onyxbits / raccoon Goto Github PK

Currently, Raccoon stores credentials plain-text in plain-view, which poses a security risk (at least on systems with multiple users). Would you consider …

• adjusting file permissions (on *nix systems) to keep "others" out? Instead of 664 for the credentials file, I'd suggest 600 (full access for owner, no access for anyone else). This should be easy to achieve.
• ask the user whether to store the password (and offer means to revert a decision on this). What's not stored cannot be copied ;) Again, relatively easy to do.
• use some encryption on stored passwords might be an option as well – though that rises the question of how to make that transparent, bi-directional and safe at the same time (you'd need to decrypt the password for the login). So this would be more difficult to achieve.

I'd recommend a combination of the first two items: number one definitely increases security without "impact" on the user, and number two is up to the user then.

Raccoon sounded pretty neat. I have an old phone (can't afford to upgrade it), so the google play store no longer runs on it. I thought I could use Raccoon to get an apk that I could sideload.
But it seems that would require dummydroid to build an old profile, and that evidently requires purchasing a licence.

Yes, i saw the blog post on `why free doesn't mean free support'. But this isn't support. It's not a bug report. It's a feature. And after 20 minutes of searching the website, I couldn't find anything about needing to purchase a licence to use it.
Feels bad, man.

The repository is missing a pom.xml to build with Maven.

I wrote one myself, and that was all that was needed.

Is part of your move to a freemium and paid feature model mean you will no longer release the free version, currently with JAR builds available on your site at 4.2, going to be mirrored here so we can review the source and help out? The current version available at the time of this report is 3.7 judging from your last commit to update the version string from 3.6 to 3.7.

I believe you deserve money, but I like to support open developers first. I for one will donate to you ASAP if you intend to continue releasing the source to the free components.

The SHA-1 checksums in your README file are all outdated.
It would great if you could update them from time to time.

Raccoon can automatically update all .apks in its archives. It'd be pretty handy to have a way to utilize adb and update .apks on the connected device within the app.

The account was previously working, but now it says "BadAuthentication". I tried with a brand new account. It says the same.

NOTE: I haven't changed my password or did any update to the old account

Doesn't seem to run cleanly, could be java issue.

Hi.

It would be great to be able to search apps (or directly download it) by entering its bundle ID in the search bar.

Let's take an example.
Suppose one wants to download https://play.google.com/store/apps/details?id=com.sonymobile.screenrecording.

If you search for Live screen streaming or Sony Mobile Communications, you can go up to the fiftieth search page with no luck. Why ? Because the application itself cannot even be found via the desktop Play Store.
I don't know why, I found this link via Sony's official blog on an announce about Xperia software updates.

The truth is a lot of applications cannot be found the conventional way. But if you can get an app's bundle ID in any fashion, you have at my knowledge 99.5% to find it by directly guessing its desktop Play Store's URL.
If the application is paid, there is no way to download it and even when free, you may fail to find it (it happened to me once, though there was a redirection in my Xperia Z3+'s Sony custom Android that linked to a Play Store, meaning that it wasn't an app from a '2.5th' or third-party source).
I think it might not be an issue that either only concerns not-vanilla OS built-in apps or only touches manufacturer custom Android-dedicated ones as there are rare Nexus-exclusive apps that do need their updates on the Play Store and apparently do have Play Store URL but no way to find them via conventional search ways — neither on the mobile app nor on the desktop Play Store (but it'd be better to get feedback from Nexus tinkerers).

I know little to the Android universe so I cannot say whether this is possible or not, though.

Thanks.

Edit (feb. 20th, 2016, 11h7 A.M.) : About this direct download thing… Why not just allow an input of a raw text file containing one app bundle identifier per line that would start download them all, one by one ? Of course, said like that, it's easy as can be. Write it down and get it working is another story. But you get the idea.
I wonder if that could help with pulled apps (such as E.A.'s zzSunset-flagged apps).

