JLR API update broke jlrpy again

[ardevd]

JLR has updated their API again, breaking third party apps in the process.

[pmharris77]

@ardevd Out of curiosity, do most of the API changes you've had to fix look like they were intentionally to stop third-party apps, or are they adding new functionality?

[ardevd]

@ardevd Out of curiosity, do most of the API changes you've had to fix look like they were intentionally to stop third-party apps, or are they adding new functionality?

Solely to stop third party apps.

[ardevd]

Looks like they've added a new layer of API authentication.

[ardevd]

The x-App-Secret is now dynamic and seemingly changes frequently. Re-using previously used values doesn't seem to work either.

[pmharris77]

The x-App-Secret is now dynamic and seemingly changes frequently. Re-using previously used values doesn't seem to work either.

@ardevd That sounds hard to work around? Is it possible they have implemented it as some sort of shared time-based pseudo-random sequence baked into the app code, similar to a 2FA code?

[ardevd]

Not necessarily. Either, the secret is provided by the InControl API, or it might be calculated locally on the device (and reproduced on the server side). Either way, it should be possible to re-implement the same behaviour.

[pmharris77]

@ardevd Wish I could help, rather than just ask questions, but reverse engineering APIs is not really in my skillset. Thanks v much for trying to sort this for the community!

[dconlon]

I think I’ll try to find a contact at JLR unless anyone already has one?

If their intent is to stop third party apps, it seems like they will keep iterating until a jlrpy workaround cannot be made. I’d like to make the case for them offering open API access - I think there are benefits to JLR and it is what forward looking companies are doing.

My attempt probably won’t change anything but I will try. It might sound petty, but removal of API access would factor into my next vehicle purchase decision and somebody in JLR should want to know that if there are others like me.

[ardevd]

I'd really appreciate that! This cat and mouse game has been going on for a while now and while I enjoy the challenge, it's getting tedious.

JLR alienating their most enthusiastic customers in a misguided attempt to improve security is unfortunately. I've been reaching out to JLR repeatedly but never heard back.

When I first developed jlrpy
and WattCat they did reach out and we concluded that they actually appreciated that someone would develop community apps for such a niche car manufacturer. I guess times have changed.

[pmharris77]

@ardevd I've tried to decompile the app using a couple of Android Java decompilers and they're all failing to decompile for me. Have you had any luck?

[ardevd]

apktool or JADX (which used apktool) works fine.

[pmharris77]

apktool or JADX (which used apktool) works fine.

Weird, I used JADX, must the app that calls it that's the issue.

Found another and interestingly, there are a few developer names throughout the code base who are on LinkedIn or have their own blogs:

Chris Banes
Dan Lew