Question about how FreeFire API requests were discovered

[Susil1]

Thanks for sharing your work.
I’m currently a beginner in cybersecurity and reverse engineering, so I’m trying to understand how things like this work.

I had a few questions if you don’t mind:

• How did you capture the Free Fire API requests even though the game normally uses encryption and SSL pinning?
• Did you use tools like Frida, mitmproxy, or Burp Suite to intercept the traffic?
• How did you identify the protobuf structures used in the requests? Did you reverse the APK or extract .proto files from the game?
• How were values like client_secret, client_id, MAIN_KEY, and MAIN_IV discovered? Were they hardcoded in the APK or obtained through runtime analysis?
• Did you reverse engineer the game using tools like JADX / Ghidra / IDA?
• Are there any learning resources or topics you would recommend for someone starting with mobile game traffic analysis and reverse engineering?

I’m not trying to misuse anything — I’m just interested in learning the process behind how these things are discovered.

If you have any resources, write-ups, or tips, I would really appreciate it.

Thanks for your time!