如何从谷歌播放用户获得付费应用程序列表？ [英] How to get list of paid apps by a user from google play?

问题描述

我最近遇到了这个应用 -

请帮助。

---

编辑：
我在这个问题上提出了一个新的赏金，正如一个类似的问题已询问有关

安全/隐私通知

您第一次运行此应用程序时，您的Google帐户的权限。不幸的是，
是访问所需信息的唯一方法。不存储个人
信息，没有关于您的应用程序的信息与此应用程序的开发人员共享
，也不与任何第三方共享。
一切都保存在您的手机上。

< img src =https://i.stack.imgur.com/UKi2e.pngwidth =200height =400>

---

我在<这是一个大学顶点项目（没有货币收益）的博客文章。我倾向于认为这是API中的漏洞利用，而不是Google设计的状态，因为除了开发人员自己的应用程序之外，没有任何API调用可以获取应用程序。我假设这是零日攻击，在这种情况下，没有合法的方式来访问这些信息。

I recently came across this app - Purchase Apps, which is somehow able to retrieve apps I've paid for in google play after I signed in using my google account.

I'm trying to find out how it is being done as I want to build a similar app, but for the free apps which were downloaded.

However, I cant find which OAuth API Scope was used for retrieving that information. I went through the entire list of APIs here.

Please help.

---

EDIT: I'm putting a new bounty on this question, as suggested by a similar question I've asked about here, and because here and there I don't see a real answer about how to do it, and what can be done with it.

I'd like to refine the questions into multiple pieces:

1. What is the API that can be used to get information of purchased apps? Where can I read about it? Please show a full, working example of how to do it.

2. Can it do more ? Maybe perform search? Maybe show free apps that were installed? Maybe the time they were installed and uninstalled? And the categories of those apps?

3. Are there any special requirements for using this API ?

解决方案

This answer has turned into a conglomeration of ideas and been edited to include information from discussion in the comments.

The androidmarket api, would be a customised api written by the developer. It's not available to the public.

To address your concerns in the comments. The developer would have utilised the current apis available through Android Developer and Google to create a project that manages all of these.

As for accessing Full Account Access, I'm not sure exactly how these developers have achieved this.

I'd recommend using the AccountManager, which is part of android.accounts, has access to credentials and a method getUserData. The account manager has access to passwords and is capable of creating and deleting accounts. This, possibly used with Content Provider

See Udinic/SyncAdapter Authentication.

To reply to your comment:

This blog should help you to get started. Write your own Android Authenticator.

---

How these apps actually work, I cannot tell you. They may also have different implementations (unless they're a collaborative effort behind the scenes, they most certainly will be different).

One guess. Firstly use GoogleSignInAccount with com.google.android.gms.auth.api.signin.

There a definition for scope, to determine the extent of the permissions the app is granted.

Using requestScopes(), the

public static final String PROFILE

.../ It lets your web app access over-the-air Android app installs.

For example:

GoogleSignInOptions gso =
        new GoogleSignInOptions.Builder(GoogleSignInOptions.DEFAULT_SIGN_IN)
            .requestEmail().
            .requestScopes(new Scope("https://www.googleapis.com/auth/contacts.readonly"))
            .build();

If full access can be gained a list of all apps used by the account holder can be found and compared to what's on the device.

Package Manager will retrieve a list of all apps currently installed on the device.
PackageInfo provides the details about the app.
INSTALL_REASON_USER will also filter out apps that have been actively installed by the user.

You might want to look at com.google.firebase.appindexing and Log User Actions. Different actions can be tracked.

The users account history is found at https://myactivity.google.com/myactivity.

A helpful link is the OAuth 2.0 Playground.

---

This github repo node-google-play, using node, is current and will call Google Play APIs. As did the archive that was used as an "unofficial" api, android-market-api, to query the market place.

---

App 1

The app claims to use the following permissions:

Version 2.1.8 can access:
$ In-app purchases

Other

• receive data from Internet
• view network connections
• full network access
• use accounts on the device
• prevent device from sleeping
• read Google service configuration

Noteworthy, the app doesn't set any permissions when there was a basic, install. I was unable to use any of the features, as I have no paid apps. So for the initial search - there were no permissions needed, which would indicate the app didn't have access to my account.

I checked the permissions - there were none set. So the only thing required was to accept the pop up, as displayed in your question.

---

App 2

The other app you refer to that does the same thing is more upfront about what is being accessed.

My Paid Apps

SECURITY/PRIVACY NOTICE
The first time you run this app, it will ask for full permission to your Google account. This is unfortunately the only way to access the required information. No personal information is stored, no information about your apps is shared with the developer of this app, nor shared with any third parties. Everything is kept on your phone only.

---

I've gone into detail over these apps in this blog post, which was for a university capstone project (no monetary gain). I'm inclined to think this is an exploit in the API and not status by design by Google, as there are no API calls to fetch purchases of apps other than the developer's own app. I hypothesize it's a zero day exploit, in which case there's no legitimate way to access this information.

这篇关于如何从谷歌播放用户获得付费应用程序列表？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！