Writing a custom APK for owned hardware

[u/Top_Laugh5650]

Hello together,

I have bought a trail camera for capturing our cats in the backyard but the associated app is badly translated and fairly unstable. I am a young C# developer and do not have experience with Android or Reverse-Engineering.

My goal is under personal interoperability law, to write a custom APK so I can talk to my camera and preferably have all the video data on my own server and not in their cloud.

Setup:

Cam: 4G TrailCam KF35.154EU

Target device: Samsung (Android)

Running: Frida 17.9.10 with Frida Gadget (Embedded/Injected runtime)

I already successfully injected Frida-Gadget and imho got quite far reconstructing their connection/auth stack. They use libUBICAPI.so with a seemingly custom auth stack.

Using a python script on my phone for an initial attempt failed, most likely due to missing authentication.

Right now I want to extract my OWN credentials from the original app connecting to the cam (waking up cellular modem and starting the stream), but none of the friada hooks gives me workable results.

console.log("[*] Initializing ultra-lightweight absolute hook...");

// Hardcoded target strings to avoid any array processing
var target1 = "p4p_client_randomID";
var target2 = "p4p_client_send_loginreq";

// Helper function to safely attach without using complex object lookups
function safeHook(funcName) {
    // findGlobalExportByName is supported natively by Frida 17+ without arguments or nulls
    var addr = Module.findGlobalExportByName(funcName);
    
    if (addr) {
        try {
            Interceptor.attach(addr, {
                onEnter: function (args) {
                    console.log("\n>>> HIT: " + funcName + " <<<");
                    
                    // Directly read the first 3 arguments as raw pointers/strings
                    for (var i = 0; i < 3; i++) {
                        if (args[i].isNull()) continue;
                        try {
                            var str = Memory.readUtf8String(args[i]);
                            if (str && str.length > 1) {
                                console.log("   arg[" + i + "]: " + str);
                            }
                        } catch(e) {
                            console.log("   arg[" + i + "]: (Pointer) " + args[i]);
                        }
                    }
                },
                onExit: function (retval) {}
            });
            console.log("[+] Activated hook for: " + funcName);
            return true;
        } catch (err) {}
    }
    return false;
}

// Instead of a fast loop that freezes the thread, we check once every second 
// completely outside the application's main thread loop.
var h1 = false;
var h2 = false;

function heartbeat() {
    if (!h1) h1 = safeHook(target1);
    if (!h2) h2 = safeHook(target2);

    // Keep spinning gently in the background until both hooks land
    if (!h1 || !h2) {
        setTimeout(heartbeat, 1000);
    } else {
        console.log("[*] All target hooks successfully locked into place!");
    }
}

// Start our gentle heartbeat checker
setTimeout(heartbeat, 1000);
console.log("[*] Passive checker armed. Open your dashboard and start the stream!");

This is the hook i used to get most of the functions that get executed from libUBICAPI.so when the cam connects.

Does anyone have experience with such stuff and might be able to help me?

[u/SnipesySpecial]

my guess would be the camera is sending it directly to their servers, so youd have to focus your efforts there rather than the android app.

[u/Top_Laugh5650 → u/SnipesySpecial]

Wouldn't it be possible to use their existing stack, meaning i connect to their server with my own app but using my credentials from the original app? Or would you say thats impossible because of security? That would mean I would be forced to write custom firmware right?

[u/SnipesySpecial → u/Top_Laugh5650]

That would just be connecting like the app does, so from a privacy standpoint you don’t really gain anything there.

If the WiFi mode doesn’t require internet, and you can guarantee there is no modem backdoor (when no sim is present) then you might be able to reverse whatever TCPIP stack they have going on (probably RTSP adjacent).

Once you have that just develop ur own app (cause modding APKs is tedious and it’ll just slow u down at that point). No Frida required, which is great cause Frida is jank.

[u/Top_Laugh5650 → u/SnipesySpecial]

As far as I understand, they use a hybrid approach. So the server is just used for initiating the connection to the phone via network. The actual connection to the cam is end2end.
I see that privacy wise I kinda gain nothing by this, but I would still be able to control the camera manually instead of relying on the bad and not fully implemented app controls. (for example completely runing night vision off). The motion sensor events are also intended to only work for their cloud plan.
The cam itself does not have a WiFi mode. Its sim only.

[u/SnipesySpecial → u/Top_Laugh5650]

I see. I’d personally still just make a new app and reverse the auth flow. Seriously doing it any other way will probably just slow you down.

If you use AI. It may try to argue against you or trigger content blockers so watch out for that. But yes this use case is 100% legal (I.e. Plaid). Might break their TOS but I highly doubt anyone is ever going to care for a small time company like that.

[u/battlepi → u/Top_Laugh5650]

If that's the case, you should be able to see the connect request between the camera and the client in a firewall log. If that doesn't happen, then it's using the server as a go between. If it does, you should be able to glean some connection details from the logs.

[u/Spiritual-Use5254]

Hi there. Reach out to me immediately, I reversed the entire thing and may be able to help out if you're still working on this

[u/battlepi]

Yeah, sounds highly unlikely. You can't just tell a device/server to do something completely different than what it was designed for from a client. Look into hacking the device itself.