Whatsapp client

[syl...@rentoo.immo]

Hello guys,

Does anyone have a jiophone and can dump the application code? It should be under: /system/b2g/webapps/

[Ivan]

Sylvain, the /system/b2g/webapps folder contain only the pre-installed apps of the system. The Whatsapp client is available only into the Jio Store. We need to see how we can get Jio Repository.

For everybody having a KaiOS based phone you need the same "adb pull" command of Android to copy folders from his phone. In this case, to view how an app is made you need to pull out the folder of the apps in this mode, from PC:

adb pull /system/b2g/webapps

Now you all can see how your preinstalled apps works. Thank you for the attemption.

Ps: Sylvain, I've sent to you that 800 MB file you have asked to me. Open the e-mail. Thank you!

[I Understand I Exist]

dude, even better, he can dump the jio store and we will install it on out nokias

[syl...@rentoo.immo]

Unfortunately It will not work because the Nokia don't have the jio certificate.

[saveNgo]

It is worth to try on Nokia 8110. Here is "JioStore" app, extracted from system.img

Store app is having name : kaios-plus.kaiostech.com

[Ivan]

Hi saveNgo, I've installed your JioStore that now have update my preesisting Store. My result is that the store now is loading without showing me the installable apps. And also the apps installed by the store now are deleted. No problem, I had only 2048 installed (it was the only I think have sense) and Maps was already existing as default system app and is anyway available. All the other available apps of the store sucks, my shortcuts are better ;)

[saveNgo]

Hi Ivan. I hope that you have taken backup of built-in store of Nokia 8110 and roll-back to original version of it.

Sorry to here that JioStore has replaced the original store and have deleted installed apps.

It is quite possible that JioStore is linked with "MyJio" account (just like Google Play is linked with Gmail) to ensure that JioStore is installed and used on Jio Phone only.

May be there is other explanation....

Someone should install JioStore on Nokia 8110 to ensure the results.....(On their own risk....First Backup /system of-course... ;-) )

[Frank A.]

It's even worse, if you go to https://www.browserling.com/jio when logged in with an browserling account you get the following message:

That's right, you need to pay to use https://web.whatsapp.com

Op woensdag 24 oktober 2018 15:32:33 UTC+2 schreef Frank A.:

That's weird man, like jio itself "solved" the whatsapp problem using browserling.
I'm gonna try https://www.browserling.com.jio on my banana, see how far I will come.

Op dinsdag 23 oktober 2018 21:51:05 UTC+2 schreef Ivan:

Hey people! Forget my "Whatsapp shortcut". Anyone know browseling? On this website you can testing a website on other browsers into your browser. I've tryed this website many times on my pc and on my Nokia 8110. Works for every link, but if I put the visualizzation of https//web.whatsapp.com my result is this: look

if you see the address is automatically https://www.browserling.com/jio . On many Reliance Jio Phone videos on youtube (more often them are fakes) people talks about connecting to Whatsapp by Browseling. For me them were all fake videos...but why for the web.whatsapp.com website the result is this (for every OS and every web browser emulated)?

Let me know. It can be only a my impression!

[Vicky]

I don't have much time at the moment but thought about using iframe to display WhatsApp web by modifying the user agent header.
A quick search gave me this result:
https://stackoverflow.com/questions/14787964/setting-a-user-agent-for-an-iframe

When I have more time I will look into it and if I find any usable information I will share it. It could just be that it could take some days or weeks until I can do some research. I would also try to make a website as proof of concept once I find out more.

With this solution you always have to run WhatsApp on another device/computer/VM in the background to be able to use WhatsApp web

[Getz Mikalsen]

I feel like this discussion has taken a wrong turn and turned into ways to use whatsapp web, requiring connection to a smartphone.

Maybe someone could create a simple guide for how to dump the whatsapp application from a jiophone so someone without too much technical knowledge can dump the application for us.

I will first be able to get a hold of a jiophone in early December but maybe someone else already has one.

