4 ms·

I really doubt this. Any such upload would be visible inside the WhatsApp application, which would make it the world's most exciting (and relatively straightfor

I really doubt this. Any such upload would be visible inside the WhatsApp application, which would make it the world's most exciting (and relatively straightforward) RE project. You can even start with a Java app, so it's extra easy.

cosmicgadget 9mo ago
If you claim REing a flagship FAANG application is "extra easy", either they need to be laughed out of the room or you do.
- martinralbrecht 9mo ago
  Note that WhatsApp as a web client, too: https://eprint.iacr.org/2025/794 https://eprint.iacr.org/2025/794
- gruez 9mo ago
  Does FAANG apps have antidebug or code obfuscation? At least for google their apps are pretty lightly protected. The maximum extent of obfuscation is the standard compilation/optimization process that most apps go through (eg. r8 or proguard).
- quesera 9mo ago
  Reverse engineering is easy when the source code is available. :) The difference between source code in a high-level language, and AArch64 machine language, is surmountable. The effort is made easier if you can focus on calls to the crypto and networking libraries.
  - cosmicgadget 9mo ago
    The source is available? Understanding program flow is very different from understanding the composition of data passing though the program.
    - quesera 9mo ago
      At some level, the machine code is the source code -- but decompiling AArch64 mobile apps into something like Java is common practice. As GP alludes, you would be looking for a secondary pathway for message transmission. This would be difficult to hide in AArch64 code (from a skilled practitioner), and extra difficult in decompiled Java. It would be "easy" enough, and an enormous prize, for anyone in the field.
      - cosmicgadget 9mo ago
        I am familiar with disassembly and decompilation and what you just said is a huge handwave. > a secondary pathway for message transmission That's certainly the only way messages could be uploaded to Facebook!
        quesera 9mo ago
        I'm curious why you think it's handwavy. I've done this work on other mobile apps (not WhatsApp), and the work is not out of the ordinary. It's difficult to hide subtleties in decompiled code. And anything that looks hairbally gets special attention, if the calling sites or side effects are interesting. (edit for edit) > That's certainly the only way messages could be uploaded to Facebook! Well, there's a primary pathway which should be very obvious. And if there's a secondary pathway, it's probably for telemetry etc. If there are others, or if it isn't telemetry, you dig deeper. All secrets are out in the open at that point. There are no black boxes in mobile app code.
        cosmicgadget 9mo ago
        > if there's a secondary pathway, it's probably for telemetry etc. Seems like a good channel upon which to piggyback user data. Now all you have to do is obfuscate the serialization. > It's difficult to hide subtleties in decompiled code. Stripped, obfuscated code? Really? Are we assuming debug ability here? > All secrets are out in the open at that point. There are no black boxes in mobile app code. What about a loader with an encrypted binary that does a device attestation check?

cosmicgadget 9mo ago

If you claim REing a flagship FAANG application is "extra easy", either they need to be laughed out of the room or you do.

martinralbrecht 9mo ago
Note that WhatsApp as a web client, too: https://eprint.iacr.org/2025/794 https://eprint.iacr.org/2025/794
gruez 9mo ago
Does FAANG apps have antidebug or code obfuscation? At least for google their apps are pretty lightly protected. The maximum extent of obfuscation is the standard compilation/optimization process that most apps go through (eg. r8 or proguard).
quesera 9mo ago
Reverse engineering is easy when the source code is available. :) The difference between source code in a high-level language, and AArch64 machine language, is surmountable. The effort is made easier if you can focus on calls to the crypto and networking libraries.
- cosmicgadget 9mo ago
  The source is available? Understanding program flow is very different from understanding the composition of data passing though the program.
  - quesera 9mo ago
    At some level, the machine code is the source code -- but decompiling AArch64 mobile apps into something like Java is common practice. As GP alludes, you would be looking for a secondary pathway for message transmission. This would be difficult to hide in AArch64 code (from a skilled practitioner), and extra difficult in decompiled Java. It would be "easy" enough, and an enormous prize, for anyone in the field.
    - cosmicgadget 9mo ago
      I am familiar with disassembly and decompilation and what you just said is a huge handwave. > a secondary pathway for message transmission That's certainly the only way messages could be uploaded to Facebook!
      - quesera 9mo ago
        I'm curious why you think it's handwavy. I've done this work on other mobile apps (not WhatsApp), and the work is not out of the ordinary. It's difficult to hide subtleties in decompiled code. And anything that looks hairbally gets special attention, if the calling sites or side effects are interesting. (edit for edit) > That's certainly the only way messages could be uploaded to Facebook! Well, there's a primary pathway which should be very obvious. And if there's a secondary pathway, it's probably for telemetry etc. If there are others, or if it isn't telemetry, you dig deeper. All secrets are out in the open at that point. There are no black boxes in mobile app code.
        cosmicgadget 9mo ago
        > if there's a secondary pathway, it's probably for telemetry etc. Seems like a good channel upon which to piggyback user data. Now all you have to do is obfuscate the serialization. > It's difficult to hide subtleties in decompiled code. Stripped, obfuscated code? Really? Are we assuming debug ability here? > All secrets are out in the open at that point. There are no black boxes in mobile app code. What about a loader with an encrypted binary that does a device attestation check?