Exploring the Android APK via Pokemon GO The story of a Cat and a - - PowerPoint PPT Presentation

▶
exploring the android apk via pokemon go
SMART_READER_LITE
LIVE PREVIEW

Exploring the Android APK via Pokemon GO The story of a Cat and a - - PowerPoint PPT Presentation

Nov 19, 2023 425 likes •969 views

Exploring the Android APK via Pokemon GO The story of a Cat and a Mouse Structure of APK Extraction Techniques Solutions Us Niantic (Pokemon Go) Connor Tumbleson Software Engineer Apktool Maintainer @iBotPeaches

slide-1
SLIDE 1

Exploring the Android APK via Pokemon GO

slide-2
SLIDE 2

The story of a Cat and a Mouse

๏Structure of APK ๏Extraction Techniques ๏Solutions

Niantic (Pokemon Go) Us

slide-3
SLIDE 3

Connor Tumbleson

Software Engineer


Apktool Maintainer

@iBotPeaches connortumbleson.com

slide-4
SLIDE 4

Pokemon Go

slide-5
SLIDE 5

Why Pokemon?

๏Popularity ๏Rough Launch ๏Augmented Reality

slide-6
SLIDE 6

Pokemon Go - Unofficial Project Boom

๏Map Scanners ๏Bots ๏3rd party Clients

github.com/AHAAAAAAA/PokemonGo-Map

slide-7
SLIDE 7

Player Count or API Abuse?

Unofficial API Requests blocked.

pokemongo.nianticlabs.com/en/post/update-080416/

slide-8
SLIDE 8

Where did it begin?

slide-9
SLIDE 9

Where did it begin?

slide-10
SLIDE 10

Let’s learn about APKs

slide-11
SLIDE 11

So let’s take a look at Pokemon Go

slide-12
SLIDE 12

So what is in an APK?

๏Java Code ๏compiled to .class (javac) ๏then to .dex (dx) ๏dex file per 65,000 methods

Java Code classes.dex

slide-13
SLIDE 13

So what is in an APK?

๏Resources ๏Strings ๏Layouts ๏Images

Resources resources.arsc

slide-14
SLIDE 14

So what is in an APK?

๏Libraries ๏Game Engines ๏Android NDK ๏Native langs - C / C++

C/C++ il2cpp.so

slide-15
SLIDE 15

Goals

๏Understand Format ๏Extract ๏APIs ๏Assets ๏Rebuild

slide-16
SLIDE 16

Meet Apktool

slide-17
SLIDE 17

Meet Apktool

(not a plug)

slide-18
SLIDE 18

Pokemon Go - Decode

slide-19
SLIDE 19

Extraction - Format

๏Unity Game Engine ๏Multi Platform ๏Widely Used

slide-20
SLIDE 20

Extraction - Assets

slide-21
SLIDE 21

Extraction - Assets

slide-22
SLIDE 22

Extraction - Assets

slide-23
SLIDE 23

Solution - Assets

๏Placeholders ๏Download assets on runtime

slide-24
SLIDE 24

Extraction - MITM

๏Man in the Middle ๏Peek into SSL traffic

slide-25
SLIDE 25

Extraction - MITM

๏Not exactly readable

slide-26
SLIDE 26

Google - Protocol Buffers

Protocol buffers are Google's language-neutral, platform-neutral, extensible mechanism for serializing structured data – think XML, but smaller, faster, and simpler.

https://developers.google.com/protocol-buffers/

slide-27
SLIDE 27

Extraction - Raw Protobuf

๏Raw Protobuf output ๏Could be better

slide-28
SLIDE 28

Extraction - il2cpp

https://blogs.unity3d.com/2015/05/06/an-introduction-to-ilcpp-internals/

IL IL IL C++ C++ C++ C# user scripts Unity Script user scripts IL Assemblies (UnityEngine.dll, UnityEngine.UI.dll, asset store packages) il2cpp.exe Mono C# compiler UnityScript compiler Xcode (iOS) Other C++ compiler Emscripten (WebGL)

slide-29
SLIDE 29

Extraction - il2cpp

https://blogs.unity3d.com/2015/05/06/an-introduction-to-ilcpp-internals/

IL IL IL C++ C++ C++ C# user scripts Unity Script user scripts IL Assemblies (UnityEngine.dll, UnityEngine.UI.dll, asset store packages) il2cpp.exe Mono C# compiler UnityScript compiler Xcode (iOS) Other C++ compiler Emscripten (WebGL)

slide-30
SLIDE 30

Extraction - protobuf

slide-31
SLIDE 31

Extraction - MITM

https://github.com/AeonLucid/POGOProtos

slide-32
SLIDE 32

๏Understand Request ๏Edit Requests ๏Bonus: Precise values

slide-33
SLIDE 33

Solution - Sniffing

๏SSL Pinning ๏Not in launch ๏Added in 0.31

slide-34
SLIDE 34

Extraction - Diff Report

๏NianticTrustManager.smali ๏hmmm

New Old

slide-35
SLIDE 35

Extraction - smali

slide-36
SLIDE 36

Extraction - smali patched

slide-37
SLIDE 37

Extraction - Rebuild Complete

๏We are back ๏Caveat: Google Auth

slide-38
SLIDE 38

Solution - Java Obfuscation

slide-39
SLIDE 39

Solution - Java Obfuscation

vs

Old New

slide-40
SLIDE 40

Solution - “Unknown6”

slide-41
SLIDE 41

Unofficial API Blackout

Unknown6 Enforced

pokemongo.nianticlabs.com/en/post/update-080416/

slide-42
SLIDE 42

ClientBlob - “Unknown6”

๏GPS ๏Sensor ๏Device ๏Activity

slide-43
SLIDE 43

“Unknown6” broken

https://github.com/pogodevorg/TU6

slide-44
SLIDE 44

Solution - Native Obfuscation

๏Obfuscation ๏Anti-Debugger ๏Integrity Validation ๏Complexity

slide-45
SLIDE 45

Hello SafetyNet

slide-46
SLIDE 46

Solution - SafetyNet

๏SafetyNet enforces the CTS ๏Compatibility Test Suite ๏Blocks rooted devices ๏Integrity Checks

slide-47
SLIDE 47

Solution - SafetyNet evolves

๏suhide / magisk ๏bypasses SafetyNet ๏frequent updates

https://developer.android.com/training/safetynet/index.html

slide-48
SLIDE 48

Solution - Captcha

๏Not all users are equal ๏Catch the outliers ๏Google’s reCAPTCHA

slide-49
SLIDE 49

Solution - Legal :/

slide-50
SLIDE 50

Solution - Production is not Development

๏Debug code can be abused ๏Application contains clues ๏Explain features

slide-51
SLIDE 51

Solutions - Recap

๏Runtime Assets ๏Obfuscation ๏API Security ๏Captcha, SafetyNet, Legal

slide-52
SLIDE 52

@iBotPeaches connortumbleson.com

Q / A

slide-53
SLIDE 53

Story Time

Upsight Analytics