SUMMARY/UPDATES
API stopped accepting requests from any sources which are not the actual client. The API needs a value "unknown 6", this value was already in the API in previous versions, but now the server is validating it. Only the actual client can create a valid "unknown6". We dont actually 100% know that it is indeed "unknown6" that is being validated, but it would make sense since its a big piece of data which isnt recreateable.
It is not as easy as locating where any updates made changes because the unknown6 was already being calculated and sent in previous versions but not validated by the server.
It doesnt really matter exactly what values go into the unknown6. Cracking/bruteforcing the code is impossible because the key alone wouldnt do it. We need to get to the piece of code that makes "unknown6". The key and the way to calculate unknown6 is somewhere within the code and were trying to find it.
We are trying to locate where the app calculates unknown6 in order to be able to recreate out own valid unknown6's. If we do that we have a working API again.
This is hard because parts of the code are not easily accessible. We need people that can decompile and document parts of the code!
GMT +1, 14:00 - Breakthrough? The programmers think they have found where unknown6 is created. Now the it still needs to be recreated and hope it actually works, that unknown6 really is what broke the code.
GMT +1, 14:30 - The dev discord has gone private due to people claiming the breakthrough as their own. They are still working doubletime on it! I am locked out on the discord too, so no more updates from me I guess. They let me in (16:20).
Unknown6 is indeed related to API changes, meaning our worst fear is not true. That would be when we would be able to recreate the unknown6, but that was not what broke the API. In that case everything we did would be worthless. We are on the right track.
GMT +1, 16:30 - The stuff being done is very technical. From my understanding we know where unknown6's core is created. From there we are able to see what inputs it takes and which functions it calls for further encryption. We are in a steady process of uncovering more steps of unknown6 it's creation. We've still got some steps to do..
GMT +1, 18:00 - Some important part of the encryption method has been decompiled, meaning we can now read it, and run the code through the decompilation when the other parts of the encryption have been found.
GMT +1, 19:30 - One step closer to fully determining the input.
GMT +1, 20:30 - Breaktrough #2: Two pieces of the unknown6 creation-code got linked together. We figured out where the encryption is called. As mentioned earlier we have the decompiled encryption.
GMT +1, 21:15 - We now need to do 2 things:
Get the decompiled encryption into a usable state. The encryption is a custom encryption and the decompiled file was over 200 pages long. People are working on it and it is not the hardest part but it has to be done. (slow but steady)
Figure out the last pieces of input, this could prove to be the difficult part. There is 3-4 fields remaining and every field that we figure out is a minor breakthrough.
GMT +1, 22:30 - No news, other than "they are working on it", but I thought I'd write something anyways, a reflection on the last 24 hours.
It has been facinating to see the devs from this sub work together to crack the unknown6. This is the same thing Ingress-hackers never defeated. But the POGO-dev community is bigger. I have seen people work on it 20 hours out of the 24 that the API-change is live. /u/keyphact hasnt slept for 40 (seriously go to sleep). These people are tirelessly, determined. I feel like we can do this.
We found the core creation place of unknown6 in mere hours. The encryptionfunctions were decompiled and the place where its called has been found. 10% of the input and the usability of the encryptionfunctions is whats left. Were so close, yet so far away. Will we solve this?
GMT +1, 23:30 (sorry wrong timestamp previously) - We have much of the encryption understood. We however still dont know, how exactly the input is stored (protobuffer), this issue is very complicated. This is needed to track down the remaining inputfields.
GMT +1, 01:30 - We've got the encryption fully working (although we dont fully understand it)! You could call this breakthrough #3. The primary thing we are working on is getting the protobuffer.
This is a journey for me also. It is hard to keep up with what the devs are doing. What is a "protobuf format" for example? I am told it sits between the input and the encryption. It takes the inputvalues, rearranges them and sends them off for encryption. Like a blueprint for the inputdata.
Now we have the encryptionpart fully working, but we cannot backtrack to the input because we dont know how the blueprint arranged the inputvalues. Therefore we are making our own blueprint (protobuf-format)! Backtracking one step at a time. As we work on our protobuff format the input will become clear hopefully.
GMT +1, 03:30 - No major news. We're working on it and making progress.
I do want to make this another moment of reflection, the logistical nightmare of getting a community to work together like it has. It was a nightmare, without a clear solution, where the mods had no "good" choice.
It started off small: an open discord channel in which everyone could talk, working together to fix the API. It became clear this wasn't as easy as we thought.
Meanwhile the amount of people in the channel talking grew and grew. This however led to huge amounts of spam, most commonly "When is the API ready/What happened with the API". The situation became unworkable and we had to restrict talking rights on the discord.
This situation also became unworkable, people were claiming our progress as their own and they were also giving the community false hope as in how fast a new API would be made. On top of that the mods were still being spammed to death with requests for talking rights in the channel. We decided to hide the channel completely.
We tried a secondary channel, in which people could prove themselves worthy. But this channel started to get the same problems as the primary channel had initially. As well as people in the channel being understandibly angry at the mods, because they had no access to our primary channel they were doing the work we did hours ago.
Right now we are moving to transparancy again. We made the primary channel readable for everyone again. And hopefully noone will abuse this. We have also made an open-to-everyone github:
[Only registered and activated users can see links. Click Here To Register...] &&
[Only registered and activated users can see links. Click Here To Register...]
What can we learn from this though? I think there is no "solution" to this problem. Instead I want to thank the mods for putting in ridiculous amounts of work, merely to ease the pain of an unsolvable situation.
For now I am going to sleep. We have opened a channel for API-updates
[Only registered and activated users can see links. Click Here To Register...], the updates in the chat will probably be a bit more tech-heavy. I will be back for translations to English tomorrow.
