Skip to content

Intercepting and Redirecting API Traffic (iOS)

Warning

Developer Only / For Advanced Users This method is intended strictly for developers and advanced users with sufficient technical knowledge of network protocols and system administration. It is not recommended for general players, as incorrect configuration can compromise your device's security or stability.

Note

Connection Endpoints & Offset Hashes For the specific domain names, custom server addresses, or required binary offsets needed for setup, please refer to endpoints.md.

Note

No Launcher App for iOS Because there is no client-side launcher application (like Android's Launcher SAF) available for iOS, network-level traffic redirection (MITM) is the only method to connect the iOS game client to a custom server.

This approach decrypts HTTPS traffic locally and rewrites API and asset server domains in-flight. Although this workflow requires advanced networking knowledge and custom Root CA certificate installations, it provides the most seamless user experience. Once configured, players can launch the KRFN application directly from their home screen without opening any helper launcher or browser.

This guide describes how to intercept and perform Man-in-the-Middle (MITM) redirection of iOS network traffic, allowing you to seamlessly reroute game API requests from the official production servers to your custom Sparkle server.

Warning

This setup requires installing a custom Root Certificate Authority (CA) on your iOS device. Only install certificates generated by tools you trust (e.g., your own instance of Proxyman or Charles). Never install untrusted third-party certificates.

Traffic Redirection Flow

Here is the general architecture of how traffic from your iOS device is intercepted, decrypted via MITM, and mapped to the custom server:

flowchart TD
    Client["iOS Client<br>(KRFN)"] -->|HTTPS Requests| Proxy["MITM Proxy Service<br>(Proxyman / Charles)"]
    Proxy -->|Decrypts Traffic using Custom CA| Decrypt["Intercept & Decrypt<br>(SSL Proxying Enabled)"]
    Decrypt -->|Rewrite API / Asset Hostnames| Match["Rewrite Matching Rules"]
    Match -->|Redirected API Requests| SparkleAPI["Custom Sparkle API Server<br>(https://sparkle-api.com)"]
    Match -->|Redirected Asset Requests| SparkleAsset["Custom Asset Server<br>(https://sparkle-assets.com)"]

Proxyman is a free, high-performance web debugging proxy tool available for iOS. While the free version limits you to enabling one active Map Local (Mock Response) rule at a time, this is completely sufficient for routing traffic to a custom server.

By mocking only the app version check endpoint (GET /api/app/version/get) and returning an APPLYING (resultCode: 2) response containing your custom server's URL, the client will dynamically redirect all subsequent API and asset calls to your custom server. This eliminates the need for setting up multiple rewrite rules and allows full utilization of the free version.

Prerequisites for Method 1

  • An iOS device running iOS 15.0 or later.
  • Proxyman for iOS installed (available for free on the App Store).
  • A custom Sparkle API/Asset server URL.

Step-by-Step Configuration

Step 1: Install and Trust the Proxyman CA Certificate

  1. Open Proxyman on your iOS device.
  2. Follow the setup prompt to allow Proxyman to configure a local VPN profile (used to intercept local loopback and outbound traffic).
  3. In the Proxyman settings, tap Certificate -> Install Proxyman CA Certificate to this device and download the profile.
  4. Open the iOS system Settings app.
  5. Tap the Profile Downloaded banner near the top. (Or navigate to General -> VPN & Device Management -> select Proxyman CA).
  6. Tap Install in the top-right corner, enter your passcode, and confirm the installation.
  7. Next, navigate to Settings -> General -> About -> Certificate Trust Settings (at the very bottom).
  8. Find the Proxyman CA certificate under "Enable full trust for root certificates" and toggle the switch ON, then confirm.

Step 2: Enable SSL Proxying for the Game API Domain

  1. Back in Proxyman, navigate to SSL Proxying.
  2. Add the game API domain: krr-prd.star-api.com to the list.
  3. This allows Proxyman to decrypt and modify secure HTTPS traffic for this domain.

Step 3: Configure Map Local (Mock Response) for Version Check

Now, mock the /api/app/version/get endpoint to return the dynamic override configurations.

  1. In Proxyman, configure a Map Local rule with the following details:
    • Method: GET
    • URL: https://krr-prd.star-api.com/api/app/version/get
  2. Create the mock response body (JSON) as follows: 
    {
  "resultCode": 2,
  "applyUrl": "https://<your-custom-server-ip>/api/",
  "applys3Url": "https://<your-custom-asset-server-ip>/bundleHash/"
}
    (Replace <your-custom-server-ip> and <your-custom-asset-server-ip> with your actual custom server endpoints. Note that HTTPS is recommended due to iOS cleartext restrictions).
  3. Add the following HTTP response headers in the Map Local settings:
    • Content-Type: application/json
    • kNNHMre7jsDEHFaURYBP: 0 (This informs the client that the response body is non-encrypted, bypassing decryption routines).
    • X-Star-CC: <computed-crc32-checksum>

