Miitomo RE

Well, let me say, even though Ninty tried everything to stop derping with its runtime, they can't top us from RE-ing the app :P


I started with acquiring the apk (com.nintendo.zaaa) from a russian website. According to Play Store, the latest is 1.1.1, and luckily for me, it was available. This is the only 1.1.1 apk that was a proper zip file.

I started my trusty aLogcat (the free edition is perfectly enough, or you could even use Eclipse ADT's LogKitty tool for overkill), set the search term to "nintendo", and started Miitomo.

Well, the regular Holo-styled gradient showed up for a few seconds, black scree for a second, and this repeated a few times before the app finally decided to finally die. Ofc the logs said nothing related to the heartattack-y behavior, so I "extracted" the main Activity's class name from the logs (it would've been easier from the AndroidManifest.xml file though :P), desmai'd and dex2jar'd the classes.dex, and unjdgui'd the classes-dex2jar.jar file, and started analyzing the main Activity file.

The app is kinda obfuscated, even the strings are!
Well, it was just too easy to RE the strings :P Ninty, and his "trusty" ol XORpads :rofl2: I wrote some tools to decrypt the strings as automatically as possible. I investigated the strings, and I found some interesting ones: "Error: isRooted" and "Error: isEmulator". I searched for the string's ID, and I found where it's printed out. Appearently, if itcs detected, that your device is rooted, a NativeAbort function is called, which causes SIGABRT(6), which prevents the app from starting, causing the app to eventually close.

I backtracked to the source of the detector function, and I investigated the .java file of the detector class (which btw is cruel what it can detect :sad:). After I understood the Java code, I got back to APKStudio, and edited the smali file of the class, so most of the detector functions return the best values for me :P

I resmali'd the apk, pushed it to my phone, but it failed to install. Appearently, if you work with APKStudio (or everything that derps with the apk), you'll need ZipSigner (free and small app, get it from Play Store (kellinwood.zipsigner2)) to sign the apk file in order to allow the installation of it.

After I (successfully) installed the (signed) apk, I ran Miitomo, and SUCCESS! *insert FF win music here*


I can't use it, because it's crying about my clock being not properly set, but at least it starts :P

I'll post a tutorial SUUN about how to modify the apk yourself without downloading an edited one :P
Or if I upload the patched apk to that iso site, then get it from there :P
  • Like
Reactions: 12 people

Comments

a modded apk is highly needed, using xposed isnt really working as some fixes cause bootloops.
 
  • Like
Reactions: 3 people
Well, if you can understand smali, then you could very easily edit the apk yourself :P
Sadly it's 1:31, and I haven't slept yet, and I arrive home around 17-20h, so that tutorial is almost more than a day away. Sorry :(
 
  • Like
Reactions: 1 person
But if it's not available in your region, Miitomo won't work for you, even if you hack it :( It'll cry about your clock not being properly set...
 
  • Like
Reactions: 1 person
@MarcusD I installed Miitomo in my Mexican phone (and I'm in Mexico too), which is a country where the app hasn't been released, and it works alright. Only thing is I can't link a mexican Nintendo account, but I linked a Canadian one, and it's working great.
 
  • Like
Reactions: 2 people
When I got Miitomo, I needed xCon, because it has Jailbreak detection. I would make a patch for Flex 2 to disable it, but I am not sure how to go about doing it. (using the iOS version)
 
  • Like
Reactions: 1 person
I have been waiting and waiting for this app and because my phone is rooted I can't use it at all... Xposed, RootCloak and the security bypass thing doesn't work at all on my phone. It'll close no matter what..
 
  • Like
Reactions: 1 person
I released it, but it's awaiting confirmation on that iso site :(

Or if someone shows me a proof that someone allows posting it here, I'll post it here. But I doubt it... Even though it's only a harmless modification to make Miitomo more compatible with other Android devices.
 
It's a dick move from nintendo.

What if every apps in the playstore do that? That would be totally unfair for a vast majority of the userbase.
 
  • Like
Reactions: 2 people
its a shite app lets have it right ,, why moan over blocking root , when they made a standalone version of miimaker with some crap perks... they have how many IP's and make a release based around a user membership Fuck off nintendo.
 
That's why I call it Ninty :P Because this was an idiotic and lame move from them :angry:
 
If you read back, I'll arrive home late 2DAY. I have released a link on my pastebin though :P
 
  • Like
Reactions: 1 person
Sorry, but my pastebin is no longer fully legit, so I can no longer link it here, sorry :(

But I'm gonna tell you how my (totally legit 2015 NoBrick NoDRM no survey mega.nz download) ATLauncher's renderer works:
http://pastebin.com/qHbyM69a

I wrote it a long time ago :P
 
I downloaded the apk and I get the error message about the time. Can you fix it?
 
Because I don't have the keys to resign it. You'll have to sign it with you own device's keys!
 
Also, I have the same problem. It's not my fault, I can't fix it :(
 

Blog entry information

Author
Sono
Views
998
Comments
126
Last update

More entries in Personal Blogs

  • 4: Reddit
    Finally, number 4! Never thought this day would come, did you? Uhh...
  • books
    1. I am cool as hell, have one million dollars 2. I am banned from...
  • Syncthing is fun!
    Having been kinda active in an Android forum I quickly got sick about...
  • Feeling at home here
    Not much to say this time. I'm depressed. Like almost always. Trying to...
  • I'll start, rate mine 1-10
    It's a very mixed bag, some rock, some rap, some video game music, a...

More entries from Sono

Share this entry

General chit-chat
Help Users
    Psionic Roshambo @ Psionic Roshambo: https://youtu.be/_JcsfxdXDCc?si=WT3snpNEL3E1Cpod +1