yashsingh1/xdaforums huggingface dataset:
[Android Apps and Games] jayinc11:
Hey thanx-I will be on to this tonite.

Can you update the first page with these instructions?

If the end result is an apk why not make the apk available for d/l directly? and a separate pc/lappy client.
[Android Apps and Games] onyxbits:
I don't quite get what you mean. Could you clarify?
[Android Apps and Games] Sage:
well done! great effort! - maybe add a sideload adb apk install button for connected phones! :)
[Android Apps and Games] jayinc11:
You can post the apk file on a link where users can download it. Why go through the steps to #7 just to get the same apk file?

EDIT

Never mind - everything is perfect!:good:
[Android Apps and Games] Cerberus_tm:
Wow, this is a really cool programme! How does it deal with paid applications, can you pay for and download them without having the Play Store installed on your phone?
[Android Apps and Games] jayinc11:
This possum is on the stump!

All we need now is an android version of this raccoon or similar. I look forward to that day.
[Android Apps and Games] :
How long has phone number verification been mandatory when creating a new Google account? I don't have any other option than using my actual phone number, same one that is associated with my main Google account unless I get a prepaid card.
[Android Apps and Games] onyxbits:
That seems to randomly hit you. Probably because too many accounts have been created from your IP address in the past, so Google assumes that you may be a bot.
[Android Apps and Games] :
I see, although I've only created one Google account in my life. Glad to know that a phone number isn't mandatory, it's definitely possible as we have seen with Twitter.
[Android Apps and Games] xavihernandez:
Authentication error

Hi, first thanks for this awesome software :)

Unfortunately, long time I haven't ran it from my laptop, and when I tried to search applications I met an error :( : "Authentication error". I have taken a look at credentials.cfg as it is plain text, and password is ok on it.

What could be the problem? Can I extract some logs?
[Android Apps and Games] onyxbits:
You'd have to look at whats printed on the console.
[Android Apps and Games] xavihernandez:
Which console?
[Android Apps and Games] elaurens:
Onyx, just so you know .. I'm getting the exact same message when launching a search query from within an archive which I've been using for months w/o a single issue. I checked credentials.cfg (user/pass are correct), managed to login with that account on google.com and can confirm that the "allow less secure apps" option is enabled (no two factor auth.). I tried creating a new archive with a different google account, but simple get the message "bad credentials" when trying to log in (again, I'm pretty sure password/settings are 100% correct). Is this something you are not experiencing on your side?

Thx.
[Android Apps and Games] trancilo:
same issue

It looks like maybe google changed something.

I'm getting the same error on an existing account. Which was tested before.

UI says: Authentication error

Console output:

java.util.concurrent.ExecutionException: com.akdeniz.googleplaycrawler.GooglePlayException: Error=UNKNOWN_ERR
at java.util.concurrent.FutureTask.report(FutureTask.java:122)
at java.util.concurrent.FutureTask.get(FutureTask.java:188)
at javax.swing.SwingWorker.get(SwingWorker.java:602)
at de.onyxbits.raccoon.gui.SearchWorker.done(SearchWorker.java:199)
at javax.swing.SwingWorker$5.run(SwingWorker.java:737)
at javax.swing.SwingWorker$DoSubmitAccumulativeRunnable.run(SwingWorker.java:832)
at sun.swing.AccumulativeRunnable.run(AccumulativeRunnable.java:112)
at javax.swing.SwingWorker$DoSubmitAccumulativeRunnable.actionPerformed(SwingWorker.java:842)
at javax.swing.Timer.fireActionPerformed(Timer.java:312)
at javax.swing.Timer$DoPostEvent.run(Timer.java:244)
at java.awt.event.InvocationEvent.dispatch(InvocationEvent.java:312)
at java.awt.EventQueue.dispatchEventImpl(EventQueue.java:745)
at java.awt.EventQueue.access$300(EventQueue.java:103)
at java.awt.EventQueue$3.run(EventQueue.java:706)
at java.awt.EventQueue$3.run(EventQueue.java:704)
at java.security.AccessController.doPrivileged(Native Method)
at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:77)
at java.awt.EventQueue.dispatchEvent(EventQueue.java:715)
at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:242)
at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:161)
at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:150)
at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:146)
at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:138)
at java.awt.EventDispatchThread.run(EventDispatchThread.java:91)
Caused by: com.akdeniz.googleplaycrawler.GooglePlayException: Error=UNKNOWN_ERR
at com.akdeniz.googleplaycrawler.GooglePlayAPI.executeHttpRequest(GooglePlayAPI.java:582)
at com.akdeniz.googleplaycrawler.GooglePlayAPI.executePost(GooglePlayAPI.java:540)
at com.akdeniz.googleplaycrawler.GooglePlayAPI.executePost(GooglePlayAPI.java:519)
at com.akdeniz.googleplaycrawler.GooglePlayAPI.login(GooglePlayAPI.java:228)
at de.onyxbits.raccoon.App.createConnection(App.java:132)
at de.onyxbits.raccoon.gui.SearchWorker.doQuerySearch(SearchWorker.java:137)
at de.onyxbits.raccoon.gui.SearchWorker.doInBackground(SearchWorker.java:111)
at de.onyxbits.raccoon.gui.SearchWorker.doInBackground(SearchWorker.java:38)
at javax.swing.SwingWorker$1.call(SwingWorker.java:296)
at java.util.concurrent.FutureTask.run(FutureTask.java:262)
at javax.swing.SwingWorker.run(SwingWorker.java:335)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at java.lang.Thread.run(Thread.java:745)

