Hello,
as the title says, i have some trouble with the A_AUTH packet. I currently write my own implementation of the adb protocol for my AndroidCtrl.dll everything works so far as expected, only the token signing left...
QUESTION:
Can someone kick me in the right direction, how i can successfully sign the A_AUTH token?
My tries [C# .Net 4 Client]
Code:
//Class internal var
RSACryptoServiceProvider _rsaSP = new RSACryptoServiceProvider(2048);
// (my own loader) Load the xml saved RSA-Key
RSALoad()
// generate the signed hash
// (don't work)
byte[] shash = _rsaSP.SignData("20 byte token from A_AUTH", new SHA1CryptoServiceProvider()));
// generate the signed hash
// (don't work)
byte[] shash = _rsaSP.SignData("20 byte token from A_AUTH", new SHA256CryptoServiceProvider()));
I also tried it with "_rsaSP.SignHash()" but no luck... Seems .Net is not capable to sign a adb token... If i send my public key, on the device the adb dialog pops up and ask me to grand access. So the device have the public key. But it sends all the time a new token after i send my signed token...
THX in advance
Sebastian
Related
Hi guys, I hope you can help me!
I have a Samsung i-9000 and i'm writing an application to enter the pin code of the SIM card if it has not already been done before.
I inserted android:sharedUserId="android.uid.system" in AndroidManifest.xml and this is the code in my Activity class:
Code:
TelephonyManager tm = (TelephonyManager)getSystemService(Context.TELEPHONY_SERVICE);
try {
clazz = Class.forName(tm.getClass().getName());
m = clazz.getDeclaredMethod("getITelephony");
m.setAccessible(true);
it = (ITelephony)m.invoke(tm);
} catch(ClassNotFoundException e) {
Log.e("ClassNotFoundException", e.getMessage());
} catch(ClassCastException e) {
Log.e("ClassCastException", e.getMessage());
} catch(NoSuchMethodException e) {
Log.e("NoSuchMethodException", e.getMessage());
} catch(InvocationTargetException e) {
Log.e("InvocationTargetException", e.getMessage());
} catch(IllegalAccessException e) {
Log.e("IllegalAccessException", e.getMessage());
}
it.supplyPin(pin);
Now I know I have to sign my app with system certificate (or system key) to work with Android 2.3.3, but I don't how I can do it. I never signed an app before, especially as system app.
On google I found this for a Dream telephone:
- In the AndroidManifest.xml of your application: under the <manifest>
element add the attribute android:sharedUserId="android.uid.system".
- Export an unsigned version of your Android application using
Eclipse: right-click on the project >> Android Tools >> Export
Unsigned Application Package.
- Use <root-of-android-source-tree>/out/host/<your-host>/framework/
signapk.jar to sign your app using platform.x509.pem and platform.pk8
in <root-of-android-source-tree>/build/target/product/security
generated earlier: java -jar signapk.jar platform.x509.pem
platform.pk8 YourApp-unsigned.apk YourApp-signed.apk.
I don't understand the meaning of the last point!!!! What have I to do step by step?? Where is <root-of-android-source-tree>/out/host/<your-host>/framework/
signapk.jar file?? Where are platform.x509.pem and platform.pk8? It says "<root-of-android-source-tree>/build/target/product/security", but where is this path?
The setps above are for a Dream telephone, maybe there is something different in Samsung i9000?
I don't know if it could be useful, hower I have a rooted Samsung i-9000 with Darky 10.2 ROM, development tool: Eclipse, OS: Windows7 32bit
Thank you very much!!!!
There is a Dream system certificate made available by the manufacture somehow. Not all manufactures will make available of their system certificate. I too would like to make a system app myself. However, without having the apk signed by the handset system certificate, there is no way obtain system permissions. I was wondering if there is a way to add my own system certificate to my handset given that I have root access to the handset.
Hi,
I try to implement a server side verification of an application with LVL library.
I use this php code : http://code.google.com/p/android-market-license-verification/
In the file sample/verify.php, I have two lines to complete :
Code:
$responseData = '';
$signature = '';
I see in the google LVL that there is a function called verify which has these parameters :
public void verify(PublicKey publicKey, int responseCode, String signedData, String signature);
But I don't undestand where this function is called and by what function.
