About the author. I’m Colin Xiao — an independent reverse engineer, mostly working solo on contract jobs. I dig into compiled code of every kind, including but not limited to: Android and iOS apps, x86/x64/ARM native binaries, packers and obfuscators, DRM and license checks, network protocols and APIs, crypto and signature algorithms, malware, game binaries, and embedded/IoT firmware. I also handle large-scale data collection and vulnerability research. If you have any project in mind, I’d be glad to take it on — whatever it is, as long as it’s within my wheelhouse. Just reach out. You can reach me on X at @colinxiao_lab or on Telegram at https://t.me/ColinXiao666.

This research is published for educational and defensive purposes. The target sample is anonymized throughout.

Analyzing the mtgsig 2.4 Signing Algorithm

1. Introduction

1.1 The target app

Y29tLnNhbmt1YWkubWVpdHVhbg==

(The package name of the app under analysis, base64-encoded. The platform itself is anonymized throughout this writeup.)

1.2 Prior work

1.3 The mtgsig parameters

a0: mtgsig version (this writeup covers 2.4)
a1: appkey (fixed for a given app version)
a3: Android device version
a4: timestamp
a5: encrypted device info #1
a6: fixed value
a7: xid
a8: dfp
a9: encrypted device info #2
a10: the random value XORed into the a2 parameter during encryption
x0: fixed value
a2: the sign value

Colin Xiao — I take on contract reverse-engineering work, and writeups like this are how I show what I can do. If you need help with anything in this space — including but not limited to the areas I cover above — I’m available. No project is too big or too small — if it’s reverse engineering and I can do it, I’ll take it. DM me on X (@colinxiao_lab) or Telegram (@ColinXiao666).

Get in touch