thijooree/android
9
1
Fork 2
Code Issues 18 Pull Requests 1 Actions Packages Projects Releases 35 Wiki Activity

MIB v2 login works
Auto Tag on Version Change / check-version (push) Successful in 3s
Details

Browse Source
This commit is contained in:
shihaam
2026-10-23 03:09:42 +05:00
parent 7ccd8aa4f5
commit 870d3eb0f6
4 changed files with 64 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/mibapi/02-login.md
+11 -1
View File
@@ -57,6 +57,16 @@ def compute_pgf03(password: str, user_salt: str, client_salt: str) -> str:
## Step-by-Step Reference
**Endpoint**: `POST https://faisamobilex-smvc-v2.mib.com.mv/index/`
**Headers** (on all requests):
```
User-Agent: android/2.0
Accept: application/json
X-Request-ID: {YYYYMMDDHHmmss}{milliseconds}-{16-char-hex}
Content-Type: application/x-www-form-urlencoded; charset=utf-8
```
### [0] Initial Key Exchange — `sfunc=r`
**Key**: `DEFAULT_KEY = 8M3L9SBF1AC4FRE56788M3L9SBF1AC4FRE5678`
@@ -67,7 +77,7 @@ def compute_pgf03(password: str, user_salt: str, client_salt: str) -> str:
"sfunc": "r",
"data": {
"cmod": "<G^A mod P as decimal string>",
"appId": "IOS17.2-<15 random alphanumeric chars>",
"appId": "AND34-<15 random alphanumeric chars>",
"routePath": "S40",
"sodium": "<random int in [1_000_000, 16_000_000)>",
"xxid": "<random 40-bit int as string>"
docs/mibapi/README.md
+1 -1
View File
@@ -12,7 +12,7 @@ MIB uses **two completely separate backends**:
| Backend | Base URL | Auth | Used for |
|---|---|---|---|
| Encrypted API | `https://faisanet.mib.com.mv/faisamobilex_smvc/` | Blowfish + DH session key | Login, key exchange |
| Encrypted API | `https://faisamobilex-smvc-v2.mib.com.mv/index/` | Blowfish + DH session key | Login, key exchange |
| WebView host | `https://faisamobilex-wv.mib.com.mv` | Session cookies | Accounts, history, transfers, contacts, cards, financing |
---
docs/mibapi/upgradev2.md
+35 -22
View File
@@ -18,13 +18,13 @@ This document tracks all MIB API calls used by thijooree and their upgrade statu
| API Code | Endpoint | Purpose | Used By | Status |
|----------|----------|---------|---------|--------|
| `sfunc=r` + `S40` | Key Exchange (Init) | First-time device registration | `MibLoginFlow.kt` | ☐ |
| `sfunc=i` + `S40` | Key Exchange (Login) | Regular login session setup | `MibLoginFlow.kt` | ☐ |
| `sfunc=n` + `C41` | Registration Init | Initialize device registration flow | `MibLoginFlow.kt` | ☐ |
| `sfunc=n` + `C42` | OTP Verification | Verify one-time password after registration | `MibLoginFlow.kt` | ☐ |
| `sfunc=n` + `A41` | Main Login | Submit username/password credentials | `MibLoginFlow.kt` | ☐ |
| `sfunc=n` + `A44` | Get User Salt | Retrieve user salt for password hashing | `MibLoginFlow.kt` | ☐ |
| `sfunc=n` + `P47` | Switch Profile | Activate different user profile | `MibLoginFlow.kt` | ☐ |
| `sfunc=r` + `S40` | Key Exchange (Init) | First-time device registration | `MibLoginFlow.kt` | ✅ |
| `sfunc=i` + `S40` | Key Exchange (Login) | Regular login session setup | `MibLoginFlow.kt` | ✅ |
| `sfunc=n` + `C41` | Registration Init | Initialize device registration flow | `MibLoginFlow.kt` | ✅ |
| `sfunc=n` + `C42` | OTP Verification | Verify one-time password after registration | `MibLoginFlow.kt` | ✅ |
| `sfunc=n` + `A41` | Main Login | Submit username/password credentials | `MibLoginFlow.kt` | ✅ |
| `sfunc=n` + `A44` | Get User Salt | Retrieve user salt for password hashing | `MibLoginFlow.kt` | ✅ |
| `sfunc=n` + `P47` | Switch Profile | Activate different user profile | `MibLoginFlow.kt` | ✅ |
---
@@ -132,7 +132,7 @@ This document tracks all MIB API calls used by thijooree and their upgrade statu
| Type | URL |
|------|-----|
| **Encrypted API** | `https://faisanet.mib.com.mv/faisamobilex_smvc/` |
| **Encrypted API** | `https://faisamobilex-smvc-v2.mib.com.mv/index/` |
| **WebView/Data** | `https://faisamobilex-wv.mib.com.mv` |
---
@@ -162,20 +162,33 @@ pgf03 = SHA256(clientSalt + SHA256(SHA256(password) + userSalt))
## Upgrade Checklist
- [ ] Review all 28+ endpoints for v1 compatibility
- [ ] Update authentication flow (encryption/key exchange)
- [ ] Update beneficiary management endpoints
- [ ] Update transfer endpoints (internal, local, account lookup)
- [ ] Update debit card endpoints
- [ ] Update transaction history endpoint
- [ ] Update activity history endpoint
- [ ] Update profile scraping (if API available in v1)
- [ ] Update financing endpoint (if API available in v1)
- [ ] Test session management & keep-alive
- [ ] Verify all error handling & session recovery
- [ ] Test all 8 categories end-to-end
### Core Implementation
- [x] Update encrypted API endpoint URL
- [x] Update User-Agent header
- [x] Add X-Request-ID header
- [x] Verify Blowfish encryption compatibility
- [x] Test device registration flow
- [x] Test regular login flow
- [x] Test OTP verification
- [x] Test profile switching
### WebView Endpoints (Pending)
- [ ] Test beneficiary management (`/ajaxBeneficiary/*`)
- [ ] Test transfer endpoints (`/ajaxTransfer/*`, `/AjaxAlias/*`)
- [ ] Test debit card endpoints (`/ajaxDebitCard/*`)
- [ ] Test transaction history (`/ajaxAccounts/trxHistory`)
- [ ] Test activity history (`/aProfile/getPagedActivityHistory`)
- [ ] Test user profile scraping (`/personalProfile`)
- [ ] Test financing (`/financing?dashurl=1`)
- [ ] Test session keep-alive (`/aProfile/keepAlive`)
### Validation
- [ ] Verify all account balances display correctly
- [ ] Verify error handling (419, 505) and auto-recovery
- [ ] Verify all data formats match expectations
- [ ] Full end-to-end user flow test
---
**Started:** 2026-10-22
**Target Completion:** TBD
**Implementation:** 2026-10-22 ✅
**WebView Testing:** In progress