{"action":"created","issue":{"url":"https://api.github.com/repos/NoxxDev/NecroBot/issues/336","repository_url":"https://api.github.com/repos/NoxxDev/NecroBot","labels_url":"https://api.github.com/repos/NoxxDev/NecroBot/issues/336/labels{/name}","comments_url":"https://api.github.com/repos/NoxxDev/NecroBot/issues/336/comments","events_url":"https://api.github.com/repos/NoxxDev/NecroBot/issues/336/events","html_url":"https://github.com/NoxxDev/NecroBot/issues/336","id":172295566,"number":336,"title":"[Issue] Protocol API still broken. Niantic can still identify 3rd party app users.","user":{"login":"WinterMoxRZ","id":21127256,"avatar_url":"https://avatars.githubusercontent.com/u/21127256?v=3","gravatar_id":"","url":"https://api.github.com/users/WinterMoxRZ","html_url":"https://github.com/WinterMoxRZ","followers_url":"https://api.github.com/users/WinterMoxRZ/followers","following_url":"https://api.github.com/users/WinterMoxRZ/following{/other_user}","gists_url":"https://api.github.com/users/WinterMoxRZ/gists{/gist_id}","starred_url":"https://api.github.com/users/WinterMoxRZ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WinterMoxRZ/subscriptions","organizations_url":"https://api.github.com/users/WinterMoxRZ/orgs","repos_url":"https://api.github.com/users/WinterMoxRZ/repos","events_url":"https://api.github.com/users/WinterMoxRZ/events{/privacy}","received_events_url":"https://api.github.com/users/WinterMoxRZ/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2016-08-20T23:12:12Z","updated_at":"2016-08-21T21:26:57Z","closed_at":null,"body":"First of all I like to thank everybody who contributes to free opensource projects to make them better and not to break them. \r\n\r\nIncluding updated POGOProtos is a good thing.\r\n\r\nSad thing is that protocol API is still broken. There hasn't been a real actual fix.\r\n\r\nChanging code from this:\r\n\r\n//static for now\r\nsig.Unk22 = ByteString.CopyFrom(new byte[16] { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F });\r\n\r\nTo:\r\n\r\nsig.SessionHash = ByteString.CopyFrom(new byte[16] { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F });\r\n\r\nDoesn't magically change the fact that SESSION_ID is still same static 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F. And removing \"//static for now\" comment fix the problem even less.\r\n\r\nAlso following code is still the same in those C# files where it was before previous issue was closed.\r\n\r\nvar downloadSettingsMessage = new DownloadSettingsMessage\r\n{\r\n   Hash = \"05daf51635c82611d1aac95c0b051d3ec088a930\"\r\n};\r\n\r\nIf someone wants to look the pictures I posted earlier here's a link to closed issue.\r\n\r\n\"#293 [Issue] Fix protocol API. Or Niantic keeps banning users of 3rd party apps. Current public Rocket API is completely broken.\"\r\n\r\nAll the three example problems I presented earlier still exist. And as I said before there is more.\r\n\r\nGood luck to everyone.\r\n"},"comment":{"url":"https://api.github.com/repos/NoxxDev/NecroBot/issues/comments/241283177","html_url":"https://github.com/NoxxDev/NecroBot/issues/336#issuecomment-241283177","issue_url":"https://api.github.com/repos/NoxxDev/NecroBot/issues/336","id":241283177,"user":{"login":"WinterMoxRZ","id":21127256,"avatar_url":"https://avatars.githubusercontent.com/u/21127256?v=3","gravatar_id":"","url":"https://api.github.com/users/WinterMoxRZ","html_url":"https://github.com/WinterMoxRZ","followers_url":"https://api.github.com/users/WinterMoxRZ/followers","following_url":"https://api.github.com/users/WinterMoxRZ/following{/other_user}","gists_url":"https://api.github.com/users/WinterMoxRZ/gists{/gist_id}","starred_url":"https://api.github.com/users/WinterMoxRZ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WinterMoxRZ/subscriptions","organizations_url":"https://api.github.com/users/WinterMoxRZ/orgs","repos_url":"https://api.github.com/users/WinterMoxRZ/repos","events_url":"https://api.github.com/users/WinterMoxRZ/events{/privacy}","received_events_url":"https://api.github.com/users/WinterMoxRZ/received_events","type":"User","site_admin":false},"created_at":"2016-08-21T21:26:57Z","updated_at":"2016-08-21T21:26:57Z","body":"@NoxxDev \r\n\r\nNo comment about this right now. Haven't had enough time to dig in.\r\nNoxxDev/NecroBot-Rocket-API@6bc1672\r\n\r\nNext doesn't fix anything, if something it breaks things even more.\r\nNoxxDev/NecroBot-Rocket-API@6180e62\r\n\r\nHere is fast description of these two things.\r\nRandomDevice.NextBytes(_sessionHash);\r\nsig.SessionHash = ByteString.CopyFrom(_sessionHash);\r\n\r\nThis code generates new ID on every request. This isn't requestid it's sessionid so it should stay the same as long as session exist. In other words new sessionid should be generated when NecroBot logs in and be sent to /dev/null when NecroBot exits or logs in again because of connection problems.\r\n\r\nI'm going to copy/paste none working pseudo code here which somewhat illustrates how sessionid generation could work.\r\n\r\n        public void InitializePropertyDefaultValues(object obj)\r\n        {\r\n            .....\r\n\r\n            var tmpRNG = new RNGCryptoServiceProvider();\r\n            tmpRNG.GetBytes(AuthConfig.SessionHash);\r\n\r\n\r\n        private Unknown6 GenerateSignature(IEnumerable<IMessage> requests)\r\n        {\r\n            .....\r\n\r\n            sig.SessionHash = ByteString.CopyFrom(settings.SessionHash);\r\n\r\nNow about Hash = \"54b359c97e46900f87211ef6e6dd0b7f2a3ea1f5\".\r\n\r\nIt's still static and sent in incorrect places and as @thekjohn brought up it was only changed in one place.\r\n\r\nThings don't stop there, \"05daf51635c82611d1aac95c0b051d3ec088a930\" (the old static hash which wasn't changed in commit) is sent in authentication request. If you look traffic dump from official client there is no this kind of hash in authentication request.\r\n\r\nNecroBot sends those hard coded hash's in incorrect requests.\r\n\r\nIf you look traffic dump from official client you will see that official client doesn't send this kind of hash until server returns this kind of hash in response. After that client starts to use hash sent by server.\r\n\r\nSo PLEASE who ever is coding protocol API \"fixes\" PLEASE look what happens in traffic between official client and server.\r\n\r\nThen last thing about protocol API, there is more problems then I have presented here. Please please look it yourself.\r\n\r\nThanks fly to all developers and people who know how to code or reverse engineer.\r\n"}}
{"actor":{"display_login":"WinterMoxRZ"}}