The JS is right there. The endpoint isn't.

A React Native app ships one JavaScript bundle, usually at assets/index.android.bundle. When the app uses the default JavaScript engine, that bundle is plain text. You can open it, read the fetch calls, and search for the strings that build URLs.

When the app uses Hermes, the bundle is compiled to Hermes bytecode. The strings are still there, but the structure of the functions is not plain JavaScript. Reading the hostnames is easy. Reading the exact signing logic takes more work.

A regex over the bundle catches the obvious hostnames and paths. We then read the code around each match to see how the request is assembled, which header is added, and where the body comes from.

The endpoint is the easy half. The header that the server checks is the part worth finding. React Native apps often build that value in a native module, so the bundle shows the call and the native code shows the signing.

// where the JS builds the call
fetch(BASE + "/v1/orders", {
  method: "POST",
  headers: {
    "Authorization": "Bearer " + token,
    "X-Device-Sig": NativeModules.Signer.sign(body),
  },
  body: body,
});

Fig. 02 · the JS calls Signer.sign, and the native module answers

The JavaScript fetch is a wrapper over the React Native networking module. On Android it lands in OkHttp through a native bridge. That is useful: a React Native app does not invent a new transport, so the server sees a normal HTTP request from a standard client stack.

The bridge is also where the signing hides. We read the native module, find how it builds the value, and reproduce that in the output client. If the value is built in JavaScript instead, we can read it directly from the bundle.

Hermes writes the bundle as bytecode with a known, documented format. A disassembler turns the bytecode back into instruction listings, and the string table stays readable. That recovers the flow and the constants.

Rebuilding the exact semantics from bytecode is more careful work than reading plain JavaScript. It is worth it when the manifest says Hermes, but faster when the bundle has method names that point back to the original source. We read the network behavior either way, and validate the result against the live app.

We read the JS for the shape, then read the native module for the signing, and return one client that does both. The result behaves the way the app behaves, so it keeps working beyond the capture you started with.

# the native module produced X-Device-Sig, so we do the same
body = json.dumps(payload).encode()
dev_sig = base64.b64encode(sign_native(body)).decode()

r = requests.post(
  BASE + "/v1/orders",
  json=payload,
  headers={"Authorization": f"Bearer {token}",
           "X-Device-Sig": dev_sig},
)

Fig. 03 · the React Native request, rebuilt as Python