When I was connected to my 8110 through WebIDE then I was able to see all the installed apps, I didn't look too much into it but maybe it's as simple as that.

Although doing it through adb would definitely be the simplest option only requiring console commands.

I have seen people ask a jiophone user to do "adb pull /system/b2g/webapps/" but as I understand it then that would only dump the preinstalled apps and as whatsapp is a jiostore app then that command would be useless for us.

[speeduploop]

The other way would be to uncompress an official or dumped Firmware-File from a Jio.

[Getz Mikalsen]

Den lördag 3 november 2018 kl. 23:09:56 UTC+1 skrev speeduploop:

The other way would be to uncompress an official or dumped Firmware-File from a Jio.

What does the firmware have to do with whatsapp?

Were not trying to run the Jiophone version of kaios, were just trying to get whatsapp on the 8110 version of kaios.

Whatsapp isnt preinstalled, we could probably get the download package through wireshark or similar if someone has a jiohphone at hand when downloading from the jiostore.

[speeduploop]

At least on my 8110 it seems that the 'Store' isn't an online store... it's a bunch of packages. So the apps are on the phone / in the image - but they aren't active/uncompressed...

If that's the same for the Jio then a Firmware-File could be enough to get the whatsapp-app.

[Getz Mikalsen]

Den lördag 3 november 2018 kl. 23:35:42 UTC+1 skrev speeduploop:

At least on my 8110 it seems that the 'Store' isn't an online store... it's a bunch of packages. So the apps are on the phone / in the image - but they aren't active/uncompressed...

If that's the same for the Jio then a Firmware-File could be enough to get the whatsapp-app.

I don't know what you're basing that off.

I am at least unable to open the kaios appstore without a internet connection and downloading apps does change the used application data on the phone.

And I am pretty certain that the developers of this platform are too inept at programming to pull something like that off.

Also keeping all programs already available on the phone but compressed would be a really stupid move when space is already so restricted..

(not that they care as they bundle in these uninstallable "free games" already)

[speeduploop]

Now that I rechecked - it's half/half... on my device the free games arent 'completely' pre-installed - the zips are in /system/b2g/webapps, but I would need to 'install' them from the store to activate them. But Twitter for example seems to be installed from an online store.

I only had the games in mind...

So yes - it's possible that whatsapp is a 'real' online-install. Then we would need a dump.

Or it comes as part of a FW-Upgrade - then the Image would be ok.

[Getz Mikalsen]

Alright good, then thats somewhat cleared out.

But we still need a simple way for someone to dump the files or where installed applications are located to make it more likely that we get a dump by someone with access to a jiophone.

I would assume that whatsapp is found in the same location as twitter.

[speeduploop]

I don't know enough about the Jio...

On a 8110 it's easy - a prepared 'update.zip' and a sdcard is all you need to dump all partitions.

(i only dumped /system but it works for the others too)

And with adb-root you could just pull everything.

--> but this only works because Nokia/HMD uses the AOSP-Test-Keys for updates by zip from sdcard.

If the Jio uses 'real' keys this won't work.

[speeduploop]

looked a bit around...

In /data/local/webapps/webapps.json (seems to be the store-config) you see that some apps are on-device zips, some apps are loaded as zip from storage.kaiostech.com and some apps are loaded directly from their provider as a PWA/installable website (google-maps for example).

[Getz Mikalsen]

Here is a guide to dump the firmware but I doubt that is needed.

https://garbsch.eu/posts/dumping-the-nokia-8110-4g-firmware/

So for whoever has a jiophone with whatsapp installed then

/data/local/webapps/webapps.json

is the place to look for the install directory?

I want to make this easy for whoever has a jiophone and to avoid any confusion.

Do you SSH into the device or how do you browse it?

[speeduploop]

Yeah, I know this guide - but it's even easier. He is using a custom update-binary - but 'update-binary' can be a script so you don't need a C-Compiler...

