Android app API reverse engineering (documented working client)
Description
📱 What you get
If an app has no public API, I capture it: rooted Android emulator, mitmproxy with the CA injected into the Android 14+ trust store, QUIC/HTTP-3 blocked so every request is visible, Frida for certificate pinning, WebSocket capture for real-time protocols (SendBird, Ably).
✅ Deliverables
- Endpoint inventory with headers, auth flow and signing (HMAC, tokens)
- A working client script (Node.js or Python) reproducing up to 5 endpoints
- Written protocol notes so your team can extend it
- Optional: real-time/WebSocket protocol + 14 days of support (+$400)
💡 Recent work
Marketplace chat over SendBird WebSocket + Cognito, HMAC-signed listing API, a pure-API booking client that fires at an exact second.
🚫 Not offered
Payment, DRM or anti-cheat bypass; apps where you have no right to interoperate.
📨 How to order
Message me the app name (APK or store link) and what you need from it. Feasibility answer within 24 h; delivery 5-10 days through escrow.
Category: IT
Tags: android, api, reverse-engineering, mitmproxy, frida, automation
Published on: October 19, 2026
Views: 3
Legal Notice: Buyers and sellers are responsible for complying with all applicable laws in their jurisdictions. XmrBazaar does not verify legality and assumes no liability. Peer-to-peer cash-for-crypto trades are permitted if not conducted as a business and are compliant with local laws; otherwise, sellers must hold any required licenses or registrations. Listings involving fraud, violence, child exploitation, or other clearly illegal goods or services are strictly prohibited and will be removed once identified. Users are encouraged to report unlawful listings.
About the trader
N/A
N/A
-----BEGIN PGP PUBLIC KEY BLOCK----- mDMEAAAAABYJKwYBBAHaRw8BAQdAe2spi1tt0XdmJ16AEQEpqLGS0u0HJaAxq6E3 1P8Edb20HXNjcmFwZXJzZXJ2aWNlc0B4bXJiYXphYXIuY29tiJQEExYKADwWIQSz PTlvIyXWNSFttPRfsIEJ6b8foQUCAAAAAAIbAwULCQgHAgMiAgEGFQoJCAsCBBYC AwECHgcCF4AACgkQX7CBCem/H6FDzwD+JDGXZgKSngmAENNb25n1/on1VrKdA1zT k0n89WdsiswA/2VQCG6TNORLsOsy4DtCykprHrv+XJ1n9hoTLWG6U6gLuDgEAAAA ABIKKwYBBAGXVQEFAQEHQAHb44/XKBWqz0EdADn0BPhv6mBUDWWqy0jkRUXnUPRi AwEIB4h4BBgWCgAgFiEEsz05byMl1jUhbbT0X7CBCem/H6EFAgAAAAACGwwACgkQ X7CBCem/H6ExSgD/Rw8wIxj3NP3jy4Np7M9r7U6Jr/jakzOtRirgVWbChWcBAIUY 1XaS1Wj4I2kLwHrIkaXNeyFuPUMxcHTBlOgRPVUN =GYK9 -----END PGP PUBLIC KEY BLOCK-----