Ask Metalab: Please help decoding this web-request! (eg. ~base64) "?request=CsQCCuABRFFBQUFKd0FBQURCdU..."
Hey Guys! I was checking out what data my G1 is sending to Google via HTTP POST requests, which is somehow encoded. First, here is the request-string which would be nice to see decoded: ?request=CsQCCuABRFFBQUFKd0FBQURCdU5DbG04UEF5NUhyMzkzT1pTSThEcmdsWExNVGdWTTVobjBnbEdhVFk0WGo3bExHTl92MURnVUR5U2lVV281UElUT21KVTdDZEVoWHpwSHI5czQwT01HTkRkSHhvUG1nY2szREJNQ2NkNTNyV0ppTlcweHBhcjUtREljbXVFaWtQaUJURC1SNEJBMTQzSk90bDduVVNrbWNIZjJheG55UVFZTFBuY1RERUZzUnNoN0xfalNJcVpDQXlSajI3Q3g0QkJoLVR5WFNsaWVUR0VwU1hOZTAQABjqByIQMjAwMTQ1ZGE5MGM4NmU1ZioHZHJlYW06MzICZW46AkdCQhBULU1vYmlsZSBBdXN0cmlhSgBSBTIzMjAzWgUyMzIwM2IVYW0tYW5kcm9pZC10bW9iaWxlLWF0EyIKCAQ4AUAASApQABQ I found out that i can partly decode the key (starting at 'CsQCC...') with base64 and see parts of the original string, but still don't get a totally decoded result. (To decode with base64, you have to append "=" at the end of the key).
import base64 base64.decode64(REQUEST_KEY + "=")
Output (with repr): '\n\xc4\x02\n\xe0\x01DQAAAJwAAADBuNClm8PAy5Hr393OZSI8DrglXLMTgVM5hn0glGaTY4Xj7lLGN_v1DgUDySiUWo5PITOmJU7CdEhXzpHr9s40OMGNDdHxoPmgck3DBMCcd53rWJiNW0xpar5-DIcmuEikPiBTD-R4BA143JOtl7nUSkmcHf2axnyQQYLPncTDEFsRsh7L_jSIqZCAyRj27Cx4BBh-TyXSlieTGEpSXNe0\x10\x00\x18\xea\x07"\x10200145da90c86e5f*\x07dream:32\x02en:\x02GBB\x10T-Mobile AustriaJ\x00R\x0523203Z\x0523203b\x15am-android-tmobile-at\x13"\n\x08\x048\x01@\x00H\nP\x00\x14' So these are a lot of hex characters which are not inside the ascii character map. I don't know if this is the right trail, but here is where I don't know how to proceed on myself. It would be very interesting to see how the G1's communicate with Google! Please have a look at it -- perhaps we can solve this puzzle with joined forces! - Chris Jabber: metachris@jabber.metalab.at
Output (with repr): '\n\xc4\x02\n \xe0\x01DQAAAJwAAADBuNClm8PAy5Hr393OZSI8DrglXLMTgVM5hn0glGaTY4Xj7lLGN_v1DgUDySiUWo5PITOmJU7CdEhXzpHr9s40OMGNDdHxoPmgck3DBMCcd53rWJiNW0xpar5-DIcmuEikPiBTD-R4BA143JOtl7nUSkmcHf2axnyQQYLPncTDEFsRsh7L_jSIqZCAyRj27Cx4BBh-TyXSlieTGEpSXNe0\x10\x00\x18\xea\x07"\x10200145da90c86e5f*\x07dream:32\x02en:\x02GBB\x10T-Mobile AustriaJ\x00R\x0523203Z\x0523203b\x15am-android-tmobile-at\x13"\n \x08\x048\x01@\x00H\nP\x00\x14'
So these are a lot of hex characters which are not inside the ascii character map. I don't know if this is the right trail, but here is where I don't know how to proceed on myself. It would be very interesting to see how the G1's communicate with Google!
