We explore the process of analyzing an Android mobile game within the scope of bug bounty research. We demonstrate how to bypass common anti-debugging and anti-instrumentation mechanisms, and how we apply hooking techniques to uncover vulnerabilities in the client-to-server communication.

After outlining the tools and methodology used to approach the target, we present a selection of our successful findings and provide a deeper discussion of their technical details and security impact.