0x10396e7e0 Driver!+[XYBaseRequestHeader headerKeyValuesWithRequestUrl:hsnssign:]#

0x10396E42C

id __cdecl -[XYBaseRequestHeader hsignBeforeMD5Encryption](XYBaseRequestHeader *self, SEL a2)
{
  void *v3; // x0
  void *v4; // x0
  void *v5; // x0
  void *v6; // x0
  void *v7; // x0
  void *v8; // x0
  void *v9; // x0
  void *v10; // x0
  void *v11; // x0
  void *v12; // x0
  id v13; // x22
  void *v14; // x0
  void *v15; // x0
  void *v16; // x0
  void *v17; // x0
  id v18; // x23
  void *v19; // x0
  id v20; // x24
  void *v21; // x0
  id v22; // x25
  void *v23; // x0
  id v24; // x26
  void *v25; // x0
  id v26; // x28
  void *v27; // x0
  id v28; // x19
  void *v29; // x0
  id v30; // x0
  id v31; // x21
  id v33; // [xsp+50h] [xbp-D0h]
  id v34; // [xsp+60h] [xbp-C0h]
  id v35; // [xsp+68h] [xbp-B8h]
  id v36; // [xsp+70h] [xbp-B0h]
  id v37; // [xsp+80h] [xbp-A0h]
  id v38; // [xsp+88h] [xbp-98h]
  id v39; // [xsp+90h] [xbp-90h]
  id v40; // [xsp+98h] [xbp-88h]
  id v41; // [xsp+A0h] [xbp-80h]
  id v42; // [xsp+A8h] [xbp-78h]
  id v43; // [xsp+B0h] [xbp-70h]
  id v44; // [xsp+B8h] [xbp-68h]
  id v45; // [xsp+C0h] [xbp-60h]

  v3 = sub_103CF5B60(self, a2);                 // _objc_msgSend(a1, "happver");
  v43 = objc_retainAutoreleasedReturnValue(v3);
  v4 = sub_103CEC340(self);                     // _objc_msgSend(a1, "getSignStr:");
  v38 = objc_retainAutoreleasedReturnValue(v4);
  v5 = sub_103CFA920(self);                     // _objc_msgSend(a1, "himei");
  v42 = objc_retainAutoreleasedReturnValue(v5);
  v6 = sub_103CEC340(self);                     // _objc_msgSend(a1, "getSignStr:");
  v45 = objc_retainAutoreleasedReturnValue(v6);
  v7 = sub_103CEC340(self);                     // _objc_msgSend(a1, "getSignStr:");
  objc_retainAutoreleasedReturnValue(v7);
  v8 = sub_103CEC340(self);
  v44 = objc_retainAutoreleasedReturnValue(v8);
  v9 = sub_103CFB620(self);                     // _objc_msgSend(a1, "hos");
  v41 = objc_retainAutoreleasedReturnValue(v9);
  v10 = sub_103CEC340(self);
  v35 = objc_retainAutoreleasedReturnValue(v10);
  v11 = sub_103CFB860(self);                    // _objc_msgSend(a1, "hosver");
  v39 = objc_retainAutoreleasedReturnValue(v11);
  v12 = sub_103CEC340(self);
  v13 = objc_retainAutoreleasedReturnValue(v12);
  v14 = sub_103CFBD80(self);                    // _objc_msgSend(a1, "hpath");
  v37 = objc_retainAutoreleasedReturnValue(v14);
  v15 = sub_103CEC340(self);
  v34 = objc_retainAutoreleasedReturnValue(v15);
  v16 = sub_103CFBDA0(self);                    // _objc_msgSend(a1, "hproductid");
  v36 = objc_retainAutoreleasedReturnValue(v16);
  v17 = sub_103CEC340(self);
  v18 = objc_retainAutoreleasedReturnValue(v17);
  v19 = sub_103CFBDC0(self);                    // _objc_msgSend(a1, "hr");
  v20 = objc_retainAutoreleasedReturnValue(v19);
  v21 = sub_103CEC340(self);
  v22 = objc_retainAutoreleasedReturnValue(v21);
  v23 = sub_103CFBE20(self);                    // _objc_msgSend(a1, "htime");
  v24 = objc_retainAutoreleasedReturnValue(v23);
  v25 = sub_103CEC340(self);
  v26 = objc_retainAutoreleasedReturnValue(v25);
  v27 = sub_103CFBE00(self);                    // _objc_msgSend(a1, "hsignSuffix");
  v28 = objc_retainAutoreleasedReturnValue(v27);
  v29 = sub_103CEC340(self);
  v33 = objc_retainAutoreleasedReturnValue(v29);
  v30 = sub_103E3E760(&OBJC_CLASS___NSString);  // _objc_msgSend(a1, "stringWithFormat:");
  v40 = objc_retainAutoreleasedReturnValue(v30);
  objc_release(v33);
  objc_release(v28);
  objc_release(v26);
  objc_release(v24);
  objc_release(v22);
  objc_release(v20);
  objc_release(v18);
  objc_release(v36);
  objc_release(v34);
  objc_release(v37);
  objc_release(v13);
  objc_release(v39);
  objc_release(v35);
  objc_release(v41);
  objc_release(v44);
  objc_release(v31);
  objc_release(v45);
  objc_release(v42);
  objc_release(v38);
  objc_release(v43);
  return objc_autoreleaseReturnValue(v40);
}

