5 ms·

Reverse Engineered Nintendo Switch App REST API

67 points by SamWhited 6y ago

Polylactic_acid 6y ago
Is this your work? I'm wondering, if the app did use cert pinning, how would you mitm it on your own device?
- Scaevolus 6y ago
  > I reverse-engineered using mitmproxy. It was quite easy as the app does not use cert-pinning at all. If the app used cert-pinning you'd probably do the RE work on android, where you can more easily install a modified APK with cert pinning disabled.
  - lozaning 6y ago
    I've tried various times to get around a cert pinning thing for work, curious as to what you'd recommend as the best method to go about doing this on android. RE the APK or some kind of rooted phone based debugery?
    - hacksore 6y ago
      For me it’s using a rooted phone. I have some info for my RE on another app that might be helpful. https://docs.google.com/document/d/1q0Pz2t5Gmt-vv8z-2Yswhvg2x9B2f3d1vjpkIjt9EfQ/mobilebasic https://docs.google.com/document/d/1q0Pz2t5Gmt-vv8z-2Yswhvg2...
    - xkcd-sucks 6y ago
      For me, the fastest way involves using apktool to decompile it, then simply reading the API code. Or insert a log statement, recompile, run on phone w adb log - requires minimal Android code fluency
      - Polylactic_acid 6y ago
        Does this usually work? I just unzipped an apk once and saw it was all javascript but I assumed other apps would be minified.
        xkcd-sucks 6y ago
        Java/Android is basically gibberish to me as is - Maybe it is obfuscated sometimes. But strings themselves (API endpoints) have to be present some way or another. There is also something called "smali" which is an intermediate representation - You can edit it following something like https://stackoverflow.com/questions/31101740/method-to-add-a-trace-in-smali https://stackoverflow.com/questions/31101740/method-to-add-a.... Finally, there are occasionally native ARM libs included in the jar - You can get these with tool "retdec" or just run strings on it to find interesting stuff
    - mjg59 6y ago
      As well as the other answers, an alternative is to use smali to somewhat decompile the app, figure out which HTTP library it's using, delete the call to the function that enables pinning, rebuild the apk, sign it and run that version. The longer version is that it really varies based on the app. Some apps are using something like React Native and have all their logic in Javascript. Some apps have the API in Java code and you can figure it out by using jadx to get a reasonable approximation of the original source. Some apps do all of this in native code, and then you're into Ghidra territory. My personal experience is that MITMing the connection is the easiest way to get an understanding of the overall shape of the API, with inspection of the code itself then being used to fill in gaps.
    - mitmfrida 6y ago
      I use frida https://frida.re/ https://frida.re/ along with android-x86 VM. Worked well for every app I tried so far
bryan_w 6y ago
I wonder if anyone has reversed the Mario maker 2 API
- realusername 6y ago
  This would be an interesting project, especially to archive levels, who knows what will be left in a few years of the current levels.
happppy 6y ago
how many tokens are there?
guessmyname 6y ago
> Visit authorization link in browser. This page is an HTML page which loads the auth flow which you would normally see first when logging into the app. Follow through the flow by logging in with an account. I currently have no idea how this URL is generated. I recommend signing out of the Switch app, then sign back in and open the sign flow link in Safari. You can then open it on your computer and follow from there. I was surprised when I read this paragraph because the owner of the repository is a Full Stack Web Developer at Square. One would expect a web developer at such an important company to know what OAuth is [1]… but then I saw the last time the README file was updated was over 3 years ago on Jul 30, 2017. He joined Square on October 2018 hopefully knowing what OAuth is but forgot to update the repository. [1] https://tools.ietf.org/html/rfc6749 https://tools.ietf.org/html/rfc6749
- henriquez 6y ago
  OAuth is not even a real standard at this point, at best it’s a concept. Practically every company is using a different implementation; so even if we assume that Nintendo is using “OAuth,” it’s not safe to assume anything about their implementation of it.

