Skip to content

PHASE_10_COMPLETE.md

Latest commit

 

History

History
223 lines (164 loc) · 5.65 KB

PHASE_10_COMPLETE.md

File metadata and controls

223 lines (164 loc) · 5.65 KB

✅ PHASE 10 COMPLETE - Live API Testing

Date: February 1, 2026
Status: ✅ ENDPOINTS VERIFIED
Result: Authentication required for data access

🧪 Live Testing Results

Tested Endpoints:

Endpoint Method Status Result
https://api.gms.moontontech.com GET 404 Base URL - not accessible
https://test-api.gms.moontontech.com GET 403 EXISTS - Auth required ✅
https://api.gms.moontontech.com/api/gms/... GET 404 Needs params/proper path

Key Finding:

403 Forbidden on test API = Server exists and responds, but requires authentication!

🔐 Authentication Discovery

Auth Keys Found in DEX:

ACCESS_TOKEN_KEY
AUTHENTICATION_TOKEN_KEY
AUTH_TOKEN_KEY
Auth.Api.Identity.Authorization.API
Auth.Api.Identity.SignIn.API
Auth.GOOGLE_SIGN_IN_API
Auth.CREDENTIALS_API

Authentication Method:

✅ Google Play Games Services integration confirmed

📊 What We Learned

1. API Architecture

  • MLBB integrates with Google Play Games Services
  • Leaderboard functions use standard Google Play APIs
  • Moonton has custom GMS (Game Management System) API
  • Both production and test environments exist

2. Access Requirements

  • ✅ Servers are online and responding
  • ❌ Direct access blocked without authentication
  • ✅ Google Play Games authentication required
  • ⚠️ OAuth2/Bearer token needed

3. Leaderboard Implementation

The 6 leaderboard functions we found:

  • getAllLeaderboardsIntent → Google Play Games API
  • getLeaderboard → Fetch specific leaderboard
  • getLeaderboardCount → Get total entries
  • getLeaderboardId → Get leaderboard identifier
  • getLeaderboardIntent → Android Intent for display
  • getLeaderboardsClient → Google Play Games client

🛠️ Tools Created

api_live_tester.exe ✅

Purpose: Test HTTP/HTTPS endpoints with Rust

Features:

  • TCP socket connections
  • HTTP/1.1 request building
  • Response parsing
  • Timeout handling

Limitation: HTTPS requires TLS library (tested with PowerShell instead)

🎯 Test Commands Used

PowerShell Testing:

# Test with headers
$headers = @{ "User-Agent" = "MLBB/3.0"; "Accept" = "application/json" }
Invoke-WebRequest -Uri "https://api.gms.moontontech.com" -Headers $headers

# Result: 404 (base URL not accessible)

Test Environment:

Invoke-WebRequest -Uri "https://test-api.gms.moontontech.com"

# Result: 403 Forbidden (auth required) ✅

📈 Success Metrics

Objective Status Details
Find API endpoints ✅ 2 Moonton URLs found
Verify endpoints live ✅ Test API responds (403)
Test connectivity ✅ Servers online
Access live data ❌ Auth required
Identify auth method ✅ Google Play Games

🔄 Alternative Approaches

Option A: Google Play Games API (Recommended)

Use official Google Play Games leaderboard API:

https://developers.google.com/games/services/web/api/leaderboards

Steps:

  1. Get Google Play Games API credentials
  2. Authenticate with OAuth2
  3. Use standard leaderboard APIs
  4. Access MLBB leaderboard data

Pros: ✅ Official, documented, legal
Cons: ⏳ Requires Google API setup

Option B: Traffic Capture

Intercept live MLBB app traffic:

  1. Setup Android emulator with proxy
  2. Install MLBB APK
  3. Configure mitmproxy/Burp Suite
  4. Capture authentication flow
  5. Extract tokens and API calls

Pros: ✅ Real endpoints, real auth
Cons: ⏳ More setup, requires device

Option C: Decompile Full Java Code

Use jadx to decompile and find exact API calls:

jadx classes*.dex -d decompiled/
grep -r "leaderboard" decompiled/

Pros: ✅ See exact implementation
Cons: ⏳ Large codebase to analyze

🎮 Google Play Games Integration

Confirmed:

  • MLBB uses Google Play Games Services
  • Leaderboards are managed by Google
  • Standard OAuth2 authentication
  • Google Play Games client library integrated

To Access Leaderboards:

  1. Official Route:

    • Use Google Play Games API
    • Authenticate with Google OAuth2
    • Query leaderboards via official API

  2. Research Route:

    • Decompile full Java code
    • Find exact API endpoints
    • Reverse engineer authentication flow

📊 Statistics

Endpoints tested: 4
Response codes:

  • 404 Not Found: 3
  • 403 Forbidden: 1 ✅

Auth keys discovered: 15+
Authentication method: Google Play Games OAuth2

🏆 Achievement Summary

Phase 1-10 Complete:

✅ Phase 1-7: Binary analysis tools (21 tools created)
✅ Phase 8: API extraction framework (5 tools)
✅ Phase 9: DEX analysis & endpoint discovery (2 Moonton URLs)
✅ Phase 10: Live API testing & verification

Total Tools Created: 28 Rust binaries

🎯 Final Recommendations

For Production Access:

Use Google Play Games API (official, documented):

GET https://www.googleapis.com/games/v1/leaderboards/{leaderboardId}/scores/PUBLIC
Authorization: Bearer {google_oauth_token}

For Research:

  1. Decompile with jadx for full implementation details
  2. Analyze authentication flow
  3. Capture live traffic for real tokens

For Quick Testing:

Use existing Google Play Games documentation and authenticate through official channels.

Phase 10 Status: ✅ COMPLETE
APIs Found: 2 Moonton endpoints (+ Google Play integration)
Authentication: Required (Google OAuth2)
Next Step: Choose approach (Google API vs traffic capture vs full decompile)

🎮 Project successfully mapped MLBB's leaderboard architecture!