hook

// -[XYBaseRequestHeader hsignBeforeMD5Encryption](XYBaseRequestHeader *self, SEL a2)
// Frida script to call getter methods on an object

// Get a handle for the target method
var targetMethod = ObjC.classes.XYBaseRequestHeader['- hsignBeforeMD5Encryption'];

Interceptor.attach(targetMethod.implementation, {
    /**
     * Called when the method is entered.
     * We will call the object's own methods to get the component strings.
     */
    onEnter: function (args) {
        console.log("\n[+] Intercepted -[XYBaseRequestHeader hsignBeforeMD5Encryption]");
        
        // Get a handle to the 'self' object instance
        const self = ObjC.Object(args[0]);

        // This object will store the individual string values we read
        const signatureComponents = {};
        
        // This is the list of getter methods we identified from your pseudocode
        const getterMethods = [
            "happver",
            "himei",
            "hos",
            "hosver",
            "hpath",
            "hproductid",
            "hr",
            "htime",
            "hsignSuffix"
        ];

        console.log("Reading component strings from the 'self' object:");
        
        // Loop through the list of method names and call each one on 'self'
        getterMethods.forEach(function(methodName) {
            // Check if the method exists before calling it to prevent errors
            if (self[methodName]) {
                const result = self[methodName](); // e.g., self.happver()
                // Convert the result (likely an NSString) to a readable string
                signatureComponents[methodName] = result ? result.toString() : "null";
            } else {
                signatureComponents[methodName] = "method not found";
            }
        });

        // Print all the collected component strings in a clean JSON format
        console.log(JSON.stringify(signatureComponents, null, 2));
    },

    /**
     * Called when the method is about to return.
     * 'retval' is the final, assembled string.
     */
    onLeave: function (retval) {
        if (!retval.isNull()) {
            const finalString = ObjC.Object(retval).toString();
            console.log("\n[✅] Final string returned by the method:");
            console.log(finalString);
        } else {
            console.log("\n[-] Method returned nil.");
        }
        console.log("--------------------------------------------------");
    }
});

[+] Intercepted -[XYBaseRequestHeader hsignBeforeMD5Encryption]
Reading component strings from the 'self' object:     
{
  "happver": "17.4.0",
  "himei": "f7d80f1550c82ea9bceacef128b70dc9f70f599e",
  "hos": "ios",
  "hosver": "15.8.1",
  "hpath": "https://user.ksedt.com/api/login/v2",
  "hproductid": "3",
  "hr": "335580",
  "htime": "1756675077215",
  "hsignSuffix": "hZLJ3qzMgFK25A2S"
}

[✅] Final string returned by the method:
17.4.0_f7d80f1550c82ea9bceacef128b70dc9f70f599e___ios_15.8.1_https://user.ksedt.com/api/login/v2_3_335580_1756675077215_hZLJ3qzMgFK25A2S

Based on the code you’re analyzing, himei is a custom-named method that retrieves a unique device identifier. The h is likely a developer-specific prefix, and imei stands for IMEI.

