Closed RedSquirrel87 closed 3 years ago
RedSquirrel87
commented
3 years ago Original comment by Red Squirrel (Bitbucket: Red_Squirrel, GitHub: RedSquirrel87).
No problem to spoof the android client, but are you sure the secret param is always the same? Because if it’s randomly generated by the app we need to find how it’s generated.
EDIT: I just tested the two links and I got the same result, even from my Android device 🤔
RedSquirrel87
commented
3 years ago Original comment by Red Squirrel (Bitbucket: Red_Squirrel, GitHub: RedSquirrel87).
Ok, now it works (on Android I get two different results from the new links). What did you change? There was an error in the links?
RedSquirrel87
commented
3 years ago Original comment by Red Squirrel (Bitbucket: Red_Squirrel, GitHub: RedSquirrel87).
Never mind, I got 2 different results because the second (from Android client) is simply an “error” 😅
This could be a problem, if it does not accept anything from the latest version we should update the program everytime a new app version will be released
EDIT: never mind 2.0, I just noticed that the base API url is different between the two requests xD I used “webapi” for both and so the same results 🤦♂️
RedSquirrel87
commented
3 years ago Original comment by Red Squirrel (Bitbucket: Red_Squirrel, GitHub: RedSquirrel87).
Good news, it seeems that it works even using a custom app_ver param that has a higher value of the real one (for example I tested with “999” and it worked), so it should not be a problem with new app versions. And I can confirm that it downloads in the WEBP format when using the other API call:
So yes, the next version of MD will have this option 👍
RedSquirrel87
commented
3 years ago Original comment by railgun-is-good (Bitbucket: railgun-is-good, ).
Yes there was a problem with the result links.
The link that contain a secret param stopped working. But if you download the result from Dropbox and open it you will still able to load images
I tried to decompile tow different versions version 1.0 and version 1.1.14
but I am not good at Java
seem very interesting
smali_classes2/jp/co/shueisha/mangaplus/h/b$a.smali:79: const-string v3, "app_ver"
smali/jp/co/shueisha/mangaplus/App.smali:171: const-string p1, "&app_ver="here are the links to some online decompilers
RedSquirrel87
commented
3 years ago Original comment by Red Squirrel (Bitbucket: Red_Squirrel, GitHub: RedSquirrel87).
v50 released, it should fix this issue
Original report by railgun-is-good (Bitbucket: railgun-is-good, ).
Manga plus serve WebP to android client. So if it is somehow possible to spoof Manga Downloader. And make the manga plus server thinks it is an android client instead of browser. WebP better than jpeg.
jpeg is bad for text
browser
request URL
https://jumpg-webapi.tokyo-cdn.com/api/manga_viewer?chapter_id=1001834&split=yes&img_quality=super_high
result file
https://www.dropbox.com/s/k7c0pw0edu6lb1v/manga_viewer_jpeg.bin?dl=0
android client
request URL
https://jumpg-api.tokyo-cdn.com/api/manga_viewer?chapter_id=1001834&split=yes&img_quality=super_high&os=android&os_ver=28&app_ver=18&secret=a1e0e782571204b19bf6e29f4b5fdd68
result file
https://www.dropbox.com/s/pxas6t8ix4it727/manga_viewer_webp.bin?dl=0