ps. awesome application.
[Android Apps and Games] onyxbits:
Why do these things always happen when I have absolutely no time to look into them?

From what I saw so far, it seems like Google changed the URL for logging in. https://android.clients.google.com/auth now seems to return 404. It used to return a cookie ("Auth=") that could be used instead of credentials. Once I figure out where to get that cookie again, everything will be peachy (help welcome).
[Android Apps and Games] bigsupersquid:
ugh

Important:?*ClientLogin has beenofficially deprecated?*since April 20, 2012 and is now no longer available. Requests to ClientLogin will fail with a HTTP 404 response. We encourage you to migrate to?*OAuth 2.0?*as soon as possible.

the OAuth2 link

//edit: except for the developer console registration requirement, this looks useful.
[Android Apps and Games] onyxbits:
And that's exactly the problem for why I'm still using the old method: the whole point of API keys is to be able to shut competing clients out.
[Android Apps and Games] onyxbits:
K guys, new release. Changelog here. This is really all I can do for the moment. May it hold for now.
[Android Apps and Games] smowtion:
Thanks
[Android Apps and Games] jb91:
Quick question about Raccoon: I've been trying to download a few apps, but some of them I cannot find in Raccoon. Tried with Raccoon 3.6 and 4.0.0. I've tried uploading the dummy Nexus 6 profile using DummyDroid but that only returned an error (as is known to the developer). So in my position now, is there anything I can do currently to download these missing apps with Raccoon? One of them is SwiftKey, for example, which is pretty important to me.
[Android Apps and Games] onyxbits:
As the release notes say: existing archives will not automatically upgrade to the new hardware profile. You have to reset them (register a new GSF ID).

That being said: swiftkey can be downloaded with v3.6 (along with pretty much every other app, people have reported as missing so far).
[Android Apps and Games] onyxbits:
A keep thinking that this awful idea might actually be awesome:

Some people seem to be anxious about giving Raccoon their credentials. It doesn't occur to them that they can (and should) register a throw away account. Other people have trouble registering throw away accounts because Google wants a telephone number to verify that they are not bots.

Now, the interesting thing is, communication with Play doesn't require a username and password at all. You only need to authenticate with the login server which will give you an auth cookie that is used in any further communication (that was actually the part that broke in v3.5).

I keep thinking: why pesker the user with this account stuff to begin with? Why not simply register an account, get the auth cookie and hardwire that in Raccoon (of course, still allowing the user to override it)?

Pros:

It saves the user a step

Thousands of users basically sharing the same account improves privacy for the individual

Allows people to use Raccoon even if Google doesn't let them register an account without getting a phone number.

Cons:

Google is probably not going to like it

Accounts that get used from all over the world may get flagged as hacked.

Opinions?
[Android Apps and Games] bigsupersquid:
the app download record might get interesting. but that's not a huge deal.

and doesn't the auth cookie expire from what i read? there's the renewal token in oath2, is that in the old method as well?

