signing: assets/www/cordova-js-src/platform.js
  signing: assets/www/cordova-js-src/plugin/android/app.js
  signing: assets/www/cordova.js
  signing: assets/www/cordova_plugins.js
  signing: assets/www/css/index.css
  signing: assets/www/img/logo.png
  signing: assets/www/index.html
  signing: assets/www/js/index.js
  signing: assets/www/plugins/cordova-plugin-calendar/www/Calendar.js
  signing: assets/www/plugins/cordova-plugin-camera/www/Camera.js
  signing: assets/www/plugins/cordova-plugin-camera/www/CameraConstants.js
  signing: assets/www/plugins/cordova-plugin-camera/www/CameraPopoverHandle.js
  signing: assets/www/plugins/cordova-plugin-camera/www/CameraPopoverOptions.js
  signing: assets/www/plugins/cordova-plugin-device/www/device.js
  signing: assets/www/plugins/cordova-plugin-dialogs/www/android/notification.js
  signing: assets/www/plugins/cordova-plugin-dialogs/www/notification.js
  signing: assets/www/plugins/cordova-plugin-network-information/www/Connection.js
  signing: assets/www/plugins/cordova-plugin-network-information/www/network.js
  signing: assets/www/plugins/cordova-plugin-spinner/www/spinner-plugin.js
  signing: assets/www/plugins/cordova-plugin-splashscreen/www/splashscreen.js
  signing: assets/www/plugins/cordova-plugin-vibration/www/vibration.js
  signing: classes.dex
  signing: res/drawable-hdpi-v4/icon.png
  signing: res/drawable-hdpi-v4/notifications.png
  signing: res/drawable-hdpi-v4/splashscreen.png
  signing: res/drawable-ldpi-v4/icon.png
  signing: res/drawable-ldpi-v4/notifications.png
  signing: res/drawable-ldpi-v4/splashscreen.png
  signing: res/drawable-mdpi-v4/icon.png
  signing: res/drawable-mdpi-v4/notifications.png
  signing: res/drawable-mdpi-v4/splashscreen.png
  signing: res/drawable-xhdpi-v4/icon.png
  signing: res/drawable-xhdpi-v4/notifications.png
  signing: res/drawable-xhdpi-v4/splashscreen.png
  signing: res/drawable-xxhdpi-v4/icon.png
  signing: res/drawable-xxhdpi-v4/notifications.png
  signing: res/drawable-xxhdpi-v4/splashscreen.png
  signing: res/drawable-xxxhdpi-v4/icon.png
  signing: res/drawable-xxxhdpi-v4/notifications.png
  signing: res/drawable-xxxhdpi-v4/splashscreen.png
  signing: res/mipmap-hdpi-v4/icon.png
  signing: res/mipmap-ldpi-v4/icon.png
  signing: res/mipmap-mdpi-v4/icon.png
  signing: res/mipmap-xhdpi-v4/icon.png
  signing: res/xml/config.xml
  signing: res/xml/network_security_config.xml
  signing: res/xml/provider_paths.xml
  signing: resources.arsc
jar signed.

Warning: 
No -tsa or -tsacert is provided and this jar is not timestamped. Without a timestamp, users may not be able to validate this jar after the signer certificate's expiration date (2045-06-24) or after any future revocation date.

But then when I try to install it onto my device it ends with an "App not installed" error :(

[DaniGuardiola]

I found a workaround. However, this still happens. If you want the apk to debug it yourself, let me know and I'll send it to you. I don't need the tool anymore, but thanks :)

[levyitay]

@DaniGuardiola the script is designed to work with android keystore currently.
I'll open a task to support different keystore with alias and password