3

I use Fiddler to get APK of applications that I need. I used it for a long time, and usually it is not a problem to find APK in Fiddler log.

In ancient times Google downloaded APK directly how it is installed. Later, Google started to use ZIP compression.

Last time when I downloaded APK with Google Play Store 10.5.10, I saw it is not a ZIP, APK or any other file type that I know. Fortunatelly, it is possible to use obsolete Google Play version to still get understandable APK. However, I am thinking about future when Google may probably disable obsolete Google Play support.

Does anyone know how to unpack/decrypt APK file downloaded by modern Google Play Store version?

Here you can download dump of 3 HTTPS requests that Google Play sends to download APK file (in Fiddler 4 format):

https://mega.nz/#!qch3HaqQ!BDPEf7_q9oFgMMsMojSV-w9BXYXb1-mZMw-uNXAJc64

P. S. Please don't advertise other tools how to decrypt HTTPS. I know how to do it. There are a lot of tools, you may like one tool, I may like another one. The question is that at least some of APK are now encrypted and how to parse such APK without using of old Google Play that really allow to download encrypted APK in unencrypted format, because such old version may be disabled in future, and downloading of APK will become problematic.

Improve this question
2

1 Answer 1

Reset to default
5

Disclaimer: I took a different approach to find your solution. I don't use Fiddler, it has many adwares. You may use Fiddler and may find same result as I did.

Does anyone know how to unpack/decrypt APK file downloaded by modern Google Play Store version?

No, Google doesn't encrypt the APK, at least I didn't found it to be encrypted. First install Packet Capture from Play Store. Allow it to install a 3rd party certificate to intercept the SSL encryption. Open that application, click on the green play button, choose the "Downloads" or "Downloads Manager" or com.android.providers.downloads in that list. The application will be intercepting the packets from Downloads.

Start to download any app from Play Store. There will be a small 2-3 KB packet first which contains the real download link. The second packet will be the compressed APK package. Stop the download and Packet Capture, open the first packet. You may see the link as follows in this HTTP GET Location tag:

HTTP_Get_Request

Copy the full link starting with https://r6---sn-gwpa-jj0l.gvt1.com/play-apps-download-default/, place it in any browser the file will be downloaded. Link may expire in some time, so do it quickly. Here comes the important facts. The downloaded file is a GZIPed file, file command shows this: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT). Extract the APK file from it with any decompresser tool (e.g. GZIP, 7ZIP etc).

  • Here is the full log of HTTP GET header:
GET /download/by-token/download?token=AOTCm0QN_iloMjhxZLX8cMBfVXIpmMrUUTyJcDi2Aa1h_yJVIT_f6STKoVKrJWPR6qpAVsb6_0IRDjzNoneXmeliSL9Zx6IxXva7zFmP4_WNHlpo2Yaf9LUe6SXrR0r5TNzkqm79fA0LmPKB_TObJOnT1-seAI2Szdi4wVAu_3baecu_KHMeXmcV7cyHEGdrsnHbgC9VfQJKnq4Pt00WzpKhqziwLnGRRcOAKGr0gvbF_wBjbHfks2VQPNlMnhlgSS4miJomoeoKwBBPuyexDHNWrSyian1BReyBtV9liH3ueB5iJJFbuFFMRpH3cO4K8h-0MrvzHTMeYEpkcwBT8T3GhA&cpn=w_2EoAbVy7CSoAaZ&isid=VUNzEjxjRROS-g4UxpZC2A HTTP/1.1
User-Agent: AndroidDownloadManager/6.0.1 (Linux; U; Android 6.0.1; Model XYZ Build/XYZ123)
Accept-Encoding: identity
Host: play.googleapis.com
Connection: Keep-Alive

HTTP/1.1 302 Found
Content-Type: application/binary
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Thu, 28 Jun 2018 17:48:45 GMT
Location: https://r6---sn-gwpa-jj0l.gvt1.com/play-apps-download-default/download/by-id/AF3DWBexsd0viV96e5U9-SkM_V5zc7aWOEqZi1rsPmGPvWj2reBV2c5DlYCXyzUoWZfcuw0RJcQLF2IKDQXYmWT3mpm_b2KkdGTOgw07z67jzPdSHFfRpJI?cpn=w_2EoAbVy7CSoAaZ&ctier=L&initcwndbps=710&mm=31&mn=sn-gwpa-jj0l&ms=au&mt=1530208077&mv=m&pl=18&expire=1530380925&ip=12.12.12.12&ipbits=0&sparams=expire,ipbits,ip,q:,initcwndbps,mm,mn,ms,mv,pl,ctier&signature=5F361AC4E40D8665A674D9E71E971B867F0BBA71.C62F35F6BA6EE3B8D63258A950F70509544D36F2&key=am3
Server: ESF
Content-Length: 0
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Alt-Svc: quic=":443"; ma=2592000; v="43,42,41,39,35"
Improve this answer
5
  • The answer is not for my question. I don't ask "What are Fiddler alternatives?" I ask how to decrypt or parse the file that i downloaded. I know how to download the file.
    – Vitalii
    Jun 29, 2018 at 8:18
  • @Biswapriyo my guess would be that this is simply the encoding and I would expect that to depend on whatever Accept-Encoding HTTP header the client sent in the first place.
    – 0xC0000022L ♦
    Jul 3, 2018 at 15:25
  • @Vitaliy: this perfectly answers all the questions, just using a different tool to find the facts. But - as you point out - it makes no difference what tool you use to gather facts. So why do you hold it against Biswapriyo that s/he used another tool?
    – 0xC0000022L ♦
    Jul 3, 2018 at 15:29
  • 1
    @0xC0000022L This is from old Google Play app. My play store version updated after I posted this answer. I'll edit this if I decode that apk.
    – Biswapriyo
    Jul 3, 2018 at 16:20
  • @0xC0000022L Because his anwer is wrong. He just writes how to download APK; in my question I don't ask how to download APK or how to decrypt SSL, I ask how to decrypt APK itself, and it is encrypted independently from SSL.
    – Vitalii
    Jul 4, 2018 at 8:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.