The paths for webapps are:

/system/b2g/webapps

/data/local/webapps

I rooted my 8110 (adb root-shell) - the busybox on this phone is quite complete so searching/greping is easy.

So on a 8110 you could just dump those path with an update.zip - or 'adb pull' them on a rooted device.

I don't know how secure the Jio is. It's possible that the Jio isn't as easy to root as the 8110.

[saveNgo]

It is nice to see that people are interested in jailbreaking or rooting Jio Phone to extract Whatsapp...
I have tried almost every possible method to dump Jio Phone data but it seems that phone is highly secured...
For more suggestions, feel free to post on following topic in this same forum:
https://groups.google.com/forum/m/#!topic/bananahackers/4kq32Eanasw

[Getz Mikalsen]

Have you tried capturing the whatsapp file being downloaded with something like wireshark when you start the download.

This might require some experience with the program but there are alot of guides available online.

You could have your PC perform a MITM sort of attack on your phone routing all the traffic through it and then being able to filter and extract the whatsapp download file.

I think this guide would be useful http://blog.eviltester.com/2014/09/using-wireshark-to-observer-mobile-http.html

[Getz Mikalsen]

Also, the comments of that guide includes a way to do it on windows if you need that. 

[saveNgo]

OK Getz, I will try Wireshark Method and post the results soon...

[Sylvain BLOT]

I've worked on dumping apps zip from the 8810 4G store, the connection is made using SSL so you need to proxy the connexion using a software such as Charles proxy, and inject the proxy certificate in b2g, https://github.com/mcnesium/b2g-certificates/blob/master/add-certificates-to-phone.sh + modify your pref file such as: https://developer.mozilla.org/en-US/docs/Archive/B2G_OS/Debugging/Intercepting_traffic_using_a_proxy

Then you will be able to dump the zip, forget about Wireshark, you need to temper your phone.

regards

[speeduploop]

But it seems, that the way to get the zips depends on from were you have to get them... not all zips are comming from the KaiOS-Store.

If I remember right, the whatsapp should get installed if you go to 'web.whatsapp.com' with a Jio from India...

(I tried to adjust User-Agent from PC but it seems I would need an indian VPN/Proxy)

Is there any reason to dump zips from 8110-Store? Why no 'adb-pull'?

(dumping store would be needed for Jio - but the 8110 is 'pullable' when rooted)

[saveNgo]

Thanks Sylyain. I will try this approach too. Just to confirm: Jio Phone have developer mode and adb dissabled.

I have not completely read your mentioned method but lets hope that it does not involve adb commands....

I have downloaded required files. I will post result soon...

[saveNgo]

When typed: web.whatsapp.com in native browser of Jio Phone, page redirects to: https://www.whatsapp.com/

There is download button on official page of redirected Whatsapp. Clicking on it............ does nothing.....

Just thin-blue-coloured loading bar appears on browser top for few seconds and disappears.

Conclusion: Whatsapp in Jio Phone can be installed only using Jio Store. (At-the-Moment...)   :-)

[speeduploop]

That's sad... I couldn't test myself - only read about it.

Then the Proxy-Method could be a way.

[Sylvain BLOT]

Wait there is few stuff to try on a nokia, you can add app installation sources in your pref file:

pref('apps.serviceCenter.allowedOrigins', 'https://kaios-plus.kaiostech.com,app://kaios-plus.kaiostech.com,XXXXXXXXXXXXXXX’);

May be its only because the site is not trusted, would be great to tail the log at the same time.

[Rubén Rodrigo]

Hi! I've just tried connecting from my browser to web.whatsapp.com with a kaios user agent string: "Mozilla/5.0 (Mobile; LYF/F90M/LYF-F90M-000-02-21-131117; rv:48.0) Gecko/48.0 Firefox/48.0 KAIOS/2.0" and through an Indian VPN but I sadly ended up with the same results as saveNgo.

