I find this pretty hard to follow. Would you be open to writing a longform version of this aimed at the tutorial level?
Reading between the lines, I would guess you're trying to demonstrate that you really know what you're doing. Maybe as a proof of concept for possible employment opportunities. If so, that's great! Good luck.
But if I were interested in reverse engineering some other app, I don't think I could understand what you've done well enough to use these techniques on that app. Except maybe the breakpointing within `fuck_debug`, that was pretty slick and easy to follow.
After that you can explore this tutorial on frida: https://securitygrind.com/bypassing-android-ssl-pinning-with... These two techniques will give you some more basic knowledge of how app reversing is done. :)
I absolutely appreciate these posts, this guy spent WEEKS delving into the depths of SnapChat just for the joy of discovery.
Maybe a good classification would be that part 1 is detailing a number of obfuscation techniques and the key thing to take away is that all of them CAN be bypassed.
https://hot3eed.github.io/2020/06/18/snap_p1_obfuscations.ht...
As the article says, the client also responded with some code. What I think was happening: the client was responding with portions of its own executable memory, which could be checked by AOL servers.
That way for MSN to emulate that behavior, it would need to have the AIM client's executable code inside itself, which would be an easy win in a copyright lawsuit.
HTC and Palm also engaged in the back-and-forth, when Palm attempted to get their OS to sync with iTunes.
Doesn't that make obfuscation kind of pointless? Even if your knock-off app knows everything about the API of the original service, it won't be able to use it because it is not the genuine app or maybe it is but it is not running in a real iOS/Android device.
Or maybe this is only meant to include non-Android certified phones (= China)?
[1]: https://developer.apple.com/support/app-store/ [2]: https://magiskmanager.com/
Devicecheck have no such problem though, but it doesn't really feel designed for the use case - you need to implement an anti replay system yourself.
Also, why not patch the binary? I think iteratively patching out protections (in a repeatable, versioned way) would be my approach. It is then applicable to other binaries as well.
I wonder about something, how long did it take?
Prediction: Just me.
By the way, love both articles. Thanks for taking the time to share.
