Chris' Market Fingerprint Testing

[Guest chall32]

Updated:

09/06 16:15: Results for V100R001C05B820 & add new fingerprints from fibblesan & Sh4d0w940

09/06 19:40: Updated results for V100R001C05B820 now 11 not 18

09/06 23:30: Results for Fibblesan (post #2 below) = 18 Also found Erase Market History which seems to work well!

10/06 21:00: Results for Sh4d0w940's Vanilla

In an effort to understand:

1. How Android market fingerprints are derived

2. What makes a good fingerprint with lots of market apps available to the user

I've been collecting fingerprints from the build.prop files contained in the various 2.1 ROMs available on the forum.

TEST

The testing I've done is a simple search for "handcent" on the market.

Yes I 100% agree that is very very subjective and market results differ from country to country plus as with all things Market, the golden rule seems to be YOUR MILEAGE MAY VARY! Added to that, it can take anything up to 24 hours for a fingerprint change to apply and start affecting results.

I'm not using Market Extender, I'm based in the UK and looking at the UK Market.

RESULTS

Original T-Mobile Hungarian 2.1:

ro.build.description=msm7201a_surf-user 2.1-update1 ERE27 eng.huawei.20100419.103709 test-keys

ro.build.fingerprint=T-Mobile/U8220/U8220/U8220:2.1-update1/ERE27/eng.huawei.20100419.103709:user/test-keys

Note the test-keys entry. Guess this is why the original ROM had issues. Handcent search results score = (didn't test) zerosignaull's Oscillation 7B:

ro.build.description=msm7201a_surf-user 2.1-update1 ERE27 20100504 ota-rel-keys,release-keys

ro.build.fingerprint=RBM2/U8230/RBM2/RBM2:2.1-update1/ERE27/20100504:user/ota-rel-keys,release-keys

Handcent search results score = 7 results Eris Droid Fix (from the Market):

ro.build.description=msm7201a_surf-user 2.1-update1 ERE27 20100504 ota-rel-keys,release-keys

ro.build.fingerprint=verizon/voles/sholes/sholes:2.1-update1/ESE81/29593:user/release-keys

Handcent search results score = 7 results Fibblesan's FLB-Mod:

ro.build.description=passion-user 2.1-update1 ERE27 24178 release-keys

ro.build.fingerprint=verizon/voles/sholes/sholes:2.1-update1/ESE81/29593:user/release-keys

Handcent search results score = 14 results U8220 V100R001C05B820(Taiwan C HT Android2.1) - released on huaweidevice.com 09 June 2010

ro.build.description=msm7201a_surf-user 2.1-update1 ERE27 20100511 ota-rel-keys,release-keys

ro.build.fingerprint=CHT8000/U8220/CHT8000/CHT8000:2.1-update1/ERE27/20100511:user/ota-rel-keys,release-keys

Handcent search results score = 18 11 results From Fibblesan (post #2 below)

ro.build.description=ro.build.description=passion-user 2.1-update1 ERE27 24178 release-keys

ro.build.fingerprint=verizon/inc/inc/inc:2.1-update1/ERE27/161494:user/release-keys

Handcent search results score = 18 results Sh4d0w940's Vanilla

ro.build.description=msm7201a_surf-user 2.1-update1 ERE27 eng.huawei.20100419.103709 test-keys

ro.build.fingerprint=htc_wwe/htc_legend/legend/legend:2.1/ERD79/139791:user/release-keys

Handcent search results score = 18 results

So some varying results, and to be honest, I don't believe I'm going to beat 14 18 results.

Am I any closer to understanding how the keys are derived? :) not really no. I can only call it as I see it!

At the very least, it's interesting to see how each fingerprint affects the market, and if nothing else, this thread will serve as a fingerprint repository.

- Chris

Edited June 10, 2010 by chall32

[Guest Simon O]

There's also this fingerprint you can try:

verizon/inc/inc/inc:2.1-update1/ERE27/161494:user/release-keys

which is for the HTC/Verizon Droid Incredible. The build matches the build of 2.1 (ERE27) we are using so it might be better?