Conclusion#

In short, the himei method is the app’s internal way of getting a unique device identifier to include in its security signature. While it’s named after the old IMEI standard, on a modern iPhone, it’s actually fetching a more private, temporary identifier like the IDFV.

The “Encryption” Function (sub_10396DACC)#

Let’s trace the logic to see how the value for hext-union is created:

1. Filtering Data: The code iterates through a dictionary. It picks out specific key-value pairs and puts them into a new dictionary called v12.
2. JSON Conversion: It then converts this new dictionary (v12) into a JSON string by calling sub_103D296E0 (which corresponds to [v12 jx_toJsonString]).
3. Transformation/Encryption: This JSON string is then passed as an argument to sub_10396DACC. This function is the one that performs the actual transformation, hashing, or “encryption.”
4. Setting the Value: The result from sub_10396DACC is then set back into the main dictionary using hext-union as the key.

So, the function you’re looking for is sub_10396DACC. Its input is a JSON string of filtered parameters, and its output is the final value for the hext-union key.

Why “hext-union” is Missing from the Pseudocode#

This is a classic reverse engineering scenario where the assembly tells a clearer story than the decompiled C code.

The Assembly Code Provides the Proof:

Your assembly view clearly shows the string being used twice:

1. First Use (The Check):

   Code snippet

   __text:000000010396DC40 ADRL  X2, cfstr_HextUnion ; "hext-union"
   __text:000000010396DC48 BL    sub_103CA5A80
   

   Here, the address of the string "hext-union" is loaded into the X2 register right before calling sub_103CA5A80 (containsObject:). In the ARM64 calling convention, X2 is the first argument to the method. So this is equivalent to [v7 containsObject:@"hext-union"]. The decompiler missed this.

2. Second Use (Setting the Value):

   Code snippet

   __text:000000010396DDCC ADRL  X3, cfstr_HextUnion ; "hext-union"
   ...
   __text:000000010396DDDC BL    sub_103DED500
   

   Here, the string "hext-union" is loaded into the X3 register. The call is to sub_103DED500 (setObject:forKeyedSubscript:). For this method, X2 holds the object (the value to set) and X3 holds the key. This is equivalent to [dictionary setObject:encryptedValue forKey:@"hext-union"]. The decompiler also failed to represent this constant string.

Summary of the Function’s Purpose#

Putting it all together, the sub_10396DBE0 function does the following:

• It receives a dictionary of parameters.
• It checks if this dictionary already contains the key "hext-union". If it does, it returns the dictionary as is.
• If not, it filters out a subset of the parameters, converts them to a JSON string, “encrypts” that string using sub_10396DACC, and adds the result back to the dictionary under the key "hext-union".

This is a very common pattern for creating a derived parameter, like a signature or a checksum, from other request data before sending it in a network request. The cross-reference (XREF) in your assembly (-[XYBaseRequestHeader headerKeyValues]+240) strongly suggests this function is used to prepare HTTP header values.

// 1. Get the base address of the main application binary.
//    This is crucial because of ASLR (Address Space Layout Randomization).
const baseAddr = Module.findBaseAddress('Driver'); // this name is found by command `frida-ps -Uai`
if (!baseAddr) {
    console.error("Could not find base address for YourAppName. Is the app running?");
} else {
    // 2. Calculate the function's real address in memory.
    //    The address from IDA (0x10396DACC) is the file offset.
    //    We subtract the default image base address (0x100000000) to get the true offset.
    const functionOffset = 0x10396DACC - 0x100000000;
    const targetAddr = baseAddr.add(functionOffset);
    console.log(`[+] Target App Base Address: ${baseAddr}`);
    console.log(`[+] Encryption Function Address: ${targetAddr}`);