\xc4 mean 244 characters. \x02GBB is 2 chars: that's GB plus that B? But in generalthat explains the hexcodes quite well. So, the only real interesting thing is this string: "DQAAAJwAAADBuNClm8PAy5Hr393OZSI8DrglXLMTgVM5hn0glGaTY4Xj7lLGN_v1DgUDySiUWo5PITOmJU7CdEhXzpHr9s40OMGNDdHxoPmgck3DBMCcd53rWJiNW0xpar5 -DIcmuEikPiBTD- R4BA143JOtl7nUSkmcHf2axnyQQYLPncTDEFsRsh7L_jSIqZCAyRj27Cx4BBh- TyXSlieTGEpSXNe0" I expect it to be a unique session key not containing any information at all (or at least that's what I'd claim if I'd was Google). ciao, tom -- Thomas R. "TomK32" Koll <> http://ananasblau.com just a geek trying to change the world http://github.com/TomK32
Maybe also interesting and related: Google is internally using the protocol buffer [1] a lot for serialization. Could it be that the request is serialized with this protocol? As you mentioned, beginning the request with "\xc4" indicates an information to the receiver about the content. Could that hint to a binary encoding -- or do you rather think it's encoded with an algorithm such as base64? - Chris [1] http://code.google.com/p/protobuf/ Thomas R. Koll wrote:
Output (with repr): '\n\xc4\x02\n \xe0\x01DQAAAJwAAADBuNClm8PAy5Hr393OZSI8DrglXLMTgVM5hn0glGaTY4Xj7lLGN_v1DgUDySiUWo5PITOmJU7CdEhXzpHr9s40OMGNDdHxoPmgck3DBMCcd53rWJiNW0xpar5-DIcmuEikPiBTD-R4BA143JOtl7nUSkmcHf2axnyQQYLPncTDEFsRsh7L_jSIqZCAyRj27Cx4BBh-TyXSlieTGEpSXNe0\x10\x00\x18\xea\x07"\x10200145da90c86e5f*\x07dream:32\x02en:\x02GBB\x10T-Mobile AustriaJ\x00R\x0523203Z\x0523203b\x15am-android-tmobile-at\x13"\n \x08\x048\x01@\x00H\nP\x00\x14'
So these are a lot of hex characters which are not inside the ascii character map. I don't know if this is the right trail, but here is where I don't know how to proceed on myself. It would be very interesting to see how the G1's communicate with Google!
\xc4 mean 244 characters. \x02GBB is 2 chars: that's GB plus that B? But in generalthat explains the hexcodes quite well. So, the only real interesting thing is this string: "DQAAAJwAAADBuNClm8PAy5Hr393OZSI8DrglXLMTgVM5hn0glGaTY4Xj7lLGN_v1DgUDySiUWo5PITOmJU7CdEhXzpHr9s40OMGNDdHxoPmgck3DBMCcd53rWJiNW0xpar5 -DIcmuEikPiBTD- R4BA143JOtl7nUSkmcHf2axnyQQYLPncTDEFsRsh7L_jSIqZCAyRj27Cx4BBh- TyXSlieTGEpSXNe0"
I expect it to be a unique session key not containing any information at all (or at least that's what I'd claim if I'd was Google).
ciao, tom
-- Thomas R. "TomK32" Koll <> http://ananasblau.com just a geek trying to change the world http://github.com/TomK32
_______________________________________________ Metalab mailing list Metalab@lists.metalab.at http://lists.metalab.at/mailman/listinfo/metalab
Hi, Chris Hager (chris@linuxuser.at) wrote on 2009-08-03:
Please have a look at it -- perhaps we can solve this puzzle with joined forces!
Needs more context, like a full HTTP request. Generally: Is there reason to believe that you can't just look that up in the android source? ciao, -- [*Thomas Themel*] "That doesn't make it bad, but it's also not [extended contact] spectacular nerd porn." [info provided in] - ExtremeTech review of IA-64 [*message header*]
Hey, It's a request the Android market is sending when it wants to see new games. The code of the Market is proprietary. So it's definitely containing a request in some form, and not only a session string. - Chris Thomas Themel wrote:
Hi, Chris Hager (chris@linuxuser.at) wrote on 2009-08-03:
Please have a look at it -- perhaps we can solve this puzzle with joined forces!
