Full-Link Reverse Engineering & Protection-Bypass from APK to Production Automation
Using Maersk's official app as a sample, this fully demonstrates our Android reverse-engineering capability: static decompilation, Frida dynamic hooking, SSL certificate-pinning bypass, traffic-redirection capture, device certificate/key extraction, TLS-fingerprint replication (OkHttp/Android Chrome), and Akamai protection bypass — ultimately restoring a closed mobile interface into a standard, reusable API automation chain.
Each project is annotated with its position in the product system, making it easy to see at a glance how systems support each other.
From "visible" to "usable" — turning a black-box app into engineerable interface assets.
Decompile the APK to extract RSA public key, API host, Consumer-Key, embedded certificates, and hardcoded config — building the app's "map."
Hook certificate validation and SSL calls at runtime, bypassing Certificate Pinning so a MITM proxy can decrypt HTTPS traffic.
Frida rewrites the socket target + disables cert validation, routing app traffic to a proxy, reconstructing request structure and auth chain per API.
Replicate OkHttp / Android Chrome TLS fingerprints (JA3/JA4), with real or forged sensor data, bypassing Akamai Bot Manager and risk control.
The more closed and risk-controlled the enterprise app, the higher its first wall.
Built-in Certificate Pinning makes Charles/Burp throw cert errors; HTTPS traffic is invisible — the first wall of reverse engineering.
Cert validation lives in the libflutter.so native layer; ordinary Java-layer hooks fail — must locate and hook native functions (GetSockAddr / verify_cert_chain).
Server uses TLS fingerprint + sensor data + behavior signals for bot detection; scripts or proxy requests easily trigger 403 / 429 / 441, freezing accounts.
Cert and key extraction generally needs Root + ADB; memory dumps and system keystore reads are fragile and easily trigger app anti-tamper.
Query/validation APIs first return PROSPECTIVE or routeValidationsComplete=NO; using too early creates "fake success" — needs two-step polling for backend to converge.
Client version upgrades require syncing impersonate targets and custom OkHttp fingerprints; overseas residential proxies bill by traffic, SSL jitter often misread as account failure.
A reusable mobile reverse-engineering and automation engineering capability
Frida one-click injection + mitmproxy/Burp integrated capture, auto-extracting Akamai sensor data to JSON.
Hook SSLContext / X509TrustManager / OkHttp CertificatePinner / libssl, exporting client and server certificates.
Via ADB + Root, extract system/app keystores, scan certs, dump app memory to locate private keys and credentials.
Use curl_cffi impersonate to mimic Android Chrome and OkHttp 4.x JA3/JA4 fingerprints, keeping them consistent within a session.
Support both real-device sensor and algorithm-forged sensor modes, restoring service bypass with risk-control cookies.
From capture, restore the 14+ call sequence from login OAuth, query, space-lock, to booking submission, incl. two-step verification timing.
Crystallize one "black-box capture" into a reusable, engineerable standard process
Turn a one-off black-box break into a repeatable, handoff-ready engineering asset.
The difficulty is not "can we hook," but engineering the breakthrough into something stable and reusable.
Self-built traffic-capture script auto-starts frida-server and injects redirect, removing manual proxy/cert configuration.
Fix JA3/JA4 within a session (Android Chrome / OkHttp 4.x), avoiding mid-session switching detection and lifting pass rate.
Support both real-device sensor capture and algorithm forgery, switch by scenario for authenticity, cost, stability.
Dead/frozen accounts auto break and thaw; per-proxy SSL error-rate stats and switching decouple "network" from "account" issues.
Convert technical capability into quantifiable, reusable business value.
Product content has been published based on internal materials. The following areas are planned for further development:
Explore Xianma AI solutions in other domains