SUMMARY/UPDATE at API fix from Reddit Unknown6 Team

[exporious]

I know a dev who's already fixed it, the fact the rest of you so called 'devs' are still scratching your heads at it is hilarious, none of you have a clue a part from Milas on how even the first API was originally created, never mind fixing the changes in the new one on your own, you just all hopped off his API and made your own little bots, probably even sold subscriptions to people, and are now frantically trying to work out whats changed, its a hilarious show to watch.

either you're a troll or they are trolling you

[HackerDex]

I know a dev who's already fixed it, the fact the rest of you so called 'devs' are still scratching your heads at it is hilarious, none of you have a clue a part from Milas on how even the first API was originally created, never mind fixing the changes in the new one on your own, you just all hopped off his API and made your own little bots, probably even sold subscriptions to people, and are now frantically trying to work out whats changed, its a hilarious show to watch.

Shots fired. How about you share those details?

[Mad4poko]

Hum...didn't say there i don't support bots...it says don't be greedy and bot 1000 accounts to make a few buck, that will kill the new bots and ban all users in next ban wave... thanks for input.

Reply to rsxtypers

[Mad4poko]

I find it funny that you guys cracking the api say you so not support bots...if that is true you would not crack it at all. So please stop with the moral highground. Other then that keep up the great work

Read above

[Mad4poko]

SUMMARY/UPDATE

GMT +1, 20:00 - On the coding front no major news. Still working on the remaining fields.
We are getting used to the variety of ways we use to communicate with you. We have the Discord, Twitter, Reddit live thread, this post, the githubs for contributions. It is safe to say that this "blew" up. However the internal communication regarding updates is becoming more streamlined. It requires a lot of time to uphold the communication at times, but it is good fun too. It is good to know that the devs can focus on doing what they're best at, cracking this API.

GMT +1, 23:30 - I am back at my desk now, I will be awaiting the update to the reddit-live thread then try to translate it for you guys. We're far but not there yet.

GMT +1, 00:45 - The progress made in the last hours could be called breakthrough #4.
We have uncovered 3 more of the input fields. One field was an encrypted (more correct: hashed) version of the authentication ticket, when this field was combined with the gps location another field was uncovered. The third field is also related to the authentication ticket but in a different way.

“Combined” is a huge understatement of the complexity and we also needed the (earlier mentioned) protobuf along the way. The full scale complexity of what these coders are doing is beyond me.
We are now working to uncover the remaining field(s).

GMT 03:30 - We havn't updated much because progress is a bit slow right now.
We have been trying to crack one field unsuccessfully for the last 12 hours now (on and off). We know more about the field then when we started, but no breakthrough yet.

We know the field is not combined with the authentificationtoken, however it is dependant on the session (could be indirect correlation). We also know it's lenght (16 bytes). We are working on narrowing it down and hopefully cracking.

[Mad4poko]

Here's the technical update for those who are interested:

https://github.com/pkmngodev/Unknown6/issues/65 /u/ChipIsTheName

[Mad4poko]

https://www.reddit.com/live/xdkgkncepvcq/

For LIVE Reddit updates at pokemongo dev

[alexg1993]

as someone said on Dev's discord they have to figure & fix more 47 unknows ... so there is no ETA it can take days/weeks to solve them all. don't expect to anything just hope they will fix it, and they are doing a great job all together!

[Mad4poko]

Niantic labs update at 4 August

Update on Maintaining and Running the Pokémon GO Service

Things have been pretty crazy here at Niantic over the last few weeks but despite all of the ups and downs we get up every day inspired by the original goals of Niantic – to create an experience that encourages healthy outdoor exploration and social gameplay. Every positive story we hear (like this one from the UK) motivates us to keep working to support the game and continue the roll-out. Running a product like Pokémon GO at scale is challenging. Those challenges have been amplified by third parties attempting to access our servers in various ways outside of the game itself.

As some of you may have noticed we recently rolled out Pokémon GO to Latin America including Brazil. We were very excited to finally be able to take this step. We were delayed in doing that due to aggressive efforts by third parties to access our servers outside of the Pokémon GO game client and our terms of service. We blocked some more of those attempts yesterday. Since there has been some public discussion about this, we wanted to shed some more light on why we did this and why these seemingly innocuous sites and apps actually hurt our ability to deliver the game to new and existing players. The chart below shows the drop in server resources consumed when we blocked scrapers. Freeing those resources allowed us to proceed with the Latin America launch.

Picture of Server Resource Graph

In addition to hampering our ability to bring Pokémon GO to new markets, dealing with this issue also has opportunity cost. Developers have to spend time controlling this problem vs. building new features. It’s worth noting that some of the tools used to access servers to scrape data have also served as platforms for bots and cheating which negatively impact all Trainers. There is a range of motives here from blatant commercial ventures to enthusiastic fans but the negative impact on game resources is the same.

Of course, there are also outright hackers out there attempting to break into systems, hijack social media accounts, and even bring down the service. Some of them have posted publicly about their attempts.

We don’t expect these attempts to stop. But we do want you to understand why we have taken the steps we have and why we will continue to take steps to maintain the stability and integrity of the game.

We value feedback from our community. We have heard feedback about the Nearby feature in the game and are actively working on it. Over the past three and half years many of us in the company have traveled throughout the country and, in fact, around the world to meet, play, and learn from our Ingress user community. And we look forward to doing the same with the Pokémon GO community. Please keep your game ideas and feedback coming. We look forward to getting the game on stable footing so we can begin to work on new features.

