7 ms·

Reverse Engineer Amazon's Whispersync

124 points by ptbrowne 6y ago

sdoering 6y ago
Wow. This was a fun read. I would have been lost - but loved for somebody to explain it in a way I was able to grasp with my level of technically understanding. Thanks to the author - I would love for this data to be in an open format, as I would love to do some kind of personal analytics on that (same with Audible data actually). On a different tangent, I really love the ease in the Kindle/Audible ecosystem to switch between the same content in different media. Reading on the kindle app, switching to Audible in the car and back to kindle in the evening in bed. That really makes reading/book consumption great.
kilroy123 6y ago
I'm very interested in this. I read a lot of books that aren't from Amazon on my Kindle. I do a lot of highlighting, which I like to export to readwise. In order to do this I have to plug in my Kindle. Mount it. Find the clippings file. Upload the file to readwise. The best I came up with was a script that detects when I plug-in my Kindle and opens the finder window and opens the readwise page. Pretty lame.
- sushicalculus 6y ago
  Could you post this script to somewhere? Gist, codepen, etc? I want to see if can improve it. There might be a way to have the terminal auto-copy the clippings file
  - farss 6y ago
    Here's a similar script I wrote. Would be glad for feedback. https://github.com/wneuheisel/Kindle-Notes-Backup https://github.com/wneuheisel/Kindle-Notes-Backup
    - kilroy123 6y ago
      Oh awesome. I see you spent much longer than my 30 minutes on this. I'm going to take a good look at this later.
- ptbrowne 6y ago
  Unfoturnately, Amazon does not sync highlights on books that have not been purchased on Amazon. This is also why Readwise cannot automatically sync those highlights. https://help.readwise.io/article/67-some-of-my-kindle-books-and-highlights-arent-syncing-what-do-i-do https://help.readwise.io/article/67-some-of-my-kindle-books-...
fprog 6y ago
Loved section 1.5.1, "Bytes in color". The author wrote code to help them understand a custom binary format by coloring the bytes based on their value, making patterns in the format visually obvious. The structure of the binary becomes much more clear when visualized this way. That's a handy approach I've mentally bookmarked for the future.
- syoc 6y ago
  You might be interested in https://github.com/sharkdp/hexyl https://github.com/sharkdp/hexyl > hexyl is a simple hex viewer for the terminal. It uses a colored output to distinguish different categories of bytes (NULL bytes, printable ASCII characters, ASCII whitespace characters, other ASCII characters and non-ASCII).
- p_l 6y ago
  I was in a team that, among other things, was working on integrating 3d visualisation of binary files in a hex editor with the plan of making a reverse engineering tool (mainly for security). It's a very powerful method.
  - LargoLasskhyfv 6y ago
    Like CantorDust by Christopher Domas@Batelle? https://www.youtube.com/watch?v=4bM3Gut1hIk https://www.youtube.com/watch?v=4bM3Gut1hIk really blew my mind when I saw it. Btw. about 8 years later they finally delivered, by releasing it as plug-in for Ghidra! Yay! https://github.com/Battelle/cantordust https://github.com/Battelle/cantordust
    - rckoepke 6y ago
      Does that have the 3D visualizations shown in Christopher's 2013-2014 talks? Both the github readme and the associated blogpost from July make it look like it only includes 2D visualizations. There are fewer "view" buttons on the right toolbar than the demo had. I should answer my own question by simply trying it out, but I'm not quite sure when I'll have a moment to get around to it. [0]: https://inside.battelle.org/blog-details/battelle-publishes-open-source-binary-visualization-tool https://inside.battelle.org/blog-details/battelle-publishes-...
ibatindev 6y ago
Very well explained! I though the text was encrypted but then I realized it was just french. Damn.
- adolph 6y ago
  https://en.wikipedia.org/wiki/Code_talker https://en.wikipedia.org/wiki/Code_talker
tshrjn 6y ago
readwise kinda helps do something similar?
- ptbrowne 6y ago
  Hi, thanks I did not know Readwise. I signed up for an account to check how it works. It uses a browser extension to sync the highlights instead of using the API. It can sync automatically but your browser must stay open (which is OK IMHO). Readwise can sync much more sources also. Thanks for introducing me to Readwise, I might use it :)
  - bredren 6y ago
    Still a valuable exploration! That said, this suggestion and it’s method of avoiding direct interaction, but instead using rendered content in browser is another reminder of how powerful browser extensions are. They can also make additional requests using the user’s ip address. Would pulling data this way also seems less likely to be a TOS issue? Reason being that you are reading content you are manipulating or displaying in a browser “after” amazon does their own highlighting.
mmastrac 6y ago
This could also be an interesting way to liberate my Kindle books from the Amazon ecosystem.
rektide 6y ago
would this work if Amazon was using cert pinning? cert pinning basically seems like a way to make apps able to resist user's having any freedom or power. the author here installs a custom CA to man-in-the-middle. now more & more apps use cert pinning, which would block that, I believe, & keep the user from being able to reverse engineer & probe. imo the forces in favor of securing things have done the users great great damage. who are we securing things for? imo the security world needs to re-orient, & begin to harken to RFC 8890 The Internet is For End Users[1], allowing users some means to see how their systems are behaving. "secure" standards like cert-pinning favor giant companies & totalistic visions of security, taking from computing the person & personal. cert-pinning is a good layer of defense, but it takes away user affordances that must be added back. [1] https://tools.ietf.org/html/rfc8890 https://tools.ietf.org/html/rfc8890
- ptbrowne 6y ago
  You're right, this technique would not work if Amazon had used cert pinning. I haven't yet tried to bypass a cert pinning app, but it seems that frameworks like Frida could help : https://medium.com/@ved_wayal/hail-frida-the-universal-ssl-pinning-bypass-for-android-e9e1d733d29 https://medium.com/@ved_wayal/hail-frida-the-universal-ssl-p....
  - Godel_unicode 6y ago
    Or just open up the apk in e.g. apk studio and replace the bundled cert with the one from your mitm proxy. Effectively, that'll repin the app to your proxy specifically. There are more exotic pinning methods that this won't solve (the forever cat-and-mouse game) but it's good for many apps.
    - rektide 6y ago
      It's a problem that, alas, must be tackled somewhat uniquely on every platform, where-as previously users were free to manage their own Certificate Authorities as they wished. Now users are safe & secure from themselves. :/ Admittedly there were a lot of problems with poorly managed CA stores, users being abused, but cert-pinning feels like such a drastic overreach in preventing any form of user control. Techniques like this "rebuild your apk" are interesting & good to have, but every OS needs it's own bag of tricks. It's probably not a total show-stopper, but news like today's that Windows 10 will only install signed driver software (an admittedly niche-ish case), the closed Apple store,... there's a lot of places side-loading is not an option. Do those apps get a pass, get to be complete black-box software that we the users have zero ability to look at or understand? [1] https://www.zdnet.com/article/windows-10-will-start-blocking-drivers-if-it-cant-verify-software-publisher/ https://www.zdnet.com/article/windows-10-will-start-blocking...
bredren 6y ago
Anyone know if there been any action around reverse engineering the hardware connectivity? I’ve wanted a clicker page turner for a while. It would be amazing if the usb interface was figured out.