Google not liking it generally means anything from cease and desist orders to them changing their current interfaces to block it.

they do seem to use login locations to pop extra security questions sometimes for auth.

oh, and if you're going to register an account for the auth token, why not use the developer panel to enable oath2 with the secret and token and all? you'd wanna get people to chip in for the $25 to register that throwaway account as a development account, but I'd bet enough people would pony up for that.

just whether Google would close the account for the Play bypass or not I'd wonder about in that case.
[Android Apps and Games] onyxbits:
Actually, the whole idea was to make the download record worthless and therefore uninteresting as you have no way of telling who downloaded what ;).

The auth cookie you get from ClientLogin seems to be long time stable. So stable in fact that I don't even save the password in the database in v4.x any longer (well .. .that's mainly to save myself from having an idiot discussion with people who think their harddisks need to be encrypted so they can safely run malware).

And hence the push for OAUTH2: not so much a security improvement, but rather a way to shut 3rd party cleints out by revoking their API keys.

That wouldn't be an issue. We are talking post auth here. All Google could do is invalidate the cookie and force a new login.

Sounds like a great way to throw money out of the window. Luckily it doesn't seem nescessary for now due to Google's own fault: Older Androids don't speak OAUTH2 and most of them will never see an update. So as long as Jelly Beans still have a significant market share, Google can't entirely shut off ClientLogin.
[Android Apps and Games] bigsupersquid:
yep. i even still have devices stuck running froyo when they're factory stock (and one old tab that never got updated from eclair) and at least one ice cream sandwich tab.

if they ever completely shut down the old login methods a bunch of cheap people like me will raise a small public havoc for them...

appreciate feedback on feedback, was just my 2 cents worth off the top.
[Android Apps and Games] bigsupersquid:
just as an fyi for the pc-less technically inclined

using the same Google account as microg/blankstore, and my physical device android id as gsf id (retrieved with "com.redphx.deviceid" app, but com.evozi.deviceid lists a different Android id with the output previous app showing as gsf id. go figure.) for both blankstore and raccoon

armv6 raspbian linux with lxde, and xserver-xsdl

but i figure any distribution should work

using armv6 java from Oracle

i can run raccoon directly on my Android device in chroot with xserver-xsdl gui.

it is a very short step from there to "pm install" downloaded apps, no pc involved at any stage.

now I've got two open source Google play app download methods on my device.

thanks again for the awesome work!
[Android Apps and Games] billb1234:
3.6 showing "Bad credentials" due to UNKNOWN_ERR (new Raccoon user)

Trying out Raccoon (v3.6) for the first time, but joining the party right after Google changed their auth API so not sure if I'm doing something wrong or if Raccoon 3.6 is still struggling with the auth API changes.

I set up a dummy gmail account; it has "Allow less secure apps: ON" and "2-step verification: OFF". Can't get past the initial "Bad credentials" message on the initial screen. (I also set up a second dummy account; same problem.)

The error message behind the scenes is "java.util.concurrent.ExecutionException: com.akdeniz.googleplaycrawler.GooglePlayException: Error=UNKNOWN_ERR", which is different than the "java.util.concurrent.ExecutionException: com.akdeniz.googleplaycrawler.GooglePlayException: Error=BadAuthentication" error that is shown when I intentionally use a bad password, so it seems like the user account is good and the authentication is working? Do I need to set anything else up in order to connect properly?

FWIW, looks like Google is returning a 404 status on valid user information, as shown below in Fiddler HTTP capture. (I'm assuming the "11 below" is the associated code for whatever UNKNOWN_ERR it is throwing?)

HTTP/1.1 404 Not Found
Content-Type: text/plain; charset=utf-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Fri, 10 Jun 2016 16:52:03 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Accept-Ranges: none
Vary: Accept-Encoding
Transfer-Encoding: chunked

11
Error=UNKNOWN_ERR
0

Is there something else I need to do?
[Android Apps and Games] onyxbits:
... /sigh
[Android Apps and Games] pbeckmann:
Hey

I just tried to download an App via Raccoon. No problems in my side.

