is anyone aware if this project is already being done by someone?
if not, perhaps we can brainstorm how to go about this, now that the pdf for the revised nwt is out.
a couple initial impressions:.
jgnat and Simon,
Thanks - it was fun believe it or not :) It got me away from the normal development routine.
One thing I noticed, once I started to partse through the text for the verses in NWTx2, they do not spell out numerical figures. An example if this from Genesis 5:15:
1984 version: "And Ma·hal′a·lel lived on for sixty-five years. Then he became father to Ja′red."
2013 version: "Ma·hal′a·lel lived for 65 years and then became father to Ja′red."
MMM
is anyone aware if this project is already being done by someone?
if not, perhaps we can brainstorm how to go about this, now that the pdf for the revised nwt is out.
a couple initial impressions:.
Apognophos,
It would be interesting to know if the PUB files could be read with this method. It is important to note: The WT would have to use, not only the exact same method, but would also have to use the exact same secret keys and initial vector to the AES encryption. Just a single byte change and it would no longer work. Also, after the decrypt, you have to use the right unzip code. The andriod app uses the java Inflator/Deflator (for obvious reasons). But the WTLIB doesn't run in the java virutal machine (unless they changed something!) and so they might be using a different process completely. It would be interesting to see if just the decryption only yields the text.
Actually, I think there is an easier way to get the content out of the WTLIB. It would require getting WTLIB and using the Spy++ app that comes with Visual Studio to examine the window structure. Once you know that you can get the handle (GetWindow() API function) to get the top level window and traverse into the window the WT lib uses for users to traverse the document. Then you can send in clicks and other messages to automate it, and pull the text out of the app directly - with no need to go through the decyption.
MMM
is anyone aware if this project is already being done by someone?
if not, perhaps we can brainstorm how to go about this, now that the pdf for the revised nwt is out.
a couple initial impressions:.
Apognophos,
This is happening now:
MMM
is anyone aware if this project is already being done by someone?
if not, perhaps we can brainstorm how to go about this, now that the pdf for the revised nwt is out.
a couple initial impressions:.
All,
So it looks like the NWTx2 version is out on the web. Good. I will parse through that very easily now. But interestingly enough, just a few hours after they posted the online NWTx2, I was successful with castthefirststone's method, using the SQLite database. I was actually surprised at the lengths they went to in order to keep someone from just reading the publication text from the database. After my previous posts, I decided to step through the Dalvik java assembly code one line at a time to figure out the logic. I used the OP codes here: http://pallergabor.uw.hu/androidblog/dalvik_opcodes.html.
The top of the Deobfuscator class contains this byte array, 32-bytes:
.array-data 0x1
0xbet
0xeet
0xb8t
0x3bt
0xe3t
0xf0t
0x45t
0xf6t
0x43t
0x1dt
0xe1t
0x2et
0x26t
0xa9t
0xe4t
0x8t
0x2ct
0xc6t
0x74t
0xc2t
0x67t
0x44t
0xadt
0x36t
0x3ft
0xe9t
0xe0t
0xaft
0xd8t
0xb6t
0x8bt
0xf7t
.end array-data
But that is not the secret key for decryption. The AES descryption is 128 bit, it needs a secret key that is 16 bytes (not 32), and an IV (initial vector) that is also 16 bytes. Stepping through the code, here is how they come up with those values.
1. Take the meps language symbol, publication symbol, and the year and create a string separated by underscores: 0_nwt_2013.
2. SHA-256 hash that string into a 32-byte array, same size as the constant array above.
3. Derive the secret decrypt key from XORing the first 16 bytes of the constant array and the SHA key.
4. Derive the IV array from XORing the last 16 bytes of the constant array and the SHA key.
After this is all over, you are presented with a byte array that you need to "inflate" or decompress. For this I used J#, and got ahold of the java Inflator class. The rest of this hack was written in VB.NET.
So here is what you get when its all over:
Here is the VB code:
hmmm, code doesn't work out very well.. let's try images...
Java code for the Inflator object. Compiled to DLL and referenced in VB.NET project:
:)
Apognophos, I will probably get the NWTx2 version from the web later. Still easier.
MMM
is anyone aware if this project is already being done by someone?
if not, perhaps we can brainstorm how to go about this, now that the pdf for the revised nwt is out.
a couple initial impressions:.
YAY... I just cracked the DB... I mean just a few minutes ago. Dang, they must have put that out there just today, because I checked earlier. Oh well. I can take it from the web easier. But I can still say that the DB didn't beat me!