124 points by ptbrowne 6y ago

Wow. This was a fun read. I would have been lost - but loved for somebody to explain it in a way I was able to grasp with my level of technically understanding. Thanks to the author - I would love for this data to be in an open format, as I would love to do some kind of personal analytics on that (same with Audible data actually). On a different tangent, I really love the ease in the Kindle/Audible ecosystem to switch between the same content in different media. Reading on the kindle app, switching to Audible in the car and back to kindle in the evening in bed. That really makes reading/book consumption great.

kilroy123 6y ago

I'm very interested in this. I read a lot of books that aren't from Amazon on my Kindle. I do a lot of highlighting, which I like to export to readwise. In order to do this I have to plug in my Kindle. Mount it. Find the clippings file. Upload the file to readwise. The best I came up with was a script that detects when I plug-in my Kindle and opens the finder window and opens the readwise page. Pretty lame.

sushicalculus 6y ago
Could you post this script to somewhere? Gist, codepen, etc? I want to see if can improve it. There might be a way to have the terminal auto-copy the clippings file
- farss 6y ago
  Here's a similar script I wrote. Would be glad for feedback. https://github.com/wneuheisel/Kindle-Notes-Backup https://github.com/wneuheisel/Kindle-Notes-Backup
  - kilroy123 6y ago
    Oh awesome. I see you spent much longer than my 30 minutes on this. I'm going to take a good look at this later.
ptbrowne 6y ago
Unfoturnately, Amazon does not sync highlights on books that have not been purchased on Amazon. This is also why Readwise cannot automatically sync those highlights. https://help.readwise.io/article/67-some-of-my-kindle-books-and-highlights-arent-syncing-what-do-i-do https://help.readwise.io/article/67-some-of-my-kindle-books-...

fprog 6y ago

Loved section 1.5.1, "Bytes in color". The author wrote code to help them understand a custom binary format by coloring the bytes based on their value, making patterns in the format visually obvious. The structure of the binary becomes much more clear when visualized this way. That's a handy approach I've mentally bookmarked for the future.

