Google Home App Broadcast Endpoint

[DataPools]

Does anyone here know the endpoint that the Google Home App calls when you broadcast from your phone? I've tried listening on the app traffic through Charles but have not been able to find any API calls.

[DataPools]

Turns out I can just use the Foyer API with google.internal.home.foyer.v1.HomeControlService/ExecuteRoutineOnDevice

Does anyone have the ExecuteRoutineOnDevice protobuf?

[rithvikvibhu]

Since you've already found the gRPC service and method, probably know how to make grpc requests and stuff.

To create the protobufs for getHomeGraph and others, I used grpc-dump to see what request and response bodies were like. Then used this json dump to convert to protobuf v2, then to v3 by hand. More info in this comment #39 (comment).

To be able to dump, the phone must trust the CA and grpc-dump must use a cert from this CA. On how to set this up: #39 (comment)

Check out one of the existing protos for reference: #39 (comment)

If/When it works, post it here if you can, I'll add it along with the others.

[DataPools]

I unfortunately only have an iPhone which doesn’t play well with grpc-dump. If someone could construct a protobuf for ExecuteRoutineOnDevice it would be much appreciated.

[rithvikvibhu]

I'm kinda busy this week. If someone else can, great. Otherwise I'll do this ~1st week of Jan

[DataPools]

Great! Thanks so much!

[DataPools]

Not sure if this can be converted directly to protobuf, but I found this code: https://github.com/iCrazeiOS/Class-Dumped-Apps/blob/11e9fc710f1ac3da7bc876319c5023b84e182811/Headers/Google%20Home%202.30.123/GHCExecuteRoutineOnDeviceRequest.h

[rithvikvibhu]

Oh interesting, nice find! Not sure if it's possible directly, but can use it as a reference when building I think.

[DataPools]

I've been experimenting on Android x86 7.1 in VMWare, but have been unable to get the Google Home app to trust my grpc-dump certificate. How were you able to do it and listen on the grpc traffic?

I also installed Android x86 5.1, but that had some problems with the Google Play store.

[rithvikvibhu]

I'd first use mitmproxy to set up and confirm that the CA is trusted: https://docs.mitmproxy.org/stable/howto-install-system-trusted-ca-android/

Visit a https site in a browser and make sure mitmproxy catches it and the page loads normally.

Now that the mitmproxy's CA is trusted by the phone, use its CA to generate a specific cert for googleapis.com. The 4 lines from #39 (comment) will do it.

[DataPools]

I actually just generated my cert with openssl (following your 4 commands), but I think it’s an issue with Android 7. It just doesn’t trust outside certs unless the app itself is patched.

[rithvikvibhu]

Afaik (at least as of a few months ago), the app only pins the cert for communicating with local devices (with a chromecast cert), but does not for others (like google severs).

Which CA did you use in the 3rd line? That CA (and not the googleapis.crt) has to be imported as system cert, not as a user cert.

[DataPools]

Yes, so I generated a certificate called cert.pem with openssl, using this command openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365

I then followed your steps to have grp-dump use it with googleapis.crt.

Then, I installed cert.pem on my (rooted) virtual device using this app: https://play.google.com/store/apps/details?id=net.jolivier.cert.Importer&hl=en_US&gl=US

It showed up in my system certs, so it appeared to work.

However, grp-dump kept getting this error TLS handshake error from 192.168.0.105:38090: remote error: tls: unknown certificate, so I assume it's because the Google Home App was not using the cert.

[rithvikvibhu]

Hm can't think of anything right now. I'll try it again in ~10 hours and see if anything's changed. If you figure it out, post it here and I'll update the docs.

[DataPools]

Figured it out, was a problem with my cert. I decided to switch to Charles proxy and that worked fine.

Something interesting is that the ExecuteRoutineOnDevice request does not use protobuf, it uses some raw hex instead (with three leading zero bytes).

Thanks so much for your help!