B4A Library CovidPass - the reader

drgottjr · Nov 24, 2021

thanks. i just saw the sample you posted nov 9. unusual format, perhaps only used in the philippines. i need to look into it. also thanks for the link; i'll take a look. the specifications may be there.

Johan Schoeman · Nov 28, 2021

I can scan and read this one:

Result is:

B4X:

{"4":1624458597,"6":1624285797,"1":"AT","-260":{"1":{"v":[{"dn":1,"ma":"ORG-100030215","vp":"1119349007","dt":"2021-02-18","co":"AT","ci":"URN:UVCI:01:AT:10807843F94AEE0EE5093FBC254BD813#B","mp":"EU/1/20/1528","is":"Ministry of Health, Austria","sd":2,"tg":"840539006"}],"nam":{"fnt":"MUSTERFRAU<GOESSINGER","fn":"Musterfrau-Gößinger","gnt":"GABRIELE","gn":"Gabriele"},"ver":"1.2.1","dob":"1998-02-26"}}}

No joy with the QR code in post #13. It gives this error:

B4X:

*** Service (starter) Create ***
** Service (starter) Start **
** Activity (main) Create, isFirst = true **
** Activity (main) Resume **
Scanned String = PK
��������#GS÷uÛçt����C����������certificate.jsonuSÛ¢Hý}jp¼àÓ"8ÃMÀnlLPHy¦
PìèÄv»{#v# 2ëäIÎÉäÿ3Ê³ßJ~òeÁ&½Þõzí^ûÝz {Å1ÎJÎ¬WüË0&uuÇ½EÉð¿±*Iµu¿ðeSà¶ÓS±ú^æyb'Ïº/×PþIîUáGðÕ¯ONÞÁå"KÅÞÜG$2ti¡ºg*3ólCÑMÅâLÅ´À{éá@LÅAç!¢<uD©#ù7àg¬Â´í¸08Í^ðï)EXCeË/    Ø0òÅÁd0ýîx ík
¢Ö×÷/ý/%QÅ¡ümu¦%8AwI_î>Lý´5+De> *@^¤ÍÝ¼jot#ÊÜ³ÝåYââÜ¶!Ù«    Eg®s
åO.QÆÎ8%]àºÜ_PV%(*+ú°g§Lû{Z?¿$;BßÄÔ>]Q÷Ç DPè¬AÄ!3)vâÏ1Ê|[b)6ç¸ ÆRuÅà¶çè¾b��ckkG5¯²6ïÓãßÞÞÀ(íSP`Ún$Ü´Âï~åÉsòÈíÁ?6$Åÿ=ôVOýØôè1iÞbcOôÊþiåT´xÈçØK¿¼ðÇk;3Ü,Óp,Wë».ZDgúE@ùpùÎ"i
±Õ ÝØgFc ègQîv-c<3§på?2Oë£Û.PgîÝL~ªæi(æþ×<)6â»£��h¤[©Öl¡BV]k§ÄYÛ©ßÜ=ùÉtQÏÊe38mwaX^#©¥GçkÚ¾vòiä$DÝ{öØáHþ¶NVÛnÊ0[ÈÃÍwõúmá_acòKºx²æ]]W|o ©+¿V{ÿÔ¹fÜ,;Á`¯°¾Zj(dÂtdìb²£ó[nÜ) Ü±ma'«ÿsºÙeL¾ßB{ªÉiT£Ò=âÔÔzçnAÿ.,×cÍöºoÊ¶ël
s\o¦µ5Öé)XY¦TRàP´Û
T,FhnÌ/+Ø ßPK��
��������#GS÷uÛçt����C��������������������������������������certificate.jsonPK������������>������¢��������
could not decode Base45 string: java.lang.IllegalArgumentException
main_bs1_scan_value (java line: 381)
java.lang.NullPointerException: Attempt to invoke virtual method 'int java.lang.String.length()' on a null object reference
    at anywheresoftware.b4a.BA.addLogPrefix(BA.java:604)
    at anywheresoftware.b4a.keywords.Common.LogImpl(Common.java:191)
    at jhs.CovidGreenPassScan.main._bs1_scan_value(main.java:381)
    at java.lang.reflect.Method.invoke(Native Method)
    at anywheresoftware.b4a.BA.raiseEvent2(BA.java:213)
    at anywheresoftware.b4a.BA$2.run(BA.java:387)
    at android.os.Handler.handleCallback(Handler.java:873)
    at android.os.Handler.dispatchMessage(Handler.java:99)
    at android.os.Looper.loop(Looper.java:214)
    at android.app.ActivityThread.main(ActivityThread.java:7032)
    at java.lang.reflect.Method.invoke(Native Method)
    at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:494)
    at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:965)

drgottjr · Nov 28, 2021

@Johan Schoeman
thanks for incorporating the library.

