Neopets Mobile

Neopets Mobile does not refer to the 2021 interface of the website, but the 2006 flip phone application that has long been discontinued.

Archival

https://www.jellyneo.net/?go=mobile

https://pinkpt.com//neodex/index.php?title=Neopets_Mobile

https://drive.google.com/file/d/1Cj8hqk4VI-O408kgMnKpffPmI-kxKmWR/view

Attempts to reverse engineer the long-defunct API

TODO (The jars are all minified, but perhaps I can extract the API URLs from them and document what the application expects to get back)

The META-INF/MANIFEST.MF for the Nokia 6280 version specifies a Java version of 1.4.2_04.

The decompiler used is quiltflower: https://github.com/QuiltMC/quiltflower and the javax.microedition classes were copied from https://github.com/mcpat/java-microedition-libraries

Nokia 6280 V02.30.00 (en) Singtel

m.java contains two calls:

• http://npprod-singtel.in-fusio.com/data-np/
• http://npprod-singtel.in-fusio.com/singtel/check?session= followed by RecordStore.openRecordStore("data-i", true).getRecord(1) as a String if not null, else ""

The session check appears to return one of the following values, with anything else as a failure code of -1:

Response	Treated as ID
SUBSCRIBED	1
UNSUBSCRIBED	2
REVOKED	3
SECURITY	5

Nokia 6111

m.java contains one call:

• http://npprod.in-fusio.com/data-np/

Getting sample network requests

1. Install Kahvibreak
2. Edit /path/to/Kahvibreak/Software/win32/KLaunch.bat
3. Change echo NetworkNotAvailable=true>>property.txt to echo NetworkNotAvailable=false>>property.txt
4. Edit /etc/hosts
5. Add 127.0.0.1 npprod-singtel.in-fusio.com
6. Add 127.0.0.1 npprod.in-fusio.com
7. Run something on port 80 that listens to /data-np/
8. Launch Neopets Mobile from Kahvibreak
9. Try to login

Logging in

With username "aaaaaa" and password "bbbbbb", in Python 3 bytes notation:

b'client=NEOPETS/2.8&game=11061&center=61&language=en\n\xa0\x01\x00\x00\x01\xa0\x00\x12\x00\x00\x00\x00\x00@\x00\x00\x00@\x00\x10\x00\x18\x00 \x00\x0eISO-8859-1;2.8\x00\x06aaaaaa\x00\x06bbbbbb\x00\x00\x00\xff'

Signing up

With username "adadad", password "gjgjgj", male green Kacheek, name "cccccc", birthday 1999-12-31, health 6, strength weak, defense very poor, movement slow, height 36 cms, weight 26 lbs, in Python 3 bytes notation:

b'client=NEOPETS/2.8&game=11061&center=61&language=en\n\xa0\x07\x00\x00\x04\xd0\x00:\x00\x00\x00\x00\x00@\x00\x00\x00@\x00\x10\x00\x18\x00 \x00(\x004\x00:\x00>\x00B\x00J\x00S\x00Z\x00\x00\x00\x06\x00\x00\x00\x04\x00\x00\x00\x04\x00\x00\x00\x05\x00\x00\x00$\x00\x00\x00\x1a\x00\x0eISO-8859-1;2.8\x00\x06adadad\x00\x06gjgjgj\x00\x06cccccc\x00\n1999-12-31\x00\x04Male\x00\x02en\x00\x02EN\x00\x06adadad\x00\x07Kacheek\x00\x05GREEN\x00\x04Male\x00\xff'

Reverse engineering the format

I've been renaming symbols in the decompiled source code to slowly figure out what the application is looking for as a response.

The response seems to use the same data structure as the request: a form-encoded set of key-value pairs, then a newline, then some sort of binary data structure.

Shorts seem to be big-endian. Strings seem to be delayed until the end of the structure.

The game ID is hardcoded to 11061 and the center is hardcoded to 61.