Re:Reverse Engineered Nintendo Switch App REST API
by mjg59 on Thursday May 21, 2020 @01:11AM
(#23255022)
As well as the other answers, an alternative is to use smali to somewhat decompile the app, figure out which HTTP library it's using, delete the call to the function that enables pinning, rebuild the apk, sign it and run that version.
The longer version is that it really varies based on the app. Some apps are using something like React Native and have all their logic in Javascript. Some apps have the API in Java code and you can figure it out by using jadx to get a reasonable approximation of the original source. Some apps do all of this in native code, and then you're into Ghidra territory. My personal experience is that MITMing the connection is the easiest way to get an understanding of the overall shape of the API, with inspection of the code itself then being used to fill in gaps.
The longer version is that it really varies based on the app. Some apps are using something like React Native and have all their logic in Javascript. Some apps have the API in Java code and you can figure it out by using jadx to get a reasonable approximation of the original source. Some apps do all of this in native code, and then you're into Ghidra territory. My personal experience is that MITMing the connection is the easiest way to get an understanding of the overall shape of the API, with inspection of the code itself then being used to fill in gaps.