Snapchat Reverse Engineering - Part 1 - Snapchat Account Creator Bot - API based

Snapchat Reverse Engineering - Part 1 - Snapchat Account Creator Bot - API based


Update 2 (June 4th, 2024)


Progress:

OOOOOOOOOOOOOOOOOOOOOOOOOOOOOO - around 70 %
0 - - - - - - - - - - - - - - - 50 - - - - - - - - - - - - - - 100


SSL pinning and SSL unpinning at Snapchat:

Yesterday I wrote the terms "SSL pinning" and "SSL unpinning", since SSL pinning is integrated in Snapchat.

I promised to send you a link to an almost noob-friendly explanation:

ReverseEngineering said:

[4] SSL pinning: (follows, I didn't find a noob-friendly explanation so far)

Click to expand...

Here you go:

https://medium.com/@vinodh_36508/enhancing-ios-app-security-with-ssl-pinning-09111c104c44#


Why do you need SSL unpinning? To intercept the encrypted traffic between the Snapchat app (Apple iOS or Google Android) and the Snapchat servers you have to bypass the SSL pinning.

The SSL pinning in Snapchat can't be bypassed by classic methods (e. g. with Frida, Magisk, Objection, Xposed and related projects). Also the import of the SSL certificate of your proxy server into Google Android doesn't help regarding Snapchat.

Snapchat uses "native libraries" to organize the SSL handling. At the Snapchat app for Android you will find the native libraries after you unzip the ".apk" file of the app inside the "lib" directory. The code can't be decompiled like the main parts of the app, written in Java, because the native libraries are written in C/C++. You need a disassembler of your choice to view the code, I prefer IDA Pro and sometimes Ghidra. [1]

Regarding Ghidra please be careful: The NSA has created Ghidra. So it may contain some spyware-like code fragments. Use it on your own risk, maybe install it on a "throw away" machine.



Some easy terms have been used to make it easier for non-professionals to read and understand the concept. For example: I wrote "access tokens", "hard coded" or "encoded" although there is much more behind.


(I am not native English/American, so please excuse any spelling or grammar mistakes.)


Side notes (linked from above):

[1] https://en.wikipedia.org/wiki/Ghidra


Short updates (random daily work) will be posted at my BHW profile: https://www.blackhatworld.com/members/reverseengineering.1413206/

So maybe you should follow me here at BHW to keep you up-to-date? https://www.blackhatworld.com/members/reverseengineering.1413206/follow

Are you guys interested in reading more details about the Snapchat API endpoints used for the registration?

Especially what device data of Android phones/tablets/emulators will be transmitted to the Snapchat servers, to be categorized as "spam" or not?

Please kindly let me know.

ReverseEngineering said:

Are you guys interested in reading more details about the Snapchat API endpoints used for the registration?

Especially what device data of Android phones/tablets/emulators will be transmitted to the Snapchat servers, to be categorized as "spam" or not?

Please kindly let me know.

Click to expand...

Yes, this would be very interesting.

I would also be interested in logged in accounts how you handle all the (action) log requests, analytic requests and the alive pings.

Why are you doing this all anyway?
You want to earn with accounts or sell them or what?
I have read that to use snap account you must do selfies (live) and many other things,

Many people just quit..

Good luck to your journey.

rampzeus said:

I would also be interested in logged in accounts how you handle all the (action) log requests, analytic requests and the alive pings.

Click to expand...

Noted.

Please don't laugh now. The login and everything else is much easier than the registration. The massive part of their spam protection is only active during the registration.

That's why many people fail since 2023. That's why I created this journey thread.

olivier said:

Why are you doing this all anyway?
You want to earn with accounts or sell them or what?
I have read that to use snap account you must do selfies (live) and many other things,

Many people just quit..

Click to expand...

Yeah, many people just quit. I know. And I always hear: "That's not possible, do something else..."

For the moment I just want to break their spam algorithm. What happens next... I don't know yet.

No, you don't have so send selfie story posts. You can send almost any image or video you have.

A few bots manipulate the timestamp of the image/video, so it looks like taken live. To be honest, this was one of the easiest tasks for me at Snapchat.

TechEinstien said:

Good luck to your journey.

Click to expand...

Thank you.

Hey how are you planning to monetize this snapchat accounts and will you just create the account or will also do some activities in snapchat to make the account look more natural.

Are you using an external signature server or have you reversed request signing?

King98 said:

Hey how are you planning to monetize this snapchat accounts and will you just create the account or will also do some activities in snapchat to make the account look more natural.

Click to expand...

I will send some Snapchat accounts to friends, partners, ... Personally I don't do affiliate marketing, CPA any more. And I don't want to start with OnlyFans marketing. ;-)

For the moment it's a public "proof of concept" that masses of accounts (2000 or more) can be automatically created very day.

