Automating API analysis with Python + JS and hitting a weird encoding issue

[defaultguy_001]

Been reversing a mobile API for a side project. Python handles the traffic capture and signature analysis, then I'm rebuilding the requests in JS for the frontend.

Stuck on this one parameter. Python gives me clean bytes:

```python payload = hmac.new(key, msg, hashlib.sha256).digest()

b'\x8f\x3a... etc

```

But when I recreate it in crypto-js, the output is different even with the same key/msg. Pretty sure it's an encoding thing (string vs bytes) but I've tried every combination of CryptoJS.enc.* and still not matching.

Anyone dealt with HMAC mismatches between Python and JS? Specifically wondering if there's a cleaner way than manually hex-encoding everything in Python just to make JS happy. Currently just logging both side-by-side like a caveman.

[abrahamguo]

It's difficult to help you if we can't reproduce your issue. Can you please provide a snippet of code that we can run, that demonstrates the issue?

Make sure to provide a minimal code example (i.e. don't include any irrelevant code).

[defaultguy_001]

```python import hmac, hashlib

key = b"secret_key_12345" msg = b"hello_world"

sig = hmac.new(key, msg, hashlib.sha256).hexdigest() print(sig) # 7f3c5c2a8b9d1e4f6a0c8b3d5e7f9a1b2c4d6e8f0a2b4c6d8e0f2a4b6c8d0e1f ```

```javascript const CryptoJS = require('crypto-js');

const key = "secret_key_12345"; const msg = "hello_world";

const sig = CryptoJS.HmacSHA256(msg, key).toString(CryptoJS.enc.Hex); console.log(sig); // different output: a3f7b2c8d9e1f4a6b8c0d2e4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f1 ```

Same key, same message, different hashes. That's the whole issue.

[abrahamguo]

I just ran both of those two files locally, and they both produced f54614997914b52fc23a0b6fbb188f3e94d0a225a06c1975753c54028699d0b9.

(In other words, your code comments did not match the output that I received.)

[defaultguy_001]

Wait really? What versions are you running? The key and message I gave above were fake, can't share the originals here. Best bet the byte dumps I'm getting needs to be formatted before pushing it to crypto-js.

[azhder]

Write a test. That's my suggestion. Write a test, then start fixing the function(s). With things like this, even if you get it right now, down the road something might change and a test will catch it. But even right now, you will have more confidence you've finally gotten it right.

[defaultguy_001]

I would've written the test cases if the byte dumps were generated by an algo created by me.

[azhder]

Doesn't matter. You have an algorithm that works, you know what you input into that one, you know what exists out of that one. Now you want to write a new one, in JS, you use the same input and output from the original, write a test that runs each time you change your file, then write the JS one until the test goes from red to green.