Also I want to get this datas.
How can I do that ?
Thank you,
Yeah!! Same here!
Can someone tell us?
Most apps use client side license verification, don't know why... This would be very useful!
I am trying to figure out how to use reflection to access field data from another apk.
Both apks are in debug and signed with the same certificate and they are sharing the same user id. I built out the method to use reflection to retrieve the field value from the other apk.
Code:
public Class<?> getClass(String remoteClass) throws Exception {
Context remoteContext = mContext.createPackageContext(REMOTE_PACKAGE,
Context.CONTEXT_IGNORE_SECURITY | Context.CONTEXT_INCLUDE_CODE);
ClassLoader loader = remoteContext.getClassLoader();
Class<?> cls = loader.loadClass(remoteClass);
return cls;
}
public Object getField(String obfuscatedClass, String obfuscatedField) throws Exception {
try {
Field field = this.dexLoader.getClass(obfuscatedClass).getDeclaredField(obfuscatedField);
field.setAccessible(true);
return field.get(this.reference);
} catch (NullPointerException | IllegalArgumentException | IllegalAccessException | NoSuchFieldException
| SecurityException | ClassNotFoundException e) {
}
return null;
}
Example:
A - APK (A)
In APK (A) I am running the application and while it is running their is real-time data being set...
B - APK (B)
With APK (B) I have the method getClass in which I will use to access the package from APK (A) and then pull the declared field in the package.
The issue is every time I run the apk that uses the reflection on the running application it just returns the default value that the field started with. In java you can use reflection to access a jvm's field values/methods while it is running. I am trying to do the same approach with the android applications but it doesnt look like it is returning real-time data.
Am I doing this all wrong or is this just not possible?
Another thing I am able to do is decompile the running application and make any additions/modifications I want and then recompile. Is there anything I can do to be able to use reflection to retrieve the data from the field values in real-time. Everything is public and static in the apk.
Thank you for your time to whoever is reading this!
Maybe if I were to inject into the other APK reflection methods and then I can use the other apk to invoke the reflection method with reflection to pull data?
If we briefly talk about what HMS Site Kit is, you can provide users to explore the world faster with Site Kit. You can search for locations by keywords, find places which are close to the specified coordinate point, get detailed information about a place and get suggestions for places by keyword.
We can get detailed information about a place with Place Detail Search, another feature of Site Kit. The only condition for this, we need to know Site model’s id value that belongs to the place we want to search.
Before I explain the use of Place Detail Search, I would like to share with you a function that we can use this feature.
Code:
fun placeDetail(siteId: String){
val searchService = SearchServiceFactory.create(context,
URLEncoder.encode(
"Your-API-KEY",
"utf-8"))
var request = DetailSearchRequest()
request.siteId = siteId
request.language = Locale.getDefault().language // Getting system language
searchService.detailSearch(request, object: SearchResultListener<DetailSearchResponse>{
override fun onSearchError(searchStatus: SearchStatus?) {
Log.e("SITE_KIT","${searchStatus?.errorCode} - ${searchStatus?.errorMessage}")
}
override fun onSearchResult(detailSearchResponse: DetailSearchResponse?) {
var site = detailSearchResponse?.site
site?.let {
Log.i("SITE_KIT", "Name => ${it.name}," +
"Format address => ${it.formatAddress}, " +
"Coordinate => ${it.location.lat} - ${it.location.lng}, " +
"Phone => ${it.poi.phone}, " +
"Photo URLS => ${it.poi.photoUrls}, " +
"Rating => ${it.poi.rating}, " +
"Address Detail => ${it.address.thoroughfare}, ${it.address.subLocality}, " +
"${it.address.locality}, ${it.address.adminArea}, ${it.address.country}")
} ?: kotlin.run {
Log.e("SITE_KIT","Site Place couldn't find with the given site ID")
}
}
})
}
First, we need to create a SearchService object from the SearchServiceFactory class. For this, we can use the create() method of the SearchServiceFactory class. We need to declare two parameters in create() method.
The first of these parameters is context value. It is recommended that Context value should be in Activity type. Otherwise, when HMS Core(APK) needs to be updated, we can not receive any notification about it.