When I run java -jar raccoon-3.5.jar -a ../Raccoon/archives/default -u I'm starting to get this error more frequently.

com.akdeniz.googleplaycrawler.GooglePlayException: Error=BadAuthentication
    at com.akdeniz.googleplaycrawler.GooglePlayAPI.executeHttpRequest(GooglePlayAPI.java:582)
    at com.akdeniz.googleplaycrawler.GooglePlayAPI.executePost(GooglePlayAPI.java:540)
    at com.akdeniz.googleplaycrawler.GooglePlayAPI.executePost(GooglePlayAPI.java:519)
    at com.akdeniz.googleplaycrawler.GooglePlayAPI.login(GooglePlayAPI.java:228)
    at de.onyxbits.raccoon.App.createConnection(App.java:132)
    at de.onyxbits.raccoon.CliService.doUpdate(CliService.java:139)
    at de.onyxbits.raccoon.CliService.run(CliService.java:115)
    at de.onyxbits.raccoon.App.main(App.java:83)

I've definitely checked my Google Account and Password and it's definitely valid, I can login through the app.

Update: Just confirmed it looks like some sort of glitch at Google's end. Not sure what's causing it. Sometimes it works sometimes it doesn't.

The download site is served over http and md5 is vulnerable to collision attacks

I recommend using your public key if you have one to sign your files or use sha256 or higher to generate checksums and put them in a file and sign that with your public key.

Any signatures on a http page would be useless because http offers no protection and the page content and signatures can be changed but if the applications or a signatures file were signed by you their integrity could be cyptographically verified before installing.

You could also include the signatures in the github readme for the latest versions as github has https. If you sign the applications with your public key you could also include the key fingerprint in readme so users could verify your key.

Thank you for your work

I just tried the CLI for importing several apps into my archive. I created a file with the following content

https://play.google.com/store/apps/details?id=org.wikipedia

and ran the CLI

java -d64 -jar raccoon-3.5.jar -u -a ~/Raccoon/archives/default -i app-list.txt

but no apps were download nor did it give any output whatsoever.

Downloading the one app directly with the -f switch worked absolutely fine. Do you have any idea, why this is not working?

I'm on Debian and I've just tried to login to my Google account in Raccoon, but unfortunately I am unable to paste my account password in the field. The password consists of all kinds of special characters and is very long, so entering it manually is nearly impossible (there's also no way to actually see what I'm typing in the password field).

Perhaps this is something I can fix on my end, that currently prevents me from pasting into the password field?

Hi, unfortunately I'm not able to search for apps at certain GSF IDs. The IDs were generated by DummyDroid. When I set up a new account with a random ID, app search works perfectly, but I have to use the correct ID as my phone is giving me parsing errors for some apps.
With the IDs from DummyDroid there are always "no results", no matter what I'm looking for, in raccoon.
I'm using Windows 7, raccoon-4.1.4.exe, Samsung Galaxy N7100.
Thanks, I really appreciate your work and of course I have purchased a code :)

For users with Java 1.6, Raccoon starts up, but it throws an exception the moment someone searches for an app.

This is because, in ListView.java, line 48, there's a call to a method that doesn't exist in Java 1.6. ( javadoc link )

comp.setBorder(BorderFactory.createLineBorder(Color.DARK_GRAY, 2, false));

Change that one line to this and it will compile, run, search, and download properly.

comp.setBorder(BorderFactory.createLineBorder(Color.DARK_GRAY, 2));

Thanks for your efforts. I attempted to run Raccoon on an Ubuntu server (CLI) and it says 'No profile to connect with.'. Is there a way to set google play credentials? If possible, can you please make it compatible for CLI usage? Thanks in advance.

I have tried multiple times to start the login with my gmail credentials, but I fail every time. I guess the project might not be maintained and the newest login procedure from google is not implemented.

Is there any chance to get an apk from the google play store?

Using Windows 7 and the JAR executable.

As of 3.5, subsequent launches of Raccoon after signing into an account and downloading an app will recreate the folder used for the last archive, whether or not it exists.

Along with preferences being stored in the registry (non-portability; leaves traces on removal of the JAR file), this causes a bit of a head scratcher when setting up the raccoon.home directory after creating an archive and having deleted it.

