Re:Reverse Engineering Snapchat: Obfuscation Techniques
by zelly on Wednesday June 17, 2020 @09:12PM
(#23558751)
Yes that complicates things. But if you can find the cert in the binary's data section, maybe you can patch it with your own.
[ Parent
| on HN ]
Re:Reverse Engineering Snapchat: Obfuscation Techniques
by __float on Wednesday June 17, 2020 @11:39PM
(#23559588)
This probably runs into the same issue mentioned in the article, where the checksums are wrong and you end up in an infinite loop.
Re:Reverse Engineering Snapchat: Obfuscation Techniques
by brendonjohn on Thursday June 18, 2020 @12:51AM
(#23559891)
Assuming this is for Android, the APK would no longer be signed and would cause all login attempts to fail.
Have a read about "SafetyNet Attestion API" for Android.
Re:Reverse Engineering Snapchat: Obfuscation Techniques
by IAmLiterallyAB on Thursday June 18, 2020 @01:02AM
(#23559937)
You could patch Android and run it in an emulator. Or patch Snap not to care. Not super familiar, but there should be a way. Client side security can only do so much.
Re:Reverse Engineering Snapchat: Obfuscation Techniques
by looperhacks on Thursday June 18, 2020 @01:51AM
(#23560155)
You can't patch Snap to not care because the safetynet process is (roughly) like that: The App asks the Play libraries whether the phone is okay. This is verified (in part) on the Google servers, so the Snap servers can ask Google whether a call came from a non-tampered phone. The client can't do anything about it, except tricking google into believing the phone is not tampered with. Which is notoriously hard, because nobody knows how the process really works.