Repository navigation
Null response #1
Description
Hello! (First - sorry for my bad English, it is not my native language)
I am making simple "bot" to save Musical.ly videos. I tried using Charles Proxy to see how Musical.ly API works, but there was no informations about calls to API on Charles (even with SSL pinning disabled by using Inspectage + Emulator).
I do not use/like PHP. For me it is hard. (I really prefer C# - for me is much more easy to read)
I wanted to port your library to C# DLL (and add as repo) but your lib not works :(
When I run login.php from my local webserver it returns that:
Notice: Undefined offset: 7 in M:\MySQL\htdocs\Musically-API-master\src\musically.php on line 63
Notice: Undefined offset: 1 in M:\MySQL\htdocs\Musically-API-master\src\musically.php on line 64
Notice: Undefined offset: 3 in M:\MySQL\htdocs\Musically-API-master\src\musically.php on line 65
Notice: Undefined offset: 8 in M:\MySQL\htdocs\Musically-API-master\src\musically.php on line 67
Notice: Undefined offset: 3 in M:\MySQL\htdocs\Musically-API-master\src\musically.php on line 68
Notice: Undefined offset: 12 in M:\MySQL\htdocs\Musically-API-master\src\musically.php on line 71
Notice: Trying to get property of non-object in M:\MySQL\htdocs\Musically-API-master\src\musically.php on line 237
{"success":null,"full_response":null}
Last line says that response from Musically API is null. So what I did wrong. I tried your test account Jessica, my two test accounts and it still won't work - always response==null
After running login.php I tried searchuser.php but on end of printed error message I could read that response is null.
Please fix it or explain me what I did wrong... sorry - maybe it's n00b question and my setup is bad.
Thanks for your time.
Edit: I use Xampp, and M:\MySQL\htdocs is root of my webserver.
Activity
mangledbottles commentedon Nov 18, 2017
Hello!
I haven't tested the API in a while so it may be outdated...
I will check it tomorrow, it may also be a problem that the account you tested with doesn't work!
Regards ;)
mangledbottles commentedon Nov 28, 2017
Hello,
I just checked it there, they seem to have changed the way they are hashing requests now. The login still returns a hash, but it's in a different format and with fewer parameters (which is what gave you the offset errors). I am unsure if this will affect the rest of the code yet.
I will look into it.
Regards
dfuse-dev commentedon Dec 14, 2017
Try replacing these in src/musically.php file:
$dexplore = explode('=', $data[7]);
with $dexplore = explode('=', $data[6]);
and
$dexplore1 = explode('"', $data[8]);
with $dexplore1 = explode('"', $data[7]);
scrapewww commentedon Feb 9, 2018
#5
mangledbottles commentedon Feb 25, 2018
@Enter03 Did you check the API?
charlie-niekirk commentedon Mar 1, 2018
This may help, there is a login endpoint returned by the https://api.musical.ly/rest/discover/navigate :
/rest/passport/v2/login?___d=eyJhYyI6IlBPU1QiLCJieiI6InVzZXJfbG9naW4iLCJkbSI6IlVTRVIiLCJ2ZXIiOiJkZWZhdWx0In0%3Dmangledbottles commentedon Mar 2, 2018
@Enter03 @charlieAndroidDev Thanks for you help! I'm reviewing it atm, I tried to jailbreak my iPhone 8 iOS 11 with Electra to install SSL Kill Switch 2; however I'm experiencing difficulties.
In another issue, someone stated that Musically does not SSL pin their Android app so it might be worthwhile looking into that. I have loads of iPhones and no androids!
charlie-niekirk commentedon Mar 5, 2018
@mangledbottles Yep I can confirm that the latest Android app for both Musically and Lively are not SSL pinned. I can use this packet capture app: https://play.google.com/store/apps/details?id=app.greyshirts.sslcapture&hl=en to capture all requests and responses.
I am now stuck on a very tricky issue however. The
X-Request-Sign5header used in most requests is an HMAC-SHA1 hash of what I think is theX-Request-Info5header value. However, I am not sure how the hashing function works as it is done in the native layer and I believe the function has been dynamically registered and cannot find it in any of the native shared object files. More info available here: https://reverseengineering.stackexchange.com/questions/17583/reversing-an-apk-to-replicate-api-x-request-sign5I’ll try to use remote LLDB to set breakpoints in the native code. I have decompiled the APK and edited the manifest to allow debugging and have seen quite a few interesting logs when the app has been running, I’ll try a bit more and update you on that when I get something good.
charlie-niekirk commentedon Mar 10, 2018
OK, I now know how the
X-Request-Sign5header value is generated after quite a bit of trial and error and static analysis of the smali code from the Android APK. No more obstacles in the way anymore..,awebartisan commentedon Apr 28, 2018
Hey guys, how the searchuser.php is working? its only returns
{"success":null,"full_response":null}Is it changed?
How username should be provided for searching in code?