# Rambling - Bagas Wastu

My personal ramblings, mostly tech-related stuff.

## Rambling (Blog)

### [Everything Has an API If You're Willing to Prompt](https://wastu.net/blog/everything-is-an-api)

Pulling my workout data from Boostcamp with an AI agent

- Date: 2026-09-09

I've been using an app called Boostcamp for at least 3 years to track my workouts. It does a great job at logging sets. But, the problem is that the deep analytics are locked behind a subscription paywall.

![All analytics locked behind a paywall](/content/boostcamp-paywall-carousel-c58c53ca.png)

This happens with almost every service. They hold your data hostage inside the app, and you're stuck with whatever they decide to show you. Even if I paid them $50/year for subscription, they still wouldn't let me export my training logs.

I was inspired recently seeing people use AI agents to get their own stuff back, like [having Codex reverse-engineer studio lights](https://www.youtube.com/watch?v=FCCmgRpX5ys) or [taking a Samsung TV from a browser sandbox all the way to root](https://blog.calif.io/p/codex-hacked-a-samsung-tv).

Before AI, my instinct was always to reverse-engineer the app myself whenever I wanted my data back. But let's be honest, who wants to spend hours after work digging through network requests and databases just to get a CSV?

## The setup

I already have an old Xiaomi Poco F4 that's rooted with KernelSU dedicated to things like this.

![My rooted Xiaomi Poco F4](/content/poco-f4-desk-16b06794.jpg)

The phone is connected to my private network through [meshflare](https://github.com/bgwastu/universe/tree/main/experiments/meshflare) (my project that brings a Tailscale-like mesh network to Cloudflare Zero Trust), running my fork of [wadbd](https://github.com/bgwastu/wadbd) so wireless ADB stays active across reboots and is bound strictly to the VPN interface.

I used DeepSeek V4 Flash and attached my [grill-me](https://github.com/mattpocock/skills/blob/main/docs/productivity/grill-me.md) skill so the agent interviews me about what data I actually want before touching anything.

Then I pointed it at the phone over wireless ADB.

## Pulling 3 years of data

Because the phone is rooted, there was no need to decompile the app. The agent went in over ADB, inspected the app's local storage, and grabbed my active Firebase auth credentials and refresh token.

It wrote a standalone Python script to query Boostcamp's private API directly. In less than 10 minutes, it dumped and normalized all 339 of my lifetime workouts (5,069 sets) into JSON and CSV files, matching my exact app stats.

Then it built a single-file dashboard canvas of the full lifting history:

<video src="/content/dashboard-scroll-11111994.mp4">My full lifting history</video>

The agent looked at the logs and noticed I only lift around 1.6 times a week, so some muscle groups stall. I asked it to design two new full-body routines around the equipment I actually have. A gym routine grouped into 3 physical stations, so I don't have to walk around hogging machines. A home routine that's dumbbell-only, with minimal plate changes and no bench needed.

I didn't configure those exercises back into the app myself. The agent used Boostcamp's own internal API to archive my old stalled program and push both routines in as native workout templates.

![Custom templates that Agent created on Boostcamp](/content/templates-carousel-2017ce40.png)

Now I have a personal dashboard, three years of clean workout history in my own database, and an agent that updates my routine whenever I need it, all without paying for a subscription :)

## If you try this

GPT, Claude, and Gemini refuse the moment you ask them to inspect or reverse-engineer an APK. GLM or DeepSeek tend to have [far fewer false-positive refusals](https://news.ycombinator.com/item?id=49459654) when inspecting your own hardware. I used DeepSeek V4 Flash because it's fast and cheap.

Also, I would skip the emulator. Play Integrity and missing hardware sensors is really pain in the ass. A cheap secondary Android phone rooted with KernelSU is a good option in my case. For Play Integrity bypasses, root hiding, and the rest of that cat-and-mouse game, [r/androidroot](https://www.reddit.com/r/androidroot/) is where people share what still works on current firmware.

If the app uses certificate pinning or heavy obfuscation, use DragonJAR's [Android-Pentesting-Skill](https://github.com/DragonJAR/Android-Pentesting-Skill) to equip the agent with Frida hooks and decompilation workflows so it doesn't get stuck.

