mbcp/mbbpatch
mbcp/mbbpatch
Watch
2
Fork
You've already forked mbbpatch
 0
Code Issues Pull requests Releases 11 Wiki Activity

docs: update about new checksum measure

Browse source 
with v6.5.15+, the checksum is enhanced...

Signed-off-by: Cuynu <cuynu@proton.me>
This commit is contained in:
Cuynu 2026-09-12 03:20:40 +07:00
commit db71084199
Signed by: cuynu
GPG key ID: 1F01341D0B42B51A
2 changed files with 55 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

21
README.md
View file

@ -18,6 +18,18 @@
>
> Older releases (v6.4.90 or older) has mismatch commit ID with this new repo, for reference to the exactly same commit, see [MBCP_VersionReference.md](MBCP_VersionReference.md) in repository.
## Checksum
- More information about checksum measure :
<details>
- Since v6.5.15+, the checksum is more strict, see [this explain](/docs/checksum_newapp.md) for more details.
- The checksum measure (which throws GW934 as response) is known enabled from the server-side (v6.4.64 works since days 0, but return with GW934 error after 11 days), it requires client (MBCP/MBBank) app to sent the SHA256 hash of 3 app libraries `libapp.so` | `libmbshield.so` | `libclosestmadagascar.so` and all of 5 dex files (classes1->5.dex) to the server for comparing hash, and if it doesn't match, the server will prevent the app from logging in with GW934 error : `Re-install app to continue using app.`
- The other function (eg: DigitalOTP) that works without logging in still works.
</details>
## Introduction
> Fact : MBCP / MBZDefend-Fix is my "hobby project", I maintain it in my free times :>
@ -338,15 +350,6 @@ Early note : When I created @mbbmod channel back in 2023, no one knows it for mo
- [x] Adapt new v6.4.68 trungthu theme
## Old measure
- More information about GW934 measure :
<details>
- The `GW934` error is known enabled from the server-side (v6.4.64 works since days 0, but return with GW934 error after 11 days), it requires client (MBCP/MBBank) app to sent the SHA256 hash of 3 app libraries `libapp.so` | `libmbshield.so` | `libclosestmadagascar.so` and all of 5 dex files (classes1->5.dex) to the server for comparing hash, and if it doesn't match, the server will prevent the app from logging in with GW934 error : `Re-install app to continue using app.`
- The other function (eg: DigitalOTP) that works without logging in still works.
</details>
## Credits
- [apktool](https://github.com/iBotPeaches/Apktool)

43
docs/checksum_newapp.md Normal file
View file

@ -0,0 +1,43 @@
# MBBank v6.5.15+ checksum list
in first day of v6.5.15+ released, there is no such checksum, it still the same as before, only until 4 days since release, there is toggle in backend that enable the check, remain unaffected for older base
same as v6.4.63+, in first day nothing happens, no checksum, but after 9 days, checksum appears.
if one of these is modified (even one bit) will trigger checksum fail that refuse to accept login from
all of this is both app & server side, server side ask for checksum, the client get sha256 hash and send to server side `getSHFiles` and if something mismatch, the server side will refuse to login and return GW934 as response to app
```shell
# outside assets (v6.5.15+)
mb.apk/AndroidManifest.xml
mb.apk/lib/arm64-v8a/*.so # previously is libapp / zshield & zdefend libs only since v6.4.63+
mb.apk/lib/armeabi-v7a/*.so # previously is libapp / zshield & zdefend libs only since v6.4.63+
mb.apk/classes*.dex # since v6.4.63+
# in assets
# zimperium (v6.5.15+)
mb.apk/assets/zimperium_local_model_randomized_filename*
mb.apk/assets/zimperium_encrypted_dex_folder/*.odex
mb.apk/assets/*.szip # zshield encrypted files
# vkey vtap (v6.5.15+)
mb.apk/assets/firmware # vkey vtap fw
mb.apk/assets/profile # vkey vtap profile
mb.apk/assets/signature # vtap vkey signature
mb.apk/version.json # vtap vkey vos info
mb.apk/voscodesign.vky
mb.apk/vkeylicensepack
# singalarity ekyc files (v6.5.15+)
mb.apk/assets/sgprofile
mb.apk/assets/smart_ekyc_finall.zip
mb.apk/assets/media_init_data
# flutter assets (v6.5.15+)
mb.apk/assets/flutter_assets/assets/fonts/*
mb.apk/assets/flutter_assets/fonts/*
mb.apk/assets/flutter_assets/FontManifest.json
```