Snapchat Reverse Engineering - Part 1 - Snapchat Account Creator Bot - API based

[ReverseEngineering]

Snapchat Reverse Engineering - Part 1 - Snapchat Account Creator Bot - API based


Update 4 (June 16th, 2024)


Progress:

OOOOOOOOOOOOOOOOOOOOOOOOOOOOOO - around 85 %
0 - - - - - - - - - - - - - - - 50 - - - - - - - - - - - - - - 100

Backend - Linux servers: 100 % complete
Frontend - GUI, API: ~ 30 % complete


Account stability/ban rate:

Since June 8th, 2024: 0,00 % (0 of 30,000+ accounts locked/permanently locked, banned)


5G multi proxy setup:

Let's be honest, 5G IP addresses are simply the best when it comes to automating the processes of a social media platform like Snapchat with bots. Especially the mass creation of accounts (currently 1,000 to 3,000 accounts per day - with further increases in the numbers).

Unfortunately 5G IPv4 proxy services are either hard to find or extremely expensive, since most mobile proxies are based on hardware dongles (USB sticks) from Asia with 4G support only (e. g. Huawei). Well, everything is expensive if you create 3,000 accounts per day. ;-)

So why not create my own redundant 5G proxy setup?

I created a custom hardware solution together with custom software. Did you expect something else from me? hahaha

One standard industrial part of each custom proxy server:

The Snapchat account creator bot requests a fresh, unused 5G IP IPv4 address from West Europe for the duration of the account creation and email verification. As soon as the workflow has been completed and a few warm up tasks have been absolved, the bot requests a new IP address and starts the workflow again.

The IP address space has a total of theoretical 16,581,375 IPv4 addresses, experts would call this a /8 network. [1]

So it's a mix of a static mobile proxy solution and a rotating proxy solution.

Of course all hardware components work with registered, legal SIM cards. So no hacking/phishing will be used to stay absolutely white hat.

Why don't I use IPv6 address space? I guess you know the answer. Or not? ;-)


Vitality and life time checks:

Somebody at a messenger asked me if "aged" Snapchat accounts are really still required for adding friends due to this complex white hat account creation process with currently 0,00 % account loss (since June 8th, 2024).

So I'm going to set up a little workflow to add a few hundred friends right after the creation and also accept a few hundred friend requests. Of course fully software based (no phones, no emulators, no browser emulation, no BS).

Let's see what will happen, and maybe also adjust the setup.



Some easy terms have been used to make it easier for non-professionals to read and understand the concept. For example: I wrote "access tokens", "hard coded" or "encoded" although there is much more behind.


(I am not native English/American, so please excuse any spelling or grammar mistakes.)


Side notes (linked from above):

[1] - CIDR, /8 network https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing


Short updates (random daily work) will be posted at my BHW profile: https://www.blackhatworld.com/members/reverseengineering.1413206/

So maybe you should follow me here at BHW to keep you up-to-date? https://www.blackhatworld.com/members/reverseengineering.1413206/follow

 

[OccultKingdoms]

5G network gives different IPs than 4G? I don't know. I only use LTE.

Wait, I changed my phone, it says 5G. Before it said LTE.

But I think it's the same pool of IPs.

I rotate this and I'm getting 100.100.x.x all the time. First 2 columns don't change almost ever. So it sucks.

 

[ReverseEngineering]

5G network gives different IPs than 4G? I don't know. I only use LTE.

5G is faster than 4G (LTE) here. And it's also a different IP address space (IP pool) here.

I rotate this and I'm getting 10.10.x.x all the time. So it sucks.

This means you have at least a /16 network (see link above). So 255 x 255 IP addresses (excl. broadcast).

* IP address network edited by me

 

[Beklink]

5G is faster than 4G (LTE) here. And it's also a different IP address space (IP pool) here.



This means you have at least a /16 network (see link above). So 255 x 255 IP addresses (excl. broadcast).

* IP address network edited by me

you mentioning the broadcast IPs tells me you have a strong network background, right?

 

[OccultKingdoms]

5G is faster than 4G (LTE) here. And it's also a different IP address space (IP pool) here.



This means you have at least a /16 network (see link above). So 255 x 255 IP addresses (excl. broadcast).

* IP address network edited by me

But third column is usually x.x.110 - 120.x

So it's not much to get.

I used that for account creation on desktop. After a day I exhausted the pool on google.

