More API Issues

[chipriley]

Once again, it seems something has changed. I restarted my Home Assistant instance this afternoon and my devices are unavailable. There's a new issue in the HA repo regarding this stating that the API is not returning a security token but, rather, a rejection message.

home-assistant/core#28337 (comment)

[towerhand]

Mine started doing that about 24 hrs ago.

[Bahnburner]

Same issue here. I dug around a bit but came up mostly empty handed.

  File "<stdin>", line 1, in <module>
  File "/usr/local/lib/python3.7/asyncio/base_events.py", line 579, in run_until_complete
    return future.result()
  File "<stdin>", line 3, in main
  File "/usr/local/lib/python3.7/site-packages/pymyq/api.py", line 162, in login
    await api.authenticate(username, password)
  File "/usr/local/lib/python3.7/site-packages/pymyq/api.py", line 117, in authenticate
    login_request=True,
  File "/usr/local/lib/python3.7/site-packages/pymyq/api.py", line 85, in request
    data = await resp.json(content_type=None)
  File "/usr/local/lib/python3.7/site-packages/aiohttp/client_reqrep.py", line 1040, in json
    return loads(stripped.decode(encoding))
  File "/usr/local/lib/python3.7/json/__init__.py", line 348, in loads
    return _default_decoder.decode(s)
  File "/usr/local/lib/python3.7/json/decoder.py", line 337, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "/usr/local/lib/python3.7/json/decoder.py", line 355, in raw_decode
    raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)```

[bachya]

Ugh. 😡

Because the iOS app now does SSL cert pinning, I’m unable to use my traditional methods for sniffing traffic. We will likely need a user who is android app is working to dig in, decompile it and work with us.

[Bahnburner]

I'm on android. If you can walk me through what needs to be done, I'd be glad to help. It's been years since I've decompiled an apk.

[bachya]

I’m an iOS user, so unfortunately, I won’t be much help there. Basically, what we need is to decompile the most recent version of the app and look around for API calls (URLs that start with https://api.myqdevice.com/api). That likely won’t tell us much – we have no clue what they changed – but it will be a starting point.

[Bahnburner]

Got it. I've grabbed dex2jar and smali/baksmali and about to pull the APK over ADB. I don't have a rooted device, so depending on how the app is installed it might be futile.

[bachya]

Worth a shot. Thanks for attempting!

[Bahnburner]

Running into some merge issues with Dex2Jar, building the new version from source. Will report back shortly.

[brbeaird]

Has anyone actually reproduced the error in Postman? Manual request is still working for me with the way I call it.

[brbeaird]

I think I see it - stop sending the user agent header. Just don't send one at all. That should fix it.

[Bahnburner]

Has anyone actually reproduced the error in Postman? Manual request is still working for me with the way I call it.

Not in postman, but I attempted to manually pull my devices in python in the cli.

[brbeaird]

I can submit a PR in just a sec.

[Bahnburner]

@brbeaird Well crap. Just got the android apk decompiled. Anyone still need the classes?