2

I've been trying to reverse engineer an Android app's communication protocol using a combination of Xposed and Packet sniffing. Most of the packets the app sends have this header set:

Content-Type: application/octet-stream

which leads me to beleive it is some sort of byte array. The sniffed packet body is encoded in something I do not recognize, but thanks to Xposed, I can get the decoded version. This is what I receive from the server: http://i.imgur.com/lIV6BiQ.png (raw data is at http://bit.ly/2g5JKgH ). I've tried various ways of decoding it to no avail. After hooking some methods in Xposed which receive the final, decoded data, I found that the decoded version of the data I was sniffing is this:

{"miis":[{"owner_player_id":"12bea2c3d7654b66","position":"12bea2c3d7654b66"}],"SAKASHO_CURRENT_ASSET_REVISION":"","SAKASHO_CURRENT_MASTER_REVISION":"b324a24d2cf7cd0effb2941e9f5e515456e9e82d","SAKASHO_CURRENT_DATE_TIME":1480231467}

I'm not sure how it got decoded, but I have some clues. First, the encoded packet has a size of 183 bytes, while the decoded version has a size of 231 bytes. This leads me to believe it's using some sort of compression. The client also sends an Accept-Encoding: gzip to the server which supports this, but after decoding it using gzip, I still get unreadable data, which I think means there is some sort of encryption going on. Looking at the app's code, translated from smali into a rough java equivalent, this is the method that supposedly takes in a byte array and spits out a String

public static String a(byte[] bArr) {
        if (bArr == null) {
            return null;
        }
        try {
            return new String(bArr, "UTF-8");
        } catch (Throwable e) {
            throw new RuntimeException("Can't happen!", e);
        }
    }

however, while trying to replicate this in my own Java program, I always get the original strange character representation of the data.

What I'm wondering is, how does the original packet data get to the final, uncompressed json structure, and if it's a general encoding method, or one the app developers made themselves.

Thanks in advance.

  • Is Xposed open source and/or does it have a "verbose" flag so you can see what it's doing? – barrycarter Nov 27 '16 at 20:47
  • Xposed is open source, but it is not the app i'm trying to reverse engineer, it's what i'm using to see what that encrypted text turns into, by hooking methods in the app I am looking at – dylanpdx Nov 28 '16 at 2:41

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.