Greetings
[Android Apps and Games] theyupp:
Same problem here. I created a new Google account yesterday and Raccoon fails already at first Login. It seems, that there's something wrong with the ANDROIDID. After patching that in code, it continues but fails later.
[Android Apps and Games] bigsupersquid:
raccoon is working fine for me.

previously set up archive and generating new archive.

using old Google accounts though. two different ones.

the older account i just set up two different archives for, one with my device gsf id and one with raccoon generating the gsf id, and both auth and download just fine.
[Android Apps and Games] billb1234:
The "Bad Credentials" / UNKNOWN_ERR problem seems to be related to whether the dummy account has been associated with Play, or something else related to making it "real". I installing Play Services on an Android Emulator image, opened the "Play" app on the Emulator, then logged in to the Play store with my new "dummy1" account. I grabbed the GSF ID from the Emulator image, then I was able to log in successfully with Raccoon using the "dummy1" account and the Emulator's GSF ID.

Also, once I had been able to connect properly with Raccoon the first time, I was able to connect with a new archive and a generated GSF ID using the same "dummy1" account.

---------- Post added at 01:23 PM ---------- Previous post was at 12:42 PM ----------

Looks like the same trick you used to get Raccoon to work around the OAUTH2 restriction (by telling Play that this is an older device) works for DummyDroid as well.

Changing lines 191 and 237 of GooglePlayAPI.java from

{ "sdk_version", "21" }, }, null);

to

{ "sdk_version", "17" }, }, null);

lets DummyDroid successfully connect and generate new GSF ID's. (I would send you a PR but I'm not really set up to do that very well yet.)

(This still requires that the account has already been connected to Play, but as long as Play already "knows" about the dummy account, everything seems to work fine.)

---------- Post added at 01:36 PM ---------- Previous post was at 01:23 PM ----------

Aaaaaaaand ... it looks like "mfonville" already discovered this (that the API change works for DummyDroid as well) plus added some other tweaks and to DummyDroid. [ see github.com/mfonville/dummydroid - I haven't been on here for long enough that I can add real links to post... ]
[Android Apps and Games] billb1234:
Correct, "dummy1" is a brand new account that I created just to try downloading via Raccoon. Could not connect via Raccoon 3.6 (kept getting that UNKNOWN_ERR error) until I used that "dummy1" account to connect to Play via the Play app on an emulated device. Once I did that, I can connect, generate new GSF ID's, register all sorts of other test devices, etc.

I also could not connect via DummyDroid (using that same "dummy1" account) until I made that same OATH2 "SDK 17" change to the DummyDroid code; once I did that, I could successfully connect via DummyDroid with that "dummy1" account.
[Android Apps and Games] onyxbits:
Hm,

I'm having some minor success here taking taking the logging proccess apart. Nothing so far you could produce a patch with, but at least I seem to have found an easy workaround for the problem. Hope that helps.
[Android Apps and Games] billb1234:
Did you do anything after logging in to the Play web site? I can't seem to get that method to work on new accounts...
[Android Apps and Games] onyxbits:
Log out completely and log in from here (though it might be that my experimenting on that accoutn triggered something, in whcih case I spoke too soon).

Unfortunately, I cannot retrace my steps atm because Google wants a telephone number from me atm to register new accounts.
[Android Apps and Games] onyxbits:
I think, I have a bugfix. Unfortunately, I can't test it till Google allows me to generate accounts without a phonenumber again. If someone feels like creating a throw away account for me -> PM
[Android Apps and Games] bigsupersquid:
pm'd
[Android Apps and Games] billb1234:
No luck here trying to generate a new throwaway account - Google wants my phonenumber now too for some reason. Not sure what they are using to detect that it's still "me" - I tried creating an account using different browsers, different machines, even going out via a VPN connection and creating an account using the browser in a KitKat 4.4.2 emulator image, but still getting blocked by Google. Hopefully it's just a time-based thing and it will open back up again in the near future?
[Android Apps and Games] onyxbits:
By my experience it's a temporary issue. They probably do this on an IP address level (likely on the whole subnet if one address creates to many accounts).

That being said: I might probably burn through several on this one and my first attempts were unsuccessful (it's all really trial and error here).
[Android Apps and Games] onyxbits:
New release! I'm not quite happy with it as you still have to jump through one non-obvious hoop manually, but at least it should work again with new accounts.

Release notes here.
[Android Apps and Games] onyxbits:
A few people informed me that Raccoon got stuck for them on the login screen, but didn't follow up on it. If anyone can confirm that, and more importantly, provide a stack trace, please share.

