A step in the right direction?

play-services-core/src/main/kotlin/org/microg/gms/cryptauth/SyncKeysRequest.kt

@@ -3,6 +3,7 @@ package org.microg.gms.cryptauth
 import android.accounts.Account
 import android.app.KeyguardManager
 import android.content.Context
+import android.util.Base64
 import android.util.Log
 import com.google.android.gms.BuildConfig
 import com.google.android.gms.common.Scopes
@@ -28,26 +29,33 @@ import org.microg.gms.profile.Build
 import java.io.IOException
 import java.net.HttpURLConnection
 import java.net.URL
+import java.security.KeyPairGenerator
+import java.security.MessageDigest
 import kotlin.math.roundToInt
 
 private const val SYNC_KEY_URL = "https://cryptauthenrollment.googleapis.com/v1:syncKeys"
 private const val API_KEY = "AIzaSyAP-gfH3qvi6vgHZbSYwQ_XHqV_mXHhzIk"
 private const val CERTIFICATE = "58E1C4133F7441EC3D2C270270A14802DA47BA0E"
 private const val TAG = "SyncKeysRequest"
 
-private const val GCM_REGISTER_SENDER = "745476177629"
-private const val GCM_REGISTER_SUBTYPE = "745476177629"
-private const val GCM_REGISTER_SUBSCRIPTION = "745476177629"
+private const val GCM_REGISTER_SENDER = "16502139086"
+private const val GCM_REGISTER_SUBTYPE = "16502139086"
+private const val GCM_REGISTER_SUBSCRIPTION = "16502139086"
 private const val GCM_REGISTER_SCOPE = "GCM"
+private const val GCM_REGISTER_CLIV = "iid-202414000"
+private const val GCM_REGISTER_INFO = "0wqs6iYsl_URQEb1aBJ6XhzCbHSr-hg"
 
-private const val AFTER_REQUEST_DELAY = 500L
+private const val RSA_KEY_SIZE = 2048
+
+private const val AFTER_REQUEST_DELAY = 750L
 
 suspend fun syncCryptAuthKeys(context: Context, account: Account): JSONObject? = syncCryptAuthKeys(context, account.name)
 suspend fun syncCryptAuthKeys(context: Context, accountName: String): JSONObject? {
 
  val lastCheckinInfo = LastCheckinInfo.read(context)
 
  // Instance ID token for use in CryptAuth query
+ val instanceId = generateAppId()
  val instanceToken = completeRegisterRequest(context, GcmDatabase(context), RegisterRequest().build(context)
  .checkin(lastCheckinInfo)
  .app("com.google.android.gms", CERTIFICATE.lowercase(), BuildConfig.VERSION_CODE)
@@ -57,22 +65,22 @@ suspend fun syncCryptAuthKeys(context: Context, accountName: String): JSONObject
  .extraParam("subtype", GCM_REGISTER_SUBTYPE)
  .extraParam("X-subtype", GCM_REGISTER_SUBTYPE)
  .extraParam("app_ver", BuildConfig.VERSION_CODE.toString())
- .extraParam("osv", "30")
- .extraParam("cliv", "iid-202414000")
+ .extraParam("osv", "29")
+ .extraParam("cliv", GCM_REGISTER_CLIV)
  .extraParam("gmsv", BuildConfig.VERSION_CODE.toString())
+ .extraParam("appid", instanceId)
+ .extraParam("scope", GCM_REGISTER_SCOPE)
  .extraParam("app_ver_name","%09d".format(BuildConfig.VERSION_CODE).let {
  "${it.substring(0, 2)}.${it.substring(2, 4)}.${it.substring(4, 6)} (190800-{{cl}})"
  })
- .info("s_mGjPgQdoQeQEb1aBJ6XhxiEx997Bg")
- .extraParam("scope", GCM_REGISTER_SCOPE)
+ .info(GCM_REGISTER_INFO)
  ).let {
  if (!it.containsKey(GcmConstants.EXTRA_REGISTRATION_ID)) {
  Log.d(TAG, "No instance ID was gathered. Is GCM enabled, has there been a checkin?")
  return null
  }
  it.getString(GcmConstants.EXTRA_REGISTRATION_ID)!!
  }
- val instanceId = instanceToken.split(':')[0]
 
  // CryptAuth sync request tells server whether or not screenlock is enabled
  val cryptauthService = AuthConstants.SCOPE_OAUTH2 + Scopes.CRYPTAUTH
@@ -172,12 +180,28 @@ suspend fun syncCryptAuthKeys(context: Context, accountName: String): JSONObject
  }
 }
 
+/**
+ * Generates an app / instance ID based on the hash of the public key of an RSA keypair.
+ * The key itself is never used.
+ */
+fun generateAppId(): String {
+ val rsaGenerator = KeyPairGenerator.getInstance("RSA")
+ rsaGenerator.initialize(RSA_KEY_SIZE)
+ val keyPair = rsaGenerator.generateKeyPair()
+
+ val digest = MessageDigest.getInstance("SHA1").digest(keyPair.public.encoded)
+ digest[0] = ((112 + (0xF and digest[0].toInt())) and 0xFF).toByte()
+ return Base64.encodeToString(
+ digest, 0, 8, Base64.URL_SAFE or Base64.NO_WRAP or Base64.NO_PADDING
+ )
+}
+
 fun Context.isLockscreenConfigured(): Boolean {
  val service: KeyguardManager = getSystemService(Context.KEYGUARD_SERVICE) as KeyguardManager
- if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.M) {
- return service.isDeviceSecure
+ return if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.M) {
+ service.isDeviceSecure
  } else {
- return service.isKeyguardSecure
+ service.isKeyguardSecure
  }
 }