the qr code in #13 isn't an EU covid cert so the govidpass
library won't recognize it, plus it is most likely bogus.
by that i mean not only invalid but incorrectly formatted.
i've spent a lot of time with it, and i've been
unable to find another like it online to verify this belief.

the leading PK is the giveaway. it's the signature for
a (pk)zipped file, but it's not valid. the layout is very, very
similar to a zip archive. if you examine it and compare it
to a zip file structure, you'll see how close it is. the
structure of the certificate (it seems to be divoc or
possible cowin for s.e. asia use) is supposed to be a zip
file. that much i know for sure. the payload is buried in
the archive (you can see its name in clear text). it's a
compressed json string. at this point i am too tired to
continue with this project, but i am pretty sure it would be
possible to extract the compressed json part and
[un|de]compress it alone. having written a zip parser, i
know how i would go about it.

i'm giving up on the project, but i have amassed about a
dozen different decoder/recognizers since i first stumbled
upon the green pass. you would not believe what is out
there (or maybe you would).

the whole thing is a b4a class with some inline java (not
unlike how you built one of your early zxing coder/decoders).
i also moved my library code into it, so it's all under one
roof. i've separated all the scanning-related parts from the
parsing parts. unfortunately, all those additional jars are
still needed, but as a b4a class, it would be easier to modify
both the b4a code as well as the java. i'm never going to see
any of these codes here, and i did learn a lot, but the moment
has passed. if you want the class, i'll send it to you. i'm also
happy to answer any questions. pm me.

ismamokan · Nov 29, 2021

I think so, its a compressed json string but anyhow, thanks so much for trying to decode the qrcode. I am very much interested on your class. again, thank you very much.

drgottjr · Nov 29, 2021

ismamokan said:
I think so, its a compressed json string but anyhow, thanks so much for trying to decode the qrcode. I am very much interested on your class. again, thank you very much.

if you don't mind my asking, exactly what is your interest? the certificates used in s.e. asia are different from those used in, eg, the e.u. in addition, the governments in s.e. asia make it very difficult (if not impossible) to read the digital certificates without accessing government websites. plus, these certificates are not things you will see in public. aside from attempting to read your own digital certificate, i don't see how the class (or my library) can help you. what is it you were hoping to do?

Johan Schoeman · Nov 30, 2021

An interesting read.

Reverse engineering digital COVID-19 certificates

Many countries are in the process of rolling out digital COVID-19 certificates. In Europe, most of these appear to be in the form of a QR code. I recently received my own certificate, and was curious about the data it contained, as well as the supporting infrastructure around certificate...

harrisonsand.com

drgottjr · Nov 30, 2021

similar to the one i read and which served as the base for my library. assembling and de-sugaring the base45, cbor and cose dependencies was the interesting part. things start to drag when you realize that the e.u.'s version of a covid certificate is just one of many - mutually incompatible - versions.

as a coding exercise, it was useful. but unlike the ubiquitous qr codes one sees in print, in shop windows, in restaurants and at museum and airport entrances - all just waiting to be scanned - the only covid qr code you will see in practice is your own. or maybe you can amuse your friends by reading their covid certificates at a party.

drgottjr · Dec 6, 2021

just to tie up a loose end: the code posted by member ismamokan appears to be a pkpass (aka, apple wallet) file. pkpass is a zip file. it's readable as a zip file. as with any zip file, it can contain all sorts of mime types, the most conspicuous of these being a json file with all the meat you're looking for. a key is required to validate the certificate, but extracting the json is straightforward. unfortunately, the qr code uploaded to the forum seems to be corrupted.