My expected result is that a new archive is created based on the currently used data directory.

(Basically, add a check to see if (new File(tmp)).exists() before creating an Archive somewhere near this line, passing it to the else statement if it doesn't exist.)

We can help you out by providing pull requests before you upload a final build.

At least when using the terminal, when Raccoon does an update, it won't give a warning if the package isn't available on Google Play.

Opened this issue and found commandline help here http://www.onyxbits.de/content/command-line-usage
Closing this!

Thank you for your work!

On version 2.3 (built from source) I can do racc -a . -f tv.arte.plus7,211142203,1 successfully but on 3.0 it says "Failure: null"

Hello,

is there a way to download e.g. the top 100 free apps without the need of selecting one by one?

Thanks

I have been getting Authentication Error when trying to update apps

Serious security issue: the proxy option is only used by some connections. This is the netstat of a session:
java 123 user 0t0 TCP myhostnme:50300->lhr25s07-in-f1.1e100.net http (ESTAB) java 123 user 0t0 TCP localhost:50105->localhost 8118 (ESTAB) java 123 user 0t0 TCP myhostnme:32365->lhr25s07-in-f1.1e100.net https (ESTAB) java 123 user 0t0 TCP myhostnme:32366->lhr25s07-in-f1.1e100.net https (ESTAB) java 123 user 0t0 TCP myhostnme:32367->lhr25s07-in-f1.1e100.net https (ESTAB) java 123 user 0t0 TCP myhostnme:54313->lhr25s07-in-f1.1e100.net http (ESTAB) java 123 user 0t0 TCP localhost:50105->localhost 8118 (CLOSE_WAIT)
Notice all the connections directly from myhostnme to google. Only two connections actually use the proxy.

Also, it's very insecure to have users create a network.cfg file, and then have to trust/hope that it will be found and used. This exposes all real IPs of all users the first time the program executes, because the credentials.cfg must be created first, so that network.cfg can be put in the same directory for the next run. The format of credentials.cfg is also undocumented, so even cautious users have no way of pre-empting the leak.

At a bare minimum, there needs to be a commandline switch so a user can dictate that everything fail if a proxy connection is not established for any reason.

Please Ad the in "numbers" the rating of the app under the gauge directly without the need to hover on the icon to see it, it would be more easy to find new apps with better rating especially when their score is around "4".

Maybe just put it as an option if you think some will not like it.

Thanks for this very useful utility 😺

Regards

• When searching for an app, show app package name (as well as app name, developer name). It can be useful for identifying exact app or apps with similar name.
• Show minimum required Android version (or SDK version) for the current device profile, in the app info. section. so that it's possible to know compatible Android version before downloading the app. (especially when using a generic device profile which sdk version is not known)
• Also display search results in different view (List, Details view: with more info about app,..)

Dear all,

Thank you very much for this piece of software!

I would like to use it on my Ubuntu desktop to download an apk file for my Fairphone device.

However, I am too inexperienced to know how to run Raccoon on Ubuntu.

Could someone assist me?

Thankfully,

~Robert

I'm trying to locate some apps that I know exists in my country (Pokémon GO) and does not appear in Racoon.

I updated to 3.0 and running java -jar /dir/raccoon.jar in my archive (containing valid credentials) showed me the username and password fields. Later, I launched the open archive dialog and selected my archive and ever since then when I run java -jar /dir/raccoon.jar I am shown only the search dialogue. I don't see how this is possible, but anyway ;-). I don't see any cache or ext directory in my old archive either.

Edit: I expected raccoon to take the archive from the directory it's run from but it takes the archive from the last one opened via the gui. This is quite confusing, so I'll leave the issue open.

Add new tab called "Play Store" and Load https://play.google.com/store as WebBrowser.

There will be no further development on Raccoon v3. This repository is only kept here for legacy reasons. Development on Raccoon v4 is continued in another repository:

https://github.com/onyxbits/raccoon4/

Please head over there.