    // 3. Use Interceptor to hook the function at its address.
    Interceptor.attach(targetAddr, {
        // This function is called when sub_10396DACC is entered.
        onEnter: function(args) {
            console.log("\n[+] Intercepted call to encryption function!");           
            // The first argument (a1) is in args[0]. It's a pointer to an Objective-C object (id).
            // We can wrap it with ObjC.Object to interact with it.
            const inputString = new ObjC.Object(args[0]);
            // Log the original input (the cleartext JSON string).
            console.log("    [->] Input (Cleartext JSON):", inputString.toString());            
            // You could even save it for later use in onLeave
            this.input = inputString.toString();
        },

        // This function is called when sub_10396DACC is about to return.
        onLeave: function(retval) {
            // The return value is in retval. It's also a pointer to an Objective-C object (id).
            const outputString = new ObjC.Object(retval);
            // Log the original output (the encrypted, Base64-encoded string).
            console.log("    [<-] Output (Encrypted String):", outputString.toString());
        }
    });
}

[+] Target App Base Address: 0x102d04000
[+] Encryption Function Address: 0x106671acc
[Apple iPhone::com.jiaxiao.driveAPP ]->
[+] Intercepted call to encryption function!
    [->] Input (Cleartext JSON): {"himei":"f7d80f1550c82ea9bceacef128b70dc9f70f599e","zxaid":"A01-ZPRKHXiMy6GFjN+mdZRC4PA654J6Pk9h","hcityid":"143","hosver":"15.8.1","zxid":"Z01-1758934824-fkbw7wDLUK6R093X-DE52"}
    [<-] Output (Encrypted String): B5zCEgw3MF1yGl6wHAUHImZGyrDUTGR4u43K_utaU8BadPsWonMhefeE_GYcij0KG2UEDAqTIJNQh1ZSBgPICxcb-9L8it95Ys9OjiJR8V9z1uvUns8vVikFownxpEOjBPv0_EwImE42DIap8IOopbBKHMrc9v4aMxCS7XkvUzKHIj-H7tClmpm45GLrxFsWdGYdBlXNN_qfdnxWQ_sOpYAemBGRoKN3gN4mciLx9puPoMxX37UrcuWheL3y6gj7

so we can dive into the function sub_10396DACC

/**
 * @brief This function encrypts a given string using AES-256 and then Base64-encodes the result.
 * It's the core encryption routine used to generate the value for the "hext-union" parameter.
 *
 * Probable Original Signature:
 * + (NSString *)encryptAndEncodeString:(NSString *)jsonString;
 *
 * @param a1 The input string (expected to be JSON) to be encrypted.
 * @return An AES-256 encrypted, web-safe, Base64-encoded NSString.
 */
id __fastcall sub_10396DACC(void *a1)
{
  id v1; // x20
  void *v2; // x0
  id v3; // x19
  __int64 v4; // x21
  void *v5; // x0
  id v6; // x0
  id v7; // x22
  id v8; // x0
  id v9; // x20
  void *v10; // x21
  id v11; // x0
  id v12; // x23
  id v13; // x0
  id v14; // x24
  void *v15; // x0
  id v16; // x20
  id v17; // x21

  // Retain the input string (a1) for the duration of this function.
  v1 = objc_retain(a1);

  // --- Step 1: Fetch Encryption Key and IV ---
  // Get the secret key by calling a class method on XYBaseRequestHeader.
  v2 = sub_103CCBAC0(&OBJC_CLASS___XYBaseRequestHeader);  // _objc_msgSend([XYBaseRequestHeader class], "encryptSecretKey");
  v3 = objc_retainAutoreleasedReturnValue(v2);          // v3 now holds the secretKey string.

  // Get the secret Initialization Vector (IV) from another class method.
  v5 = sub_103CCBAA0(*(v4 + 1688));                    // _objc_msgSend([XYBaseRequestHeader class], "encryptSecretIv");
  objc_retainAutoreleasedReturnValue(v5);             // The result (secretIv string) is stored in v10/v17.