 

[thebotmaker]

I created a custom hardware solution together with custom software. Did you expect something else from me? hahaha

One standard industrial part of each custom proxy server:

Nice journey, if you don't mind please share more info about the solution and how you built it.

 

[AllOutAnime]

What kind of 5G speed do you get with your device and how much does it cost to obtain?

 

[ReverseEngineering]

you mentioning the broadcast IPs tells me you have a strong network background, right?

I wouldn't call it "strong", but I know how routing works, which hardware is required to open a data center, and I'm also 2 times certified at the RIPE.

So nothing special. ;-)

Why do you ask?

For non-professionals: https://en.wikipedia.org/wiki/RIPE + https://en.wikipedia.org/wiki/RIPE_NCC

Nice journey, if you don't mind please share more info about the solution and how you built it.

As you can see it's one of a few Raspberry Pi with Ubuntu 22.04 Linux (24.04 will follow some day). You see the connection via RJ45 and the power connection. I use the Squid proxy software with a lot of modifications.

Missing at the picture: the external SIM reader ;-)

For the non-professionals: https://en.wikipedia.org/wiki/Raspberry_Pi

The next plan is to "rotate" the SIMs automatically for SMS verifications. I talked to 4 mobile providers about my idea of a possible solution and a cooperation with their "nerd" and recruiting department. They also operate their own "makers space" to recruit people.

What else do you want to know about the proxy solution?

What kind of 5G speed do you get with your device and how much does it cost to obtain?

The speed totally depends. The provider offers 300 Mbit/s downstream and 50 Mbit/s upstream.

But I have to say that I didn't run a benchmark yet. I don't want to view streams, I just want to do some random HTTP/2.0 requests. ;-)

The costs will be between 10 Euro (8 GB) and 20 Euro (25 GB) per month per SIM. But it's the first month, I don't know the volume yet.


* Edit: a few details added

 

[AllOutAnime]

I wouldn't call it "strong", but I know how routing works, which hardware is required to open a data center, and I'm also 2 times certified at the RIPE.

So nothing special. ;-)

Why do you ask?

For non-professionals: https://en.wikipedia.org/wiki/RIPE + https://en.wikipedia.org/wiki/RIPE_NCC




As you can see it's one of a few Raspberry Pi with Ubuntu 22.04 Linux (24.04 will follow some day). You see the connection via RJ45 and the power connection. I use the Squid proxy software with a lot of modifications.

Missing at the picture: the external SIM reader ;-)

For the non-professionals: https://en.wikipedia.org/wiki/Raspberry_Pi

The next plan is to "rotate" the SIMs automatically for SMS verifications. I talked to 4 mobile providers about my idea of a possible solution and a cooperation with their "nerd" and recruiting department. They also operate their own "makers space" to recruit people.

What else do you want to know about the proxy solution?




The speed totally depends. The provider offers 300 Mbit/s downstream and 50 Mbit/s upstream.

But I have to say that I didn't run a benchmark yet. I don't want to view streams, I just want to do some random HTTP/2.0 requests. ;-)

The costs will be between 10 Euro (8 GB) and 20 Euro (25 GB) per month per SIM. But it's the first month, I don't know the volume yet.


* Edit: a few details added

Thank you for the update.

I was referring to the cost of the device.
Where are the antennas?
Usually you need 4 to run 5G.

 

[th3darkknight]

Question, are you generating the tokens via raw code?

 

[ReverseEngineering]

I was referring to the cost of the device.
Where are the antennas?
Usually you need 4 to run 5G.

I put the antennas outside, I will post a picture later.

It's a simple plastic case with everything integrated, so made for outdoor usage.

Question, are you generating the tokens via raw code?

Yes, they are generated based on the original code.

Why do you ask?

 

[lolbrah]

as someone who's got the api reversed, you're making this sound very questionable, if you can generate the header or whatever you wish to call it then there shouldn't be a limit as to how many accounts you can make a day or whatever you wish to call it

not being able to log into the accounts isn't a matter of playing with the settings, it's because your token is flagged which means something is detected which i assume is because you're using a bridge to make the token

the register request doesn't take an email or number field as it's a separate request to-do this

you've made everything sound overly complicated, if you use https://mitmproxy.org/ when you unpin ssl you can see the protobuf schema obviously without the field names but you can get a good understanding of what's inside the request, or you could log the bytes as base64 or hex and use https://protobuf-decoder.netlify.app/ to view the schema in the same way mitmproxy would show you

there's several public frida scripts for Snapchat available on https://github.com, frida is detected but if you use https://github.com/hzzheyang/strongR-frida-android then you'll be fine

i doubt you've done what you claim to have done;

 

[rickty]

I guess Snapchat will collect something like Device Fingerprint, how do u deal with this part?