It's a shame that we don't have whatsapp yet, this is what is stopping me from using this nokia as my daily phone. I communicate with friends and family mainly through whatsapp. I don't understand what game Nokia is playing with Kaios. It seems to me that the money google invested was focused on the Indian market

[saveNgo]

After Getz Mikalsen, I have tried Wireshark method to extract Network traffic from my JioPhone.

I think I have sucessfully got hand on the requied netwotk traffic. (Specifically traffic during downloading Whatsapp)

But due to my limited knowledge about data extraction from pcap file, I have difficulty to extract exact whatsapp zip or application file.

pcap file surely contains the app downloaded from JioStore. On wireshark, I have tried to extract data from "Follow TCP Stream" and "Export HTML".

But I am unable to identify the exact file.

I cannot share pcap file because it contains potential information about my device. But.........

If anyone can point me in right direction, I can extract Whatsapp File from pcap soon.

[Rubén Rodrigo]

great! that's wonderful news. Are you sure the traffic between jio store app and their servers is not encrypted? You might have collected a bunch of encrypted packets. Let's hope I'm wrong.

I wonder if they'll ban us if they detect that we are using the app from a non-licensed device out of India...

[syl...@rentoo.immo]

Its encrypted unfortunately.

[saveNgo]

It is possible that network traffic is encrypted... I don't have exact knowledge about it.

-----------------------------------------------

Let me describe what I have done to get hands on Network Traffic: In Detail....

I do not have WiFi adapter attached to my PC. Hence the only available option was (and is) to use rooted android mobile to sniff on JioPhone.

So target device: JioPhone, Sniffing Device: rooted Android Mobile with 'Intercepter-NG' app installed and Internet providing WiFi-Hotspot..... In my case I have borrowed my friend's smartphone Hotspot.

I have connected both target and sniffing mobiles to same WiFi-Hotspot. Using 'Intercepter-NG' app I have captured .pcap file.

Without DNS-Spoof option, .pcap file is around 150KB. On the other hand, With DNS-Spoof, .pcap file is around 3.5MB

-----------------------------------------------

Using Wireshark and NetworkMiner on Windows PC, I have tried to analyse the pcap file but unable to extract files related to Whatsapp.

NetworkMiner shows some extracted .cer files linked with godady.com .

My query is:

If the captured traffic is encrypted, How to decrypt  it? and is decryption method to be applied during capturing or after capture?

I have read tutorial about pcap data extraction using Wireshark. "Follow TCP Stream" provides an option to save file in ASCII, HEX or RAW format.

Lets assume that I have decrypted the traffic. How to detect zip segment of RAW or HEX related to Whatsapp or any application?

[saveNgo]

Hey Sylvain BLOT, few comments ago, you have mentioned about: dumping apps zip from the 8810 4G store. also mentioned about Charles proxy and something.....

Can you provide more specific guidelines about it? This may help me to get Whatsapp form JioStore if my previous attempt of network traffic capture is entirely wrong....

On Tuesday, November 6, 2018 at 3:23:39 PM UTC+5:30, Sylvain BLOT wrote:

[syl...@rentoo.immo]

Hey if you can run OTA zip update then I can help you! You can contact me on hangout for more details but it involves injecting a certificate in b2g, setup b2g to use the proxy and then uses Charles to analyse. That way you will be able to analyse the traffic as the store doesn't implement certificate pining.

You can forget about your network dumps, they are encrypted.

[saveNgo]

Ohhh.... Well then I am Out of scope here.

Jio Phone OTA update are secured. I am unable to run OTA update created by ASOP signed zip.

This seems to be dead end for me.....

"Nayam Amarshe" may be able to help here as he have installed OmniJB in JioPhone F50Y.

I was wondering... If Nayam can install OmniJB from recovery option of 'Update from SdCard'. Then it is possible to create update.zip file to dump userdata or /data partition on SdCard of his Jio Phone. In that way, if whatsapp is stored in /data partition, it can be extracted....