Hello @onyxbits

Could you update the checksums for the latest version of raccoon when you get a chance.

Thank you

Hi, there!

We are a research team working on third-party library analysis. We have found that some widely-used third-party libraries in your project have major/critical bugs, which will degrade the quality of your project. We highly recommend you to update those libraries to new versions.

We have attached the buggy third-party libraries and corresponding jira issue links below for you to have more detailed information. We have analyzed the api call related to the following libraries and found one library that is using the API call that might invoke buggy methods in the library of the history.

1. org.apache.httpcomponents httpclient
   version: 4.2.3
   API call in your project:org.apache.http.conn.ssl.SSLSocketFactory.createDefaultSSLContext()

Jira issues:
GzipDecompressingEntity does not release InputStream when an IOException occurs while reading the Gzip header
Unable to shutdown executor service used by AsynchronousValidator
FileNotFoundException on Cached Variant
HttpClient -> local address binding does not work correctly
Certificate verification rejects IPv6 addresses which are not String-equal
SSLSocketFactory.createSystemSSLContext causes java.security.UnrecoverableKeyException: Password verification failed
SSL handshake exceptions are hidden from application
2. commons-logging commons-logging
version: 1.1.1
Jira issues:
Unit tests fail on linux with java16
deadlock on re-registration of logger
Potential missing privileged block for class loader
Log4JLogger uses deprecated static members of Priority such as INFO
LogFactory/LogFactoryImpl ingore Throwable
LogFactory.nullClassLoaderFactory is not properly synchronized
SimpleLog.log - unsafe update of shortLogName
BufferedReader is not closed properly
3. commons-cli commons-cli
version: 1.2
Jira issues:
Unable to select a pure long option in a group
Clear the selection from the groups before parsing
Commons CLI incorrectly stripping leading and trailing quotes
Coding error: OptionGroup.setSelected causes java.lang.NullPointerException
StringIndexOutOfBoundsException in HelpFormatter.findWrapPos
HelpFormatter strips leading whitespaces in the footer
OptionBuilder only has static methods; yet many return an OptionBuilder instance
Unable to properly require options
Download link gives HTTP/1.1 403 Forbidden
OptionValidator Implementation Does Not Agree With JavaDoc
4. commons-io commons-io
version: 2.4
Jira issues:
IOUtils copyLarge() and skip() methods are performance hogs
CharSequenceInputStream#reset() behaves incorrectly in case when buffer size is not dividable by data size
[Tailer] InterruptedException while the thead is sleeping is silently ignored
IOUtils.contentEquals* methods returns false if input1 == input2; should return true
Apache Commons - standard links for documents are failing
Links are broken on User Guide....
FileUtils.sizeOfDirectoryAsBigInteger can overflow
Regression in FileUtils.readFileToString from 2.0.1
Correct exception message in FileUtils.getFile(File; String...)
org.apache.commons.io.FileUtils#waitFor waits too long
getPrefixLength return -1 if unix file contains colon
FilenameUtils should handle embedded null bytes
Exceptions are suppressed incorrectly when copying files.

Sincerely~
FDU Software Engineering Lab
Marth 14th,2019

I am trying to mimic an Nvidea Shield TV (Android TV), after a while finally found this app showing a GSF ID.

I do have problems forming a correct user agent. Can't find anything in the documentation. Is there a method for doing this and if so, how?

Thanks

hi , this i amazing software
can you offer download app via terminal in linux ( ubuntu )
like gplaycli
gplaycli -f /home/user -d com.supercell.boombeach

I love using Raccoon, but it would be great if it can output metadata (based on the 'Details' section) somehow in the CLI for developers to work with.

When selecting the archive as documented here (but without the "-u"):

http://www.onyxbits.de/content/there-way-update-my-archives-nightly

java immediately terminates. The only way to select the archive is after launching the default archive, then in the GUI selecting "File >> Open archive".

