1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

fully integrated instagram app

Discussion in 'Social Networking Sites' started by ateep22, May 9, 2013.

  1. ateep22

    ateep22 Registered Member

    Joined:
    Dec 7, 2012
    Messages:
    75
    Likes Received:
    7
    anyone know of a good instagram app that has multiple features? photo saving, tagging and comment features, reposting pics, share options, just stuff like that all integrated into one web-app, software, or iphone app. like a instagram tool. i hope you get what im saying. thanks fellas..
     
  2. DopeyDuke

    DopeyDuke Junior Member

    Joined:
    Apr 18, 2013
    Messages:
    107
    Likes Received:
    17
    Location:
    PI
    Home Page:
    Short answer is No. There is no such app/bot/software that can do those.

    One software that came close to the actual IG app is xgram and it's completely dead. I understand why though.

    Xgram acts like the actual iphone/android app in the sense that it tricks Instagrams server in thinking it is the real thing. What did Instagram do when they found out? They signed their application requests so they'll know that the requests coming are from their own app.

    There is nothing you can do to imitate them short of cracking and decompiling their app if you want features like you said. It's entirely doable, however, what they'll do is just configure their algorithm to a new signing method. And the developer will start from scratch again. Unfortunately, this is a losing battle for blackhatters.

    What you can do though is build your business around what is available and working.
     
  3. Nom26

    Nom26 Junior Member

    Joined:
    Aug 29, 2012
    Messages:
    107
    Likes Received:
    27
    You seem to know what you are talking about. Would like to chat further if you are able. Thanks
     
  4. DopeyDuke

    DopeyDuke Junior Member

    Joined:
    Apr 18, 2013
    Messages:
    107
    Likes Received:
    17
    Location:
    PI
    Home Page:

    How can you "resell" a dead software? And how can you call it "legit"?

    LMAO.
     
  5. mindblowin

    mindblowin Newbie

    Joined:
    Aug 6, 2010
    Messages:
    39
    Likes Received:
    2
    you can try a 3rd party app: "bluestacks"
     
  6. CriminalMind

    CriminalMind Regular Member

    Joined:
    Sep 26, 2012
    Messages:
    423
    Likes Received:
    180
    there is many bots like xgram out and workin even better and getting updates they just not for public that s all
     
  7. DopeyDuke

    DopeyDuke Junior Member

    Joined:
    Apr 18, 2013
    Messages:
    107
    Likes Received:
    17
    Location:
    PI
    Home Page:
    You just missed the whole point of my post.
     
  8. DopeyDuke

    DopeyDuke Junior Member

    Joined:
    Apr 18, 2013
    Messages:
    107
    Likes Received:
    17
    Location:
    PI
    Home Page:
    Unless you can't read, I just posted what's going on with Instagram. From what you are posting on a few threads here, you only know bits and pieces of how it works.

    Don't hate me for saying xgram is dead. It truly is. Stop selling cracked copies of xgram. Stop scamming people here.

    Here is a sample post by the IG app just to reiterate whya bot like this isn'tmaintainable:

    Code:
    [/B]		 		
    [LIST=1]POST https://instagram.com/api/v1/accounts/create/ HTTP/1.1
    Host: instagram.com
    Proxy-Connection: keep-alive
    Accept: */*
    Accept-Encoding: gzip, deflate
    Content-Length: 441
    Content-Type: multipart/form-data; boundary=Boundary+0xAbCdEfGbOuNdArY
    
    Accept-Language: en
    
    Connection: keep-alive
    
    User-Agent: Instagram 3.4.2 (iPhone5,1; iPhone OS 6.0.1; en_US; en) AppleWebKit/420+
    
     
    
    --Boundary+0xAbCdEfGbOuNdArY
    
    Content-Disposition: form-data; name="signed_body"
    
     
    
    a9437b9842e707ffd020bcfe68f666bc408fb64f5509c6635cdbaabffbd1109b.{"password":"xxx324232","username":"aasdsda12","first_name":"Alecia","email":"aleciagirl212@sadsadr.com","device_id":"E9E75084-AEE3-47F4-A997-4D4C0FC41BCE"}
    