[syl...@rentoo.immo]

Exactly "Nayam Amarshe" is the only hope :) Meanwhile I will have the Jio Phone 2 this afternoon I will give a try!

Other options: COM or bus pirate the chip directly

[speeduploop]

Intercepting encrypted (HTTPS/SSL) traffic would be possible with a proxy like 'squid' -- it does a real man in the middle attack.

(device to proxy is encrypted with proxy's keys - proxy to server is encrypted with server's keys -- proxy gets plaintext)

--> but that's not so easy to setup.

But if it's possible to use an update.zip on the device dumping the whole flash would be easy --> this dump would include all installed apps.

[Nayam Amarshe]

Bad news :(

I uninstalled omnijb to install the new october ota update and guess what? Omnijb now shows zip verification failed😭

I'm crying rn

We need to figure this out, we need to make an omni jb for jiophone, we gotta find the certificates!!!

[Nayam Amarshe]

certificate="build/target/product/security/platform.x509.pem" private_key="build/target/product/security/platform.pk8"

This is what I found in the firmware flash file.

[Nayam Amarshe]

What keys did you try? test keys or platform?

On Tuesday, November 20, 2018 at 4:24:14 PM UTC+5:30, saveNgo wrote:

[Backwood]

This is going so much uphill 'n downhill that it's almost hilarious. I'm sorry I just had to say it :D Its amazing to see your guys motivation for this OS, I wish I had the time to study and help with programming.

[Nayam Amarshe]

this os was dead on arrival, there was nothing to improve but the guys here tried hard but shit is still shit no matter how much you sugar it.

[Nayam Amarshe]

I'm gonna try something, will let you know if it works. Also, google groups sucks.

[Nayam Amarshe]

I think I found the key!!!!
SaveNgo, try this asap and let me know
Download this file:
https://www.atvxperience.com/download/twrp-311/
It's a temporary twrp file I made for amlogic devices but don't worry it won't work in jiophone and it won't change your system files either, so you're all safe.

Try flashing it via recovery, if it says, Applying update and doesn't show the verification failed message, I have good news for everyone.
If it doesn't work, I have another method.

Just flash it and see if it applies the update zip or not.

[saveNgo]

Tried Twrp311. Signature verification Failed.

[saveNgo]

Are those AOSP signature files or extracted from JioPhone f50y formware? I have tried AOSP test keys. I have not tried platform keys.

[Nayam Amarshe]

That's strange. Even in the latest update my F50Y can flash telneton.zip and other zip files but not omni jb because it shows
comment is 1738 bytes, signature is 1720 bytes, probably a mismatch.

[Nayam Amarshe]

http://nayam.atvx.io/telneton.zip

Try flashing this after mounting system. It works in F50Y latest October update, I can confirm.

Also, if anybody could get ota url from wireshark, that'd be great!

[saveNgo]

Same Results. Signature Verification Failed...
I have tried both telneton and telnetoff zip files. First I have used 'Mount /system' option in recovery then 'Apply update from sdcard'. Even tried to install without mounting /system afterwords. Results are negative.

Hey Nayam, do you know how to extract or find signature keys / certificates from Mobile stock firmware? Can you point me in right direction so that I can extract them for my JioPhone F30c...
Thanks for help anyway...

[Nayam Amarshe]

Bummer, I just flashed omnijb in f50y October update and it's working like charm! I wish you could install it too. There's no way you can extract signatures from ota updates, near impossible maybe. You'll have to find the correct keys. Your only hope is the flashing method.
Try this:
Download f30c firmware from repairmymobile.in, then extract system.img with an application called packsparseimg.exe, it will give you system.raw file which you have to extract with ImgExtractor.exe, you'll get your system folder, then you have to apply same patches that omnirun.sh in omnijb-final.zip does, then pack the system folder and convert to system_1.img, system_2.img..... with packsparseimg.exe and flash the firmware in your jiophone with Qfil v1.0.02