Trying to make this work for v2.5

[mysteriouslyblah]

I have spent some time trying to adjust these patches for version 2.5.0 of the G7 app, starting with the compatibility patch.

So far I was able to find the new location of the device check and patch it in the same way it was patched for 1.6.1. It was also necessary to patch the AndroidManifest.xml and some smali files like in the android-manifest-service.patch for 1.6.1, renaming the referenced classes containing invalid characters due to the code obfuscation used.

Reassembly and installation is successful, however the application crashes at launch throwing the following exception:
android.content.res.Resources$NotFoundException: assets/pinning.cert
This file does not seem to exist in the unmodified apk or is lost at extraction. I was also unable to find any references to the file in the code using jadx-gui, which might also be due to code obfuscation.

Running apktool with the --no-res flag or simply creating the file results in the same exception. To me this suggests that it is looking for the file somewhere else, where I would assume that it is generated at runtime, however I don't understand why it isn't doing that. That's the point I'm currently stuck at, my only idea is to keep poking at the code until I find the reference to the file. If someone more knowledgeable than me could point me in the right direction that would be appreciated.

[anbraten]

Sounds related to ssl pinning: https://medium.com/@anandgaur22/ssl-pinning-in-android-14851dc41703

[b-aeby]

Hello,
Would it help to unpin the apk before patching?
https://httptoolkit.com/blog/frida-certificate-pinning/
https://github.com/mitmproxy/android-unpinner

[anbraten]

If ssl pinning is actually the problem that sounds perfect. @mysteriouslyblah maybe could try it with their current version.

[mysteriouslyblah]

Thank you for the suggestion, however I don't quite understand how this could be the solution. Even if modifying the running application to remove pinning fixes the issue, how does it help me with modifying the actual apk to run without the certificate?

Edit: Sorry, I didn't realize the second link you provided actually patches the apk. Going to try it.

[mysteriouslyblah]

I have now tried this and unfortunately it does not work. android-unpinner waits for onCreate to be called, which never happens. The patched app is stuck in the splash screen without crashing like the unpatched does. Idk if there is some incompatibility or maybe the app detects that it has been patched or is being debugged.

[anbraten]

@mysteriouslyblah Did you achieved anything new here?

[mysteriouslyblah]

Unfortunately, no. I have since switched to xDrip+ and prefer it over the Dexcom app.

[khskekec]

Hi @mysteriouslyblah,

Could you provide a small tutorial how you disassemble and assemble the new apk. I had some trouble with it due to its new xapk structure and would like to profit from your knowledge.

Thank you in advance

Selcuk

[mysteriouslyblah]

Hi Selcuk,

thank you for creating the original version of the patcher.

I extract the .xapk as a zip file. It contains 3 apk files, I just resign the config.arm64_v8a.apk and config.mdpi.apk files and com.dexcom.g7.apk is the one I disassemble and reassemble using apktool. Then I install the apks using adb install-multiple. Alternatively you can also replace the apks in the extracted folder, adjust the total_size in the manifest.json, repackage it as a zip named .xapk and install it using APKMirror Installer.

Hope this helps.

[v-cheng]

I'm wondering if the Dexcom server's certificate/public key was not hardcoded in the app, but instead got fetched from the server during app launch? I know it kind of defeats the purpose of using the embedded cert/key for SSL/TLS handshake authentication, but some programmers use it that way so they won't get stuck with tons of clients out there with wrong embedded cert/key, especially when you got client or server upgrade/update.

[v-cheng]

Do we have any progress on this effort? Thank you very much for your effort to help us out.

[v-cheng]

Do we have any hope to make this work? Thanks.

[mysteriouslyblah]

I have since switched to xDrip+ and it's so much better than Dexcoms app, I don't see any reason to spend time on modifying the official app if I can just use that.

[v-cheng]

Yeah, my only problem is that I can't make the data upload to work in xDrip+, so I have to use the receiver and manually upload the data into Clarity. If that part works, I can be careless if the Dexcom app works or not.

[mysteriouslyblah]

That's not possible afaik. Tidepool works well if setting up Nightscout isn't an option. If your clinician required Clarity, though, you could just keep the dedicated receiver at home so it syncs once per day and then upload it to Clarity before your visits.