Above all, be safe, be nice to your fellow Trainers, and keep on exploring.

jh

[Mad4poko]

We've discovered that unknown5 turns out to be GPS-related information. We're still investigating this and unknown22, and hope to have a more technical update later on in the day while we affirm our suspicions. /u/keyphact

LIVE update https://www.reddit.com/live/xdkgkncepvcq

[Mad4poko]

SUMMARY/UPDATE

6 august 2016, GMT +1, 13:00 - This redditcomment will now be my POV. These are unofficial updates. For the only source of official updates go to the reddit-live thread (all other updates are a scam). To reflect this change I will use I for myself and They for the devs from here on.
This decision was made to remove pressure from the devs.

Whilst I was asleep not a lot has happened, possibly because the devs were also asleep. The field we have been working on for quite a bit now deserves a name. Unknown22 has been a pain in the ass. One of the problems is that because Unknown22 is bound to sessions it is harder to gather data on. The devs get a datapoint every time we have a new session, this only happens every now and then.
We are collecting data on Unknown22 and on another field.

GMT +1, 14:30 - No news, just wanted to adress the following question: how come they're not done yet? You said there were 3-4 unknown fields a while ago, and since the devs have uncovered many more!
What's been happening is that as the devs were researching these 3-4 fields it became apparent that they are combinations of other, underlying, fields. To get to know all of the fields we need to figure out all the fields which are used to build them.
I can't answer to the question as to how many are left. Firstly it would create an expectation. Secondly we can't know for sure how many are left.

GMT +1, 17:00 - Breakthrough #5: the coders found out that they do not need unknown22. One of the devs reacted with a very understandable "are you ****ing kidding me". The devs are atthempting to build a "demo" to verify this find, they will atthempt to call Niantics servers without using the official app. The devs are excited and they are praying that the API call will be succesfull.
Now it important to understand that if the API call is succesful that would mean there is a working prototype, not a working API-fix. The devs are bypassing quite a few fields. For example a field which is neccesary for android, to bypass this the devs are making it look like they are using IOS. Now imagine how easy it would be to flag every android device (data that's also sent) that appears to be using IOS. Much needs to be done to "not sound retarded".

GMT +1, 17:30 - The earliest implementations of calling the API are not working.

GMT +1, 18:00 - No news, I want to explain to you guys why unknown22 was such a pain in the ass now that there is a working theory on what Unknown22 is. Unknown22 is a random fixed value, it is randomly generated as soon as the app starts up, after that it is fixed for the session.
The devs were looking for anything that influences Unknown22 until it slowly dawned upon them that Unknown22 has no inputs. It is just randomly generated. I'll explain why this can be hard to figure out.
First with a real world example: Say that we are looking for the temperature in New York. There is however a ton of values that correlate with the temperature in New York. Ice Cream sale for example: when ice cream sale goes up, so does the temperature. However to derive the temperature from the amount of ice creams sold is a futile atthempt. Correlation does not mean causation. Keep this in mind whilst reading the following about Unknown22.
The coders were at first trying to change authentificationtokens (using another login) and every time they did that Unknown22 also changed! Their first instinct told them to try to see whether the authentification was an input for the Unknown22. To test this they needed datapoints.
The gathering of these datapoints took a lot of time however, because they have to log out and back in for every datapoint. Now add to this that there are quite a few variables which could have been the input to Unknown22, I am for sure missing some, but I saw these pass: SessionID, Auth_token, Auth_ticket. They tried all these and came up empty handed, until someone figured it out: Unknown22 has no inputs.
Unknown 22 is randomly generated whenever the POGO app starts.
And because it has no inputs Niantic can not check what value Unknown22 should "be". Therefore the devs can just assign any value they want. Now this is all a working theory, but it would perfectly explain the behaviour of Unknown22 and all the devs are agreeing on this theory (for now).

GMT +1, 18:30 - Breakthrough #6 I think the devs made the first succesful API call! Everyone get on the Reddit-live thread, I am going to say they will confirm this in the next hour.

GMT +1, 18:35 - Basically confirmed by accidental cheers. I am watching the redditthread with just as much excitement as you are though.

GMT +1, 19:00 - The public discord debugger chat is completely empty. Still awaiting the update. Anyone else been refreshing the live thread, only to realize that does nothing?

LIVE Reddit pokemongo dev https://www.reddit.com/live/xdkgkncepvcq

[prrovoss]

demo clients are being implemented atm

[Mad4poko]

SUMMARY/ UPDATE

GMT +1, 20:00 - It's been a while without any information. They have however said they are working on implementation, so they are not working on cracking unknowns. Next update should still be a big one so I'd keep the reddit-live open for sure.

GMT +1, 20:30 - They have taken down the public github. Ill guess they are moving the github. Another indication that they are up to something. It was taken down for copyright issues.

LIVE Reddit pokemongo dev https://www.reddit.com/live/xdkgkncepvcq

[Mad4poko]

"To clarify, we didn't get a C&D and took down the repo to prevent legal issues before release. Code to actually implement what we have found is being worked on. Only encrypt.c, rewrites of encrypt.c, and compiled versions of encrypt.c are copyrighted by Niantic and we cannot legally distribute it in any way, even if rewritten. We have thus taken down the repo while we figure out a solution to this. This does not mean that we will not release. We will come up with a solution to the copyright issue, please be patient."

LIVE Reddit pokemongo dev https://www.reddit.com/live/xdkgkncepvcq

[adamganteng123]

https://github.com/keyphact/pgoapi
Its finished