67 points by SamWhited 6y ago

Polylactic_acid 6y ago

Is this your work? I'm wondering, if the app did use cert pinning, how would you mitm it on your own device?

Scaevolus 6y ago
> I reverse-engineered using mitmproxy. It was quite easy as the app does not use cert-pinning at all. If the app used cert-pinning you'd probably do the RE work on android, where you can more easily install a modified APK with cert pinning disabled.
- lozaning 6y ago
  I've tried various times to get around a cert pinning thing for work, curious as to what you'd recommend as the best method to go about doing this on android. RE the APK or some kind of rooted phone based debugery?
  - hacksore 6y ago
    For me it’s using a rooted phone. I have some info for my RE on another app that might be helpful. https://docs.google.com/document/d/1q0Pz2t5Gmt-vv8z-2Yswhvg2x9B2f3d1vjpkIjt9EfQ/mobilebasic https://docs.google.com/document/d/1q0Pz2t5Gmt-vv8z-2Yswhvg2...
  - xkcd-sucks 6y ago
    For me, the fastest way involves using apktool to decompile it, then simply reading the API code. Or insert a log statement, recompile, run on phone w adb log - requires minimal Android code fluency
    - Polylactic_acid 6y ago
      Does this usually work? I just unzipped an apk once and saw it was all javascript but I assumed other apps would be minified.
      - xkcd-sucks 6y ago
        Java/Android is basically gibberish to me as is - Maybe it is obfuscated sometimes. But strings themselves (API endpoints) have to be present some way or another. There is also something called "smali" which is an intermediate representation - You can edit it following something like https://stackoverflow.com/questions/31101740/method-to-add-a-trace-in-smali https://stackoverflow.com/questions/31101740/method-to-add-a.... Finally, there are occasionally native ARM libs included in the jar - You can get these with tool "retdec" or just run strings on it to find interesting stuff
  - mjg59 6y ago
    As well as the other answers, an alternative is to use smali to somewhat decompile the app, figure out which HTTP library it's using, delete the call to the function that enables pinning, rebuild the apk, sign it and run that version. The longer version is that it really varies based on the app. Some apps are using something like React Native and have all their logic in Javascript. Some apps have the API in Java code and you can figure it out by using jadx to get a reasonable approximation of the original source. Some apps do all of this in native code, and then you're into Ghidra territory. My personal experience is that MITMing the connection is the easiest way to get an understanding of the overall shape of the API, with inspection of the code itself then being used to fill in gaps.
  - mitmfrida 6y ago
    I use frida https://frida.re/ https://frida.re/ along with android-x86 VM. Worked well for every app I tried so far

bryan_w 6y ago

I wonder if anyone has reversed the Mario maker 2 API

realusername 6y ago
This would be an interesting project, especially to archive levels, who knows what will be left in a few years of the current levels.

happppy 6y ago

how many tokens are there?

guessmyname 6y ago

> Visit authorization link in browser. This page is an HTML page which loads the auth flow which you would normally see first when logging into the app. Follow through the flow by logging in with an account. I currently have no idea how this URL is generated. I recommend signing out of the Switch app, then sign back in and open the sign flow link in Safari. You can then open it on your computer and follow from there. I was surprised when I read this paragraph because the owner of the repository is a Full Stack Web Developer at Square. One would expect a web developer at such an important company to know what OAuth is [1]… but then I saw the last time the README file was updated was over 3 years ago on Jul 30, 2017. He joined Square on October 2018 hopefully knowing what OAuth is but forgot to update the repository. [1] https://tools.ietf.org/html/rfc6749 https://tools.ietf.org/html/rfc6749

henriquez 6y ago
OAuth is not even a real standard at this point, at best it’s a concept. Practically every company is using a different implementation; so even if we assume that Nintendo is using “OAuth,” it’s not safe to assume anything about their implementation of it.