Miitomo RE

Well, let me say, even though Ninty tried everything to stop derping with its runtime, they can't top us from RE-ing the app :P


I started with acquiring the apk (com.nintendo.zaaa) from a russian website. According to Play Store, the latest is 1.1.1, and luckily for me, it was available. This is the only 1.1.1 apk that was a proper zip file.

I started my trusty aLogcat (the free edition is perfectly enough, or you could even use Eclipse ADT's LogKitty tool for overkill), set the search term to "nintendo", and started Miitomo.

Well, the regular Holo-styled gradient showed up for a few seconds, black scree for a second, and this repeated a few times before the app finally decided to finally die. Ofc the logs said nothing related to the heartattack-y behavior, so I "extracted" the main Activity's class name from the logs (it would've been easier from the AndroidManifest.xml file though :P), desmai'd and dex2jar'd the classes.dex, and unjdgui'd the classes-dex2jar.jar file, and started analyzing the main Activity file.

The app is kinda obfuscated, even the strings are!
Well, it was just too easy to RE the strings :P Ninty, and his "trusty" ol XORpads :rofl2: I wrote some tools to decrypt the strings as automatically as possible. I investigated the strings, and I found some interesting ones: "Error: isRooted" and "Error: isEmulator". I searched for the string's ID, and I found where it's printed out. Appearently, if itcs detected, that your device is rooted, a NativeAbort function is called, which causes SIGABRT(6), which prevents the app from starting, causing the app to eventually close.

I backtracked to the source of the detector function, and I investigated the .java file of the detector class (which btw is cruel what it can detect :sad:). After I understood the Java code, I got back to APKStudio, and edited the smali file of the class, so most of the detector functions return the best values for me :P

I resmali'd the apk, pushed it to my phone, but it failed to install. Appearently, if you work with APKStudio (or everything that derps with the apk), you'll need ZipSigner (free and small app, get it from Play Store (kellinwood.zipsigner2)) to sign the apk file in order to allow the installation of it.

After I (successfully) installed the (signed) apk, I ran Miitomo, and SUCCESS! *insert FF win music here*


I can't use it, because it's crying about my clock being not properly set, but at least it starts :P

I'll post a tutorial SUUN about how to modify the apk yourself without downloading an edited one :P
Or if I upload the patched apk to that iso site, then get it from there :P
  • Like
Reactions: 12 people

Comments

I don't understand your last post about signing with devices' keys. And I thought I was an Android developer. Oh, sigh...
 
I signed it but it gives me that error. Are you going to fix it in the future?
 
I have the clock error too. It's not my fault.

Btw, I'm working on the tutoriel right now :P It may come out 2DAY, 2MORROW, or 4EVER, or SUUN
 
Ah! Nintendo updated the app to work on rooted phones.. lol, but I'm stuck after Mii creation as it errors up on me
 
It works on Rooted devices now? I've been using the Xposed module to enable it, if I don't need it anymore that's fantastic!
 
  • Like
Reactions: 1 person
Well it might still have measures that won't let you use the app to some degree.. Like how I'm stuck as soon as I finish making my Mii. I'm downloading the version @MarcusD just uploaded to pastebin now to see if it helps.
 
Okay, so I just disabled the Miitomo security bypass extension and updated the APK, and I'm getting launch crashes now. I also went and disabled developer tools to no avail.
 
I downloaded straight from Google Play about 7 hours ago and had no issues on my rooted NVidia SHIELD Portable. The original version (v 1.0.0) force-closed, but not anymore.
 
  • Like
Reactions: 1 person
Woh! I actually didn't know you could root the NVidia Shield! I need to look into this..

Anyway, can you get past the Mii creation?
 
I was able to play the entire game: bonus games (like Plinko), connect to MyNintendo, purchase clothing in the in-game shop, participate in the weekly event (answer a question), and everything else not mentioned otherwise. Oh, and I was able to use GameGuardian, but the values are stored server-side,so no hacking unless it is done through the game's apk and library files.

For those interested, when you answer a personal question, the Mii's responses sound much more natural than Tomodachi Island, and the shading of the Miis is much better and smoother.
 
  • Like
Reactions: 1 person
1.1.2 works fine on my rooted Moto G (XT1034), just verified was rooted with root checker (just to be sure) but Miitomo works fine!
 
I'm a fucking developer, goddamnit Ninty! Why can't I have my phone rooted?! It's bullshit! :angry:
 
  • Like
Reactions: 2 people
1.1.2 doesn't work for me either. I use cyanogenmod, and I think this might be the problem...
 
  • Like
Reactions: 1 person

Blog entry information

Author
Sono
Views
1,005
Comments
126
Last update

More entries in Personal Blogs

  • Geogria 2 - 0 Portugal
    My country Georgia (not state, but country in Europe next to black sea)...
  • I WON
    "ALPHADREAM IS DEAD SO NO MORE MARIO AND LUIGI GAMES (insert nerd emoji...
  • 4: Reddit
    Finally, number 4! Never thought this day would come, did you? Uhh...
  • books
    1. I am cool as hell, have one million dollars 2. I am banned from...
  • Syncthing is fun!
    Having been kinda active in an Android forum I quickly got sick about...

More entries from Sono

Share this entry

General chit-chat
Help Users
  • No one is chatting at the moment.
    Psionic Roshambo @ Psionic Roshambo: https://www.techspot.com/news/103548-korean-isp-accused-installing-malware-600000-customers-pcs.html +1