I've been trying to reverse engineer an Android app's communication protocol using a combination of Xposed and Packet sniffing. Most of the packets the app sends have this header set: Content-Type: application/octet-streamwhich leads me to beleive it is some sort of byte array. The sniffed packet body is encoded in something I do not recognize, but thanks to Xposed, I can get the decoded version. This is what I receive from the server: http://i.imgur.com/lIV6BiQ.png (raw data is at http://bit.ly/2g5JKgH ). I've tried various ways of decoding it to no avail. After hooking some methods in Xposed which receive the final, decoded data, I found that the decoded version of the data I was sniffing is this:{miis:[{owner_player_id:12bea2c3d7654b66,position:12bea2c3d7654b66}],SAKASHO_CURRENT_ASSET_REVISION:,SAKASHO_CURRENT_MASTER_REVISION:b324a24d2cf7cd0effb2941e9f5e515456e9e82d,SAKASHO_CURRENT_DATE_TIME:1480231467}I'm not sure how it got decoded, but I have some clues.First, the encoded packet has a size of 183 bytes, while the decoded version has a size of 231 bytes. This leads me to believe it's using some sort of compression. The client also sends an Accept-Encoding: gzip to the server which supports this, but after decoding it using gzip, I still get unreadable data, which I think means there is some sort of encryption going on. Looking at the app's code, translated from smali into a rough java equivalent, this is the method that supposedly takes in a byte array and spits out a Stringpublic static String a(byte[] bArr) {        if (bArr == null) {            return null;        }        try {            return new String(bArr, UTF-8);        } catch (Throwable e) {            throw new RuntimeException(Can't happen!, e);        }    }however, while trying to replicate this in my own Java program, I always get the original strange character representation of the data.What I'm wondering is, how does the original packet data get to the final, uncompressed json structure, and if it's a general encoding method, or one the app developers made themselves.Thanks in advance.
What encryption/compression is this, and how to encode/decode from it?
encryption;decompress;function hooking;sniffing