Git Product home page Git Product logo

cipher.so's Introduction

PLEASE NOTE, THIS PROJECT IS NO LONGER BEING MAINTAINED

Cipher.so

Providing a simple way to keep your secure info safe for android app development.

GitHub license Android Weekly Recommend

Wiki


About

How it works?

All the key-values will be auto package into a native library during the compile time. Then your can obtain them from the Java interface generated by Cipher.so.

Features

  • Encrypt secure info in a native library via easy configs
  • Reflection free

Usages

Installation

Step 1. in the root build.gradle:

Add maven { url 'https://jitpack.io' } resposity and classpath 'com.github.MEiDIK:Cipher.so:dev-SNAPSHOT' dependency into the buildscript:

buildscript {
    repositories {
        google()
        maven { url 'https://jitpack.io' }
    }
    dependencies {
        classpath 'com.android.tools.build:gradle:3.0.1'
        classpath 'com.github.MEiDIK:Cipher.so:dev-SNAPSHOT'
    }
}
Step 2. in the app module build.gradle:

Add apply plugin:'cipher.so' before(VERY IMPORTANT) apply plugin: 'com.android.application'

apply plugin: 'cipher.so'
apply plugin: 'com.android.application'

That's all, Cipher.so is ready to GO.

Configuration

In your app module build.gradle, add the follow-like configs to save key-values.

cipher.so {
    keys {
        hello {
            value = 'Hello From Cipher.so😊'
        }
        httpsKey {
            value = 'htkdjfkj@https2017now'
        }
        数据库密码 {
            value = '今天天气不错😂😂'
        }
        ...
    }
    encryptSeed = 'HelloSecretKey' //Secret key used for encryption
}

Then Rebuild to generate the Java Interface.

3. Call In Java/Kotlin

String hello = CipherClient.hello();
String httpsKey = CipherClient.httpsKey();
String dbKey = CipherClient.数据库密码();

Sample: HelloCipherSo

Contribute?

I am very glad for your contributes. Let's make this job awesome.

Here is the contribute workflow from github: Contribute Guide

Todos

  • Encrypt data in .so-lib
  • Prevent dynamic attacks
    • Check Signature
    • More
  • Support different Application varients

References

Great Thanks to


关于

原理?

在编译期,通过gradle配置将Key-value加密打包进native so库,然后通过自动生成的Java接口可以获取相应的数据。

特性

  • 通过简单的配置把隐私信息加密进native库
  • 没有使用反射

用法

安装

Step 1. 在root project的build.gradle中:

在buildscript中添加仓库maven { url 'https://jitpack.io' },添加依赖classpath 'com.github.MEiDIK:Cipher.so:dev-SNAPSHOT':

buildscript {
    repositories {
        google()
        maven { url 'https://jitpack.io' }
    }
    dependencies {
        classpath 'com.android.tools.build:gradle:3.0.1'
        classpath 'com.github.MEiDIK:Cipher.so:dev-SNAPSHOT'
    }
}
Step 2. 在目标模块的build.gradle中:

apply plugin: 'com.android.application'(十分重要)添加apply plugin:'cipher.so'

apply plugin: 'cipher.so'
apply plugin: 'com.android.application'

至此,Cipher.so已经就绪。

配置

在app模块的build.gradle中,通过以下的配置保存key-value值。

cipher.so {
    keys {
        hello {
            value = 'Hello From Cipher.so😊'
        }
        httpsKey {
            value = 'htkdjfkj@https2017now'
        }
        数据库密码 {
            value = '今天天气不错😂😂'
        }
        ...
    }
    encryptSeed = 'HelloSecretKey' //用于加密的密钥
}

然后Rebuild一下,自动生产Java的调用接口。

3. 在Java/Kotlin中调用

String hello = CipherClient.hello();
String httpsKey = CipherClient.httpsKey();
String dbKey = CipherClient.数据库密码();

例子: HelloCipherSo

贡献代码?

