Group of developers creates another working Pokémon Go API

A group of developers has re-developed a Pokémon Go API called “Team Unknown6”. Previous APIs were disabled by Niantic last week, causing many third-party sites to shut down.

Late last week, the Pokémon servers stopped accepting access requests made outside of the official app. This affected third-party sites, for example Pokévision had to close its doors. Niantic stated that these services complicate the development of new features and that they place a large burden on the servers. To render the existing APIs useless, the company ensured that a value, named “unknown6”, was verified on the server.

As a result of this blocking, a group of developers, which grew out of a thread on Reddit, have set to work to regain access with an API. Finally, after three days, they succeeded and they made their code available on GitHub. The aim of the collaboration was to find out how ‘unknown6’ was generated. This value was already part of the Pokémon Go app, but was not yet verified by the server.

By reverse engineering the app, the developers found out that the unknown value was calculated in the libNianticLabsPlugin object. The difficulty was then to find out which elements this calculation consisted of. In an interim update, the developers explained that multiple values ​​are used. For example, the hashed value of an authentication token in combination with the user’s location information. They also had to find out how the encryption takes place.

Following the successful completion of the project, some Pokémon Go services appear to be working again. The makers warn that access through the cracked api, however, is easily determined by Niantic and that this should not be considered secure. One of the developers says on Reddit that a full technical description of the project will be available soon.