Snapchat iOS API accounts manager

Reversing Snapchat, Part 0

This is the first post of a series. I'm going to log the wholehe private API all the way down to the last piece I'm still

Alright. For months my machine hasn't really done anything else. People keep asking if I'm just talking, so before I start dropping the details piece by piece, here's the honest state of where I actually am.

The internal API. Done.
I talk to Snapchat's private endpoints directly, app closed. Send snaps, send chat messages, post stories, straight to their servers. The small stuff that makes it read like a real client is there too: markRead, the typing indicator firing exactly when I want it, My AI rerouted through my own backend. The cupidbot / builtin runs on top of that. Basically whatever the app does, I do without it.

Auth and tokens. Done.
This was the real wall at the start. Login, refresh, get token, the three flows, all reproduced outside the app. And the thing that locks the whole system down: Snapchat's Argos anti-abuse layer and its X-Snapchat-ATT-Token header. I got far enough to sign it myself, headless, no device, in several modes. The server accepts an attestation I generate offline and mints a real token back. Reproducible, not a one-off fluke.

Register. 90% there.
I have everything for it. The only thing between me and clean, repeatable creation is Apple, not Snap. It's DeviceCheck. I've burned an absurd amount of time understanding how that token is actually built on the device, what it carries, and what gets verified and where. What I'll say for now: it's rooted way deeper in the silicon than most people writing about it realize, and most of the "methods" going around are hitting the wrong layer entirely. I've got results. Keeping them for now.
In fact I could use web snapchat creation which is easier but it's not as sexy as iOS one, with devicecheck to boost as much as possible account's trust score.

By the way i'm working with an iPhone 8 on 16.7.16 Dopamine 2 roothide. My Snapchat API is on the latest version actually 14.13.0.53.
Lot of informations don't want to go to deep for the first post but you can ask me some questions i'll be glad to answer as i feel knowing more snapchat api than me.
I'm not fluent english so excuse me for my language mistakes.

The dashboard. In progress.
This is the actual project. The reverse is just the foundation under it. The idea is the full iOS stack sitting behind a single account-management API: you drive your account, your tokens, your actions from one place and never open Snapchat. That's what I'm finishing.

So here's where that puts me:

OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO------ ~87%

~87%. What's left is wrapping the dashboard and landing a clean DeviceCheck. That last 13% is the hard 13%, but I'm on it.

This is Part 0. Next posts I go deeper on the individual pieces. Follow along. Will show you some cool stuff, not here to just blabla and show nothing. Stay safe <3

Snapchat API - Bitmoji injection #2

Had a few questions about bitmoji injection. Is it even possible? Short answer yes. i just finished the Bitmoji Studio module of my SaaS so i made you a simple demo to show it live.

The whole avatar editor, rebuilt on my side. Everything customizable, live preview, every category the app has. Hair, face, full wardrobe w/ the brands, jewelry and every piercing slot, makeup, colors w/ the real palettes. Nothing faked, the full catalog is mine.

But the editor alone is not the point. The point is what you do with it at scale.

You build bitmoji templates and assign them to your accounts by groups. Example: Group 1 = 100 accs = 1 bitmoji. Or you flip the randomize option and every single acc gets its own different bitmoji. Your call.

In the workflow tab it just plugs in. After a login or a register, the acc either drops into a group and inherits its bitmoji, or it gets randomized right at creation. Hands off.

Since i wanted something really clean and not half done, i pushed further than the avatar itself. Selfies first, the profile pic your friends actually see in the chat list, w/ your bitmoji posing inside its bubble. Then poses and backgrounds too, for max personalization.

And yeah, all of it gets pushed onto the real account. The demo is me injecting on a test snap acc, app never opened by hand. That's the answer to the question.

The front will prob stay close to this once it's fully baked into the SaaS, but at least you get how it works.

For the ones already wondering: it's not an emulated iphone. it's just wormhole giving me a live screen of my jailbroken iphone for the demo, nothing more.

Other feature questions, drop them in the thread and i'll answer, i read everything. Otherwise stay tuned for the daily progress post.

OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO----- 88%

Stay safe <3

How many accounts can you safely register per phone?

g63 said:

How many accounts can you safely register per phone?

Click to expand...

Hey ! on iOS tbh 5. If you block device check request and use only App Attest you can register 5 accounts then wait 30 days. No way to create without device check and without App attest, and no way to spoof or generate device check token / app attest cause linked to the Secure Enclave. But if you need bulk creation, you can use web or android both work with API smoothly (if you don't want handle GPI bypass on android, there is some solver online)

notaudren said:

Hey ! on iOS tbh 5. If you block device check request and use only App Attest you can register 5 accounts then wait 30 days. No way to create without device check and without App attest, and no way to spoof or generate device check token / app attest cause linked to the Secure Enclave. But if you need bulk creation, you can use web or android both work with API smoothly (if you don't want handle GPI bypass on android, there is some solver online)

Click to expand...

Makes sense, that's interesting that snap works on a jailbroken phone for you.