{"action":"created","issue":{"url":"https://api.github.com/repos/pkmngodev/Unknown6/issues/65","repository_url":"https://api.github.com/repos/pkmngodev/Unknown6","labels_url":"https://api.github.com/repos/pkmngodev/Unknown6/issues/65/labels{/name}","comments_url":"https://api.github.com/repos/pkmngodev/Unknown6/issues/65/comments","events_url":"https://api.github.com/repos/pkmngodev/Unknown6/issues/65/events","html_url":"https://github.com/pkmngodev/Unknown6/issues/65","id":169711336,"number":65,"title":"Technical Update So Far.","user":{"login":"keyphact","id":1712363,"avatar_url":"https://avatars.githubusercontent.com/u/1712363?v=3","gravatar_id":"","url":"https://api.github.com/users/keyphact","html_url":"https://github.com/keyphact","followers_url":"https://api.github.com/users/keyphact/followers","following_url":"https://api.github.com/users/keyphact/following{/other_user}","gists_url":"https://api.github.com/users/keyphact/gists{/gist_id}","starred_url":"https://api.github.com/users/keyphact/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/keyphact/subscriptions","organizations_url":"https://api.github.com/users/keyphact/orgs","repos_url":"https://api.github.com/users/keyphact/repos","events_url":"https://api.github.com/users/keyphact/events{/privacy}","received_events_url":"https://api.github.com/users/keyphact/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":17,"created_at":"2016-08-05T22:58:42Z","updated_at":"2016-08-05T23:11:41Z","closed_at":null,"body":"**Detailed info for those who are interested:**\r\nThe new struct, which we are calling `Signature` (previously `Unknown6`), authenticates every request made to the API. The structure of `Signature` turns out to be made up of a few more structures and values. We've managed to figure out what some of those are, leaving only a few remaining.\r\n\r\nThe integer `unknown_10` is a hash generated by Pokémon Go. It is made by taking the user's current authentication ticket in protobuf format (app specific; different from their PTC or Google login token) and running it through a hashing function called `xxHash32`.\r\nWhile our understanding of `xxHash32` is not complete, from what we know, this hash function takes three values: the first being some data to hash, the second being a 32-bit integer to use as a \"seed value\" to start the function with, and the third being how many bytes from the data to use for hashing. In this case, the seed value has been determined to be `0x1B845328`. This spits out a new 32-bit integer.\r\n\r\nNow we take this integer and use it as the seed value to hash our current latitude, longitude, and altitude. The resulting 32-bit integer is `unknown_10`.\r\n\r\nSimilarly, the integer `unknown_20` is another hash generated by the game. We take the current latitude, longitude, and altitude, as before, and hash it once again using `xxHash32`, with `0x1B845238` as the seed value. The resulting 32-bit integer is `unknown_20`.\r\n\r\nWe're not 100% sure about how to generate `unknown_22`, but it acts as a check to prevent users from simply copy-pasting API requests from the app. In other words, it prevents replay attacks. `unknown_22` is time based and changes every few minutes.\r\n\r\nFinally, `unknown_24` (now known as `request_hash`) is an array of hashes, one for each function call being called via the API. (So, for example, getting the player info and inventory list in the same API call would result in two hashes.)\r\nTo generate `request_hash`, we start by hashing the authentication ticket with a seed value of `0x1B45328`, but this time using the hashing function `xxHash64`. This becomes our new seed value for the remaining hashes.\r\n\r\nNow, for each RPC function call included in the request, we take its protobuf data and hash using `xxHash64` using the `xxHash64` hash of the authentication ticket. The set of all these hashes is our `request_hash`."},"comment":{"url":"https://api.github.com/repos/pkmngodev/Unknown6/issues/comments/237986576","html_url":"https://github.com/pkmngodev/Unknown6/issues/65#issuecomment-237986576","issue_url":"https://api.github.com/repos/pkmngodev/Unknown6/issues/65","id":237986576,"user":{"login":"DestroyerJoules","id":20867419,"avatar_url":"https://avatars.githubusercontent.com/u/20867419?v=3","gravatar_id":"","url":"https://api.github.com/users/DestroyerJoules","html_url":"https://github.com/DestroyerJoules","followers_url":"https://api.github.com/users/DestroyerJoules/followers","following_url":"https://api.github.com/users/DestroyerJoules/following{/other_user}","gists_url":"https://api.github.com/users/DestroyerJoules/gists{/gist_id}","starred_url":"https://api.github.com/users/DestroyerJoules/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DestroyerJoules/subscriptions","organizations_url":"https://api.github.com/users/DestroyerJoules/orgs","repos_url":"https://api.github.com/users/DestroyerJoules/repos","events_url":"https://api.github.com/users/DestroyerJoules/events{/privacy}","received_events_url":"https://api.github.com/users/DestroyerJoules/received_events","type":"User","site_admin":false},"created_at":"2016-08-05T23:11:41Z","updated_at":"2016-08-05T23:11:41Z","body":"Great job"}}
{"actor":{"display_login":"DestroyerJoules"}}