十分欢迎你的贡献,让我们一起把这个做得更好。

这是Github的贡献指南: Contribute Guide

Todos

  • 在.so-lib中加密数据
  • 防止动态攻击
    • 检查应用 签名
    • 更多
  • 支持Multi Application varients

相关资料

万分感谢


License

Copyright 2017 认真的帅斌

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

   http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

cipher.so's People

Contributors

linisme avatar revolter avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

cipher.so's Issues

External build files / force resync

The moment i implemented this library, I always keep getting the message:

External build files have changed since last project sync. A project sync may be necessary for the IDE to work properly.

I pressed "Sync Now" but after each resync, the message comes back. Same if i do a project Rebuilt, the message doesn't go away.

Any idea how to solve this? thanks

Support for Android libraries?

Hello,

I would like to use your library in one of my Android library module. Is-it possible?
Right now I have this error when I include the apply plugin line in the module:

Error:Cannot get property 'externalNativeBuild' on null object

Thanks

Cipher.so in an Android Library

Can this library be used in an android library?

I have placed the apply plugin: 'cipher.so' but I am unable to build the project. I keep getting the error, cannot read 'externalNativeBuild' on a null object

Move CmakeList.txt generation after clean task

Thank you for the nice plugin! 👍

While trying to replace my own implementation with this, I ran in to a somewhat a problem, so maybe some one else is also experiencing this.

I like to sometimes run a clean task before building my project (mostly when deploying), and with that task in place the compiler game me an error that the file specified in the externalNativeJsonGenerator.makefile property does not exist. Some investigation revealed that the CMakeLists.txt is generated in the afterEvaluate callback witch is executed before the clean task, so on the clean task the file is deleted.
So I was wondering if it is plausible of moving the generation after the clean task?
Maybe it can be hooked to after/before preBuild task?

The issue can be simulated with the sample projects by running a clean when building ./gradlew sample:clean sample:assemble

A problem was found with the configuration of task ':sample:generateJsonModelDebug'.
> File '/Users/darius/workspace/android/Cipher.so/sample/build/cipher.so/cmake/CMakeLists.txt' specified for property 'externalNativeJsonGenerator.makefile' does not exist.

Insecure key storage: secrets are very easy to retreive

Description

The password used to encrypt the secret (when the project is configured to encrypt them) is embedded in the app and can be easily retrieved.

The password used to generate the key (in a weak way but this is an other matter) is stored in the binary as a string constant. And from what I saw, the IV is always 0000 (which is bad, you should use a random number instead).

In AESEncryptor.java

private static byte[] iv = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};

In extern-key.h

#define SECRET_KEY "Cipher.so@DEFAULT"

In cipher-lib.cpp

jstring
Java_net_idik_lib_cipher_so_CipherCore_getString(JNIEnv *env, jobject instance, jstring key_) {
    const char *key = env->GetStringUTFChars(key_, 0);
    string keyStr(key);
    string value = _map[keyStr];
    const char *result = encryptor->decrypt(SECRET_KEY, value.c_str());

It means that you will have to look for strings in the binary which makes it quite easy to find.
Also the password is stored as a constant (read only data). In the ELF file generated with clang this value is stored in the .rodata section.

Reproduction

You first need to unzip the APK to exctract the so file.

$ readelf -p .rodata lib/x86/libcipher-lib.so
String dump of section '.rodata':
  [     0]  HelloSecretKey
  [     f]  9Lh16XTo0e+6tw+oD7jVx9cBTty2WSxRi75FJTEPpbA=
  [    3c]  5d41402abc4b2a76b9719d911017c592
  [    5d]  NkXVm1rkyXcK1SsYkV8l8mgu6BDpwBIt2iqCVjVIQRg=
  [    8a]  58b49c7df6e825734005b0185607e8d7
  [    ab]  basic_string
...

