Naman Deshmukh

Guess who’s back on android phones? That’s right! Our little rabbit friend! We have fought through: ⁃ “IMEI checks” We discovered these literally don’t exist and you still can just use any string as IMEI ⁃ Other header checks These are obfuscated across a few files and even a c++ extension, but they aren’t secure at all. We patched these into the app file and also patched it to not require system level permissions anymore. ⁃ Sleep schedules We needed to stay up late because the only person which had physical access has the opposite timezone as the rest of us. ⁃ IP bans A few members of the team including me got IP banned from the servers, fortunately we don’t care and I was in a vacation home. ⁃ Acquiring an updated app This was hellish but we figured out a way eventually to dump the original ROM and patch OTA updates onto it. ⁃ Blocked http inspection tools The app now uses certificate pinning, we can probably patch that out but for now we haven’t needed it. This is the current latest OTA update with the latest app. There are a lot of fakes and knockoff apps going around twitter, and information about rooting of the device, but we have access to the official dumped app, the official servers, and a valid method to dump the entire ROM. No cheating here. Please note that we will not be sharing any files. Thanks to these amazing people: @EmilyLShepherd @ChromMob @thel3l @uwukko @schlizzawg There are also some other people who rather don’t want to be mentioned. Also a huge thanks to @MishaalRahman for the credibility and sticking with us through the process. No one would have trusted us if some of us just posted it. 

I linked the full new article below.