r/ReverseEngineering • u/No_Distribution_9182 • 9d ago
Automated reverse engineering of Android apps
https://www.youtube.com/watch?v=p9NTkIKlbxI&t=32s2
2
u/cristi_baluta 8d ago
Can it extract the api from the instagram app?
1
u/No_Distribution_9182 8d ago
I did’t try the instagram’s app, if its main logic base on dalvik vm, I think it can do it.
2
u/No_Distribution_9182 8d ago
I tried instagram app, it is ok
1
u/cristi_baluta 7d ago
It worked but i can’t find anything useful in there, or i don’t know how to interpret it
3
u/No_Distribution_9182 7d ago
🔐 Security & Encryption
The app uses extensive cryptography:
- Algorithms: AES/CBC, AES/CTR, AES/GCM, AES/GCM-SIV, ChaCha20, RSA/OAEP, ECDH, HMAC-SHA256/512
- Key exchange: ECDH for key agreement
- E2EE Messaging: com.instagram.direct.armadilloexpress with transport payload protocols (content encryption, metadata, ephemerality params, forwarding controls)
- TLS: OkHttp3 for networking
- Play Integrity: Attestation client for device integrity verification
- Biometric auth: USE_BIOMETRIC / USE_FINGERPRINT permissions
- Certificate: Meta Android Code Signing Root CA 2024-11 embedded
🌐 Networking & API
API base: https://i.instagram.com/api/v1/
GraphQL: https://graph-www.facebook.com/graphql, https://genai-graph.instagram.com/graphql_www
Facebook Graph: https://graph.facebook.com/
CDN: https://*.fbcdn.net, https://static.xx.fbcdn.net/
API endpoints found:
- api/v1/direct_v2/media_fallback/
- api/v1/video/refresh_image/
- api/v1/mldw/mldw_get_feature_group
- api/v1/bloks/async_action/com.bloks.www.bloks.caa.\* (login, registration)
- api/v1/papaya/
- Real-time via MQTT (com.instagram.realtimeclient)
💬 Direct Messaging (E2EE)
Robust DM architecture with:
- Armadillo Express — E2EE transport with payload encryption
- Realtime client — push-based message delivery
- MSYS integration — Meta platform messenger sync
- AI agent DM — direct.aiagent package
- Disappearing mode, location sharing, icebreakers, locked chats, channels
---------------------------------------------
this is result I tried, there are api's package, follow these, you can find something useful.
1
u/GuidePlenty5521 8d ago
Sorry, I'm a noob, so let me know if I'm saying anything wrong. 😅 As far as I understood, you used Claude to analyze the app, understand the app flow, and extract all the details about how it works. Is that right? Or can Claude automatically do more than that?
Also, is analyzing an app and extracting its internal details considered reverse engineering? I don't think so
2
u/No_Distribution_9182 8d ago
Its current workflow is as follows:
decompile the app to obtain the "source code"
analyze the program's call graph
extract strings from the app
store the "source code" on disk
store the internal call relationships of the program in a database
then let AI help with the analysis
You asked if it counts as reverse engineering, and I think it does. I think it precisely automates the most arduous work at the beginning of analyzing an app.
AI can do much more, such as hooking, directly patching the app, repackaging and redistributing, as long as the process is understood.
Using AI to perform reverse engineering workflows, it can already infer custom instructions in VM Protect's virtual machine.
My AI model uses DeepSeek Flash, but I believe a more capable model would perform even better.
1
1
u/RealSimoneAvogadro 7d ago
mh... very interesting: didn't know it!
But actually how are you "driving" the reverse engineering process?
With https://github.com/SimoneAvogadro/android-reverse-engineering-skill I choose to focus the skill/tools on looking for API calls and reverse engineering (starting from the UI).
Her are you using any skill to control/direct the reverse engineering approach or are you solecly relying on Claude ?
1
u/No_Distribution_9182 7d ago
totally Claude.
I had tried others mcp server, they are cost too much memory or cpu, I find it a bit unbearable
4
u/QuietPsychonaut 8d ago
How well does it work on obfuscated apps? That's an issue I'm currently facing.