问题描述

我最近发现了这个应用

正如我向

安全/隐私声明
第一次运行此应用程序时，它会要求您获得 Google 帐户的完全权限.这是不幸的访问所需信息的唯一方法.没有个人信息已存储，不会与您共享有关您的应用程序的信息此应用程序的开发者，也不与任何第三方共享.一切都只保存在您的手机上.

我在这篇博文中详细介绍了这些应用程序，大学顶峰项目(没有金钱收益).我倾向于认为这是 API 中的一个漏洞，而不是谷歌设计的状态，因为除了开发者自己的应用程序之外，没有任何 API 调用来获取应用程序的购买.我假设这是一个零日漏洞，在这种情况下，没有合法的方法可以访问这些信息.

I recently came across this app Purchase Apps, which is somehow able to retrieve apps I've paid for in google play after I signed in using my google account.

I'm trying to find out how it is being done as I want to build a similar app, but for the free apps which were downloaded.

However, I can't find which OAuth API Scope was used for retrieving that information, even after going through the entire list of APIs.

EDIT: I'm putting a new bounty on this question, as suggested by a similar question I've asked about here, and because here and there I don't see a real answer about how to do it, and what can be done with it.

I'd like to refine the questions into multiple pieces:

1. What is the API that can be used to get information of purchased apps? Where can I read about it? Please show a full, working example of how to do it.

2. Can it do more ? Maybe perform search? Maybe show free apps that were installed? Maybe the time they were installed and uninstalled? And the categories of those apps?

3. Are there any special requirements for using this API ?

EDIT: I'm putting a max bounty on this, because no matter how much I've read and tried, I still failed to make a POC that can query the apps from the Play Store that the user has ever downloaded (name, package name, date installed and/or removed, icon URL, price...), including both paid and free apps.

If anyone finds a working sample, show how it's done, and also show how you've found about it (documentation or anything that has led you to the solution). I can't find it anywhere, and the current solutions here are too vague for me to start from.

Issue is resolved. The exploit has been closed.

We will be closing this bug due to being logged in a Preview version of Android. If the issue is still relevant and reproducible in the latest public release (Android Q), please capture a bugreport and log the bug in https://source.android.com/setup/contribute/report-bugs. If a reply is not received within the next 14 days, this issue will be closed. Thank you for your understanding.

Latest update:

This is a bug and Google will address it in the next update.

We've deferred this issue for consideration in a future release. Thank you for your time to make Android better

This answer has turned into a conglomeration of ideas and been edited to include information from discussion in the comments.

The androidmarket api, would be a customised api written by the developer. It's not available to the public.

To address your concerns in the comments. The developer would have utilised the current apis available through Android Developer and Google to create a project that manages all of these.

As for accessing Full Account Access, I'm not sure exactly how these developers have achieved this.

I'd recommend using the AccountManager, which is part of android.accounts, has access to credentials and a method getUserData. The account manager has access to passwords and is capable of creating and deleting accounts. This, possibly used with Content Provider

See Udinic/SyncAdapter Authentication.

To reply to your comment:

This blog should help you to get started. Write your own Android Authenticator.

How these apps actually work, I cannot tell you. They may also have different implementations (unless they're a collaborative effort behind the scenes, they most certainly will be different).

One guess. Firstly use GoogleSignInAccount with com.google.android.gms.auth.api.signin.

There a definition for scope, to determine the extent of the permissions the app is granted.

Using requestScopes(), the

public static final String PROFILE

.../ It lets your web app access over-the-air Android app installs.

For example:

GoogleSignInOptions gso =
        new GoogleSignInOptions.Builder(GoogleSignInOptions.DEFAULT_SIGN_IN)
            .requestEmail().
            .requestScopes(new Scope("https://www.googleapis.com/auth/contacts.readonly"))
            .build();

If full access can be gained a list of all apps used by the account holder can be found and compared to what's on the device.

Package Manager will retrieve a list of all apps currently installed on the device.
PackageInfo provides the details about the app.
INSTALL_REASON_USER will also filter out apps that have been actively installed by the user.

You might want to look at com.google.firebase.appindexing and Log User Actions. Different actions can be tracked.

The users account history is found at https://myactivity.google.com/myactivity.

A helpful link is the OAuth 2.0 Playground.

This github repo node-google-play, using node, is current and will call Google Play APIs. As did the archive that was used as an "unofficial" api, android-market-api, to query the market place.

App 1

The app claims to use the following permissions:

Version 2.1.8 can access:
$ In-app purchases

Other

• receive data from Internet
• view network connections
• full network access
• use accounts on the device
• prevent device from sleeping
• read Google service configuration

Noteworthy, the app doesn't set any permissions when there was a basic, install. I was unable to use any of the features, as I have no paid apps. So for the initial search - there were no permissions needed, which would indicate the app didn't have access to my account.

I checked the permissions - there were none set. So the only thing required was to accept the pop up, as displayed in your question.

App 2

The other app you refer to that does the same thing is more upfront about what is being accessed.

My Paid Apps

SECURITY/PRIVACY NOTICE
The first time you run this app, it will ask for full permission to your Google account. This is unfortunately the only way to access the required information. No personal information is stored, no information about your apps is shared with the developer of this app, nor shared with any third parties. Everything is kept on your phone only.

I've gone into detail over these apps in this blog post, which was for a university capstone project (no monetary gain). I'm inclined to think this is an exploit in the API and not status by design by Google, as there are no API calls to fetch purchases of apps other than the developer's own app. I hypothesize it's a zero day exploit, in which case there's no legitimate way to access this information.

这篇关于如何从 Google Play 获取用户下载的应用程序(付费/免费)列表?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持跟版网！