News for hackers. Stuff that matters.
Re:Instagram Has Become SkyMall by grishka on Sunday July 11, 2021 @04:57AM (#27799398)
Maybe it's just me, but I dislike the whole concept of advertising in places that aren't related to shopping. I go to Instagram to look at my friends' pictures, not to be sold something I don't actually need. If I were to shop, I'd go to a mall, thank you very much.

Anyway, at some point Instagram ads (especially the autoplaying video kind, with sound) drove me crazy enough that out came jadx and apktool and I found a beautiful way to inject my own code into Instagram's networking. The code I injected rewrites the API responses before the rest of the app sees them. I can now scroll through my feed without annoying salesmen begging for my attention. I've also enabled a "secret" debugging menu while at it, where there are manual overrides for server-side settings, and there are at least several hundred of them — it's a bit creepy what they're A/B testing, like slightly different wording or different button colors.

The only problem that still remains is that the feed is still algorithmic, and there's nothing that could be done with that with client patches.

Re:Instagram Has Become SkyMall by distances on Sunday July 11, 2021 @06:02AM (#27799663)
I wonder why they left the debugging stuff in live release builds. Common best practice for Android is to have a separate build flavor with debug settings and layouts, and make sure they aren't included in live builds.
Re:Instagram Has Become SkyMall by bat_sy on Sunday July 11, 2021 @05:40AM (#27799569)
Can you share the modified apk or any tutorial to make similar modified Instagram apk?
Re:Instagram Has Become SkyMall by grishka on Sunday July 11, 2021 @08:02AM (#27800145)
Re:Instagram Has Become SkyMall by NeoLaval on Monday July 12, 2021 @10:46AM (#27810800)
Re:Instagram Has Become SkyMall by grishka on Monday July 12, 2021 @10:55AM (#27810901)
This isn't mine but it does use my approach to ad blocking.
Re:Instagram Has Become SkyMall by FearlessNebula on Sunday July 11, 2021 @07:36AM (#27800029)
I’d love to read a write up on how you did that. I wonder if it’s possible that one endpoint returns a chronological feed whereas another endpoint returns an algorithmic field?
Re:Instagram Has Become SkyMall by grishka on Sunday July 11, 2021 @08:07AM (#27800164)
In short. The HTTP client Instagram uses (Proxygen) is written in C++, which means it needs JNI bindings, which means those classes are necessarily excluded from obfuscation. I decompiled the dexes into human-readable bytecode (smali) using apktool, compiled my own class with additional code to strip ads, converted it to dex, decompiled that into smali, added that to instagram smali files, added calls into my class in the JNI classes, and, finally, put it all back together with apktool. I didn't want to touch the obfuscated parts because that would make the patch break with every version. Though I did have to touch them to enable the debug menu.

I should also probably make this in the form of an Xposed module. Do people even use Xposed any more?

Re:Instagram Has Become SkyMall by FearlessNebula on Sunday July 11, 2021 @08:13AM (#27800202)
Doesn’t compiling the code into an executable inherently obfuscate it?
Re:Instagram Has Become SkyMall by grishka on Sunday July 11, 2021 @10:42AM (#27801198)
Technically yes, to some degree. However, JVM and Dalvik bytecode retains enough information, compared to machine code, to recover the source with a good enough level of quality that you could sometimes modify it and compile it back.

In the context of JVM, obfuscation is an extra step where identifiers are renamed to various kinds of nonsense to make code more compact and supposedly hinder reverse engineering.

Re:Instagram Has Become SkyMall by stirfish on Sunday July 11, 2021 @10:22AM (#27801058)
Good question, but no. Obfuscation is an additional step you can take to make it harder to turn that executable back into code.
Re:Instagram Has Become SkyMall by FearlessNebula on Sunday July 11, 2021 @11:32AM (#27801593)
So with obfuscation you can still decompile the binary into source code, but that version of the source code is much less human-readable and it would take more effort for a human to go through and understand it?
Re:Instagram Has Become SkyMall by grishka on Sunday July 11, 2021 @12:45PM (#27802395)
Yes. Imagine that a class like "me.grishka.app.something.SomeDescriptiveClassName" gets renamed to "zzq" in the default (root) package. You end up with thousands of classes in there, none have sensible names, and nothing inside them has sensible names either. So you do have to spend extra effort to rename them back to something that makes sense. A good starting point for figuring out what an obfuscated class does is to look for log messages.

Java classes must still have names, and methods and fields must also retain type information for the JVM to work. Inside a JVM, classes and fields are accessed using names, and methods are accessed using name+signature, the signature being of the form "(Ljava/lang/String;II)V", that's a method that takes a string and two ints and returns void.

Re:Instagram Has Become SkyMall by 0x0nyandesu on Sunday July 11, 2021 @05:02AM (#27799417)
It's definitely just you. Women go on Instagram to see fashion with links to shopping "the look".
Re:Instagram Has Become SkyMall by Broken_Hippo on Sunday July 11, 2021 @05:30AM (#27799534)
Some people go to instagram for fashion, but that is definitely not all women nor just women.

I personally just wear a black shirt and black pants almost every day, am not all that interested in fashion, and am a woman.

Re:Instagram Has Become SkyMall by coldtea on Sunday July 11, 2021 @05:55AM (#27799639)
>Some people go to instagram for fashion, but that is definitely not all women nor just women.

No, but it is the third option you ommited: mostly women (doing that).

Re:Instagram Has Become SkyMall by OJFord on Sunday July 11, 2021 @07:09AM (#27799925)
Great, does it matter? I think GGP's comment's point was that some do want that. They said 'women' but I don't think it really matters (or affects the point) who it is.
Re:Instagram Has Become SkyMall by stirfish on Sunday July 11, 2021 @10:30AM (#27801111)
Are you on Instagram? If so, do you find the fashion ads annoying?

I just scrolled through Instagram and I think they changed the ads. I still want to shoot myself, but I'm not getting any ads for weapons anymore

Re:Instagram Has Become SkyMall by fieryskiff11 on Sunday July 11, 2021 @10:17PM (#27806240)
YWNBAW
Re:Instagram Has Become SkyMall by stirfish on Wednesday July 14, 2021 @04:49PM (#27838248)
You are not welcome here. Get out.
Re:Instagram Has Become SkyMall by Izikiel43 on Sunday July 11, 2021 @05:06AM (#27799434)
How do you detect ads? If not in following empty response?
Re:Instagram Has Become SkyMall by grishka on Sunday July 11, 2021 @05:09AM (#27799445)
Ad posts have additional fields in them. They have to, because they're shown in the UI as "sponsored" and with extra buttons and stuff. Ad stories are retrieved via a separate request, so it just suffices to either return an empty response or throw an exception from there.