Hello guys,
I'm looking to extract the API calls of an obfuscated apk. It seems like the app was obfuscated with DexGuard, since there is one .class fragment which is called ProtectedGame.class.
The app communicates over X.509 SSL with certificate pinning, therefore all I need to do is to modify the methods checkServerTrusted() and checkClientTrusted(). But as soon as I edit something in the .smali the App crashes immediately after reinstalling. Even if I just sign the .apk with a new generated key, the app crashes. It seems that there are some anti-tampering methods involved that check the signature of the app. I tried to modify the obfuscated methods in the .smali but hadn't got any success. I also tried running some xposed modules on Android 4.x that claim to counter certificate pinning.
Can you help me with this? I am talking about this app: https://play.google.com/store/apps/details?id=ch.pala.resources&hl=en_US
I will include the compiled ProtectedGame.java, ProtectedGame.smali and the original .apk to this post.
Thank you!
The files:
https://drive.google.com/file/d/1N_dpWBabLoS3dwD2lquzrhcd30i9E39t/view?usp=sharing