We can clearly identify a the password here: HelloSecretKey. As well as the encrypted secrets 9Lh16XTo0e+6tw+oD7jVx9cBTty2WSxRi75FJTEPpbA= and NkXVm1rkyXcK1SsYkV8l8mgu6BDpwBIt2iqCVjVIQRg=

Then it is easy to decrypt the secrets, you generate the key the same way you did (you should at least use a safe key generation algorithm like PBKDF2 or bcrypt).

echo -n HelloSecretKey | md5sum -
88c5ef0a90786ede576a9cb8ab0190a3

To finish you can decrypt the secret using openssl or whatever

echo "9Lh16XTo0e+6tw+oD7jVx9cBTty2WSxRi75FJTEPpbA=" |openssl base64 -d|openssl enc -aes-128-cbc -d -K "88c5ef0a90786ede576a9cb8ab0190a3" -iv 0000000000000000
Hello From Cipher.so😊

Solution

Sadly, there is no solution I recommend. Developers should avoid to embed secret keys in their application. The problem you try to solve is actively researched and is called whitebox cryptography. Some solutions try to replace AES implementation and a key by a huge lookup table. However all the public proposal have been broken...

In the meantime, you can try to better generate and hide the key. But understand this will never be safe. Here are some ideas:

  • Use a random IV. IV does not require to be hiden. Use a different IV per secret you encrypt.
  • Use a randomly generated key instead of a password. You can have a look to KeyGenerator
  • You can try to hide the key in other sections of the ELF file, maybe in .text area among code
  • You can try to randomize a bit the place where the key is stored so it is different for each project

Can not Add Cipher.so to my project

可以考虑更复杂的加密

很不错的工具,使用方便,提高了反编译的门槛。但是直接把字符串放在 so 里,使用现代工具还是很容易反编译的。比如使用 IDA Pro F5 就能很容易拿到字符串。可以考虑加入汇编指令或者更复杂的加密而非直接讲字符串写在头文件中。

module下的java目录不见了

引用这个库,rebuild一下,调用函数值后,我的module下的java目录竟然不见了。一直找不到....................

Error trying to start sample, no activity.

I can not start the test project. Displays the following error.

Error while executing: am start -n "net.idik.lib.cipher.so.sample/net.idik.lib.cipher.so.sample.MainActivity" -a android.intent.action.MAIN -c android.intent.category.LAUNCHER
Starting: Intent { act=android.intent.action.MAIN cat=[android.intent.category.LAUNCHER] cmp=net.idik.lib.cipher.so.sample/.MainActivity }
Error type 3
Error: Activity class {net.idik.lib.cipher.so.sample/net.idik.lib.cipher.so.sample.MainActivity} does not exist.

Error while Launching activity

Is there any special configuration for proguard?
I run in the 64 bits architecture device.

无限build

使用ndk16,ndk15编译,都会无限build.

feature request:

it would be helpful if we can encrypt array of values (strings/integers) and retrieve them later

Can I remove cipher.so keys from build.gradle after Java client is created?

Can this functionality be introduced to retain previous keys?

I don't know how this works, or even if it is possible.

For e.g. It might look like this.

  1. I created keys.
cipher.so {

    keys {
        password {
            value = 'noonecanfindthis.'
        }
    }

    encryptSeed = 'HelloSe1cretKey'
}
  1. Rebuild the project.

  2. Change/Add keys

cipher.so {
    keep_previous_keys = true
    keys {
        user {
            value = 'meidik.'
        }
    }

    encryptSeed = 'HelloSe1cretKey'
}
  1. After Rebuild, remove keys from build.gradle
cipher.so {
    keep_previous_keys = true
    encryptSeed = 'HelloSe1cretKey'
}

We can do same for encryptSeed as well. Can this be done?

Unable to add cipher.so to my project

Something wrong with default gradle tasks

When I try to run a project from Android Studio, an app is running, but not installed before.

Next command is called (without installation part)

$ adb shell am start -n "com.simplepractice.simple/com.simplepractice.simple.module.launch.LaunchActivity" -a android.intent.action.MAIN -c android.intent.category.LAUNCHER

Nothing changed in pre-launch config
screen shot 2018-02-15 at 11 56 06 pm

I made follow guide, but there is issue. I don't know how to solve, please help me