Hacking info to follow...
MMM
is anyone aware if this project is already being done by someone?
if not, perhaps we can brainstorm how to go about this, now that the pdf for the revised nwt is out.
a couple initial impressions:.
@stapler99: when this is all done we should know each and every difference between the two versions.
MMM
is anyone aware if this project is already being done by someone?
if not, perhaps we can brainstorm how to go about this, now that the pdf for the revised nwt is out.
a couple initial impressions:.
Apognophos,
If that is what the WT is thinking, then after I figure it out (if, in fact I do figure it out), I'll post sample code to use their format both in java and .NET :)
But I think it is utterly stupid, since they have all the content online (just not the NWTx2 yet). When its online, you can link to it... you can just download it whenever you want. The content is there for anyone. It took me 3 hours to create an app to peel off the entire bible from their website, all parsed into separate records. Seems silly to obfuscate it, then just put it out there for anyone to link to.
MMM
is anyone aware if this project is already being done by someone?
if not, perhaps we can brainstorm how to go about this, now that the pdf for the revised nwt is out.
a couple initial impressions:.
Apognophos,
Yes, the key is 20 bytes - its in there, but you have to parse through assembly to get it. Perhaps I'll take the hex for one of the scriptures, convert it into the byte array, then try to AES decrypt with the key ... then try to unzip... good lord.
You are right the ZIP isn't buying them much space, but it is another layer in their obfuscation - even though I have no idea why they would want to obfuscate that. Just odd.
MMM
is anyone aware if this project is already being done by someone?
if not, perhaps we can brainstorm how to go about this, now that the pdf for the revised nwt is out.
a couple initial impressions:.
OK, 2:39 AM - I thought I would give everyone an update on what I found. After trying various encodings, I decided to re-visit the entire .ZIP package that castthefirststone provided to me. The tool that he used to unpack the android APK file, as it turns out, can take the compiled java and turn it into a decompiled *.smali file. Now, I have decompiled java in the past, and for the most part, you can bring *.class files back to somewhat understandable java code. However, as it turns out, *.smali files are about as far back toward java as you can get because a lot of information about the original code is lost during the compile process. Yes, I did find some people out there trying to do a further decompile, but that process is in its infancy.
Anyway, the *.smali files are very much like a java assembly code. They are not as readable as java... but if you want to, you can find what you need. So what I did was seach the entire JW app for the occurance of the string "bible_verse". My goal was to find a SQL query and trace back to as far as I could until I found how the DB data is interpreted. The search did locate many occurances. I chose a simple one. You can see in the assembly-like language the SQL query is created and the verseIndex is appended to the end of the SQL query as a string, using a StringBuilder. Then the ";" is added. The final highlighted line means that the StringBuilder.toString() method is called and the result is stored in a variable "v3"...
"v3" holds the SQL query string. That string gets submitted to the rawQuery() function, part of the SQLite library. It returns a Cursor. The first record is peeled off the top, finally the field is selected, and the getString() is called, followed by valueOf(). This value is placed in variable "v2" and then passed to.... drum roll!!!
A class called PublicationDef.Deobfuscator...
A quick peek at that class shows that the process looks to be an AES decryption (the AES cypher is not shown in the following shot) followed by an unzip. So the data we see in the content field of the WT database is most likely a compressed text, followed by an AES encryption. And to get it back we would have to do the opposite (as shown in the picture, AES followed by an inflate). Simon, that is why you don't see the ZIP header there.
Now on to a little sleep... I'll have to decide whether or not this is worth pursuing later...
MMM
they seem determined to undermine the us democracy and shut the government down hurting employees and veterans.. what a despicable bunch, hope they get their asses kicked for what they are doing..
designs,
Everytime we go all Free Market with loose consumer protections and we go all crashy crashy burn burn.
Not true. The government, especially the FED, is the cause. But capitalism gets blamed every time, and it has nothing to do with capitalism or the free market. It is the deviation from the free market that causes the bubble in the first place.
The Boards of Directors can steer excessive bonuses while denying coverage to policy holders. ACA should be a protection against those abuses.
I get your frustration with insurance companies. But we use insurance for paying medical bills. It should not be that way. Insurance should be used for insurance - for insurable events. If you mandate these insurance companies conver things that are not insurable events (a standard colon screening at 50, for example. or birth control), they will simply roll that cost into the premiums, tack on 10% for paperwork and CEO bonus expansion.
Put Elizabeth Warren on the ACA oversight committee.
Put anyone you want there. It won't matter.
MMM
