Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse Engineering Snapchat: Obfuscation Techniques

hot3eed.github.io

Post reply on HN
Print view View original

41–50 of 180 posts

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#41

Post by georgiecasey »

akersten wrote: post #9

Wow, that seems really messy. If you're just after the API key or whatever, wouldn't reversing the Android app be simpler? As far as I know, you can't do all these low-level tricks on the Java platform.

Android was way easier until Google started helping out and introduced SafetyNet attestation. I think it was orginally coded for Google Wallet/Pay but Snapchat were definitely using it from early on. Pokemon Go use it as well.

Apple have no such system as far as I can know, and if they do, don't share it with 3rd party developers.

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#43

Post by jayd16 »

qvrjuec wrote: post #25
jayd16 wrote: post #23

Philosophically I never gave much thought to securing app client code. Why not just track usage stats and ban clearly fake/high throughput users?

Because the users who were less clearly fake would still degrade the experience of the rest of the users. To use an analogy, consider currency counterfeiting. The government doesn't just look to see who is spending lots of cash without a job because it's a much harder problem than making the bills extremely difficult for the layman to forge. Same principle here - making the token extremely difficult to forge is the e…

I'm not sure this analogy tracks very well. The government doesn't bother heightening the quality of one dollar bills, either. The government doesn't have information about every transaction, a web API does.

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#44

Post by 3eed »

cremp wrote: post #40
3eed wrote: post #16

Earlier quoted context omitted.

OP here. About half are off the shelf. Joint functions, the breakpoint infinite loop, in-house memmove, the overflowing thing, those I haven’t read about anywhere before.

For the overflow, Jagex with RuneScape did it in Java. They also did stupid Object arrays 7 or so levels deep, doing casts on casts in between. The bytecode itself made the actual runtime slow to a crawl (anywhere from 5 to 10x slowdown.) This was circa 2014.

That’s interesting to know

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#45

Post by dang »

3eed wrote: post #30
programmarchy wrote: post #22

Earlier quoted context omitted.

OP, your comments are showing up dead so you might be shadow-banned.

Thanks for letting me know! I contacted support.

Your account's fine, but some comments were getting caught in a software filter. Sorry! I've marked it legit so this won't happen again.

(Fortunately users vouched for all the affected comments, so they were unkilled before mods got to this thread. That's exactly what the vouch feature is for and I love to see it work so well.)

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#46

Post by plausibility »

sbuccini wrote: post #15

I remember back in 2013(?) I went to a collegiate hackathon in Santa Monica. Evan Spiegel showed up to walk the floor and someone showed him how they had sniffed the API and did something interesting with it (forget the particulars now, getting old). If I recall correctly, Evan offered the kid a job on the spot but the kid turned him down. They've come a long way since then!

Was this perhaps LA Hacks [0] in 2014, or Hacktech [1]? Evan Spiegel attended LA Hacks, but I had someone who was attending Hacktech email me for help with the Snapchat API for their project. (I was part of Gibson Security, and published some early Snapchat API research [2] online in 2013)

[0] https://en.wikipedia.org/wiki/LA_Hacks

[1] https://medium.com/hacktech-2014/everyones-watching-hacktech...

[2] https://gibsonsec.org/snapchat/fulldisclosure/

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#48

Post by whereistimbo »

dang wrote: post #45
3eed wrote: post #30

Earlier quoted context omitted.

Thanks for letting me know! I contacted support.

Your account's fine, but some comments were getting caught in a software filter. Sorry! I've marked it legit so this won't happen again. (Fortunately users vouched for all the affected comments, so they were unkilled before mods got to this thread. That's exactly what the vouch feature is for and I love to see it work so well.)

Hi dang, why is my latest submission flagged?
Post reply on HN