    --Boundary+0xAbCdEfGbOuNdArY
    
    Content-Disposition: form-data; name="ig_sig_key_version"
    
     
    
    2
    --Boundary+0xAbCdEfGbOuNdArY--
    [/LIST]
    
     		
    [B]
    See this line here:

    a9437b9842e707ffd020bcfe68f666bc408fb64f5509c6635cdbaabffbd3215b.{"password":"xxx324232","username":"aasdsda12","first_name":"Alecia","email":"aleciagirl212@sadsadr.com","device_id":"E9E75084-AEE3-47F4-A997-4D4C0FC41BCE"}

    --Boundary+0xAbCdEfGbOuNdArY


    "a9437b9842e707ffd020bcfe68f666bc408fb64f5509c6635cdbaabffbd3215b." --> Is a signed key string that only the app can generate. It is based on a "secret" algorithm that you can only get by reversing the app.

    Instagram can simply change that algorithm and the bot wouldn't work.
     
  9. Botoio

    Botoio Newbie

    Joined:
    Sep 22, 2012
    Messages:
    12
    Likes Received:
    24
    Infact Instagram never changed any algorithm, but just updated the keys to sign request, keys got changed 3 times in 2 years.. extract keys wont take more than 15 minutes if you know how to do it.
    The real reason behind Instagram bots deaths it's Facebook sending C&D to company and developers. I see you own one, prob in short time they will contact you if they havent already. :)
     
  10. DopeyDuke

    DopeyDuke Junior Member

    Joined:
    Apr 18, 2013
    Messages:
    107
    Likes Received:
    17
    Location:
    PI
    Home Page:
    Plausible as I haven't been playing around with Instagram for 2 years. I have only seen quite a few changes when I studied the earlier versions of their apk (android) app compared to the new one. I remember that there was a significant change though from their 3.1.x to the latest version that slightly affected their algorithm that made the decision for me to go API. I may be mistaken. It might just have been the keys used to sign.

    Yet the point remains. What if they do change it? I wouldn't be so bold to say someone can reverse engineer a posting algorithm in 15 minutes. This is coming from someone who has years of experience in "the scene". I see your point though, and it's definitely something to ponder about.

    However from a business stand point, this is an uncertainty that I will not risk because my clients need stability.

    As for C&D, well, I protected my ass from such possible actions. Same way FaceDominator is still alive today.
     
  11. Botoio

    Botoio Newbie

    Joined:
    Sep 22, 2012
    Messages:
    12
    Likes Received:
    24
    You are free to belive me or not extract keys from 3.1.x took me less than an afternoon and was my first time dealing with IG security, but sure was not the my first time dealing with apps reversion. Then reverse engineer keys from 3.4.x took me literally less than 15 minutes becouse was the same algorithm of 3.1.x.

    What the wrost scenario? they update every single request of mobile + signing algorithm, you can still fully upgrade your current bot in 4/5 days of work, and even if that happen so far IG never closed old app APIs before 2 weeks of release of new ones. That proved by the fact that Keys N°2 are still working even after 4 months after release of Keys N°3, sure N°2 leave footsteps and are much unlegit but still working.
    But if you feel better automating web based and public api you can do it, no one against you :D

    So until IG stay on android i dont see any problem on making a phone emulating, and I don't see any risk into it.

    You pointed out FaceDominator, i don't honestly know how they are alive yet :), but sure it's a point of reference and working example that show how it's possible to survive even against Facebook.
     
    • Thanks Thanks x 1
  12. DopeyDuke

    DopeyDuke Junior Member

    Joined:
    Apr 18, 2013
    Messages:
    107
    Likes Received:
    17
    Location:
    PI
    Home Page:

    I stand corrected. I rechecked all the files I had on them, and yeah it took me less than 15 minutes to get the new key.

    This is very interesting. And I appreciate all the points you had mentioned. I have some pondering to do.

    :)
     
  13. tompots

    tompots Elite Member Premium Member

    Joined:
    Dec 11, 2011
    Messages:
    4,352
    Likes Received:
    3,955
    Gender:
    Male
    Occupation:
    Full Time Bot Developer
    Location:
    Professional Botters
    Home Page:
    Nope not That I have seen.
     
