Unbundling Pokémon Go
tl;dr: on Android, it’s a Unity app, talking HTTPS to the backend, using protobuf over HTTP. Interesting notes about the use of certificate pinning and how they should be doing that
(tags: https http protobuf pokemon-go pokemon apps android reversing)