[Journey] Instagram APP Reverse Engineer

slighty

Regular Member

Jul 31, 2017

258

140

• Sep 11, 2017

• #1

Intro (Just a little bit about myself):
I myself am a software engineer (kinda?), I am connected to computers since a kid and played games my whole teenager life. Five years ago I joined college for software engineer degree and although I learned a lot from it my main expertise come from self-taught. Right now I'm affiliated with some projects where we just gather a bunch of friends and code stuff.

Basic Idea of what I'm doing:
Grab Instagram APK (Android app), modify it and learn how the most recent version of the API is currently working through spoofing all the requests.

Why am I doing it:
I heard some conversations on telegram on how hard it is to accomplish it on the most recent versions. Mainly because of cerfiticate pinning, thus you won't be able to ever read any https requests. I took it somehow personal and challenged myself into breaking the code and learn everything about how the IG API is working.

What have I done so far:
Dowloaded most recent working android APK and analyzed some of the code. Needless to say that is all obfuscated

GL ME

 

slighty

Regular Member

Jul 31, 2017

258

140

• Sep 12, 2017
• Thread Starter Thread Starter

• #2

After a day and a long night I managed to do it.
Points to notice: There is alot of trash code that do nothing, probably to frustrate you and misdirect you into losing your mind.
If anyone is interested I can post here the tools I used to help me crack it down.

 

tranza

Power Member

Jan 9, 2012

706

136

• Sep 12, 2017

• #3

Interesting, what tools did you use in the process?

 

chrispliakos

Regular Member

Jan 9, 2017

249

59

• Sep 12, 2017

• #4

Man,i have no fking idea for all of this,but it seems so interesting.
Keep posting!

 

Sapphire Eyes

Registered Member

Aug 18, 2017

57

21

• Sep 12, 2017

• #5

Yeah I heard about the trouble with the API too, I am really interested in finding out what's going on, keep up the good work!

 

SpawneR

Elite Member

Jr. VIP

Aug 15, 2014

4,066

3,875

• Sep 12, 2017

• #6

You're the man! This will be interesting !

 

slighty

Regular Member

Jul 31, 2017

258

140

• Sep 12, 2017
• Thread Starter Thread Starter

• #7

You need to use a java decompiler, something like jd-gui and also a apktool to build and rebuild the app.

 

M

MarXhacK-TN

Registered Member

Jun 24, 2017

78

7

• Sep 13, 2017

• #8

good work keep it up please

 

mnunes532

Elite Member

Jan 21, 2014

2,131

826

• Sep 13, 2017

• #9

Could you give some more technical details on how you did it? I did it in a different way, but I'm curious to know which classes you patched, etc.

PS: és tuga? pois vejo pt-pt num dos headers do pedido

 

L

Lothric

Regular Member

Apr 25, 2017

201

52

• Sep 13, 2017

• #10

Very nice.
If I wanted to make a bot with tier 1.5~2 apps (because tier 1 like IG is very hard to RE and they update their shits quickly), how long it will take until the bot completion?
And can you share some authoritive guide/video to RE android apps?

 

slighty

Regular Member

Jul 31, 2017

258

140

• Sep 13, 2017
• Thread Starter Thread Starter

• #11

mnunes532 said:

Could you give some more technical details on how you did it? I did it in a different way, but I'm curious to know which classes you patched, etc.

PS: és tuga? pois vejo pt-pt num dos headers do pedido

Click to expand...

Wouldn't really give details as it probably would be abused to create bots. And Yes I am

 

mnunes532

Elite Member

Jan 21, 2014

2,131

826

• Sep 13, 2017

• #12

slighty said:

Wouldn't really give details as it probably would be abused to create bots. And Yes I am

Click to expand...

Makes sense, thanks anyway.

 

slighty

Regular Member

Jul 31, 2017

258

140

• Sep 13, 2017
• Thread Starter Thread Starter

• #13

Lothric said:

Very nice.
If I wanted to make a bot with tier 1.5~2 apps (because tier 1 like IG is very hard to RE and they update their shits quickly), how long it will take until the bot completion?
And can you share some authoritive guide/video to RE android apps?

Click to expand...

Bot completion would depend on how hard are the requests to build, understand and how much decryption is behind it. And I don't know any guides/videos to RE android apps, I just know java i guess x)

 

greymoon

Junior Member

Aug 26, 2017

192

90

• Sep 13, 2017

• #14

if you are good at revering apps and wanna make some bots on reversed android apps ping me I have some offer with good $$$

 

slighty

Regular Member

Jul 31, 2017

258

140

• Sep 14, 2017
• Thread Starter Thread Starter

• #15

pratiksaha said:

if you are good at revering apps and wanna make some bots on reversed android apps ping me I have some offer with good $$$

Click to expand...

Thanks for the offer but I have no interest at the moment due to my busy schedule

 

nikhil79

Junior Member

Aug 5, 2011

104

27

• Sep 14, 2017

• #16

How are you sniffing https traffic and I guess the tool you are using is fiddler
thanks

 

L

Lothric

Regular Member

Apr 25, 2017

201

52

• Sep 15, 2017

• #17

nikhil79 said:

How are you sniffing https traffic and I guess the tool you are using is fiddler
thanks

Click to expand...

you can't sniff https traffic. they are meant to be SECURE from being sniffed

 

slighty

Regular Member

Jul 31, 2017

258

140

• Sep 15, 2017
• Thread Starter Thread Starter

• #18

Lothric said:

you can't sniff https traffic. they are meant to be SECURE from being sniffed

Click to expand...

If you are the sender of the requests you can always find a way to sniff everything ^^

 

L

Lothric

Regular Member

Apr 25, 2017

201

52

• Sep 16, 2017

• #19

slighty said:

If you are the sender of the requests you can always find a way to sniff everything ^^

Click to expand...

What? it's possible? how you do it?

 

Spamr

Junior Member

Jul 17, 2017

130

34

• Sep 22, 2017

• #20

Does IG have safetynet security?