  14. 312k1t

    312k1t Registered Member

    Joined:
    Oct 26, 2012
    Messages:
    56
    Likes Received:
    5
    Nice discussion. Decompiling Java app to source code is simple. There are several tools for that. More fun is extracting keys from iOS apps.
     
  15. Botoio

    Botoio Newbie

    Joined:
    Sep 22, 2012
    Messages:
    12
    Likes Received:
    24
    Well you can go reverse Objective-C with IDA and get the keys, or you can be smart :D.

    But really IG iOS keys don't hold any advantage on Android ones... So i don't see any reason why someone should use them..
     
  16. 312k1t

    312k1t Registered Member

    Joined:
    Oct 26, 2012
    Messages:
    56
    Likes Received:
    5
    I don't reverse objective-C and also don't know IDA. But this guy probably knows what he is doing. Really interesting reading.
     
  17. AllOutAnime

    AllOutAnime Jr. VIP Jr. VIP

    Joined:
    Oct 15, 2007
    Messages:
    212
    Likes Received:
    50
    Occupation:
    Coder
    Location:
    Localhost
    It isn't hard to get the key for the signed_request, that's true and I agree that the only reason no real IG bot is out there are the lawsuits by FB against developers.
    I could create a kick-ass instagram bot better than xgram was and sell it but I won't do that because it is too risky and why should I. The real money lies in using the tools you create and use em for yourself because nobody else has it. Instead I create some custom bots for people here because I'm sick of people selling low quality or scammers selling programs that don't exist or don't work properly.
    And in my eyes all this hybrid technology stuff marketing speech is a lame excuse for not getting that key. Additionally those bots will never be able to upload images to accounts.

    My cents on this
     
    • Thanks Thanks x 1
  18. DopeyDuke

    DopeyDuke Junior Member

    Joined:
    Apr 18, 2013
    Messages:
    107
    Likes Received:
    17
    Location:
    PI
    Home Page:
    Key Signing:

    Code:
    public static String generateSignature(String paramString)
      {
        String str1 = NativeBridge.getInstagramString("a4d1b77bbb1a4a5ca695ad72c84b77e5");
        StringBuilder localStringBuilder;
        try
        {
          Mac localMac = getValidMac();
          localMac.init(new SecretKeySpec(str1.getBytes("UTF-8"), localMac.getAlgorithm()));
          byte[] arrayOfByte = localMac.doFinal(paramString.getBytes());
          BigInteger localBigInteger = new BigInteger(1, arrayOfByte);
          String str3 = String.format("%0" + (arrayOfByte.length << 1) + "x", new Object[] { localBigInteger });
          return str3;
        }
        catch (Exception localException)
        {
          localStringBuilder = new StringBuilder().append("failed_to_generate_signature: ");
          if (localException.getMessage() == null);
        }
        for (String str2 = localException.getMessage(); ; str2 = localException.getClass().toString())
        {
          NoopUtil.report(str2);
          return null;
        }
      }
    By the way, I still believe that the "hybrid technology stuff marketing speech" is still the way to go on some modules. Like Increasing the likes rate limit. If you go mobile automated with that you will run into the 150-350/likes limitation (based on my test ofcourse).

    I conclude then that mobile automation + API + Web automation is the best possible course for a user. Build everything on 1 tool and let the user decide which is best for them.
     
  19. AllOutAnime

    AllOutAnime Jr. VIP Jr. VIP

    Joined:
    Oct 15, 2007
    Messages:
    212
    Likes Received:
    50
    Occupation:
    Coder
    Location:
    Localhost
    I'm doing 20k + likes in 5 hours with their mobile api, I've never seen this 150-350 likes limit.
     
  20. ateep22

    ateep22 Registered Member

    Joined:
    Dec 7, 2012
    Messages:
    75
    Likes Received:
    7
    good stuff people..but i think u guys are talking about something different. i wasnt refering to bots or xgram. theres an app that saves photos, theres an app that lets you repost someones photo, theres an app that makes it easy to comment and like. etc etc..instead of having 6 apps each doing one thing, there isnt one that does it all? its more for marketing your own ig account.