$ java -version
java version "1.7.0_95"
OpenJDK Runtime Environment (IcedTea 2.6.4) (7u95-2.6.4-1~deb8u1)
OpenJDK 64-Bit Server VM (build 24.95-b01, mixed mode)

Hi there,

thanks for the nice program. I have a feature request which would make racoon really a killer app for me. If there would be a tiny http builtin server (plugin?) which provides the downloaded or even full Google play store as an fdroid.org repository then there wouldn't be any need to run the Google framework software on the phone any more. Just let racoon run on some computer and let the fdroid.org client handle the download and installation on the Android device.

Hello.

I discovered Raccoon today. When I logged in for the first time, it added a Samsung Galaxy Note 5 as my actual device.

Would it be possible to add an option to use the device you want to into Raccoon?

I don't know yet where to look further (yet), but I realized that roughly around the moment when Google released the Play Services 9.x shortly after I started into having issues with Raccoon in CLI mode which always. Currently on CLI get the following message when trying to update:

com.akdeniz.googleplaycrawler.GooglePlayException: Error=UNKNOWN_ERR
[....]
at de.onyxbits.raccoon.App.main(App.java:83)

In GUI mode all I get with a fresh raccon is that it cannot log into the account anymore. I checked that the account(s) in use could indeed still log into web portals of the play store so they should be OK.

The library you are using in raccoon in order to talk to the Play Store doesn't seem to have gotten much love lately so possibly Google made some breaking changes lately.

If I can provide you with additional debug messages I'm happy to help - I'd be interested in hearing if the issue is reproducible other than on my Linux (OpenJDK 8) and Windows (Oracle JRE 8) system I tested on.

Can't authenticate though login&password are both correct
4.18
Simply doing as you stated at your blog isn't enough
There are no log-in attempts to allow.
https://raccoon.onyxbits.de/blog/bad-authentication-google-account-blocked/

java.lang.RuntimeException: org.apache.http.client.ClientProtocolException: BadAuthentication
	at de.onyxbits.raccoon.setup.LoginLogic.onDone(LoginLogic.java:138)
	at de.onyxbits.raccoon.setup.WizardWorker.done(WizardWorker.java:42)
	at javax.swing.SwingWorker$5.run(Unknown Source)
	at javax.swing.SwingWorker$DoSubmitAccumulativeRunnable.run(Unknown Source)
	at sun.swing.AccumulativeRunnable.run(Unknown Source)
	at javax.swing.SwingWorker$DoSubmitAccumulativeRunnable.actionPerformed(Unknown Source)
	at javax.swing.Timer.fireActionPerformed(Unknown Source)
	at javax.swing.Timer$DoPostEvent.run(Unknown Source)
	at java.awt.event.InvocationEvent.dispatch(Unknown Source)
	at java.awt.EventQueue.dispatchEventImpl(Unknown Source)
	at java.awt.EventQueue.access$500(Unknown Source)
	at java.awt.EventQueue$3.run(Unknown Source)
	at java.awt.EventQueue$3.run(Unknown Source)
	at java.security.AccessController.doPrivileged(Native Method)
	at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(Unknown Source)
	at java.awt.EventQueue.dispatchEvent(Unknown Source)
	at java.awt.EventDispatchThread.pumpOneEventForFilters(Unknown Source)
	at java.awt.EventDispatchThread.pumpEventsForFilter(Unknown Source)
	at java.awt.EventDispatchThread.pumpEventsForHierarchy(Unknown Source)
	at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
	at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
	at java.awt.EventDispatchThread.run(Unknown Source)
Caused by: org.apache.http.client.ClientProtocolException: BadAuthentication
	at com.akdeniz.googleplaycrawler.Identity.doPost(Identity.java:191)
	at com.akdeniz.googleplaycrawler.Identity.signIn(Identity.java:152)
	at com.akdeniz.googleplaycrawler.GooglePlayAPI.login(GooglePlayAPI.java:319)
	at de.onyxbits.raccoon.setup.LoginLogic.onDoInBackground(LoginLogic.java:88)
	at de.onyxbits.raccoon.setup.WizardWorker.doInBackground(WizardWorker.java:36)
	at javax.swing.SwingWorker$1.call(Unknown Source)
	at java.util.concurrent.FutureTask.run(Unknown Source)
	at javax.swing.SwingWorker.run(Unknown Source)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
	at java.lang.Thread.run(Unknown Source)

It should detect it but it forces the user to install Java 8 from the Oracle site

Not providing an Android ID will result Raccoon in generating a pseudo device. For me, this device registered in the Play Store as "T-Mobile – US-Samsung GT-I9300". It is eligible to download and install de.sky.snap which the developers restrict to a few Samsung devices.

However, searching in Raccoon for this app does not return the expected app as a result. Is there a workaround? Can one directly view an app by entering its identifier (e.g. de.sky.snap)?

hi there,

java doesn't take the argument.
java -Draccoon.homedir=/tmp -jar raccoon-3.5.jar creates always a dir in ~
java -version
java version "1.7.0_79"
OpenJDK Runtime Environment (IcedTea 2.5.6) (7u79-2.5.6-1)
OpenJDK 64-Bit Server VM (build 24.79-b02, mixed mode)

Debian Sid

any ideas how can i change it?

thanks Micha

I have 2-step auth enabled on my account and attempted to use a generated app password to log in with Raccoon. It seems to be successful initially, however I receive the following exception when I try to search for anything:

Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=vrgb java.util.concurrent.ExecutionException: com.akdeniz.googleplaycrawler.GooglePlayException: �3�1Error retrieving information from server. [RH-02] at java.util.concurrent.FutureTask.report(FutureTask.java:122) at java.util.concurrent.FutureTask.get(FutureTask.java:192) at javax.swing.SwingWorker.get(SwingWorker.java:602) at de.onyxbits.raccoon.gui.SearchWorker.done(SearchWorker.java:199) at javax.swing.SwingWorker$5.run(SwingWorker.java:737) at javax.swing.SwingWorker$DoSubmitAccumulativeRunnable.run(SwingWorker.java:832) at sun.swing.AccumulativeRunnable.run(AccumulativeRunnable.java:112) at javax.swing.SwingWorker$DoSubmitAccumulativeRunnable.actionPerformed(SwingWorker.java:842) at javax.swing.Timer.fireActionPerformed(Timer.java:313) at javax.swing.Timer$DoPostEvent.run(Timer.java:245) at java.awt.event.InvocationEvent.dispatch(InvocationEvent.java:311) at java.awt.EventQueue.dispatchEventImpl(EventQueue.java:756) at java.awt.EventQueue.access$500(EventQueue.java:97) at java.awt.EventQueue$3.run(EventQueue.java:709) at java.awt.EventQueue$3.run(EventQueue.java:703) at java.security.AccessController.doPrivileged(Native Method) at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:76) at java.awt.EventQueue.dispatchEvent(EventQueue.java:726) at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:201) at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:116) at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:105) at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:101) at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:93) at java.awt.EventDispatchThread.run(EventDispatchThread.java:82) Caused by: com.akdeniz.googleplaycrawler.GooglePlayException: �3�1Error retrieving information from server. [RH-02] at com.akdeniz.googleplaycrawler.GooglePlayAPI.executeHttpRequest(GooglePlayAPI.java:585) at com.akdeniz.googleplaycrawler.GooglePlayAPI.executeGet(GooglePlayAPI.java:575) at com.akdeniz.googleplaycrawler.GooglePlayAPI.executeGETRequest(GooglePlayAPI.java:474) at com.akdeniz.googleplaycrawler.GooglePlayAPI.search(GooglePlayAPI.java:268) at de.onyxbits.raccoon.gui.SearchWorker.doQuerySearch(SearchWorker.java:139) at de.onyxbits.raccoon.gui.SearchWorker.doInBackground(SearchWorker.java:111) at de.onyxbits.raccoon.gui.SearchWorker.doInBackground(SearchWorker.java:38) at javax.swing.SwingWorker$1.call(SwingWorker.java:295) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at javax.swing.SwingWorker.run(SwingWorker.java:334) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745)

When this occurs, the GUI app prints "authentication error". I am using Raccoon 3.7.