Skip to content

Intercepting and Redirecting API Traffic (Android - Rooted)

Warning

Developer Only / For Advanced Users This method is intended strictly for developers and advanced users with sufficient technical knowledge of network protocols and system administration. It is not recommended for general players, as incorrect configuration can compromise your device's security or stability.

Note

Connection Endpoints & Offset Hashes For the specific domain names, custom server addresses, or required binary offsets needed for setup, please refer to endpoints.md.

This approach decrypts HTTPS traffic locally and rewrites API and asset server domains in-flight. Although this workflow requires advanced networking knowledge and custom Root CA certificate installations, it provides the most seamless user experience. Once configured, players can launch the KRFN application directly from their home screen without opening any helper launcher or browser. (Note: Root access via Magisk/KernelSU/APatch is strictly required to implement this on Android due to system certificate trust policies).

This guide describes how to intercept and perform Man-in-the-Middle (MITM) redirection of Android network traffic on a rooted device. This allows you to seamlessly reroute game API and asset requests from the official production servers to your custom Sparkle server.

Traffic Redirection Flow

Here is the general architecture of how traffic from your Android device is intercepted, decrypted via MITM, or mapped directly to your custom server:

flowchart TD
    Client["Android Client (KRFN)"] --> Resolve["DNS Resolution or Proxy Interception"]

    Resolve --> Proxy
    Resolve --> Hosts

    subgraph Proxy_Decryption["Method 1 and 3: Proxy Decryption"]
        Proxy["MITM Proxy Service (Reqable or Charles)"] --> Decrypt["Intercept and Decrypt with SSL Proxying"]
        Decrypt --> Match1["Rewrite Rules: Redirect URL or Host to Custom Server"]
    end

    subgraph Systemless_Hosts["Method 2: Systemless Hosts (Recommended)"]
        Hosts["Systemless Hosts File Mapping under /system/etc/hosts"] --> Match2["Direct DNS Resolving to IP"]
    end

    Match1 --> SparkleAPI["Custom Sparkle API Server (HTTPS or HTTP)"]
    Match2 --> SparkleAPI

The Android SSL/TLS Constraint (Rooted Device Required)

Important

Android 7.0 (API Level 24) and later enforces strict network security policies. By default, applications do not trust user-installed Custom Root Certificate Authorities (CAs). If you only install the proxy's CA certificate on your device, the game client will immediately throw an SSL/TLS handshake error and fail to connect.

Because of this, you must have a Rooted Android device (via Magisk, KernelSU, or APatch) to perform MITM or DNS redirection. Non-rooted methods (such as patching the APK) are unstable and not supported.

Steps to Systemize your CA Certificate

To make the game client trust your custom CA certificate, you must force Android to treat it as a system-level certificate (System CA), which is trusted by all applications by default.

  1. Ensure your device is rooted with Magisk, KernelSU, or APatch.
  2. Download and install a Magisk module that automatically moves user-installed certificates to the system store, such as AlwaysTrustUserCerts or Move Certificates (available on GitHub).
  3. Install your proxy's CA certificate (e.g., Reqable or Charles) on your Android device as a user certificate:
    • Go to system Settings -> Security -> More Security Settings -> Encryption & Credentials -> Install a Certificate -> CA Certificate.
    • Select your proxy's CA certificate file and confirm the installation.
  4. Reboot your device. The Magisk module will automatically move the certificate to /system/etc/security/cacerts/.
  5. Verify the installation: Go to Settings -> Encryption & Credentials -> Trusted Credentials -> System tab, and ensure your proxy's CA certificate is listed there.

Method 1: On-Device HTTPS Redirection via Reqable

Reqable is a modern, high-performance HTTP/HTTPS debugging proxy for Android. It operates as a local VPN service, allowing you to perform SSL decryption and rewrite rules entirely on-device.

Prerequisites for Method 1

  • A rooted Android device with the system CA installed (see The Android SSL/TLS Constraint).
  • Reqable installed (available on Google Play or their official website).
  • A custom API server setup (IP address or domain name ready).

Step-by-Step Configuration

Step 1: Initialize Reqable and Systemize CA Certificate

  1. Open Reqable on your Android device.
  2. Complete the initial wizard. When prompted, tap Install Certificate to generate the Reqable Root CA.
  3. Follow the on-screen instructions to save and install the certificate in your system settings.
  4. Reboot your device so the Magisk module can promote the Reqable CA to a System CA.

