The premise

Over the past few weeks, I've been DIYing some of the apps that I use a decent bit but, for one reason or another, don't think are very good.

An app like Gmail or another social media service is definitely out of scope. I’m referring to apps you might use once or twice a day to do something very specific, like controlling a light switch.

Some of the apps that I DIY’d (spoiler: not all of them worked):

ButterflyMX

This one is a big pain point for me. My building recently moved over to using ButterflyMX from a keyfob system and, while I've seen worse mobile apps, it often feels like it takes three or four seconds to load, and it’s poorly designed.

I rebuilt the door-opening flow as LatchMX.

Beli

This is a really good restaurant rating app, but they don’t have a web client.

I built a web client and a Chrome extension that adds Beli scores to Google Maps.

Segway Mobility (didn’t work)

The app was too slow to open when the immediate task was locking a scooter.

I built a Scoot prototype around fast lock and unlock controls, but never finished reliable Bluetooth control.

Eight Sleep (worked)

About $200 a year for software controls on already-owned hardware felt wrong.

I built 9awake to run Pod temperature schedules without Premium.

The process

Cut the scope before writing code.

It's very easy for these rewrites to expand scope unnecessarily and create a lot of burden. For instance, if you were targeting web, iOS, and Android, you would have a lot more surface area to QA.

For my ButterflyMX rewrite in particular, scoping it to just the keys was helpful.

Find the API contract

The first thing to figure out is the auth scheme and API contract.

Chances are someone might have already created an unofficial SDK, CLI, or integration for that particular app.

I found Peter Steinberger's eightctl, for instance, which was really good for figuring out the auth scheme and how the contract worked.

I also found someone's Beli MCP, which I used as an initial cut. Unfortunately, it was not fully fleshed out. Some of the output types were not great, and there were endpoints that I definitely needed that weren't added.

The easiest way to do this is to pull the website if they have one, but they almost always don’t have one.

Your best hope is if the app has an Android version and you can find the APK.

The APK is a godsend. It'll tell you a lot about what the API hosts are, all the endpoint paths, and the payload shapes. It'll also tell you how to handle auth and even if it's viable to begin with.

One other thing that's nice about mobile apps is that the API often stays compatible with older app versions because companies don't want to break clients that haven't updated. That is an incentive, not a guarantee.

What if it’s Apple only?

If the app is iOS only, you have two approaches that you can take here.

Dig through the app code

You can use ipatool to download the IPA. You'll need to sign in to the CLI. Apple's FairPlay DRM still encrypts the native executable, but you can inspect metadata and many bundled assets.

React Native apps may ship a separate JavaScript or Hermes bundle. That can be easier to trace than native code, but it is still code, and it is not guaranteed to be plain readable JavaScript.

Proxy traffic

You can do this by installing and trusting mitmproxy's local CA on your phone, then routing the phone's traffic through the proxy. mitmproxy issues certificates for the connections it intercepts so it can display the requests and responses.

Apps that use certificate pinning may reject the connection. You can pass noisy or pinned domains through with mitmproxy's ignore-hosts configuration, but there is no need to whitelist all Apple and iCloud domains by default.

This is helpful for mapping actions in the app to endpoints, payloads, and authentication headers. It does not reveal the app's code.

Some apps are much more locked down. My Segway effort hit a NetEase-derived encrypted cloud authentication flow, while local scooter control used a separate encrypted Bluetooth protocol.

Building the client

I’ve long been a fan of using Cloudflare for miscellaneous backend services, and these projects were no exception. It was a breeze to set things up here.

Generating assets for mobile was trivial thanks to Grok Image and Imagine. I happened to have some credits, so I could generate a bunch of different graphical ideas. I was particularly proud of the icon for the Segway clone app:

I used video generation to generate a loader icon as well for Latch.

A warning

Reverse engineering is against the terms of service for a lot of these apps. Beli banned my account after I shared the extension, although I can't prove that was the reason. If you do try this, use a dummy account to limit the risk to your main one. That still does not make prohibited activity permitted. (Beli, please restore my account!)

A lot of this veers closely into security research territory, even if the intent is just trying to create alternative clients. OpenAI filed two warnings to my account for some of this work :(.