Reversing Blizzard’s Authenticator #

When you sign up for Blizzard’s TOTP authenticator, they force you to use a Blizzard app to generate the TOTP codes. I wanted to keep backups in a standard format and just use my password manager. However, there does not seem to be an easy way to convert the Blizzard authenticator to a normal TOTP code. However, we can extract the secret key from the app’s shared preferences and decode the secret key.

Extracting the secret key #

The Blizzard app stores a hashed version of the key in a shared preferences file. On Android, this file can be easily extracted by looking at the “/data/data/com.blizzard.bma/shared_prefs/com.blizzard.bma.AUTH_STORE.xml” if you have root.

If you do not have root, then normally we would be out of luck. However, Blizzard set the “android:allowBackup=“true”” flag in the Blizzard authenticator apps application manifest. This offers a rootless way to get the value of the “com.blizzard.bma.AUTH_STORE.HASH” shared preference. Check this post for more details.

Unhashing the Key #

We can pull the Android apk using ADB to get the compiled APK. Then we can run the file through something like BytecodeViewer to get a nice Java version of the code. After reading through the token and TOTP generator classes, Blizzard is simply doing a standard SHA1 based implementation of TOTP with a 30 second period. One interesting difference from standard implementations is the addition of a time offset field that is added onto the server time. In my case however, the time offset was around 900 milliseconds so it didn’t really make a difference.

The “AUTH_STORE_HASH” that is stored in shared preferences is hashed using a hard-coded mask so the key is not stored directly in shared-preferences. But this is pretty weak since it’s hard coded and can be easily reversed as follows.

import java.util. * ;
import java.lang. * ;
import java.io. * ;

class Dehasher {
  private static final byte[] HASH_MASK = new byte[]{57, -114, 39, -4, 80, 39, 106, 101, 96, 101, -80, -27, 37, -12, -64, 108, 4, -58, 16, 117, 40, 107, -114, 122, -19, -91, -99, -87, -127, 59, 93, -42, -56, 13, 47, -77, -128, 104, 119, 63, -91, -101, -92, 124, 23, -54, 108, 100, 121, 1, 92, 29, 91, -117, -113, 107, -102};
  private static final String HASH = "00112233445566.. put your hash from AUTH_STORE in here";

  private static int hexCharToInt(char var0) {
    if (var0 >= '0' && var0 <= '9') {
      return var0 - 48;
    } else {
      byte var1 = 97;
      if (var0 < 'a' || var0 > 'f') {
        var1 = 65;
        if (var0 < 'A' || var0 > 'F') {
          return 0;
        }
      }

      return var0 - var1 + 10;
    }
  }

  private static byte[] applyMask(byte[] var0) {
    for (int var1 = 0; var1 < var0.length; ++var1) {
      var0[var1] = (byte)((byte)(var0[var1] ^ HASH_MASK[var1]));
    }

    return var0;
  }

  public static byte[] hexStringToBytes(String var0) {
    int var1 = var0.length() >> 1;
    byte[] var2 = new byte[var1];

    for (int var3 = 0; var3 < var1; ++var3) {
      int var4 = var3 * 2;
      char var5 = var0.charAt(var4);
      char var6 = var0.charAt(var4 + 1);
      var4 = hexCharToInt(var5);
      var2[var3] = (byte)((byte)(hexCharToInt(var6) & 15 | var4 << 4));
    }

    return var2;
  }

  public static void main(String[] args) throws java.lang.Exception {
    String data = new String(applyMask(hexStringToBytes(HASH)));

    System.out.println("Secret (hex): " + data.substring(0, 40));
    System.out.println("Serial: " + data.substring(40));
  }
}

Then we can simply convert the secret hex-string to base 32 with something like Cryptii. This base 32 string can be encoded into a standard OTP url and used in any TOTP generator.