jonathandata1 / 2022_beijing Goto Github PK

Where is the untranslated word list located in this? I have many doubts of some of the translations, They appear very google translate -esque.

Any chance of getting this in the Play Store? I'm sick of all my wisecracks going unheard by the CCP.¹

Thanks for your work decompiling this app and showing the JavaScript and SDK strings. I took interest in your analysis but it left me with more questions than answers.

Some clarification needed in the README page.

1. The ifly SDK is very comprehensive and contains many features, most of which go unused in apps that contain it. Instead of showing the strings from the SDK, it would be beneficial to show that the calls are used in the app. Such as where on the JavaScript side that the calls are made (if at all?). Specifically for audio recording or similar.
2. For the GET requests and TCP data, it'd be beneficial to see the actual decrypted data sent back to the server. For instance containing user data or audio headers. In the screenshots you provided only normal requests to download icons, medal tally and so forth are shown.
3. In the personal health exfiltration section there is a screenshot where an icon is highlighted in the JavaScript. There isn't really an explanation as to how this is significant. Some clarification would be useful here. It might be more useful to highlight where this data is sent (is it a login button or somewhere else?).

Otherwise, this is quite long-winded and does not show anything other than a banned word list. Technically any web-based app could be updated remotely and then make use of SDK calls but this is not a smoking gun.

It is important to identify the location of the calls, if they exist in active code paths, as it helps for patching/modifying the app. Especially as Olympians are forced to use the app. It would be beneficial to be able to supply a 'fixed' version.

[redacted]