Each freshly created Snapchat account will be "aged" with typical activities (add friends, accept friend requests, post at the story, send Snaps, auto respond with Snaps, use typical links etc.). The required modules have been created in early 2024 from scratch again, following the changed Snapchat API.

I also added some "secret sauce" to the aging process I won't reveal here. I find glitches at the Snapchat server almost every single week.

lucky.sparks said:

Are you using an external signature server or have you reversed request signing?

Click to expand...

I don't use external signature providers.

Also some people at Telegram told me that a few of the "old" signature servers don't exist anymore and their owners vanished.

So everything required has been reversed by me, without any external help.

This is really interesting, I'll definitely be following

Good luck on this, it's a huge journey.
Hope to see you have success on this.

Proxy Cake said:

This is really interesting, I'll definitely be following

Click to expand...

Thank you.

hexagonal said:

Good luck on this, it's a huge journey.
Hope to see you have success on this.

Click to expand...

I already had "a little" success, since I could bypass many limits. ;-) And the account creator is almost 70 % complete now.

I guess next week I can start with the UI of the browser to manage everything.

gozzby said:

Great and interesting journey so far,

Click to expand...

Thank you.

ReverseEngineering said:

- If there are many ".so" files, you should research about Ghidra. Some people don't like it because the USA NSA created it. So you can never know...

Click to expand...

I have never done any kind of mobile reverse engineering, however, I've been reverse engineering a lot of program on Linux, AMD64 and ARM(ARMV7/8 or AARCH64), for fun, and I am actually quite surprised by the fact that these skills are actually still useful, outside of reverse engineering malwares and "classic" software, on desktop computers.
Now, I'm just realizing that what I learned doing that might actually be useful, since, Android & iOS devices are ARM AARCH64 based, and Android shares principles from Linux, since it's originally a fork.

NSA created Ghidra, however, it's fully open-source, and appreciated by the community, everyone is using it.
If you are scared, since I see you are a Linux & terminal enthusiasts, you could try https://github.com/radareorg/radare2, and if you still like GUI, Clutter is nice. Both are open-source. However, they have "less features", than Ghidra.
Or why not recommending a good old hex editor, with some notes in a MarkDown file, in Neovim? /s

ReverseEngineering said:

Why do you need SSL unpinning? To intercept the encrypted traffic between the Snapchat app (Apple iOS or Google Android) and the Snapchat servers you have to bypass the SSL pinning.

The SSL pinning in Snapchat can't be bypassed by classic methods (e. g. with Frida, Magisk, Objection, Xposed and related projects). Also the import of the SSL certificate of your proxy server into Google Android doesn't help regarding Snapchat.

Snapchat uses "native libraries" to organize the SSL handling. At the Snapchat app for Android you will find the native libraries after you unzip the ".apk" file of the app inside the "lib" directory. The code can't be decompiled like the main parts of the app, written in Java, because the native libraries are written in C/C++. You need a disassembler of your choice to view the code, I prefer IDA Pro and sometimes Ghidra. [1]

Click to expand...

The fact that applications like Snapchat are using native libraries to organize SSL handling might show how much reverse engineering / binary exploitation, are going to be increasingly demanded over time.
Since C/C++, and any other compiled language that could support Android/iOS Platform, are easier to obfuscate, and offer some nice performance, it makes sense that companies start using them in mobile apps in parts where security is an issue / performance is required.

Thanks for this thread, it's very interesting!

cynicalwork said:

Since C/C++, and any other compiled language that could support Android/iOS Platform, are easier to obfuscate, and offer some nice performance, it makes sense that companies start using them in mobile apps in parts where security is an issue / performance is required.

Click to expand...

Thank you for your detailed feedback.

You can compare the size of the .so files, the native libraries are getting bigger and bigger with almost every Snapchat release. And it's not only the known "libclient.so" anymore.

For the newbies: This means, more and more (old) Java code will be converted to C/C++ and put inside non-decompilable library files. And since not everybody is able to handle a disassembler, this is another sort of security.

Snapchat Reverse Engineering - Part 1 - Snapchat Account Creator Bot - API based


Update announcement (June 7th, 2024)


Progress:

OOOOOOOOOOOOOOOOOOOOOOOOOOOOOO - around 75 %
0 - - - - - - - - - - - - - - - 50 - - - - - - - - - - - - - - 100


Update announcement:

During the last 2 days I found interesting stuff by analyzing the "native libraries" (see updates above) - aka .so files - again.

2 people asked me about the "root" detection of the Snapchat Android app, another guy asked the same about "Frida" (see updates above). So I will be able to answer this soon with many details.