  // --- Step 2: Convert All Inputs to Raw Data (NSData) ---
  // Convert the input JSON string to an NSData object for encryption.
  v6 = sub_103D29680(v1);                              // _objc_msgSend(v1, "jx_toData");
  v7 = objc_retainAutoreleasedReturnValue(v6);          // v7 now holds the jsonData.
  objc_release(v1); // Original string is no longer needed.

  // Convert the secret key string to NSData.
  v8 = sub_103D29680(v3);
  v9 = objc_retainAutoreleasedReturnValue(v8);          // v9 now holds the keyData.

  // Convert the secret IV string to NSData.
  v11 = sub_103D29680(v10);
  v12 = objc_retainAutoreleasedReturnValue(v11);         // v12 now holds the ivData.


  // --- Step 3: Perform AES-256 Encryption ---
  // This is the core encryption call. It encrypts the jsonData (v7) using the keyData (v9) and ivData (v12).
  v13 = sub_103D28160(v7);                             // _objc_msgSend(v7, "jx_aes256EncryptWithKey:iv:", v9, v12);
  v14 = objc_retainAutoreleasedReturnValue(v13);         // v14 now holds the raw encryptedData.
  objc_release(v12); // ivData is no longer needed.
  objc_release(v9);  // keyData is no longer needed.
  objc_release(v7);  // jsonData is no longer needed.


  // --- Step 4: Base64-Encode the Encrypted Data ---
  // The raw encrypted data is encoded into a web-safe Base64 string for safe transport over HTTP.
  v15 = sub_103E3E1C0(&OBJC_CLASS___GTMBase64);        // _objc_msgSend([GTMBase64 class], "stringByWebSafeEncodingData:padded:", v14, NO);
  v16 = objc_retainAutoreleasedReturnValue(v15);         // v16 now holds the final Base64-encoded string.
  objc_release(v14); // encryptedData is no longer needed.


  // --- Step 5: Cleanup and Return ---
  // Release the originally fetched key and IV strings.
  objc_release(v17);
  objc_release(v3);

  // Return the final, encrypted, and Base64-encoded string.
  return objc_autoreleaseReturnValue(v16);
}

