dxasm/shape-ios

★ 14RustAudience · researcherComplexity · 3/5Setup · moderate

Mindmap

mindmap
  root((shape-ios))
    Purpose
      Decode Shape Security headers
      Re-encode fingerprint data
      Study anti-bot SDK
    Target
      Southwest Airlines iOS app
      Shape Security SDK
      F5 anti-fraud system
    Header format
      b prefix notation
      Ciphertext field
      32 byte nonce
      Nonce based cipher
    Tech
      Rust
      Command line tool
    Scope
      Native SDK portion only
      JS and Lua VMs not yet done

mindmap root((shape-ios)) Purpose Decode Shape Security headers Re-encode fingerprint data Study anti-bot SDK Target Southwest Airlines iOS app Shape Security SDK F5 anti-fraud system Header format b prefix notation Ciphertext field 32 byte nonce Nonce based cipher Tech Rust Command line tool Scope Native SDK portion only JS and Lua VMs not yet done

Click or tap to explore — scroll the page freely

Things people build with this

USE CASE 1

Decode captured Shape Security HTTP headers from iOS app traffic to inspect the raw device fingerprinting data inside

USE CASE 2

Re-encode custom device fingerprint data to study how the Shape anti-bot detection validates incoming requests

USE CASE 3

Use as a reference implementation for the nonce-based cipher scheme used in the -e header of Shape/F5 SDKs

Tech stack

Rust

Getting it running

Difficulty · moderate Time to first run · 30min

Requires the Rust toolchain installed, you must supply a captured encrypted header value and key derivation prefix from your own traffic analysis.

In plain English

This repository contains a Rust implementation that reverse-engineers a security SDK used in iOS mobile apps. Shape Security, now part of F5, makes bot-detection and anti-fraud software that companies embed in their mobile applications. This project specifically looks at the version of that SDK found inside the Southwest Airlines iPhone app. The SDK works by generating a set of custom HTTP headers that get attached to every request the app makes to Southwest's servers. Those headers carry device fingerprinting data and other signals that the backend uses to tell whether a request is coming from a real user on a real phone or from an automated script. The header values are computed by a combination of a JavaScript virtual machine, a Lua virtual machine with bytecode loaded from the server at startup, and native device information. The researcher who built this project figured out how the encoding and encryption scheme behind one of those headers works. The specific header is the one labeled with the suffix -e, which carries a device fingerprint encrypted with a nonce-based cipher in the format b, followed by ciphertext and a nonce. The repository implements both directions: you can feed it an encoded header value and decode it back to readable data, or you can take plain data and encode it into the format the SDK would produce. The tool is built with Rust and runs from the command line. You pass it the encrypted data string and the header prefix used for key derivation, and it outputs the decoded result. Encoding works the same way in reverse, requiring you to supply a random 32-byte nonce. The README notes that the other headers, including those driven by the JavaScript and Lua virtual machines, are not yet implemented. This covers only the native SDK portion of the fingerprinting system.

Copy-paste prompts

Prompt 1

Using the shape-ios CLI, decode this captured -e header value, what arguments does the command expect and what format does the output take?

Prompt 2

I want to encode my own test payload using shape-ios, what format does the input data need to be in and how do I generate a valid 32-byte nonce for the cipher?

Prompt 3

Explain the b, prefix format of the Shape Security -e header: how the ciphertext and nonce are laid out and how the key is derived from the header prefix

Prompt 4

Walk me through building the shape-ios Rust binary from source and running the decode subcommand against a sample captured header

Open on GitHub → Explain another repo

← dxasm on gitmyhub — every repo by this author, as a profile.

Verify against the repo before relying on details.