Please get me the invoices 🤖

AI and vibe coding is nothing new to me, but today I finally gave vibe reverse engineering (or better said, reverse vibing?) a try. To scratch an itch I had for a long time: downloading invoices from o2 Business.

There are three mobile contracts in two different accounts on my name for various family members. All via o2 Business, as they offer good conditions for mobile plans that not only work in the EU but also in Switzerland as well. The oldest one is running since 2022. Since then, each month I go to their customer portal to download the invoice and the itemized bill. With three different contracts, it’s a pretty tedious and annoying process, as each login also requires a one-time password via email. And I absolutely hate to manually save each of the six PDFs to the correct place with the correct name.

It’s already been itching me for quite some time, and before AI got more helpful and cheap, I already tried to automate the process a few times. I tried to reverse engineer the requests the frontend is making. I attempted to set up some Playwright-based workflows with n8n, but nothing really worked out. In the end I continued to do it manually.

Until I watched two videos recently about AI and reverse engineering. Kevin Chromik reverse-engineered an app for a Bluetooth-based receipt printer, and The Morpheus talked about reverse-engineered games. GTA runs in the browser before GTA 6. That got me thinking. Can AI finally reverse engineer that damn o2 Business portal?

Seems like it can. For under 1 dollar with DeepSeek V4.1 Flash in just a few minutes.

My first try, as I wanted to see how good REA works, was to let OpenCode with the REA MCP decompile the o2 Business Android app. It didn’t use REA, but simply decided to just use jaxb directly, but after a couple of minutes, it had a Go-based script that also worked with one of the accounts.

Only with one account, but I expected that, as the app also doesn’t show the invoices in the other one. I guess nobody at Telefonica uses their own app?

My second try was to let the AI reverse-engineer the web portal. Apparently it’s based on the “Salesforce Experience Cloud” and it’s not a REST API. As I said, in the past I failed to reverse engineer it myself, but AI was even quicker doing it than it did decompile the Android app. All I had to do was to login and download a few invoices and take the HAR from the browser network console for the AI to analyze. It completed the task without much steering.

As all I want to do to download the invoices from both accounts for all contracts is to execute at maximum one script, I also tasked it to implement checking an IMAP mailbox for the one-time password. I set up a new mail account on my server and created a limited forwarding rule. And now I have a script that logs into each of the accounts, gets a list of all the invoices and itemized bills, compares it with the local files, and only downloads the new ones.

Let’s see if I put everything into a container and let it run completely automatically on my homeserver. But executing one script every month is no burden anymore.

And it shows me you can now reverse-engineer almost everything. Sure, this was a relatively simple example, but it was also so fast that even a more complicated task doesn’t seem unrealistic anymore.

Some additional thoughts about the topic:

• That it’s so easy to reverse engineer things also means it’s easy for hackers with bad intentions. Applying security updates as fast as possible becomes even more important. Using devices without any more updates becomes a bigger security risk.
• Everything is “open source” now?
• As a professional software developer, it feels really uneasy for me to just “vibe” things. I like to have control over what I develop. I have developed specific preferences over the years I like to follow. Everyone is spitting out things using AI. Also, I use AI to help me code some projects, but I really like to stay in the loop.
• I won’t publish the code as long as I did not fully understand every single line in the script. I also guess the target audience for such a project is pretty small? If you want to get access, though, contact me.