Needs more context, like a full HTTP request. Generally: Is there reason to believe that you can't just look that up in the android source?
ciao,
Hey again! I've captured more requests and have them grouped a little bit: The requests are from my G1, the Android market software polling the G* servers for new games. By scrolling down the list the software kept requesting new entries, as the list of the apps keeps growing. The requests are sent with the http method "POST" and have this header: "Content-Type=application/x-www-form-urlencoded" The data posted in the requests is "request=OUR_KEYS" (OUR_KEYS look a little like a base64 variant). To see them in plain text would be great! Here I have collected and grouped and couple ofrequests: - Category: Games - Casino - By Popular + By Date (~ 20 request strings for getting more items and the icons) File: http://www.4feets.com/x/requests_casino_more.txt - Category: Games - Arcade - By Popular + By Date (again ~ 20 requests each for getting more items and icons) File: http://www.4feets.com/x/requests_arcade_more.txt If you look at the requests encoded, the with > 200 chars longer ones are receiving the png images bundle, and the shorter ones (usually around 450 chars) poll the listing of the apps and games. Looking just at the encoded keys for getting the listings, they differ by 2 bytes for each "next page", and by 1 byte for "by popular" and "by date". The interesting ones are usually at the very end of each line, the first ~200 characters are the same (only for each category). Here is a small tool I wrote that compares the characters of as many lines as you put in a file: http://www.4feets.com/x/checkstrings.py.txt Thanks in advance! Best, - Chris Chris Hager wrote:
Hey Guys!
I was checking out what data my G1 is sending to Google via HTTP POST requests, which is somehow encoded. First, here is the request-string which would be nice to see decoded:
?request=CsQCCuABRFFBQUFKd0FBQURCdU5DbG04UEF5NUhyMzkzT1pTSThEcmdsWExNVGdWTTVobjBnbEdhVFk0WGo3bExHTl92MURnVUR5U2lVV281UElUT21KVTdDZEVoWHpwSHI5czQwT01HTkRkSHhvUG1nY2szREJNQ2NkNTNyV0ppTlcweHBhcjUtREljbXVFaWtQaUJURC1SNEJBMTQzSk90bDduVVNrbWNIZjJheG55UVFZTFBuY1RERUZzUnNoN0xfalNJcVpDQXlSajI3Q3g0QkJoLVR5WFNsaWVUR0VwU1hOZTAQABjqByIQMjAwMTQ1ZGE5MGM4NmU1ZioHZHJlYW06MzICZW46AkdCQhBULU1vYmlsZSBBdXN0cmlhSgBSBTIzMjAzWgUyMzIwM2IVYW0tYW5kcm9pZC10bW9iaWxlLWF0EyIKCAQ4AUAASApQABQ
I found out that i can partly decode the key (starting at 'CsQCC...') with base64 and see parts of the original string, but still don't get a totally decoded result. (To decode with base64, you have to append "=" at the end of the key).
import base64 base64.decode64(REQUEST_KEY + "=")
Output (with repr): '\n\xc4\x02\n\xe0\x01DQAAAJwAAADBuNClm8PAy5Hr393OZSI8DrglXLMTgVM5hn0glGaTY4Xj7lLGN_v1DgUDySiUWo5PITOmJU7CdEhXzpHr9s40OMGNDdHxoPmgck3DBMCcd53rWJiNW0xpar5-DIcmuEikPiBTD-R4BA143JOtl7nUSkmcHf2axnyQQYLPncTDEFsRsh7L_jSIqZCAyRj27Cx4BBh-TyXSlieTGEpSXNe0\x10\x00\x18\xea\x07"\x10200145da90c86e5f*\x07dream:32\x02en:\x02GBB\x10T-Mobile AustriaJ\x00R\x0523203Z\x0523203b\x15am-android-tmobile-at\x13"\n\x08\x048\x01@\x00H\nP\x00\x14'
So these are a lot of hex characters which are not inside the ascii character map. I don't know if this is the right trail, but here is where I don't know how to proceed on myself. It would be very interesting to see how the G1's communicate with Google!
Please have a look at it -- perhaps we can solve this puzzle with joined forces!
- Chris
Jabber: metachris@jabber.metalab.at
_______________________________________________ Metalab mailing list Metalab@lists.metalab.at http://lists.metalab.at/mailman/listinfo/metalab
Teilnehmer (3)
-
Chris Hager -
Thomas R. Koll -
Thomas Themel