Reverse Engineering / Network Flow Origins

[tskinn]

So when authentication was broken a while back I got out an android emulator and setup mitmproxy and was able to capture the kobo login flow.. However it seems like kobo-book-downloader follows a slightly different flow. I could never get my own custom code to successfully replicate the flows I captured so I was curious of the origins of the flow used by kobo-book-downloader. I know it was forked from TnS-huns repo but I didn't see any information in that repo either. Anyways thanks for the great work.

[subdavis]

I asked TnS-huns the same question a while back and this was their answer: TnS-hun#19

I am using the Genymotion Android emulator to run the Kobo app, then inspect the traffic that it makes with HTTP Toolkit.

One time, about 2 years ago, I thought it would be more user-friendly to have this tool as a browser extension where you just go to your regular purchases library on Kobo.com and the extension adds a direct download button on the page, but the browser sends a lot of headers you can't control and it wasn't possible to emulate the android device from within a browser context. I wanted to try and see if you could do it as a web-native client instead, but lost interest.

[tskinn]

Thanks @subdavis. I've been playing with a rewrite that uses a headless chrome library to bring up and control(inject javascript and retrieve values) a chrome page so that there is no more copy/paste to get the captcha and as I mentioned I haven't been able to get the other parts of the auth flow working following my own observations. I guess I will try to just copy kobo-book-downloaders flow and see how far I get.