I'm thinking it may help to match the build.description and build.fingerprints, at least with the build name.

[Guest starkos]

There's also this fingerprint you can try:

verizon/inc/inc/inc:2.1-update1/ERE27/161494:user/release-keys

which is for the HTC/Verizon Droid Incredible. The build matches the build of 2.1 (ERE27) we are using so it might be better?

I'm thinking it may help to match the build.description and build.fingerprints, at least with the build name.

If that's the same as the one you posted in the tips and tricks thread (or whatever it's called), I changed to it a few hours ago so just did a search for Handcent & I got 18 results...

[Guest Stevos]

There must be some information from Google about this, it's insane.

Edit: When googling for the search terms, this thread comes up as the top relevant link...

Edited June 9, 2010 by Stevos

[Guest bounty123]

Wow nice work, hats off for your efforts. :)

[Guest Simon O]

If that's the same as the one you posted in the tips and tricks thread (or whatever it's called), I changed to it a few hours ago so just did a search for Handcent & I got 18 results...

Nope, it's a different one I found today.

[Guest Sh4d0w940]

So some varying results, and to be honest, I don't believe I'm going to beat 14 results.

If you want to beat it, you should use this fingerprint:

ro.build.description=msm7201a_surf-user 2.1-update1 ERE27 eng.huawei.20100419.103709 test-keys

ro.build.fingerprint=htc_wwe/htc_legend/legend/legend:2.1/ERD79/139791:user/release-keys

This fingerprint is used in my vanilla roms.

It's the fingerprint from htc legend and i have 18 results when searching for handcent.

Must say I'm not in UK but in the Netherlands, so results may vary.

Sh4d0w940

[Guest Bigsy]

I used the Eris fix on the market and that gives me 18 results.

Befroe that I was getting 7 with stock Oscillation rom.

[Guest chall32]

Updated first post:

- Results from U8220 V100R001C05B820(Taiwan C HT Android2.1) - released on huaweidevice.com 09 June 2010 - 18 Results

- Added Fibblesan's alternative fingerprint - testing now

- Added Sh4d0w940 legend fingerprint - to test

[Guest chall32]

Found this PDF

android.os.Build.FINGERPRINT:

A string that uniquely identifies this build. It SHOULD be reasonably human-readable.

It MUST follow this template:

$(BRAND)/$(PRODUCT)/$(DEVICE)/$(BOARD):$(VERSION.RELEASE)/$(ID)/$(VERSION.INCREMENTAL):$(TYPE)/$(TAGS)

For example:

acme/mydevice/generic/generic:2.1-update1/ERC77/3359:userdebug/test-keys

The fingerprint MUST NOT include spaces. If other fields included in the template above have spaces, they SHOULD be replaced with the ASCII underscore ("_") character in the fingerprint.

Breaking this down then:

VERSION.RELEASE

The version of the currently-executing Android system, in human-readable format. This field MUST have one of the string values defined in Android 2.1 allowed version strings: http://source.android.com/compatibility/2.1/versions.xhtml

Bummer. That URL is not available and the internet archive is having "technical problems"

VERSION.INCREMENTAL

A value chosen by the device implementer designating the specific build of the currently-executing Android system, in human-readable format. This value MUST NOT be re-used for different builds shipped to end users. A typical use of this field is to indicate which build number or source-control change identifier was used to generate the build. There are no requirements on the specific format of this field, except that it MUST NOT be null or the empty string ("").