Thank you for interesting thread

 

[ReverseEngineering]

i doubt you've done what you claim to have done;

Welcome to BlackHatWorld!

I'm glad that you registered today and wrote your first and only post just to reply me. ;-)

"Yes, you are right. I don't have any clue about reverse engineering, bot development, protobuf and especially how Snapchat works." Not.

But, wait, what's that? ;-)

Sorry, but I don't reply to offending posts in detail.

This is BlackHatWorld, the public forum section. I will never post my latest little secrets at the public.

I guess Snapchat will collect something like Device Fingerprint, how do u deal with this part?

Thank you for interesting thread

Thank you for your feedback, @rickty !

Since I don't use phones, emulators, browser emulation etc. I have to generate the Android DeviceID, some Google IDs and all device parameters Snapchat retrieves on my own with the bot software. But this is not a big deal.

Snapchat for Android contains a lot more "encrypted" IDs to handle the requests.

The golden times when you could use one single previously generated ID for thousands of friend adding requests are over. Regarding the friend adding/accepting I am not really sad about it. ;-)

 

[ReverseEngineering]

i'd love to hear what type of encryption the token uses (...)

could you please tell me how many blocks are in the token for registration and also what data is inside of the second block?

Please create a thread at the "Hire a Freelancer" forum section for such requests: https://www.blackhatworld.com/forums/hire-a-freelancer.76/

Please notify me after you posted it there. And don't forget to put a US$ amount into your thread, so what you would pay a freelancer to receive this information.

If your request matches my desires I may accept it.

* Edit: You posted 2 replies instead of multi-quoting. So my additional answer: I don't use any bridge.

 

[lolbrah]

Please create a thread at the "Hire a Freelancer" forum section for such requests: https://www.blackhatworld.com/forums/hire-a-freelancer.76/

Please notify me after you posted it there. And don't forget to put a US$ amount into your thread, so what you would pay a freelancer to receive this information.

If your request matches my desires I may accept it.

stop avoiding the question and answer it, if you can do what you claim to-do then you'd have no issue answering what I asked but instead you avoid it and act like a foul scammer

also i'd like to point something out which is interesting

 

[th3darkknight]

As soon as you faced a real question, you started drifting to some other direction. Dodging the questions completely.
If the code is in raw and you've already decoded everything then just answer the questions? Why act like it's a big secret now?

You already posted a thread on a public forum that you're reversing snapchat and now if someone asks a question then say "it's a public forum, i don't want to reveal my secrets" and dodge it easily.

Tbh, no hate but I myself have worked on snapchat (re) as well and half of your sayings are total crap. Anyway, good luck fishing.

 

[OccultKingdoms]

As soon as you faced a real question, you started drifting to some other direction. Dodging the questions completely.
If the code is in raw and you've already decoded everything then just answer the questions? Why act like it's a big secret now?

You already posted a thread on a public forum that you're reversing snapchat and now if someone asks a question then say "it's a public forum, i don't want to reveal my secrets" and dodge it easily.

Tbh, no hate but I myself have worked on snapchat (re) as well and half of your sayings are total crap. Anyway, good luck fishing.

So it's that you don't like the way someone is engineering or what?

I can make accounts using javascript or macros and probably people would come and tell me how reverse engineering would be better, but...

I feel like there's a lot of bragging about which way is better. And there's no simple answer to such problems.

 

[ReverseEngineering]

I'm looking forward for Snap Inc. to patch the code on server (!) side to prevent any abuse of the GitHub content.

It wouldn't be the first time. ;-)

* Edit: I totally forgot ... of course I have 2 fallback account creators already, in case Snapchat will patch anything. There is also the iOS based account creator left.

 

[AllOutAnime]

So it's that you don't like the way someone is engineering or what?

I can make accounts using javascript or macros and probably people would come and tell me how reverse engineering would be better, but...

I feel like there's a lot of bragging about which way is better. And there's no simple answer to such problems.

The best way will always be to reverse-engineer and replicate the full app 100% in your own code.
Like that you can do millions of actions per day on a raspberry pi.