Introducing: pandora_mitm

[hacker1024]

Hi everyone,
Leveraging my mitmproxy add-on and my Pandora client library, Iapetus, I've made pandora_mitm.

pandora_mitm allows you to inspect and analyse Pandora JSON API traffic with a high level API. It handles request decryption and parsing under the hood, letting you view and manipulate API messages with ease.

It's primarily a Dart library, but comes with an accompanying CLI that exposes some of the basic functionality like feature unlocking and mitmproxy UI enhancements.

I'm working on a UI as well, customised for Pandora's API - but at the moment, the mitmproxy UI is still very usable thanks to the decryption and other features.

I think this is a great tool for any Pandora API reverse-engineering - feel free to try it out!

[hacker1024]

The GUI is coming along nicely... Here's a sneak peek.

[hacker1024]

Why do Pandora need your local IP address when you remove an item from your collection...

[hucario]

They don't, and either way they can get it from the request anyways. Seems like their analytics platform can't handle that, though, so they're having it include the analytics info in every request. You could probably remove the info and be just fine.

[hacker1024]

They could definitely get your public IP from the request, I don't see how they could get your LAN IP... Unless you're referring to the request body, which I was referring to

[hacker1024]

The GUI is now at a state where I'm happy to make it public.
https://github.com/EpimetheusMusicPlayer/pandora_mitm/tree/master/pandora_mitm_gui
Automatic desktop and Web builds are set up.

I've also added a new feature: API message object definition inferences. The app records API messages and estimates the type of each JSON field. Along with JSON primitives, API-specific types like Pandora IDs, annotations, and timestamps are also detected.
This makes implementing API methods much easier - and I've even implemented code generation based off this for my own client, Iapetus.