The second parameter is API Key value that we can access via AppGallery Connect. This value is generated automatically by AppGallery Connect when a new app is created. We need to encode API parameter as encodeURI.
After creating our SearchService object as I described above, we can create a DetailSearchRequest object. We will specify the necessary parameters on this object related to the place which we want want to get information.
After creating our DetailSearchRequest object, we can determine parameters for a place that we want to get information. Two parameters are specified here:
SiteId: There is a unique id value for each Site in Site Kit. This parameter is used to specify the id value of the place whose information is to be obtained.
Language: It is used to specify the language that search results have to be returned. If this parameter is not specified, language of the query field we have specified in the query field is accepted by default. In example code snippet in above, language of device has been added automatically in order to get a healthy result.
After entering the id value and language parameter of the place that we want to learn in detail, we can start learning the details. For this, we will use detailSearch() method of the SearchService object. This method takes two parameters.
For the first parameter, we must specify DetailSearchRequest object we have defined above.
For the second parameter, we have to implement SearchResultListener interface. Since this interface has a generic structure, we need to specify class belonging to the values to be returned. We can get the incoming values by specifying DetailSearchResponse object. Two methods should be override with this interface. onSearchError() method is executed if operation fails, and onSearchResult() method is executed if operations is successful. There is one value in DetailSearchResponse. This value is Site object that belongs to the id value. With the Site variable of DetailSearchResponse object, we can access information belong to place we have searched.
sujith.e said:
Hi,Why API key is required?
Click to expand...
Click to collapse
API key is a simple credential for accessing Huawei services. Your API key is creating automatically on the AppGallery Connect when you create an application, and then your app can use the key to call public APIs provided by Huawei.
When an app calls a public API provided by Huawei, we should give this information to API to help Huawei to identify our application.
More information like this, you can visit HUAWEI Developer Forum​
Opportunity
The vast number of apps are available for download. There are apps intended for specific purposes and there are similar apps intended for the same purposes. As more apps are available, there is a tendency for users to download more apps to address specific needs or maximize the unique features of similar apps for addressing their needs.
Having an immense number of apps brings stiff competition among developers to ensure that their apps stand out among the other apps. For app users, having a lot of apps in their devices could lead to increased password fatigue and complicated username and password management. It would be a win-win solution for both developers and app end users to have a way that enables app users to sign-in to apps in a fast, simple, and secure manner to have a positive user experience resulting to possible faster app adoption.
What is HUAWEI Account Kit?
HUAWEI Account Kit enables developers to add simple, secure, and quick sign-in and authorization functions to their apps. These functions are achieved by the HUAWEI ID sign-in and authorization solution that complies with OAuth.20 and OpenID Connect. The HUAWEI ID sign-in and authorization solution enables stand-alone apps and apps running on independent developer servers to access user authentication information such as an ID token to enable users to quickly and securely sign-in to apps using their HUAWEI IDs.
How to sign in with HUAWEI ID (ID Token)?
Service process for signing in with HUAWEI ID (ID Token)
The following steps explain the process flow for signing in with HUAWEI ID (ID Token):
1. The app sends a sign-in request to HUAWEI Account SDK upon user sign-in using HUAWEI ID.
2. HUAWEI Account SDK informs the user about the content to be authorized using a user sign-in authorization interface based on the authorization scope in the sign-in request.
3. HUAWEI Account SDK sends an ID token to the app after the user authorizes the app to access the content.
4. The app verifies the ID token.
To request authorization for obtaining an ID token:
1. Present the HUAWEI ID sign-in icon on a sign-in page.
2. Send an authorization request by calling HuaweiIdAuthParamsHelper.setIdToken.
Code:
HuaweiIdAuthParams authParams = new HuaweiIdAuthParamsHelper(HuaweiIdAuthParams.DEFAULT_AUTH_REQUEST_PARAM).setIdToken().createParams();
3. Initialize HuaweiIdAuthService using getService method of HuaweiIdAuthManager.
Code:
HuaweiIdAuthService authService = HuaweiIdAuthManager.getService(MainActivity.this, authParams);
4. Bring up the HUAWEI ID sign-in authorization interface using HuaweiIdAuthService.getSignInIntent.
Code:
startActivityForResult(authService.getSignInIntent(), 8888);
5. Obtain HUAWEI ID from the sign-in result by calling HuaweiIdAuthManager.parseAuthResultFromIntent of onActivityResult after completing sign-in authorization.
