Australian COVIDSafe App Source Code - Page 1
Forum section: electronics / general

author: EEVblog
author_rank: Unknown
timestamp: April 27, 2020, 01:04:10 pm
content: Here is the decompiled source code for the Australian COVIDSafe Android AppIt's supposed to be readable in Android Studio but I have not tried it myself as that's not my thing.https://github.com/EEVblog/COVIDSafe-1.0.11

author: NivagSwerdna
author_rank: Super Contributor
timestamp: April 27, 2020, 01:11:39 pm
content: alsohttps://github.com/ghuntley/COVIDSafe_1.0.11.apkIt's written in Kotlin so it must be good. (I'm a secret Kotlin admirer)

author: SiliconWizard
author_rank: Super Contributor
timestamp: April 27, 2020, 01:41:59 pm
content: Ouch. Of Kotlin, I just know the name... Just took a quick look, but what's all this metadata stuff (which looks like it's not text) and where's the source code?*confused*

author: NivagSwerdna
author_rank: Super Contributor
timestamp: April 27, 2020, 01:51:43 pm
content: Looks like my wife would be able to check up on all the BLE devices I've been spending time with.

author: EEVblog
author_rank: Unknown
timestamp: April 27, 2020, 02:53:28 pm
content: A breakdown:https://twitter.com/matthewrdev/status/1254336105203200000

author: Wilksey
author_rank: Super Contributor
timestamp: April 27, 2020, 05:43:41 pm
content: Hmm,The code is here:https://github.com/EEVblog/COVIDSafe-1.0.11/tree/master/smali/au/gov/health/covidsafeBut it isn't "code", it's I guess you could call it bytecode or IL code sort of.The trouble is nothing decompiled ever recompiles properly, all a APK file is, is a ZIP file, so the way I reverse engineer is to rename the APK to ZIP, extract the .DEX files, run DEX2JAR to reproduce the .jar file then run it through jd-gui (java decompiler).

author: NivagSwerdna
author_rank: Super Contributor
timestamp: April 27, 2020, 06:53:44 pm
content: Quote from: Wilksey on April 27, 2020, 05:43:41 pmtryhttps://github.com/ghuntley/COVIDSafe_1.0.11.apk;decompiled in 2 flavours.

author: SiliconWizard
author_rank: Super Contributor
timestamp: April 27, 2020, 06:59:21 pm
content: Yeah, so they didn't actually release any source code.Apparently, they didn't obfuscate the compiled stuff, so yeah you can decompile it and get something readable. No clue how readable that really is though.But I'm wondering why they didn't release the source code if they wanted to be really transparent.

author: NivagSwerdna
author_rank: Super Contributor
timestamp: April 27, 2020, 07:23:10 pm
content: "You’ve have successfully uploaded our information to COVIDSafe`s highly secure server. State and Territory health officials will notify other COVIDSafe users that have recorded instances of close contact with you. Your identity will remain anonymous to other users."If I am interpreting the app correctly it stores contacts locally and only uploads on user action and then it only uploads contacts you have had with other BLE identified users. I guess they are then traced and encouraged to upload... and then the network of contacts expands.Sounds pretty tame. If I had written it I would upload all contacts automatically and build a network of what people were up to.

author: Syntax Error
author_rank: Frequent Contributor
timestamp: April 28, 2020, 12:05:23 pm
content: Just wondering who ends up on the apps..."Lau/gov/health/covidsafe/streetpass/BlacklistEntry"...and why?

author: EEVblog
author_rank: Unknown
timestamp: April 28, 2020, 01:54:23 pm
content: Quote from: NivagSwerdna on April 27, 2020, 07:23:10 pmIt is, because everyone complained about it they had to prune it back to nothing.The iPhone app doesn't even work unless you have the program in focus and the screen on all the time. Totally useless.

author: ShortCircuitMEL
author_rank: Newbie
timestamp: September 11, 2020, 12:13:39 pm
content: Quote from: Wilksey on April 27, 2020, 05:43:41 pmGive a try toDecompiler.com. It decompiles .APK files as a whole, but also supports .DEX and .JAR decompilation.

author: SiliconWizard
author_rank: Super Contributor
timestamp: September 12, 2020, 07:41:56 pm
content: I'm not sure about Australia, but looks like in most "western" countries, those apps ended up total flops anyway.

author: Nominal Animal
author_rank: Super Contributor
timestamp: September 12, 2020, 10:20:04 pm
content: Surprisingly, the sources for the FinnishKoronavilkkuis online:backend,Android, andiOS.

author: AntiProtonBoy
author_rank: Frequent Contributor
timestamp: September 16, 2020, 02:12:31 am
content: Curious, what was the purpose of decompiling the COVIDSafe app, when sources are officially available to download (see below)?https://github.com/AU-COVIDSafeAre there any surprises in the binary distributions that is missing from the official sources?