Step 2: Configure Rewrite Rules

Reqable's "Rewrite" feature allows you to redirect production domains to your custom Sparkle server in-flight.

  1. In Reqable, tap the menu icon and navigate to Tools -> Rewrite.
  2. Tap the toggle to Enable Rewrite.
  3. Create a new Rewrite Rule Group (e.g., "Sparkle Server") and enable it.
  4. Tap Add Rule to create the API redirection rule:
    • Name: Sparkle API Redirect
    • Matching Condition:
      • Protocol: https
      • Host: krr-prd.star-api.com
    • Action: Select Redirect or Replace Host.
      • Target Protocol: http (or https if your custom server supports SSL)
      • Target Host: <your-custom-server-ip>
      • Target Port: Your custom server port (e.g., 80 or 443)
  5. If your asset bundles are hosted elsewhere, add another rule for the assets:
    • Name: Sparkle Assets Redirect
    • Matching Condition:
      • Protocol: https
      • Host: asset-krr-prd.star-api.com
    • Action: Select Redirect or Replace Host.
      • Target Protocol: http (or https)
      • Target Host: <your-asset-server-ip>
      • Target Port: Your asset server port
  6. Save the rules.

Step 3: Start the Proxy Connection

  1. Go to the main screen of Reqable.
  2. Tap the Start button (the shield/VPN icon at the bottom).
  3. Allow Android to set up the local VPN profile if prompted.
  4. Open the game client. All API connections will now be seamlessly intercepted and rerouted to your custom server! 🎉

This is the most efficient, stable, and battery-friendly method. Instead of running a heavy proxy or local VPN service in the background (which can easily get killed by Android's memory manager or deplete your battery), you can map the game domains directly to your custom server IP using the Android system hosts file.

Important

Because you are redirecting traffic at the DNS level (mapping the domain name directly to a custom IP), the game client will still establish a secure HTTPS connection to krr-prd.star-api.com.

  1. You must ensure your custom Sparkle server is running on HTTPS (port 443).
  2. You must generate an SSL certificate for *.star-api.com (or krr-prd.star-api.com), configure your custom server to use it, and install + systemize this SSL certificate's Root CA on your Android device using the Magisk method described above.

If your custom server only supports plain HTTP, please use Method 1 or Method 3, as they can dynamically rewrite https:// requests to http:// during the interception.

Prerequisites for Method 2

  • A rooted Android device running Magisk.
  • The "Systemless Hosts" setting enabled in Magisk.
  • A custom Sparkle server listening on HTTPS port 443 with a valid SSL certificate (matching krr-prd.star-api.com).
  • The custom SSL Root CA certificate systemized on the Android device.

Step-by-Step Configuration

Step 1: Enable Systemless Hosts in Magisk

  1. Open the Magisk app on your Android device.
  2. Tap the gear/settings icon in the top-right corner.
  3. Scroll down to the Magisk section and tap Systemless Hosts.
    • (Magisk will automatically create and enable the Systemless Hosts module.)
  4. Reboot your device to mount the systemless hosts filesystem.

Step 2: Install a Hosts Editor App

To easily and safely edit the hosts file on your Android device, use a dedicated hosts editor.

  1. Download a hosts editor app (e.g., Hosts Editor by cyansmoke or AdAway configured for custom redirects) from Google Play, F-Droid, or GitHub.
  2. Open the app and grant Root (Superuser) permissions when prompted.

Step 3: Add Hostname Redirection Rules

  1. Open your Hosts Editor app.
  2. Tap the Add Host button (usually a + icon).
  3. Enter the mapping rule for the API server:
    • IP Address: <your-custom-server-ip> (Replace with your custom server's IP address)
    • Hostname: krr-prd.star-api.com
  4. Tap Add or Save.
  5. Add another mapping rule for the assets (if hosted on the same custom server):
    • IP Address: <your-custom-server-ip>
    • Hostname: asset-krr-prd.star-api.com
  6. Tap Add or Save.
  7. Close the app. The system will immediately start routing all requests to these domains directly to your custom server IP without running any background helper apps! 🚀

Method 3: PC-Based Redirection via Charles Proxy

Charles Proxy is a cross-platform HTTP/HTTPS debugging proxy server. This method intercepts your Android traffic by routing it through your PC on the same Wi-Fi network.