Unfortunately it takes a lot of time to inspect all Assembler code (even the pseudo code), because Snapchat jumps around trough different functions/modules to not do a single check at the same place. And to let the inspector lose the overview. ;-)

Anyways, it's day 7, and the success rate of the previously mass created accounts from the last weekend is very high. Most of them are still alive, working and didn't receive any lock or ban.

To keep a long story short: The completion level has been increased to 75 % above, and my next update will follow as soon as I invested a few more hours into the Assembler code. Therefore today's "update announcement" only.


Thank you to everybody contacting me at Telegram, but sometimes I am very busy and need a few hours to reply (please remember my timezone UTC+2 West Europe). Nevertheless I really enjoy to talk to each of you guys. You can find the link at my BHW profile.



Some easy terms have been used to make it easier for non-professionals to read and understand the concept. For example: I wrote "access tokens", "hard coded" or "encoded" although there is much more behind.


(I am not native English/American, so please excuse any spelling or grammar mistakes.)


Short updates (random daily work) will be posted at my BHW profile: https://www.blackhatworld.com/members/reverseengineering.1413206/

So maybe you should follow me here at BHW to keep you up-to-date? https://www.blackhatworld.com/members/reverseengineering.1413206/follow

Amazing thread, I will follow!
I kindly appreciate any information how they detect bots, emulators or rooted devices.

Do you offer paid mentorship or would you teach me some things in exchange for help in your projects?
I have basic knowledge and some people here have praised me for my journey but I feel like I still lack a lot in many different areas and this is holding me back.

ReverseEngineering said:

I will send some Snapchat accounts to friends, partners, ... Personally I don't do affiliate marketing, CPA any more. And I don't want to start with OnlyFans marketing. ;-)

For the moment it's a public "proof of concept" that masses of accounts (2000 or more) can be automatically created very day.

Each freshly created Snapchat account will be "aged" with typical activities (add friends, accept friend requests, post at the story, send Snaps, auto respond with Snaps, use typical links etc.). The required modules have been created in early 2024 from scratch again, following the changed Snapchat API.

I also added some "secret sauce" to the aging process I won't reveal here. I find glitches at the Snapchat server almost every single week.

Click to expand...

So you would be making about $10k per day with it?

The information is on point. I saw some of that information on gaming forums where people spoke about editing game files.

Anyways, they were those who made money and other looked at them asking "how".

The difference is that gaming doesn't make as much money as social media.

So I think you're using your expertise in the proper area. Social media is worth working on.

You have an example of info here: https://github.com/kovidomi/game-reversing

It's kinda similar.

ReverseEngineering said:

Why do you need SSL unpinning? To intercept the encrypted traffic between the Snapchat app (Apple iOS or Google Android) and the Snapchat servers you have to bypass the SSL pinning.

The SSL pinning in Snapchat can't be bypassed by classic methods (e. g. with Frida, Magisk, Objection, Xposed and related projects). Also the import of the SSL certificate of your proxy server into Google Android doesn't help regarding Snapchat.

Snapchat uses "native libraries" to organize the SSL handling. At the Snapchat app for Android you will find the native libraries after you unzip the ".apk" file of the app inside the "lib" directory. The code can't be decompiled like the main parts of the app, written in Java, because the native libraries are written in C/C++. You need a disassembler of your choice to view the code, I prefer IDA Pro and sometimes Ghidra. [1]

Click to expand...

You can create a roadmap to learn all this stuff. Like in that link I sent from github.

It looks that this Journey will be my favorite. Tons of informations, and it's just 2 pages. Following & Good Luck!

AutoVideoFreak said:

So you would be making about $10k per day with it?

Click to expand...

How would I make US$ 10k per day with it? I'm interested in all further details.

You can find my Telegram link at my profile.

AutoVideoFreak said:

The information is on point. I saw some of that information on gaming forums where people spoke about editing game files.

Click to expand...

Indeed my first "medium-sized" reverse engineering project was a game. Somebody asked me to create accounts, age them and increase the score automatically. He was a classic gaming account seller.

Your GitHub link is interesting. Unfortunately I made the experience that Snap Inc. loves to take down such and similar content at GitHub, starting with "Casper" in 2016 or 2017.

But thank you for your feedback!

ReverseEngineering said:

How would I make US$ 10k per day with it? I'm interested in all further details.

You can find my Telegram link at my profile.



Indeed my first "medium-sized" reverse engineering project was a game. Somebody asked me to create accounts, age them and increase the score automatically. He was a classic gaming account seller.

Your GitHub link is interesting. Unfortunately I made the experience that Snap Inc. loves to take down such and similar content at GitHub, starting with "Casper" in 2016 or 2017.

But thank you for your feedback!

Click to expand...

Looking forward to hearing about the lifetime you can achieve with these accounts. Are you going to simulate using the accounts for marketing to see how long they last against reports etc