FORUMS

[HACK] Allo for Android bypass authentication and have a look around the app (arm64)

8,144 posts
Thanks Meter: 6,925
 
By Quinny899, Recognized Developer / Recognized Contributor on 19th May 2016, 05:43 PM
Post Reply Email Thread
THIS DOES NOT ALLOW YOU TO USE ALLO AS A SERVICE! IT USES DUMMY MESSAGES SO YOU CAN SEE WHAT THE APP IS LIKE!
USE THIS AT YOUR OWN RISK, GOOGLE MAY NOT LIKE IT

Allo for Android was leaked yesterday in APK form, as an internal early build release. When you launched the app on a compatible device, it shows a screen to authenticate via text, but the servers aren't actually sending out verification codes so you end up stuck in a loop.

I decompiled the app, and removed the method where the "Welcome" activity is launched, allowing the app to at least show the conversation screen, using Xposed. This could probably be achieved using Smali edits, but I haven't tried that.

I then tried to get the app to actually allow me to add users, but of course, as it was trying to connect via an account that was not authorised, that wouldn't work. So I took a different approach, and edited the database used by the app using Root Explorer + SQLite Editor to add dummy users, conversations and messages that way. I'll go into what I've worked out about the database in a later post, so you can trick your friends or something.

After that, I had pretty much full access to the offline features of the app (ie. those that didn't need a constant connection, messages still would not send), and could look around the app and its UI:
- Normal (1 to 1) conversations with other users
- Group conversations
- Incognito conversations

Stickers were working earlier on, but have since stopped loading. I can say however, that the default, included, stickers were not the only stickers available, as you could download two more packs. That was working around midday BST today but has since stopped, so either Google has blocked me or capped it entirely.

Anyway, below is some videos of the aforementioned features, as well as a couple of others.

https://www.youtube.com/watch?v=aI-k...ature=youtu.be
https://www.youtube.com/watch?v=Y4mUKRtr4kg

There's some things I didn't mention:

The app appears to link your number to your account, which may mean tablets work too as long as you have a phone

You can send voice messages (I didn't cover this in the video because I assumed it was a voice input rather than a voice message)

You can send videos

Tapping a 1 to 1 conversation's image on the list opens information about the user, allowing you to call and send a message

Sharing images from other apps works the same as other messaging clients



Want to try this yourself?
You'll need Xposed and Titanium Backup (free is fine) to do this:
  1. Download the Xposed Module and Titanium Backup file from GitHub here
  2. Install the Xposed module, activate it and reboot
  3. Open the TiBkp file using Titanium Backup, and restore app and data
  4. Run Allo (it's been renamed from Messaging to Allo now)
  5. Look around, but remember nothing actually works

Next job is to see if I can get onto Duo in the same way, although that will allow even less than Allo.
The Following 31 Users Say Thank You to Quinny899 For This Useful Post: [ View ]
19th May 2016, 06:50 PM |#3  
Senior Member
Flag Székelykeresztúr
Thanks Meter: 89
 
More
can't wait to try it !
19th May 2016, 07:37 PM |#4  
MishaalRahman's Avatar
Editor in Chief
Thanks Meter: 2,049
 
More
Great work! I featured this on the XDA Portal as this is the first hands-on of the app I could find!
The Following 3 Users Say Thank You to MishaalRahman For This Useful Post: [ View ]
19th May 2016, 09:21 PM |#5  
Quinny899's Avatar
OP Recognized Developer / Recognized Contributor
Flag Salford, Greater Manchester, UK
Thanks Meter: 6,925
 
Donate to Me
More
Stickers are working again, so here's all the stickers dumped in GIF form: http://imgur.com/a/cMqI2
The Following User Says Thank You to Quinny899 For This Useful Post: [ View ]
19th May 2016, 10:34 PM |#6  
ikjadoon's Avatar
Senior Member
Flag Richmond, KY
Thanks Meter: 436
 
More
Great freaking work. Only on Android....
The Following User Says Thank You to ikjadoon For This Useful Post: [ View ] Gift ikjadoon Ad-Free
19th May 2016, 11:06 PM |#7  
Quinny899's Avatar
OP Recognized Developer / Recognized Contributor
Flag Salford, Greater Manchester, UK
Thanks Meter: 6,925
 
Donate to Me
More
I posted an update on Duo, SMS, Hangouts and the module on Reddit here: https://www.reddit.com/r/Android/com...e_allo/d3c6dd9
The Following User Says Thank You to Quinny899 For This Useful Post: [ View ]
20th May 2016, 12:34 AM |#8  
Member
Thanks Meter: 11
 
More
Doesn't work on my s4 running cm13, when restoring with titanium, it says the app was not installed
20th May 2016, 09:36 AM |#9  
FaserF's Avatar
Senior Member
Flag Munich
Thanks Meter: 2,160
 
Donate to Me
More
"Unfortunately Allo Allo has stopped" on my Galaxy S6 with Xposed and the module activated

Hopefully Google will start the server soon.
The Following User Says Thank You to FaserF For This Useful Post: [ View ] Gift FaserF Ad-Free
20th May 2016, 11:59 AM |#10  
u7Xz's Avatar
Senior Member
Flag İstanbul
Thanks Meter: 159
 
More
Quote:
Originally Posted by Accraze

Doesn't work on my s4 running cm13, when restoring with titanium, it says the app was not installed

Title.... arm64 only.
20th May 2016, 10:55 PM |#11  
Quinny899's Avatar
OP Recognized Developer / Recognized Contributor
Flag Salford, Greater Manchester, UK
Thanks Meter: 6,925
 
Donate to Me
More
Tonight's update, same as Reddit:

What I've found out today:

- SMS and Hangouts, although hinted at in the code, cannot be enabled using Xposed at this time.
- I worked out how to make messages appear in the conversations using the database, YouTube video here
- Messages support text, images (GIF or normal), videos, stickers and YouTube links, with previews. YouTube links open in the app, not inline
- There appears to be a read receipt for messages, as well as sent ticks.
- As expected (it being an internal release), there's a lot of debug code in (but disabled by default, it's not a debug release) the app. AlloAllo enables it (see the video)

Xposed Module new APK

Massive document on how the database works and how to add your own stuff

Xposed Module Source

I'll do a proper writeup as a teardown tomorrow if I get the time, but Duo is pretty much a writeoff as it's pointless
The Following 4 Users Say Thank You to Quinny899 For This Useful Post: [ View ]
Post Reply Subscribe to Thread

Tags
allo, android, hack

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes