How to decode a file in an unknown format?

Question

Programming

I sniffed the google app on my phone via HttpCanary. In principle, everything turned out, you can see where everything is sent, but with the exception of some files.
For example , request_body.bin looks like on the screenshot:

I tried to make gzdecode/gzinflate/gzuncompress using PHP, but I didn't get a positive result. How to decrypt it?

Answer 1

This is a .lha archive. When unpacked, you can see the following content:

þõæÑ
Xandroid/Lenovo/A2010-a/A2010-a:5.1/LMY47D/A2010-a-t_S255_151022.151022:user/release-keysçPZLenovo A2010-a`

Answer 2

If the request was via HTTPS, then immediately forget

Answer 3

Try it with UltraISO, 7zip

Answer 4

1. Make sure it's not encrypted
2. If it's encrypted, then recapture the traffic via Fiddler/ Charles/ mitmproxy
After the second step, you will have a decrypted and decompressed message - then you can immediately see if it's json or another text format.
If it is not encrypted, then you can look in the Content-type header for what the format is.
UPD: this might help you:
https://habr.com/ru/post/321790/
https://github.com/mildsunrise/protobuf-inspector