Client crashes

[PurpleTape]

Hello!

I'm trying to go through the entire registration flow in the app. To do this, I use the client version 367.0 on iOS 18.3.1 and the developer's certificate to sign the application.

SSL authentication is successful, but at the registration step, the instagram client accesses the CloudKit API, which causes a deliberate exception created by the client and the application crashes.

Crash log:

Exception Type:  EXC_BREAKPOINT (SIGTRAP)
Exception Codes: 0x0000000000000001, 0x00000001a6be0140
Termination Reason: SIGNAL 5 Trace/BPT trap: 5
Terminating Process: exc handler [4208]

Triggered by Thread:  0

Thread 0 name:   Dispatch queue: com.apple.main-thread
Thread 0 Crashed:
0   CloudKit                      	       0x1a6be0140 0x1a6ac2000 + 1171776
1   CloudKit                      	       0x1a6beea58 0x1a6ac2000 + 1231448
2   CloudKit                      	       0x1a6bee910 0x1a6ac2000 + 1231120
3   libdispatch.dylib             	       0x1a64f6fa8 _dispatch_client_callout + 20
4   libdispatch.dylib             	       0x1a64f87f4 _dispatch_once_callout + 32
5   CloudKit                      	       0x1a6bee8ec 0x1a6ac2000 + 1231084
6   FBSharedFramework             	       0x10c3bcaf0 -<IGCloudIDValidation startCloudIDValidationWithNetworker:> + 216
7   Instagram                     	       0x105370c10 XPluginsGetFuncPtr + 47429240
8   FBSharedFramework             	       0x10b009fd4 BKPerformanceLogEventEnd + 33208
9   FBSharedFramework             	       0x10b009be4 BKPerformanceLogEventEnd + 32200
10  FBSharedFramework             	       0x10b024f4c -<BKLispyEnvironment bkContext> + 804
11  FBSharedFramework             	       0x10b008148 BKPerformanceLogEventEnd + 25388
12  FBSharedFramework             	       0x10b002cc4 BKPerformanceLogEventEnd + 3752
13  FBSharedFramework             	       0x10b002858 BKPerformanceLogEventEnd + 2620
14  FBSharedFramework             	       0x10b002478 BKPerformanceLogEventEnd + 1628
15  FBSharedFramework             	       0x10b002074 BKPerformanceLogEventEnd + 600
16  FBSharedFramework             	       0x10b025768 BKInterpret + 164
17  FBSharedFramework             	       0x10b1f5ff4 BKBloksEvaluateAsyncAction + 532
18  FBSharedFramework             	       0x10b1f5cf4 BKBloksAsyncActionHandler + 48
19  FBSharedFramework             	       0x10b1f5c64 -<BKBloksParsedActionBundle ensureParseLispy:> + 516
20  libdispatch.dylib             	       0x1a64f5248 _dispatch_call_block_and_release + 32
21  libdispatch.dylib             	       0x1a64f6fa8 _dispatch_client_callout + 20
22  libdispatch.dylib             	       0x1a6505a34 _dispatch_main_queue_drain + 984
23  libdispatch.dylib             	       0x1a650564c _dispatch_main_queue_callback_4CF + 44
24  CoreFoundation                	       0x19e7b2bcc __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 16
25  CoreFoundation                	       0x19e7af1c0 __CFRunLoopRun + 1996
26  CoreFoundation                	       0x19e801284 CFRunLoopRunSpecific + 588
27  GraphicsServices              	       0x1eba3d4c0 GSEventRunModal + 164
28  UIKitCore                     	       0x1a1346674 -[UIApplication _run] + 816
29  UIKitCore                     	       0x1a0f6ce88 UIApplicationMain + 340
30  Instagram                     	       0x102635550 XPluginsGetListLookupDataPair + 49200
31  dyld                          	       0x1c4a41de8 start + 2724

Additionally, I tried to test the app on iOS 15.8.3, registration was successful, but the registration flow was different. As a result, after the account was created, it was marked as "spam". Thus, due to the lack of the latest iOS APIs in outdated versions of the system, instagram marks such accounts as "spam".

In other words, the strategy of launching a current client on an outdated version of iOS is not suitable for client research, because instagram reacts differently to such users.

This is definitely not related to user data by the type of IP address or mail / phone number used during registration, because the registration flow with the same user data in the App Store client version was successful and after registration the account was not limited in any way.

Thus, to achieve the best results in client research, it is necessary to run the client on the actual version of iOS.

Please clarify, would you be interested in developing the repository, bypassing the cause of such crashes?

Or do you have any ideas based on personal experience how this could be circumvented? In this case, using your experience, I could implement a bypass on my own and suggest a PR so that this bypass would be publicly available in the future.

Thanks!

[culturally]

Maybe use some tweaks on the older device to spoof your hardware, unfortunately these crashes are kinda "random" it's not really issue with the bypass so i can't really developer a bypass for that maybe in the future i will include frida script.

[PurpleTape]

Unfortunately, I can't just change the model props of the old device so that the instagram client perceives it as more modern, because it doesn't make sense since the old versions of iOS don't have system components from the actual versions of iOS.

How it works now:

• Instagram is suspicious of such a user and marks them as "spam" if you use a device with outdated iOS, which does not provide a full experience in researching the Instagram client.
• if you use a device with actual iOS, then instagram trusts such a user and does not limit his actions.

Thus, to get the best experience of researching the instagram client, there is a need to use the actual versions of iOS.

The problem described in the initial message occurs in the same place and is fully reproducible. According to the trace log, the client executes the startCloudIDValidationWithNetworker function, which accesses the CloudKit API, where an exception occurs.

I can assume that handling startCloudIDValidationWithNetworker via Frida could have prevented accessing the CloudKit API, but I don't have enough experience with this tool.

If you have an iOS 18 device, you can go through the registration flow to replay the crash. The crash occurs at the user first last name input step.

What do you think about this?

[culturally]

Then you could just use mitmproxy to replace useragent and post data. I could maybe try to fix the CloudKit but it's not planned and i won't probably have time for it

[PurpleTape]

Hello!
Please specify whether you plan to publish in the repository the code of the SSL pinning bypass solution, which is used to patch the Instagram client? Thanks to your experience, it would be possible to patch the client myself, without waiting for the release of the updated client from you, if you don't have enough free time

[culturally]

It's assembly not code. I'm probably never uploading any code or anything related to it only ipas