[+] AES Encrypt Call Intercepted
args[0] (Data to encrypt): {length = 179, bytes = 0x7b226869 6d656922 3a226637 64383066 ... 582d4445 3532227d }
            0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
281575880  7b 22 68 69 6d 65 69 22 3a 22 66 37 64 38 30 66  {"himei":"f7d80f
281575890  31 35 35 30 63 38 32 65 61 39 62 63 65 61 63 65  1550c82ea9bceace
2815758a0  66 31 32 38 62 37 30 64 63 39 66 37 30 66 35 39  f128b70dc9f70f59
2815758b0  39 65 22 2c 22 7a 78 61 69 64 22 3a 22 41 30 31  9e","zxaid":"A01
2815758c0  2d 5a 50 52 4b 48 58 69 4d 79 36 47 46 6a 4e 2b  -ZPRKHXiMy6GFjN+
2815758d0  6d 64 5a 52 43 34 50 41 36 35 34 4a 36 50 6b 39  mdZRC4PA654J6Pk9
2815758e0  68 22 2c 22 68 63 69 74 79 69 64 22 3a 22 31 34  h","hcityid":"14
2815758f0  33 22 2c 22 68 6f 73 76 65 72 22 3a 22 31 35 2e  3","hosver":"15.
281575900  38 2e 31 22 2c 22 7a 78 69 64 22 3a 22 5a 30 31  8.1","zxid":"Z01
281575910  2d 31 37 35 38 39 33 34 38 32 34 2d 66 6b 62 77  -1758934824-fkbw
281575920  37 77 44 4c 55 4b 36 52 30 39 33 58 2d 44 45 35  7wDLUK6R093X-DE5
281575930  32 22 7d                                         2"}
args[2] (Keyjx_aes256EncryptWithKey): {length = 16, bytes = 0x3338387a7a6837707734696167307039}
            0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
282dfd9a0  33 38 38 7a 7a 68 37 70 77 34 69 61 67 30 70 39  388zzh7pw4iag0p9
args[3] (IV): {length = 16, bytes = 0x336b796c77676c6d63376d7a66783265}
            0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
282dfc540  33 6b 79 6c 77 67 6c 6d 63 37 6d 7a 66 78 32 65  3kylwglmc7mzfx2e
retval (Encrypted Data): {length = 192, bytes = 0x079cc212 0c37305d 721a5eb0 1c050722 ... e5a178bd f2ea08fb }
            0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
281753750  07 9c c2 12 0c 37 30 5d 72 1a 5e b0 1c 05 07 22  .....70]r.^...."
281753760  66 46 ca b0 d4 4c 64 78 bb 8d ca fe eb 5a 53 c0  fF...Ldx.....ZS.
281753770  5a 74 fb 16 a2 73 21 79 f7 84 fc 66 1c 8a 3d 0a  Zt...s!y...f..=.
281753780  1b 65 04 0c 0a 93 20 93 50 87 56 52 06 03 c8 0b  .e.... .P.VR....
281753790  17 1b fb d2 fc 8a df 79 62 cf 4e 8e 22 51 f1 5f  .......yb.N."Q._
2817537a0  73 d6 eb d4 9e cf 2f 56 29 05 a3 09 f1 a4 43 a3  s...../V).....C.
2817537b0  04 fb f4 fc 4c 08 98 4e 36 0c 86 a9 f0 83 a8 a5  ....L..N6.......
2817537c0  b0 4a 1c ca dc f6 fe 1a 33 10 92 ed 79 2f 53 32  .J......3...y/S2
2817537d0  87 22 3f 87 ee d0 a5 9a 99 b8 e4 62 eb c4 5b 16  ."?........b..[.
2817537e0  74 66 1d 06 55 cd 37 fa 9f 76 7c 56 43 fb 0e a5  tf..U.7..v|VC...
2817537f0  80 1e 98 11 91 a0 a3 77 80 de 26 72 22 f1 f6 9b  .......w..&r"...
281753800  8f a0 cc 57 df b5 2b 72 e5 a1 78 bd f2 ea 08 fb  ...W..+r..x.....

but something seems wrong. the result is different with the one in Charles

so i decided to hook base64

0x1029FEE60

id __cdecl +[GTMBase64 stringByWebSafeEncodingData:padded:](id a1, SEL a2, id a3, bool a4)
{
  __int64 v5; // x21
  id result; // x0
  id v7; // x0
  void *v8; // x0

  sub_103C8A6E0(a3);                            // _objc_msgSend(a1, "bytes");
  sub_103D30280(a3);                            //  _objc_msgSend(a1, "length");
  result = sub_103C7CB40(v5);                   // _objc_msgSend(a1, "baseEncode:length:charset:padded:");
  if ( result )
  {
    v7 = objc_alloc(&OBJC_CLASS___NSString);
    v8 = sub_103D06D40(v7);                     // _objc_msgSend(a1, "initWithData:encoding:");
    result = objc_autorelease(v8);
  }
  return result;
}

if (ObjC.available) {
    console.log("[*] Objective-C runtime available. Attaching hook...");

    try {
        // 1. Get a handle to the target Objective-C method.
        const targetMethod = ObjC.classes.GTMBase64['+ stringByWebSafeEncodingData:padded:'];

        // 2. Use Interceptor to attach to the method's implementation pointer.
        Interceptor.attach(targetMethod.implementation, {
            
            // This function is called when the method is entered.
            onEnter: function (args) {
                console.log("\n[+] Intercepted +[GTMBase64 stringByWebSafeEncodingData:padded:]");

                // --- Accessing Arguments ---
                // args[0] is 'self': the GTMBase64 class object.
                // args[1] is '_cmd': the selector "stringByWebSafeEncodingData:padded:".
                
