fksar/docs/mibapi/README.md

MIB Faisanet API

Reverse-engineered from mv.com.mib.faisamobilex (Faisanet Mobile Banking, React Native / Hermes bytecode v96).

Play Store

---

Architecture

MIB uses two completely separate backends:

Backend	Base URL	Auth	Used for
Encrypted API	https://faisamobilex-smvc-v2.mib.com.mv/index/	Blowfish + DH session key	Login, accounts, history, transfers, contacts, profile images
WebView host	https://faisamobilex-wv-v2.mib.com.mv	Session cookies	Cards, financing, personal details, activity history, keep-alive

---

Encrypted API

All calls to the encrypted API are POST / with Content-Type: application/x-www-form-urlencoded; charset=utf-8 and form body:

xxid=<session_xxid>&sfunc=<function_code>&data=<url_encoded_base64_blowfish_ciphertext>

xxid is omitted on the key exchanges (sfunc=r / sfunc=i); sfunc=i sends key2 instead. The request JSON is encrypted with Blowfish (ECB, PKCS5) before sending. The response body is also base64-encoded Blowfish ciphertext — on failures too, which come back as HTTP 400 with an encrypted success: false body.

Every sfunc=n call is identified by a routePath inside the encrypted payload, alongside the standard fields:

{
  "nonce": "<computed nonce>",
  "appId": "<appId>",
  "sodium": "<random int>",
  "routePath": "<route, e.g. A84>",
  "xxid": "<session xxid>"
}

Route-specific fields are added to the same object. See 02-login.md for the request headers.

Two keys are used:

Phase	Key
sfunc=r (initial key exchange)	DEFAULT_KEY (hardcoded in app)
All subsequent requests	DH-derived session key

See 01-encryption.md for full details.

---

WebView Session Auth

After login, the WebView endpoints use cookie-based auth on faisamobilex-wv-v2.mib.com.mv:

Cookie: mbmodel=AND-1.0; xxid=<session_xxid>; IBSID=<session_xxid>; mbnonce=<nonceGenerator>; time-tracker=597

These values come from the login flow — xxid and nonceGenerator from the DH key exchange response.

Cookie notes:

• time-tracker=597 is a hardcoded constant in the client. Every WebView client (cards, financing, activity, etc.) sends the literal value 597 — it is not computed or rotated.
• mbnonce is the unmodified nonceGenerator string from the key-exchange response. It does not carry a freshly-computed per-request nonce. The actual per-request nonce (derived via the algorithm in 01-encryption.md) only appears inside the encrypted payloads of sfunc=n calls on the encrypted API — WebView endpoints have no nonce field.

WebView AJAX Headers

All AJAX POST calls also require:

X-Requested-With: XMLHttpRequest
Accept: */*
Origin: https://faisamobilex-wv-v2.mib.com.mv
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

The Referer value varies per endpoint (documented per endpoint). A few endpoints (notably activity history, 10-activity-history.md) omit both Referer and Origin.

---

Session Expiry Detection

A MIB session is considered expired when either condition is met (MibLoginFlow.kt:248-274):

Signal	Source
HTTP 419 status	Encrypted API or any WebView endpoint
JSON reasonCode == "505" in a decrypted response body	Encrypted API

On detection the client auto-recovers by re-running the login flow using stored credentials, refreshes xxid + nonceGenerator in the in-flight payload, and retries the original request once. Callers receive the retried response transparently. If the recovery itself hits expiry again it surfaces a SessionExpiredException.

Keep-Alive

POST https://faisamobilex-wv-v2.mib.com.mv/aProfile/keepAlive

Empty body, session cookies only. Sent periodically to keep the session open. An expired session returns HTTP 419 with:

{ "success": false, "responseCode": "3", "reasonCode": "41", "reasonText": "Session Expired" }

WebView User-Agent

Mozilla/5.0 (Linux; Android {version}; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/129.0.6668.70 Mobile Safari/537.36

---

Documents

#	File	Description
1	01-encryption.md	Blowfish encryption, DH key exchange, nonce computation
2	02-login.md	Device registration and regular login flows
3	03-accounts.md	Select profile, account balances, account refresh
4	04-history.md	Transaction history
5	05-cards.md	Debit card list
6	06-financing.md	Financing deals
7	07-profile.md	Personal details, profile image
8	08-transfer.md	Account lookup and fund transfer
9	09-contacts.md	Beneficiary management
10	10-activity-history.md	Activity / audit log

---

Start here → 01-encryption.md