Code:
@Override
protected void onActivityResult(int requestCode, int resultCode, @Nullable Intent data) {
//Process the sign-in and authorization result and obtain an ID token from AuthHuaweiId.
super.onActivityResult(requestCode, resultCode, data);
if (requestCode == 8888) {
Task<AuthHuaweiId> authHuaweiIdTask = HuaweiIdAuthManager.parseAuthResultFromIntent(data);
if (authHuaweiIdTask.isSuccessful()) {
//The sign-in is successful, and the user's HUAWEI ID information and ID token are obtained.
AuthHuaweiId huaweiAccount = authHuaweiIdTask.getResult();
Log.i(TAG, "idToken:" + huaweiAccount.getIdToken());
} else {
//The sign-in failed.
Log.e(TAG, "sign in failed : " +((ApiException)authHuaweiIdTask.getException()).getStatusCode());
}
}
}
To verify ID token validity via local verification
Note: Local verification might fail if the current time of the mobile phone is not in sync with the standard time. Make sure that the current time of the mobile phone to be used for local verification is in sync with the standard time.
1. Obtain a public key from the URI obtained from the jwks_uri field at https://oauth-login.cloud.huawei.com/.well-known/openid-configuration.
Code:
private void getJwks(ICallBack iCallBack) {
OkHttpClient okHttpClient = new OkHttpClient();
final Request request = new Request.Builder()
.url(Constant.CERT_URL)
.build();
Call call = okHttpClient.newCall(request);
call.enqueue(new Callback() {
@Override
public void onFailure(Call call, IOException e) {
Log.i(TAG, "Get ID Token failed.");
iCallBack.onFailed();
}
@Override
public void onResponse(Call call, Response response) {
if (response.isSuccessful()) {
try {
String res = response.body().string();
JSONObject jsonObject = new JSONObject(res);
mJsonArray = jsonObject.getJSONArray("keys");
iCallBack.onSuccess();
} catch (NullPointerException | JSONException | IOException e) {
Log.i(TAG, "parse JsonArray failed." + e.getMessage());
iCallBack.onFailed();
}
}
}
});
}
NOTE: The public key is updated daily and is cached in the app server.
2. Verify the ID token using JWT library such as jwt.io.
Code:
DecodedJWT decoder = JWT.decode(idToken);
Algorithm algorithm = Algorithm.RSA256(mRSAPublicKey , null);
JWTVerifier verifier = JWT.require(algorithm).build();
// verify signature
verifier.verify(decoder);
3. Check if the value of iss is https://accounts.huawei.com.
Code:
decoder.getIssuer().equals(ID_TOKEN_ISSUE);
4. Check if the value of aud is the same as the client_id of the app.
Code:
decoder.getAudience().get(0).equals(CLIENT_ID);
5. Check if the expiration of the ID token is based on the value of exp.
Code:
// Expired, throws TokenExpiredException
verifier.verify(decoder);
If the values of the iss and aud checks out and the expiration of the ID Token is based on the value of exp, the ID token is successfully verified, and the app can use the user information in the sign-in result.
Code:
JSONObject jsonObject = new JSONObject(new String(Base64.decode(decoder.getPayload(), Base64.URL_SAFE), DEFAULT_CHARSET));
For the code, you can refer to IDTokenParser.java in the Client Sample Code.
The Benefits
To the developers
Developers can provide a positive user experience to their app users since the app users do not need to undergo a registration and verification process when signing-in to apps using their HUAWEI ID.
To the end user
End users can sign-in to apps in a fast, simple, and secure manner. Minimizes username and password management since end users can sign-in to different apps integrating the Account Kit just by using their HUAWEI ID.
Learn More
To know more information on how to maximize the features and advantages of HUAWEI Account Kit, go to https://developer.huawei.com/consumer/en/hms/huawei-accountkit
Thank you so much for the post. It is very useful
Is there any image or icons specification like facebook login button has?