                // The first REAL argument (the NSData) is at index 2.
                const nsData = new ObjC.Object(args[2]); 
                const dataLength = nsData.length();
                const dataBytes = nsData.bytes();
                
                // The second REAL argument (the boolean 'padded') is at index 3.
                const isPadded = args[3].toInt32() !== 0;

                console.log(`    [->] Input (Plaintext NSData, ${dataLength} bytes, padded: ${isPadded}): 📄`);

                // Print a hexdump of the input data.
                if (dataLength > 0 && dataBytes) {
                    console.log(hexdump(dataBytes, {
                        length: Math.min(dataLength, 256)
                    }));
                }
            },
            
            // This function is called when the method is about to return.
            onLeave: function (retval) {
                // 'retval' holds the return value, which is a pointer to an NSString.
                const retvalString = new ObjC.Object(retval);
                
                console.log("    [<-] Return Value (Base64 NSString): 📜", retvalString.toString());
            }
        });

        console.log("[*] Hook is active. Waiting for the app to call the method...");

    } catch (error) {
        console.error("[!] An error occurred while setting up the hook:", error.message);
    }
} else {
    console.error("[-] Objective-C runtime not available.");
}

[Apple iPhone::com.jiaxiao.driveAPP ]-> [*] Objective-C runtime available. Attaching hook...
[*] Hook is active. Waiting for the app to call the method...
[*] Objective-C runtime available. Attaching hook...
[*] Hook is active. Waiting for the app to call the method...

[+] Intercepted +[GTMBase64 stringByWebSafeEncodingData:padded:]
    [->] Input (Plaintext NSData, 192 bytes, padded: false): 📄
            0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
280efab20  07 9c c2 12 0c 37 30 5d 72 1a 5e b0 1c 05 07 22  .....70]r.^...."
280efab30  66 46 ca b0 d4 4c 64 78 bb 8d ca fe eb 5a 53 c0  fF...Ldx.....ZS.
280efab40  5a 74 fb 16 a2 73 21 79 f7 84 fc 66 1c 8a 3d 0a  Zt...s!y...f..=.
280efab50  1b 65 04 0c 0a 93 20 93 50 87 56 52 06 03 c8 0b  .e.... .P.VR....
280efab60  17 1b fb d2 fc 8a df 79 62 cf 4e 8e 22 51 f1 5f  .......yb.N."Q._
280efab70  73 d6 eb d4 9e cf 2f 56 29 05 a3 09 f1 a4 43 a3  s...../V).....C.
280efab80  04 fb f4 fc 4c 08 98 4e 36 0c 86 a9 f0 83 a8 a5  ....L..N6.......
280efab90  b0 4a 1c ca dc f6 fe 1a 33 10 92 ed 79 2f 53 32  .J......3...y/S2
280efaba0  87 22 3f 87 ee d0 a5 9a 99 b8 e4 62 eb c4 5b 16  ."?........b..[.
280efabb0  74 66 1d 06 55 cd 37 fa 9f 76 7c 56 43 fb 0e a5  tf..U.7..v|VC...
280efabc0  80 1e 98 11 91 a0 a3 77 80 de 26 72 22 f1 f6 9b  .......w..&r"...
280efabd0  8f a0 cc 57 df b5 2b 72 e5 a1 78 bd f2 ea 08 fb  ...W..+r..x.....
    [<-] Return Value (Base64 NSString): 📜 B5zCEgw3MF1yGl6wHAUHImZGyrDUTGR4u43K_utaU8BadPsWonMhefeE_GYcij0KG2UEDAqTIJNQh1ZSBgPICxcb-9L8it95Ys9OjiJR8V9z1uvUns8vVikFownxpEOjBPv0_EwImE42DIap8IOopbBKHMrc9v4aMxCS7XkvUzKHIj-H7tClmpm45GLrxFsWdGYdBlXNN_qfdnxWQ_sOpYAemBGRoKN3gN4mciLx9puPoMxX37UrcuWheL3y6gj7

I finally remembered to use hexdump, not from hex lol. never mind XD this shit waste me about three hours :angry::punch: