So I've decompiled an APK and I believe that I have now is the source code (most with a bunch of random variables and method names, but from what I've read this is completely normal)

the app in question uses a signature in the registration request that changes everytime, this signature is not received from any request preceding it so I assume the only way to find out how this is being generated is through the APK. Do you guys have any direction on where exactly I should be looking?


The signature is likely a hash based on some string value and the current date (potentially milliseconds since the epoch). This question is impossible to answer without the source code, but try looking in the code for any references to constant string values and references to Time() or Calendar().

  • I've made a bit of progress. It seems that the source code is using the BuildConfig.VERSION_NAME value as the signature when sending off the request, funny thing is, in the manifest this value is set as null, or (""), so I think it may be using this value and some sort of time like you said? What do you think?
    – Reece
    Jan 24 '17 at 23:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.