Herbert32 · Dec 6, 2021

drgottjr said:
my government and many of my fellow citizens don't believe covid is real, so we're not allowed to have any covid-themed artifacts, such as proof one has been vaccinated (against what, right?). but they say other countries have such proofs.

hi & thx for sharing your work

may I ask where you are located?

drgottjr · Dec 7, 2021

are you from the covid police?

Herbert32 · Dec 7, 2021

would I say 'yes' if I am? - just kidding

I just want to know which countries denies the existance of covid19. I heared from Turkmenistan that it's not allowed to talk public about it in 2020 but in july this year they made vaccination mandatory for citizens which are 18+yrs old...

drgottjr · Dec 7, 2021

now you are definitely sounding like covid police.
turkmenistan? very nice! ??

Blu Blu · Feb 1, 2022

Execuse me for distrub,
when i use your library ,it tells me that i need go_cose-X.X.X.jar and some others. I can't find anywhere to download these libraries.Could you help me???
Thank you very much in advance

drgottjr · Feb 1, 2022

1) the jars should be in the zip. another user says he can use the library, so they must have been included. please check.
2) you need to do 2 things with the jars:
a) copy them to your additional libraries folder
b) refer to them in your app

B4X:

#AdditionalJar: cbor-4.4.4
    #AdditionalJar: go_cose-java-1.1.0
    #AdditionalJar: base45
    #AdditionalJar: go_cbor-0.01.02
    #AdditionalJar: numbers-1.8.2

as i recall, i mention this in one of the early posts. i am sorry if i didn't

Blu Blu · Feb 2, 2022

Sorry, this is my problem, because when I opened the zip, it showed that the file I requested did not exist, could you please help me check it again?

drgottjr · Feb 2, 2022

i will put the zip together again and upload to server again today. i have to find everything. i will post url here later today. you can check later.

Blu Blu · Feb 2, 2022

I really really really thank you very much????

drgottjr · Feb 2, 2022

ok, so here is link:
the .jars are too big to upload to forum, so you have to download archive from google drive. let me know if there is a problem.
follow the instructions. copy all .jars + the .xml file to your additional libraries folder. in your app, select the govid library to include in your project, and refer to all the other jars as follows:

B4X:

    #AdditionalJar: cbor-4.4.4
    #AdditionalJar: go_cose-java-1.1.0
    #AdditionalJar: base45-.0.0.3
    #AdditionalJar: go_cbor-0.01.02
    #AdditionalJar: numbers-1.8.2

at the time, it seemed very exciting to read a covid pass, but there really isn't all that much visible, plus it isn't like reading qr codes that you see every day everywhere. a covid pass is only on a person's phone, and you can only see it if the person shows it to you. very limited access. and without encryption keys, you don't know if the
pass is valid or not. more interesting is how the pass is decoded. if you know some java, you can study the library. the encoding uses Base45, CBOR Object Signing and Encryption (COSE), and HMAC for authentication. unfortunately, without keys - which are kept on servers - you can't say if the pass is real. you can only read somebody's name and the dates when vaccination or tests were carried out. those data could be real, they could be false. but at least we can know what the pass says

Blu Blu · Feb 2, 2022

Thank you very much ,i try right now and i will tell you if everything is ok.Thank you also for the instruction how work one qr code, thank you very much

Blu Blu · Feb 2, 2022

Thanks very much,
here is the string: gp.decodePass(EditText1.Text)={"4":1637148824,"6":1621593224,"1":"IT","-260":{"1":{"v":[{"dn":2,"ma":"ORG-100030215","vp":"1119349007","dt":"2021-04-10","co":"IT","ci":"01ITE7300E1AB2A84C719004F103DCB1F70A#6","mp":"EU/1/20/1528","is":"IT","sd":2,"tg":"840539006"}],"nam":{"fnt":"DI<CAPRIO","fn":"Di Caprio","gnt":"MARILU<TERESA","gn":"Marilù Teresa"},"ver":"1.0.0","dob":"1977-06-16"}}}
you are so awesome,I can never do it without you
Thank you again

B4A Library CovidPass - the reader

Expert

Expert

Attachments

Expert

Member

Expert

Expert

Expert

Expert

Active Member

Expert

Active Member

Expert

Member

Expert

Member

Expert

Member

Expert

Member

Member

Similar Threads