Warning

X-Star-CC Header Alignment & Auto-Formatting The client performs integrity verification on responses using the X-Star-CC header. If the response JSON body is modified or reformatted (Proxyman has a feature that automatically formats JSON with spaces/indentations), the CRC32 checksum will mismatch, causing the game to crash on startup. You must compute the X-Star-CC value using the exact byte representation of the JSON body returned by Proxyman. To easily calculate the X-Star-CC checksum for your payload, you can use this iOS Shortcut: X-Star-CC Calculation Shortcut (iOS Shortcut)

Step 4: Start the VPN and Open the Game

  1. On the main screen of Proxyman, turn the VPN switch ON.
  2. Open the KRFN game client.
  3. The client requests the app version check, receives the mocked APPLYING (result code 2) response, and automatically switches its target endpoints to your custom server for the rest of the session! 🎉

Method 2: PC-Based Redirection via Charles Proxy / Proxyman

This method intercepts your iOS traffic by routing it through a PC running Charles Proxy or the desktop version of Proxyman on the same Wi-Fi network. This is useful if you prefer to manage rules on your PC or want to inspect traffic on a larger screen.

Prerequisites for Method 2

  • A PC running Windows or macOS with Charles Proxy or Proxyman installed.
  • An iOS device connected to the same Wi-Fi network as your PC.

Step-by-Step Configuration

Step 1: Find your PC's Local IP Address

  1. On your PC, open a command prompt (cmd or PowerShell) and run: 
    ipconfig
  2. Note your local IP address under the active Wi-Fi adapter (e.g., 192.168.1.15).

Step 2: Configure iOS Wi-Fi Proxy

  1. On your iOS device, open the system Settings -> Wi-Fi.
  2. Tap the info icon (i) next to the active Wi-Fi network you are connected to.
  3. Scroll down to the bottom and tap Configure Proxy -> select Manual.
  4. Enter the following details:
    • Server: Your PC's local IP address (e.g., 192.168.1.15)
    • Port: 8888 (default Charles Proxy port)
  5. Tap Save in the top-right corner.

Step 3: Authorize Connection and Install Root Certificate

  1. Open Charles Proxy on your PC.
  2. Upon enabling the proxy on your iOS device, Charles will show a pop-up prompt asking to allow the connection. Click Allow.
  3. On your iOS device, open Safari and navigate to: 
    chls.pro/ssl
  4. A prompt will ask to download the configuration profile. Tap Allow and close Safari.

Step 4: Trust the Charles Root Certificate

  1. Open iOS system Settings -> General -> VPN & Device Management.
  2. Select the Charles Proxy Custom Root Certificate profile and tap Install.
  3. Navigate to Settings -> General -> About -> Certificate Trust Settings.
  4. Find the Charles Proxy certificate and toggle full trust ON.

Step 5: Configure SSL Proxying in Charles

  1. In Charles Proxy on your PC, go to the top menu and select Proxy -> SSL Proxying Settings.
  2. Check the Enable SSL Proxying box.
  3. Under Include, click Add and enter the game API domain:
    • Host: krr-prd.star-api.com
    • Port: 443
  4. Add another entry for the asset domain:
    • Host: asset-krr-prd.star-api.com
    • Port: 443
  5. Click OK to apply.

Step 6: Map Remote to Custom Server

  1. Go to Tools -> Map Remote in the top menu.
  2. Check the Enable Map Remote box.
  3. Click Add to create the API mapping rule:
    • Map From:
      • Protocol: https
      • Host: krr-prd.star-api.com
      • Port: 443
    • Map To:
      • Protocol: http (or https)
      • Host: Your custom server IP or domain (e.g., 192.168.1.100)
      • Port: Your custom server port (e.g., 80 or 443)
  4. Click OK. Launch the KRFN client on your iOS device. Traffic will now be mapped remote to your custom server.

Troubleshooting and FAQ

Q: Why does the game client crash or show a "Network Error" immediately upon boot?

Ensure you have completed both parts of the certificate trust steps on iOS:

  1. Installing the profile in VPN & Device Management.
  2. Enabling Full Trust in Certificate Trust Settings.

Without full trust enabled, the iOS operating system will reject the proxy's TLS certificate, leading to a secure connection failure and preventing the app from launching.

Q: Why does connecting to localhost or local IPs (HTTP) fail?

iOS restricts unencrypted HTTP network traffic by default via App Transport Security (ATS) settings (specifically matching cleartextTrafficPermitted = false). If your applyUrl or applys3Url points to a raw HTTP address like http://localhost or http://127.0.0.1, iOS will block the connection, causing a network error.

  • Solution: Use HTTPS (e.g. https://localhost or https://192.168.x.x). You will need to configure your local custom server to support TLS/HTTPS (e.g. using self-signed certificates) and trust your server's CA certificate on the iOS device.

Q: Does KRFN v3.6.0 require SSL Pinning bypasses?

The v3.6.0 client does not enforce strict native SSL Pinning checks that prevent MITM. It relies on standard system trust stores. Therefore, as long as your custom root CA certificate is fully trusted in your iOS system settings, the client will connect successfully without needing jailbreak tweaks like SSLKillSwitch.

Q: What if I am using an iOS Emulator or virtualized device?

iOS simulators (like the ones included in Xcode on macOS) do not support network interception easily without modifying the macOS system proxy. We strongly recommend using a physical, non-jailbroken iOS testing device as described in the iOS Client Installation Guide.