syoc 6y ago
You might be interested in https://github.com/sharkdp/hexyl https://github.com/sharkdp/hexyl > hexyl is a simple hex viewer for the terminal. It uses a colored output to distinguish different categories of bytes (NULL bytes, printable ASCII characters, ASCII whitespace characters, other ASCII characters and non-ASCII).
p_l 6y ago
I was in a team that, among other things, was working on integrating 3d visualisation of binary files in a hex editor with the plan of making a reverse engineering tool (mainly for security). It's a very powerful method.
- LargoLasskhyfv 6y ago
  Like CantorDust by Christopher Domas@Batelle? https://www.youtube.com/watch?v=4bM3Gut1hIk https://www.youtube.com/watch?v=4bM3Gut1hIk really blew my mind when I saw it. Btw. about 8 years later they finally delivered, by releasing it as plug-in for Ghidra! Yay! https://github.com/Battelle/cantordust https://github.com/Battelle/cantordust
  - rckoepke 6y ago
    Does that have the 3D visualizations shown in Christopher's 2013-2014 talks? Both the github readme and the associated blogpost from July make it look like it only includes 2D visualizations. There are fewer "view" buttons on the right toolbar than the demo had. I should answer my own question by simply trying it out, but I'm not quite sure when I'll have a moment to get around to it. [0]: https://inside.battelle.org/blog-details/battelle-publishes-open-source-binary-visualization-tool https://inside.battelle.org/blog-details/battelle-publishes-...

ibatindev 6y ago

Very well explained! I though the text was encrypted but then I realized it was just french. Damn.

adolph 6y ago
https://en.wikipedia.org/wiki/Code_talker https://en.wikipedia.org/wiki/Code_talker

tshrjn 6y ago

readwise kinda helps do something similar?

ptbrowne 6y ago
Hi, thanks I did not know Readwise. I signed up for an account to check how it works. It uses a browser extension to sync the highlights instead of using the API. It can sync automatically but your browser must stay open (which is OK IMHO). Readwise can sync much more sources also. Thanks for introducing me to Readwise, I might use it :)
- bredren 6y ago
  Still a valuable exploration! That said, this suggestion and it’s method of avoiding direct interaction, but instead using rendered content in browser is another reminder of how powerful browser extensions are. They can also make additional requests using the user’s ip address. Would pulling data this way also seems less likely to be a TOS issue? Reason being that you are reading content you are manipulating or displaying in a browser “after” amazon does their own highlighting.

mmastrac 6y ago

This could also be an interesting way to liberate my Kindle books from the Amazon ecosystem.

rektide 6y ago

would this work if Amazon was using cert pinning? cert pinning basically seems like a way to make apps able to resist user's having any freedom or power. the author here installs a custom CA to man-in-the-middle. now more & more apps use cert pinning, which would block that, I believe, & keep the user from being able to reverse engineer & probe. imo the forces in favor of securing things have done the users great great damage. who are we securing things for? imo the security world needs to re-orient, & begin to harken to RFC 8890 The Internet is For End Users[1], allowing users some means to see how their systems are behaving. "secure" standards like cert-pinning favor giant companies & totalistic visions of security, taking from computing the person & personal. cert-pinning is a good layer of defense, but it takes away user affordances that must be added back. [1] https://tools.ietf.org/html/rfc8890 https://tools.ietf.org/html/rfc8890

ptbrowne 6y ago
You're right, this technique would not work if Amazon had used cert pinning. I haven't yet tried to bypass a cert pinning app, but it seems that frameworks like Frida could help : https://medium.com/@ved_wayal/hail-frida-the-universal-ssl-pinning-bypass-for-android-e9e1d733d29 https://medium.com/@ved_wayal/hail-frida-the-universal-ssl-p....
- Godel_unicode 6y ago
  Or just open up the apk in e.g. apk studio and replace the bundled cert with the one from your mitm proxy. Effectively, that'll repin the app to your proxy specifically. There are more exotic pinning methods that this won't solve (the forever cat-and-mouse game) but it's good for many apps.
  - rektide 6y ago
    It's a problem that, alas, must be tackled somewhat uniquely on every platform, where-as previously users were free to manage their own Certificate Authorities as they wished. Now users are safe & secure from themselves. :/ Admittedly there were a lot of problems with poorly managed CA stores, users being abused, but cert-pinning feels like such a drastic overreach in preventing any form of user control. Techniques like this "rebuild your apk" are interesting & good to have, but every OS needs it's own bag of tricks. It's probably not a total show-stopper, but news like today's that Windows 10 will only install signed driver software (an admittedly niche-ish case), the closed Apple store,... there's a lot of places side-loading is not an option. Do those apps get a pass, get to be complete black-box software that we the users have zero ability to look at or understand? [1] https://www.zdnet.com/article/windows-10-will-start-blocking-drivers-if-it-cant-verify-software-publisher/ https://www.zdnet.com/article/windows-10-will-start-blocking...

bredren 6y ago

Anyone know if there been any action around reverse engineering the hardware connectivity? I’ve wanted a clicker page turner for a while. It would be amazing if the usb interface was figured out.