External Native Build Issues
Build command failed.
Error while executing process C:\Users\DavidSonNguyen\AppData\Local\Android\Sdk\cmake\3.6.4111459\bin\cmake.exe with arguments {-HC:\Users\DavidSonNguyen\Desktop\TestCipher\app\build\cipher.so\cmake -BC:\Users\DavidSonNguyen\Desktop\TestCipher\app\outputs\cmake\cmake\debug\armeabi-v7a -DANDROID_ABI=armeabi-v7a -DANDROID_PLATFORM=android-15 -DCMAKE_LIBRARY_OUTPUT_DIRECTORY=C:\Users\DavidSonNguyen\Desktop\TestCipher\app\build\intermediates\cmake\debug\obj\armeabi-v7a -DCMAKE_BUILD_TYPE=Debug -DANDROID_NDK=C:\Users\DavidSonNguyen\AppData\Local\Android\Sdk\ndk-bundle -DCMAKE_CXX_FLAGS= -DCMAKE_TOOLCHAIN_FILE=C:\Users\DavidSonNguyen\AppData\Local\Android\Sdk\ndk-bundle\build\cmake\android.toolchain.cmake -DCMAKE_MAKE_PROGRAM=C:\Users\DavidSonNguyen\AppData\Local\Android\Sdk\cmake\3.6.4111459\bin\ninja.exe -GAndroid Gradle - Ninja}
-- Check for working C compiler: C:/Users/DavidSonNguyen/AppData/Local/Android/Sdk/ndk-bundle/toolchains/llvm/prebuilt/windows-x86_64/bin/clang.exe
-- Check for working C compiler: C:/Users/DavidSonNguyen/AppData/Local/Android/Sdk/ndk-bundle/toolchains/llvm/prebuilt/windows-x86_64/bin/clang.exe -- works
-- Detecting C compiler ABI info
-- Detecting C compiler ABI info - done
-- Detecting C compile features
-- Detecting C compile features - done
-- Check for working CXX compiler: C:/Users/DavidSonNguyen/AppData/Local/Android/Sdk/ndk-bundle/toolchains/llvm/prebuilt/windows-x86_64/bin/clang++.exe
-- Check for working CXX compiler: C:/Users/DavidSonNguyen/AppData/Local/Android/Sdk/ndk-bundle/toolchains/llvm/prebuilt/windows-x86_64/bin/clang++.exe -- works
-- Detecting CXX compiler ABI info
-- Detecting CXX compiler ABI info - done
-- Detecting CXX compile features
-- Detecting CXX compile features - done
CMake Error at CMakeLists.txt:5 (add_subdirectory):
C:/Users/DavidSonNguyen/Desktop/TestCipher/app/build/cipher.so/cmake/CMakeLists.txt:5
when parsing string
C:\Users\DavidSonNguyen\Desktop\TestCipher\app\build\cipher.so
Invalid character escape '\U'.
-- Configuring incomplete, errors occurred!
See also "C:/Users/DavidSonNguyen/Desktop/TestCipher/app/outputs/cmake/cmake/debug/armeabi-v7a/CMakeFiles/CMakeOutput.log".
Build command failed.
Error while executing process C:\Users\DavidSonNguyen\AppData\Local\Android\Sdk\cmake\3.6.4111459\bin\cmake.exe with arguments {-HC:\Users\DavidSonNguyen\Desktop\TestCipher\app\build\cipher.so\cmake -BC:\Users\DavidSonNguyen\Desktop\TestCipher\app\outputs\cmake\cmake\release\armeabi-v7a -DANDROID_ABI=armeabi-v7a -DANDROID_PLATFORM=android-15 -DCMAKE_LIBRARY_OUTPUT_DIRECTORY=C:\Users\DavidSonNguyen\Desktop\TestCipher\app\build\intermediates\cmake\release\obj\armeabi-v7a -DCMAKE_BUILD_TYPE=Release -DANDROID_NDK=C:\Users\DavidSonNguyen\AppData\Local\Android\Sdk\ndk-bundle -DCMAKE_CXX_FLAGS= -DCMAKE_TOOLCHAIN_FILE=C:\Users\DavidSonNguyen\AppData\Local\Android\Sdk\ndk-bundle\build\cmake\android.toolchain.cmake -DCMAKE_MAKE_PROGRAM=C:\Users\DavidSonNguyen\AppData\Local\Android\Sdk\cmake\3.6.4111459\bin\ninja.exe -GAndroid Gradle - Ninja}
-- Check for working C compiler: C:/Users/DavidSonNguyen/AppData/Local/Android/Sdk/ndk-bundle/toolchains/llvm/prebuilt/windows-x86_64/bin/clang.exe
-- Check for working C compiler: C:/Users/DavidSonNguyen/AppData/Local/Android/Sdk/ndk-bundle/toolchains/llvm/prebuilt/windows-x86_64/bin/clang.exe -- works
-- Detecting C compiler ABI info
-- Detecting C compiler ABI info - done
-- Detecting C compile features
-- Detecting C compile features - done
-- Check for working CXX compiler: C:/Users/DavidSonNguyen/AppData/Local/Android/Sdk/ndk-bundle/toolchains/llvm/prebuilt/windows-x86_64/bin/clang++.exe
-- Check for working CXX compiler: C:/Users/DavidSonNguyen/AppData/Local/Android/Sdk/ndk-bundle/toolchains/llvm/prebuilt/windows-x86_64/bin/clang++.exe -- works
-- Detecting CXX compiler ABI info
-- Detecting CXX compiler ABI info - done
-- Detecting CXX compile features
-- Detecting CXX compile features - done
CMake Error at CMakeLists.txt:5 (add_subdirectory):
C:/Users/DavidSonNguyen/Desktop/TestCipher/app/build/cipher.so/cmake/CMakeLists.txt:5
when parsing string
C:\Users\DavidSonNguyen\Desktop\TestCipher\app\build\cipher.so
Invalid character escape '\U'.
-- Configuring incomplete, errors occurred!
See also "C:/Users/DavidSonNguyen/Desktop/TestCipher/app/outputs/cmake/cmake/release/armeabi-v7a/CMakeFiles/CMakeOutput.log".
C:\Users\DavidSonNguyen\AppData\Local\Android\sdk\ndk-bundle\build\cmake\android.toolchain.cmake
Warning:(63, 98) (include) CMakeLists.txt
Warning:(63, 98) (include) CMakeLists.txt

