Miitomo RE

Well, let me say, even though Ninty tried everything to stop derping with its runtime, they can't top us from RE-ing the app :P


I started with acquiring the apk (com.nintendo.zaaa) from a russian website. According to Play Store, the latest is 1.1.1, and luckily for me, it was available. This is the only 1.1.1 apk that was a proper zip file.

I started my trusty aLogcat (the free edition is perfectly enough, or you could even use Eclipse ADT's LogKitty tool for overkill), set the search term to "nintendo", and started Miitomo.

Well, the regular Holo-styled gradient showed up for a few seconds, black scree for a second, and this repeated a few times before the app finally decided to finally die. Ofc the logs said nothing related to the heartattack-y behavior, so I "extracted" the main Activity's class name from the logs (it would've been easier from the AndroidManifest.xml file though :P), desmai'd and dex2jar'd the classes.dex, and unjdgui'd the classes-dex2jar.jar file, and started analyzing the main Activity file.

The app is kinda obfuscated, even the strings are!
Well, it was just too easy to RE the strings :P Ninty, and his "trusty" ol XORpads :rofl2: I wrote some tools to decrypt the strings as automatically as possible. I investigated the strings, and I found some interesting ones: "Error: isRooted" and "Error: isEmulator". I searched for the string's ID, and I found where it's printed out. Appearently, if itcs detected, that your device is rooted, a NativeAbort function is called, which causes SIGABRT(6), which prevents the app from starting, causing the app to eventually close.

I backtracked to the source of the detector function, and I investigated the .java file of the detector class (which btw is cruel what it can detect :sad:). After I understood the Java code, I got back to APKStudio, and edited the smali file of the class, so most of the detector functions return the best values for me :P

I resmali'd the apk, pushed it to my phone, but it failed to install. Appearently, if you work with APKStudio (or everything that derps with the apk), you'll need ZipSigner (free and small app, get it from Play Store (kellinwood.zipsigner2)) to sign the apk file in order to allow the installation of it.

After I (successfully) installed the (signed) apk, I ran Miitomo, and SUCCESS! *insert FF win music here*


I can't use it, because it's crying about my clock being not properly set, but at least it starts :P

I'll post a tutorial SUUN about how to modify the apk yourself without downloading an edited one :P
Or if I upload the patched apk to that iso site, then get it from there :P
  • Like
Reactions: 12 people

Comments

I'm rooted, and I still can't run it. At least now instantly crashes at the black screen instead of having a stroke :glare:
 
I also use XPrivacy to prevent apps from having unnecessary permissions, such as accelerometer in apps without motion controls. I think I might have blocked Miitomo from reading something it uses in its root-checking stage.
 
Does it look for 'test-keys' in buld.prop or it just scan through file for variables added by CM based roms?
 
Have you looked at the timespanconverter.smali file? I don't see where it redirects to that stupid dialog box.
 
@MarioErmando You don't need a patched APK anymore.
  • The rootCheck was removed in 1.1.2.
  • The CustomROMcheck can be hacked with an Xposed module (or so I've heard).
 
@smileyhead Well crap, the platform I'm on is detected as a custom ROM and I can't get Xposed on it :( thanks anyway
 
Vanilla Miitomo crashes on my CM13 Galaxy S3. When changing the isRoot, isEmulated etc. functions to “return 0”, it doesn't crash, but gets stuck with the time-related error (801-1650). I quickly searched through the files but couldn't find the codepath triggering this.

Edit: This might be caused by me not using GApps. Not sure, though.
 
@Arthosu: sadly it has nothing to do with GApps :( I tried it with/without GApps, same. Vanilla 1.1.2 on stock errors with 801-1350 if GApps is unlinked. I had to reinstall it while linked to get it working. Also, I had to unroot.
 
  • Like
Reactions: 1 person
Sorry, that I haven't posted a tutoriel yet, but mom has sudo permission on me, so I wasn't able to finish the tutorial. :cry::cry::cry::cry::cry::cry::cry::cry::cry::cry:
Appearently modifying the apk causes the infamous "clock error", so the tutorial is bullshiet. But I'll try to find a solution as SUUN as PossibrU :)
 
Good luck with this. I´m currently trying to run the latest version on an unrooted CM 10.2 Galaxy S3 and I get an instant crash when trying to open Miitomo. It seems the CustomROM check is getting me, I will try Xposed later.
 

Blog entry information

Author
Sono
Views
989
Comments
126
Last update

More entries in Personal Blogs

More entries from Sono

General chit-chat
Help Users
    K3Nv2 @ K3Nv2: https://www.pcgamer.com/gaming-industry/sony-apologizes-for-sony-interview-with-sony-developer-ne...