In order to get a stacktrace, you need to start the .jar version from a commandline.
[Android Apps and Games] billb1234:
Works fine for me - no hanging on login, just connected right through.

Thanks!
[Android Apps and Games] Portgas D. Ace:
[MENTION=5035576]onyxbits[/MENTION]:

Trend Micro OfficeScan pushes a warning every time I try to run v3.7, identifying Raccoon as ransomware (system: Windows 7) :confused::eek:

This hasn't been the case for v3.6 or any other version before.

Any information/thoughts about it?
[Android Apps and Games] onyxbits:
Sure, check out the source code for v3.6 and v3.7 from github. Compare the two versions and you'll find that they only differ in one GUI translation string and an added HTTP header when talking to Google (this is why I publish my source code: so everyone can audit!). In other words: you are getting a false positive from Trend Micro. Why you'd trust their software in the first place is beyond me. All AV products are snakeoil riding on the user's fear as their business model (and giving the occasional false positive has the nice psychological effect of giving the user the impression the snake oil actually does what it is suppose to do).
[Android Apps and Games] Portgas D. Ace:
Thanks for the response :good:

I do indeed trust you and already guessed that it is a false positive. Nevertheless, I am forced to use the AV program at my work place (obviously), so I have to stick with v3.6 there as v3.7 gets blocked as soon as I open it. At home, I am able to use v3.7 without issues.
[Android Apps and Games] onyxbits:
Ah, I see.

Sticking with v3.6 should be no problem. The only difference to v3.7 is that you are stuck with "legacy" accounts. Alternatively, you could also use the .jar version. The .exe is just a wrapper and i assume that is actually the part, Trend Micro mainly triggers on.
[Android Apps and Games] Portgas D. Ace:
Using the .jar version works just fine :good: AV doesn't get triggered. Thanks for this little hint.
[Android Apps and Games] :
The search has performed poorly lately, for example search string "crossy road" (Crossy Road app has +50,000,000 install on Google Play; Disney Crossy Road +10,000,000) and "jetpack joyride" (Jetpack Joyride +100,000,000) don't return the applications. I also noticed this issue with Blank Store, I remember Raccoon's search working flawlessly.

I've read your article, the apps definitely aren't geo-blocked in my country. I don't believe the developers have excluded "Samsung smartphone" either.
[Android Apps and Games] onyxbits:
I seem to have no problems with those apps using Raccoon v3.7
[Android Apps and Games] onyxbits:
On a related note: I'm also in the process of rewriting Dummydroid, a companion tool for spoofing arbitrary Android devices. Any artists around here willing to contribute an application icon (must be in SVG format and under a creative commons license)?
[Android Apps and Games] theyupp:
3.7 did it

3.7 solved the problem her. Anything else (log in into play store directly...) didn't. Thank you.
[Android Apps and Games] bigsupersquid:
just for testing, made new Google account through the link on the raccoon release page.

it didn't require me to use phone verification this time, but it has the last two times previous.

turned on less secure apps in settings, two step verification defaults to off.

autogenerated gsf id, raccoon 3.6 had the expected bad credentials error on login. 3.7 worked just fine, also as expected. [MENTION=5035576]onyxbits[/MENTION], what kind of graphic are you interested in for dummydroid? notwithstanding my 7 year old 8bit ms paint avatar I've got on all the forums i frequent, i can actually generate decent stuff when motivated.
[Android Apps and Games] onyxbits:
Yeah, the phone verification is temporary. Google seems to apply it to a whole subnet when one IP address in it goes over the account creation quota. Two days later or so they take it back as it costs them money and new users. Curious thing is: when you sign up with Android, you are spared the ordeal and potentially have to submit less personal information. So that's what I'm working on currently ;): Putting account creation in DummyDroid.

Raccoon v3.6 will always fail with new accounts, no matter what. I spoke a bit too soon there. After a bit more digging it looks like that when you signed up for an account previously, you'd implicitly accept the TOS of Play. That's no longer the case unless you sign up from the Play website directly. Actually, I think that's a good change.

As for the icon: pretty much something that can show in the taskbar and the window title (so it must scale from 16x16 to 64x64). I don't particularly care what it is, I just want to get rid of the default Java icon. Maybe some variation of the Android Robot?
[Android Apps and Games] nussbaum:
A crash test dummy's head? With those circular measuring markings...

Sorry i am no artist.