Prerequisites for Method 3

  • A PC running Windows, macOS, or Linux with Charles Proxy installed.
  • An Android device connected to the same Wi-Fi network as your PC.
  • A rooted Android device with the system CA installed (see The Android SSL/TLS Constraint).

Step-by-Step Configuration

Step 1: Find your PC's Local IP Address

  1. On your PC, open a command prompt (cmd or PowerShell) and run: 
    ipconfig
  2. Note your local IP address under the active Wi-Fi adapter (e.g., 192.168.1.15).

Step 2: Configure Android Wi-Fi Proxy

  1. On your Android device, open the system Settings -> Network & Internet -> Internet (or Wi-Fi).
  2. Tap the gear/info icon next to the active Wi-Fi network you are connected to, then tap Edit (pencil icon).
  3. Expand Advanced options, change Proxy to Manual.
  4. Enter the following details:
    • Proxy hostname: Your PC's local IP address (e.g., 192.168.1.15)
    • Proxy port: 8888 (default Charles Proxy port)
  5. Tap Save.

Step 3: Download and Install Charles Root Certificate

  1. Open Charles Proxy on your PC.
  2. Upon enabling the proxy on your Android device, Charles will show a pop-up prompt asking to allow the connection. Click Allow.
  3. On your Android device, open Chrome or another browser and navigate to: 
    chls.pro/ssl
  4. The browser will automatically download the Charles certificate file.
  5. Open Android system Settings -> Security -> More Security Settings -> Encryption & Credentials -> Install a Certificate -> CA Certificate.
  6. Select the downloaded Charles certificate file and confirm the installation.
  7. Reboot your device so the Magisk module can promote the Charles certificate to a System CA.

Step 4: Configure SSL Proxying in Charles

  1. In Charles Proxy on your PC, go to the top menu and select Proxy -> SSL Proxying Settings.
  2. Check the Enable SSL Proxying box.
  3. Under Include, click Add and enter the game domains:
    • Host: krr-prd.star-api.com (Port: 443)
    • Host: asset-krr-prd.star-api.com (Port: 443)
  4. Click OK to apply.

Step 5: Map Remote to Custom Server

  1. Go to Tools -> Map Remote in the top menu of Charles.
  2. Check the Enable Map Remote box.
  3. Click Add to create the API mapping rule:
    • Map From:
      • Protocol: https
      • Host: krr-prd.star-api.com
      • Port: 443
    • Map To:
      • Protocol: http (or https)
      • Host: Your custom server IP or domain (e.g., 192.168.1.100)
      • Port: Your custom server port (e.g., 80 or 443)
  4. Repeat the process to add a mapping rule for the asset host if your assets are hosted elsewhere.
  5. Click OK. Launch your game client on your Android device. All traffic will now be mapped remote to your custom server.

Troubleshooting and FAQ

Q: Why does the game client show a "Network Error" immediately upon boot?

Ensure you have completed the SSL bypass steps correctly. Without systemizing your proxy's CA certificate via Magisk, the OS will reject the TLS connection.

  1. Verify that your custom/proxy CA certificate is listed under Trusted Credentials -> System tab in Android settings (not just the User tab).
  2. If using Method 2 (Systemless Hosts), verify that your custom server is running on HTTPS port 443 and using the correct SSL certificate matching krr-prd.star-api.com. If your custom server is HTTP-only, Method 2 will fail because the game client will attempt to initiate an HTTPS handshake. For HTTP-only servers, use Method 1 or Method 3.

Q: Does KRFN v3.6.0 require SSL Pinning bypasses?

The v3.6.0 client does not enforce strict native SSL Pinning checks (such as hardcoded certificate hashes inside the app binary). It relies entirely on standard system trust stores. Therefore, as long as your custom root CA certificate is recognized as a trusted Root CA (via the Magisk module), the client will connect successfully without needing Xposed bypasses like TrustMeAlready.

Q: Can I run this configuration on an Android Emulator?

Yes, Android emulators (like BlueStacks, LDPlayer, or Nox) make this workflow even easier.

  • Most emulators can be easily rooted in their settings. This makes Magisk installation and systemizing the CA certificate extremely simple.
  • You can use Method 1 (Reqable) inside the emulator, Method 2 (Systemless Hosts) via built-in root access, or route the emulator's network through your PC's Charles Proxy (Method 3).