So I'm confused.. was author just not able to follow thru code path to find that the auth token was just spamming 1's? or was it a bit more cryptic than that?
the real code in the APK for computing the auth_token was probably some developers some pride and joy, worked weeks on it.. but when it came time to ship, damn thing wouldnt work with the shipped hardware.. so they buried a small assignment which overwrote the original computed auth token just to make the thing work? where is THAT code, i'd like to see it! If so, that is one of those great snippets where you can visually see the developer gave up. We should have a name for that sort of thing (I'm guilty of the same.. in my.. older works).