漏洞百出

1,通过反射JAVA层AES来实现解密,解密方法在JAVA层,显然是极易被破解的
2,密钥固定死了,谁都知道是Cipher.so@DEFAULT
3,反射Packagemanager的签名校验可以有,即使在NDK层同样会被破解,作用不大

Message new items added to project always show

I try install the dependency follow the instructions but Android Studio present allways the message:
"External build files have changed since last project sync. A project sync may be necessary for the IDE work properly."
If rebuild project this error prints:

A problem was found with the configuration of task ':app:generateJsonModelRelease'.

File '/app/build/cipher.so/cmake/CMakeLists.txt' specified for property 'externalNativeJsonGenerator.makefile' does not exist.

Error : Android tasks have already been created.

Error:Android tasks have already been created.
This happens when calling android.applicationVariants,
android.libraryVariants or android.testVariants.
Once these methods are called, it is not possible to
continue configuring the model.

Gradle Error

java.lang.NullPointerException (no error message)
when add apply plugin: 'cipher.so'

Library Going to be Super Useful From Android Pie

This library is going to be super useful from android pie onwards, Because android Pie comes with strongbox, so modifying this library to store encryption keys in strongbox and all other strings as dynamic library will be super awesome. This library can be used for storing encrypted values of hundreds of urls and other private data which needs to be shipped along with the app as dynamic library using strongbox from android pie. So this library is going to be super useful from android pie onwards. We will have an unhackable secure data storage option. Please keep further development of this library and support for android pie. kudos for your great work. More developers will be able to help you also.

com.github.linisme:Cipher.so:0.0.4 -

Getting below error while trying to use below version of library. Please let me know any issues with this version.
repositories {
maven { url 'https://jitpack.io' }
}
dependencies {
classpath 'com.github.linisme:Cipher.so:0.0.4'
}

Logs:

  • What went wrong:
    A problem occurred evaluating project ':app'.

Could not set unknown property 'encryptSeed' for SoExt{keys=[KeyExt{name='ek', value='-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,CA588D9290D69EBB

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.