If you don't want a USB cable tethered to your machine 24/7, the original [wadbd](https://github.com/Magisk-Modules-Alt-Repo/wadbd) module keeps ADB alive over Wi-Fi across reboots. The catch is that stock wadbd listens on all network interfaces (`0.0.0.0`), exposing root ADB to your entire local network. [My fork](https://github.com/bgwastu/wadbd) patches it to bind strictly to the VPN interface instead.

### [Why I Always Use Default Settings for Everything](https://wastu.net/blog/default-settings)

How simplicity can enhance your efficiency

- Date: 2023-07-15

You probably know programmers who used crazy configurations on their machines. They refuse to use a common text editor and use vim instead. Their love of being productive was proven by a long lua script that happens to fit into their own special customized i3 workspace.

As a below-average programmer, I hardly beat them in terms of speed. You're not wrong to categorize this type of programmer into the "most productive" category since they can do even the most complicated tasks by just using specialized macros. But even so, I think the one who uses a default and boring program can be productive, if not more so than those who are using a complicated setup.

Just like an average developer, I'm also learning vim in my journey to learn programming. It's hard to learn at first, but as I gain more knowledge, it feels like a superpower. I get so hooked up to Vim that I changed all my app settings to accept the Vim keybinding.

I feel _fast_ and _productive_ by configuring all my apps to my liking. But the thing is, when I'm working and collaborating with other teams, I can't function properly without my personalized configuration. It bewildered me that I didn't know the basic default shortcuts for text manipulation. It all happens because my brain is already accustomed to Vim keybinding.

If you're a web developer, you're likely aware that VS Code has taken over the web development landscape. Codepen, Codesandbox, and online cloud editors all rely on VS Code as their foundation. It's game over if you don't know the basic VS Code shortcut but have interacted with this type of site every day.

Sure, every popular online editor has Vim keybinding settings, but do you really want to go through all that hassle just to change the settings of a hundred different online editors? I don't think so.

The point is not that Vim keybindings are bad, but complex configuration is. The more configurations you have, the more challenging it is to maintain and transfer.

You've probably heard of the _convention over configuration_ phrase. Basically, it means that as long as you follow certain conventions, you don't need to add additional configuration. I believe that a system in which things are pre-configured is always more productive than one in which you have to set all the rules and take all the decisions.

So, what should you learn to be fast and productive, then? Well, my advice is to learn to love default configuration. It also includes the default keyboard shortcuts as well. Make sure to have the minimum amount of configuration if possible.

There is concept called [Principle of Least Astonishment (POLA)](https://en.wikipedia.org/wiki/Principle_of_least_astonishment#:~:text=In%20user%20interface%20design%20and,not%20astonish%20or%20surprise%20users.) that means a system should behave in a way that most users will expect it to behave. For example, when you press Ctrl+C while selecting text, you expect it to be copied, right? That's because Ctrl+C is a [sacred keybinding](https://en.wikipedia.org/wiki/Keyboard_shortcut#%22Sacred%22_keybindings) that is universally implemented across most applications.

By learning [general shortcuts](https://en.wikipedia.org/wiki/Table_of_keyboard_shortcuts#General_shortcuts), you can use them seamlessly across different platforms. It's literally learn once, use it everywhere.

![gif of me doing various shortcut on Windows 11 Notepad](/content/default-shortcut-demo-14338c31.gif)

Also, it's also beneficial to learn how to utilize the [default shortcut provided by your operating system](https://support.microsoft.com/en-us/windows/windows-keyboard-shortcuts-3d444b08-3a00-abd6-67da-ecfc07e86b98), such as Alt+Tab to switch between apps or Ctrl+D to go to the desktop. It's probably tempting to [use another abstraction](https://www.reddit.com/r/Windows11/comments/q4jlkb/alternatives_to_make_improve_your_windows_11/) to aid OS imperfection. However, whenever possible, opt for the default options. This allows you to become familiar with the default settings.

How about an app that requires you to learn a new shortcut or paradigm? In this case, make sure you are betting on something that is widely used. It's wiser, for example, to learn the VS Code shortcut than Sublime or JetBrains IDE since they're practically everywhere (you can even configure another app to use the VS Code shortcut).

I know that every programmer has their own preferred configuration. If you want to extend it, I suggest to doing it lightly. Always remember that configuration is a liability, and it should only be pursued if it truly adds significant value.

I promise that by using this method, your productivity will vastly increase. Probably not as fast as another "productive" programmer, but with insane relief that you have no liability to maintain such long config files. Oh, since the knowledge is transferrable, now you can use another coworker's computer if you are tight on deadline ;)