All right, guys, to finish this chapter, let's take a look at the meta directory and see what files
are in there and how those values get calculated.
It's not that necessary to know, because the only thing I can imagine of that you need to know this
is in case of any tamper detection, but at least it's nice to understand the whole structure of this,
and it's really not that complicated.
So I open up the directory.
We have to compile this application.
And beat it back again and then they compiled it again.
So this one right here in the last step, we have seen that.
Now we've got the meta directory that contains our cert info.
But what's in there?
Here we have the RSA file and this is the signature.
We've got the ASF extension, which is the signature file and we've got the MEF extension, which is
the manifest file.
So let's have a look at the manifest EMF and see here we can see all those single android files that
are packed in this binary.
We have, for example, this game file right here, which is a music file.
And underneath this file we got the SHA1 digits, which seems to be a base64 encoded string.
We can see this because of the equal sign at the end.
Now let's take the string and have a look what this is.
I open a new terminal and I use echo and pipe the through basic C for the HD for decode and here we
can see okay this looks some binary like this looks like some binary content.
So we pipe this through x 60 and here we can see, okay, this one looks like a hash.
So this is the hash of the file.
But now the question, what is an hash?
A hash is some kind of one way operation.
So you put your your throw your input into some kind of complex algorithm and at the end you get this
representation of your single bits.
So this is some kind of, let's call it checksum.
It's not really a checksum, but this makes things a little bit easier.
And yeah, this is some kind of checksum about your file.
And the nice thing about hash is, is you cannot reverse this, so you can throw your input into those
complex algorithms and you get this value, but you cannot return from this value back to your input.
And what's also nice, if you change one single bit in this in your input, you get a complete different
hash.
I will show this to you.
So we now calculate this SHA1 digest of the original file and then we make a modification and then we
look at the difference.
And the reason why you might need all this stuff right now is regarding to tamper detection.
Now we just calculate this hash and how can this be done?
Well, first let me go into the directory, because otherwise I have to provide the whole path.
And yeah, this would be super ridiculous.
So assets, music and we've got this game file now.
I open this directory right here to show you this file first.
So here we have the game origin.
If I played this, you would see or here I guess you would here not see this some kind of background
music.
So this is the game music.
All right.
Now let's calculate this hash and this can be done with openness and openness.
This should be installed on your distribution already on your Linux distribution.
And it's a super nice handy tool.
We use open SSL and we say SHA one because we want to generate a new SHA one, some of this file and
we say read this file in binary mode and then we have to provide define name which is game Ogg and here
we can see, oh, this looks pretty identical, but to make sure we base64 encode this one and here
we can see.
Yes, these are now identical.
If we compare those two strings, these are identical.
And we can also see this is the SHA1 digests right here.
And so this fight contains all those SHA1 digests of all files.
Now let's have a look at the signature file.
So going to the old directory original meeting and now let's have a look at the signature file.
The signature file looks similar to the manifest MF at the first look because we have now again all
those files and the corresponding SHA1 hashes.
But let's have a look.
This one here seems to be different.
And the reason why this is the case is this file makes a sharp one hash over the manifest m f entries,
name and sha one.
I know this is a little bit complicated, but let's break this down into single pieces.
Therefore, I open those files side by side.
Okay.
On the left, we've got the manifest move.
And on the right we've got the signature file.
On the left, we've got a SHA1 hash over this file within the nametag.
And on the right we've got a signature over the name tag and the hash in the manifest file.
So first of all, don't worry, because all these steps are being performed automatically by the signing
process.
If you sign an application, this is done automatically.
So you don't need to know how to do this.
But it's good to know how these values are being generated because there might be this one application
where you have to modify or adjust this hash in this file right here, and then this knowledge comes
handy.
All right.
To recap this on the left side, manifest MFW, we've got all hashes for these files.
And on the right we've got a new hash about the file name and the hash that has been calculated before.
So these files just make sure that the application or the files are in a correct state regarding to
tamper detection or regarding to corrupted files.
So if a file has been damaged, this file can notice this fact.
All right.
This is all you need to know about those two.
The last one is the signature.
We also take a look at this one, of course, and afterwards we take a look at the real world vulnerability
regarding two signatures and yes, signing an application.
So here we have to address a file, which is the signature of this application, and we can simply print
this out.
So I open a new terminal and this time we use the key tool command, we use print third and we provide
this file error as a I'm going to enlarge this to give a nice overview.
And here we can see, yes, this file has been signed with this following certificate and this was our
certificate during the signing process.
But we cannot do something with this.
This is just a public information.
And unless we do not have the private key, we cannot use this.
But it's good to know how you can read those stuff because you might find additional information, maybe
some kind of additional company that maybe has this app developed or things like this.
So it's worth taking a look into this file right here.
All right.
And that's the last point.
So for now, you can completely understand the whole Android structure.
You can see.
All right.
And this is the last point for now.
So we have.
All right.
And that's it regarding to the meta directory.
Now you have a fully understanding of the whole Android application structure, which is super nice.
And this is the base year during our course for further exercises and yeah, challenges and things like
this.
Cut.
All right.
That's all you need to know about the media directory.
We have finally finished this whole theory part about the Android app structure, but it's really good
to know how all these things come together and how these works.
And yeah, these are also super handy for our further challenges.
So in the next section we take a look at a real world example, a real world vulnerability, and then
finally you have your master challenge for this chapter where you have to modify those resources and
now you are equipped with all the skills you need to do this challenge.
So feel free to browse through all this directory and make yourself familiar with this.
And if you have any questions, yeah, please drop them in the comment section below.
And for now I am looking forward to see you in the next section.