3 ms·
I am thoroughly impressed! How did you find that the key was obfuscated inside the image though?
by theflyinghorse 7y ago
I am thoroughly impressed! How did you find that the key was obfuscated inside the image though?
- netsharc 7y agoMy guess is that a function that looks like fetchKey() loads that image. Although maybe that's too easy to discover?
- selpop 7y agoSimilar to what netsharc describes Found the call that added the header for the API key to each request (even with Proguard's obfuscation string literals are preserved, so searching for "x-api-key" worked) From there I followed the call chain to their transformer, then looked at the input for the transformer and it was loading a subset of bytes read from the same resource as the launcher icon (and sure enough, opening it in a hex editor there was some weird "garbage" that I'm honestly surprised Android doesn't choke on)