1

I am trying to reverse engineer an unknown JSON binary serialization format found in a request-response pair between a mobile app, and a server.

Does anyone recognize this? I've attached the first 640B of 68 request and response pairs

Request data: https://termbin.com/4atc

Response data: https://termbin.com/04ib

Update: Response data(ungz): https://termbin.com/31va

One full req: https://termbin.com/5sa7

One full resp: https://termbin.com/m2wy

Based on the embedded string, I thought the encoding was CBOR RFC7049 based on the Type, Length, Value encoding, 0x78 0x6b followed by 107 characters.

00000180: e807 4100 0878 6b4e 4641 4e44 524f 4944 312d 5052 562d 502d 4c33 2d53 414d 5355  ..A..xkNFANDROID1-PRV-P-L3-SAMSU
000001a0: 534d 2d47 3933 3546 2d34 3434 352d 3030 3030 3030 3030 3030 3030 3030 3030 3030  SM-G935F-4445-000000000000000000
000001c0: 3030 3030 3030 3030 3030 3030 3030 3030 3030 3030 3030 3030 3030 3030 3030 3030  00000000000000000000000000000000
000001e0: 3030 3030 3030 3030 3030 3030 3030 305f 3531 0950 7673 c75e e626 663d b4f0 5e93  000000000000000_51.Pvs.^.&f=..^.

According to RFC7049 Table 5, this is a UTF-8 string.

   +-----------------+-------------------------------------------------+
   | Byte            | Structure/Semantics                             |
   +-----------------+-------------------------------------------------+
   | 0x78            | UTF-8 string (one-byte uint8_t for n, and then  |
   |                 | n bytes follow)                                 |

However, I am still unable to decode the entire message. Any pointers appreciated!

Improve this question
2
  • 1
    Are the responses all 640 Bytes or are they longer?
    – pythonpython
    Dec 15, 2019 at 1:12
  • 2
    Did you try to look at the Android application? Odds are they just use a lib so either it's directly visible in decompiled code or possibly a native binary which might give it away.
    – Johann Aydinbas
    Dec 15, 2019 at 11:47

1 Answer 1

Reset to default
1

1f 8b is gzip header magic so try decompressing it first, it may just be raw json

Improve this answer
1
  • 1
    Thanks Igor for your response. That's correct, the resp was gzipped encoded. The responses now has the same header d9d9 as the requests. I've updated the description with the unzipped responses, and a full request/response pair.
    – Joe
    Dec 12, 2019 at 18:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.