Watcher Tv 2.11.3 not opening about watcher-tv

[janjanmedinaaa]

It looks like the issue is coming from the Loklok API updating their headers. Best case is I fix it without releasing a new app version. Hopefully I could fix it within the week.

[janjanmedinaaa]

I just tried the Loklok App and they just updated the API and increased the security by adding unique headers (aesKey and sign) for every request made. For now, I won't be able to intercept that alone and won't be able to fix the app.

[Nunu27]

may i know how you intercept the request?

[janjanmedinaaa]

Before I was using HTTP Toolkit on Android emulators, but on the latest update of Loklok, it now crashes on emulators. Now I use HTTP Catcher on iOS. It has a free version, but to intercept POST requests, you need to pay for the premium version. It's just a 1 time payment.

[Nunu27]

i see, the API for the web version of Loklok also use the same security system, kinda. After looking around the web source code, i found out that it use AES and RSA encryption, i can reverse engineer it but i don't know if the mobile api use the exact same method or not.

[janjanmedinaaa]

I'm not really familiar on how the Web version works. But maybe you could reverse engineer it and share it here on how it works. I could try it on mobile if it would work.

[Nunu27]

here's the client for the web api, i've reimplemented the signing from the web using crypto from node

const { default: axios } = require('axios');
const crypto = require('crypto');

const uuid = '03e1a9143604a894';
const publicKey = `-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/K5eyJ18Y2l/vgGClKLXGQ0oAO2YdZleu59Oh2wlrxcxgKmt6FJ6rjxDJhs3K3uHdjvZWJnIQjd+pkc0g2/Yh+n5el7zWTWavUQ+q/mMIIIubiDvIJrECPj8thFy7LMFqrM2Qek8wdGV3lPMn/Yq6siidALJwOrt+UBehcwoV2QIDAQAB
-----END PUBLIC KEY-----`;
function prepareData(obj, sortValues = false) {
	const values = [];

	for (const key in obj) {
		const value = obj[key];

		if (Array.isArray(value)) {
			value.forEach((val) => values.push(`${key}=${val}`));
		} else {
			values.push(`${key}=${value}`);
		}
	}

	if (sortValues) {
		values.sort();
	}

	return values.map((val) => val.split('=')[1]).join('');
}
const encrypt = function (data, key = 'abcdefgabcdefg12') {
	if (typeof data === 'object') {
		data = JSON.stringify(data);
	}

	const keyUtf8 = Buffer.from(key, 'utf-8');
	const dataUtf8 = Buffer.from(data, 'utf-8');

	const cipher = crypto.createCipheriv('aes-128-ecb', keyUtf8, null);
	let encryptedData = cipher.update(dataUtf8);
	encryptedData = Buffer.concat([encryptedData, cipher.final()]);

	return crypto
		.createHash('md5')
		.update(encryptedData.toString('base64'))
		.digest('hex');
};

const client = axios.create({
	baseURL: 'https://web-api.netpop.app/cms/web/pc/',
	headers: {
		lang: 'en'
	}
});
client.interceptors.request.use((config) => {
	const currentTime = new Date().getTime();
	config.headers.currentTime = currentTime;
	config.headers.sign = encrypt(
		`${currentTime}${prepareData(
			'post' === config.method ? config.data : config.params,
			true
		)}`,
		uuid
	);
	config.headers.aesKey = crypto
		.publicEncrypt(
			{
				key: publicKey,
				padding: crypto.constants.RSA_PKCS1_PADDING
			},
			Buffer.from(uuid)
		)
		.toString('base64');

	return config;
});

client
	.get('homePage/singleAlbums', { params: { page: 6, size: 6 } })
	.then(({ data }) => console.log(data))
	.catch((err) => {
		console.log('err', err);
	});

*edit:
i've just tried using this method on the mobile api endpoint, and... nope. i still got sign error, so it seems to be using a different method

[janjanmedinaaa]

Archiving this repository. Thanks for the support! Feel free to use it as a reference for your Android TV App.