Interesting. Wish I could get a copy of http://source.android.com/compatibility/2.1/versions.xhtml Would put to bed the difference between "ERE79" (Sh4d0w940's vanilla) and "ERE27" (the rest)

- Chris

[Guest PsychoPingu]

Found this PDF

Breaking this down then:

Bummer. That URL is not available and the internet archive is having "technical problems"

Interesting. Wish I could get a copy of http://source.android.com/compatibility/2.1/versions.xhtml Would put to bed the difference between "ERE79" (Sh4d0w940's vanilla) and "ERE27" (the rest)

- Chris

Try here: http://source.android.com/compatibility/2.1/versions.html (dropped the x from the URL). Unfortunately, it doesn't look like that helps too much :)

[Guest chall32]

Try here: http://source.android.com/compatibility/2.1/versions.html (dropped the x from the URL). Unfortunately, it doesn't look like that helps too much :)

Cheers. So options are 2.1 or 2.1-update1.

Right, I know how this is done now then.

Lets say:

- I go into business called CHPhones and produce a nice shiny handset called a CH1, running Android 2.1 update 1.

- My CH1 is based on the ZZZ chipset

- I've singed an exclusivity contract with BTCellnet for the CH1

- I'm creating the android 2.1 build version 0001 today - 09/June/2010

Using the template from the PDF,

$(BRAND)/$(PRODUCT)/$(DEVICE)/$(BOARD):$(VERSION.RELEASE)/$(ID)/$(VERSION.INCREMENTAL):$(TYPE)/$(TAGS)

my build fingerprint would be:

BTCellnet/CHPhones/CH1/ZZZ:2.1-update1/0001/09062010:user/release-keys

And there you go, a nice specific fingerprint for use on the market. My next step would be to register this brand new fingerprint 'behind the scenes' with Google - possibly through Open Hand Set Alliance, maybe a bit of testing and there we go, one live fingerprint. There is no smoke & mirror "magic code" embedded in the fingerprint. The fingerprint really is he sum of the total of it's parts; it only works as a whole. Make any changes to any part of the registered fingerprint and it stops working. End of. So there we have it. Final loose end: OK, where can we find a complete working 2.1-update1 fingerprint from? Google to the rescue! After a search I uncovered Linpack website. Checkout the "Notes" column. See anything familiar? Pick the most common "2.1-update1" fingerprint and your home and dry. :) May I suggest:

htc_wwe/htc_legend/legend/legend:2.1/ERD79/139791:user/release-keys

A certain @paulobrien :) just happens to be using this fingerprint in his HTC Legend MCR r3 ROM. This also matches Sh4d0w940's suggestion.

Cheers gents!

- Chris

PS: proof off the pudding is in the eating... I'm testing above legend fingerprint now!

Edited June 9, 2010 by chall32

[Guest Stevos]

This is a really basic question, sorry but -

The reference to release-keys or test keys - does this reference some actual file or cryptographic signature for the ROM (to prevent faking), or is it simply that the string must contain "release-keys" to work properly?

If it does reference actual keys, where are they stored and how are they generated?

[Guest Simon O]

This is a really basic question, sorry but -

The reference to release-keys or test keys - does this reference some actual file or cryptographic signature for the ROM (to prevent faking), or is it simply that the string must contain "release-keys" to work properly?

If it does reference actual keys, where are they stored and how are they generated?

as far as I know, test-keys just work but do not allow the downloading of protected applications from the Android Market. release-keys need to be added by Google to a central database which they then use to filter apps based on the devices specifications and capabilities.

The reason why so many people have problems is that Google are slow to add new devices & rom versions to this database, and Google sometimes get it wrong by blocking compatible apps from showing.

That's my understanding.

[Guest chall32]

This is a really basic question, sorry but -

The reference to release-keys or test keys - does this reference some actual file or cryptographic signature for the ROM (to prevent faking), or is it simply that the string must contain "release-keys" to work properly?

If it does reference actual keys, where are they stored and how are they generated?

No problem.

According to the PDF:

android.os.Build.TAGS

A comma-separated list of tags chosen by the device implementer that further distinguish the build. For example, "unsigned,debug". This field MUST NOT be null or the empty string (""), but a single tag (such as "release") is fine.

I believe it's option 2; simply that the string must contain "release" or "release-keys" to make it identifiable as a key that should be registered on the market.

Without the tag, it's not immediately obvious to folks at open hand set alliance which fingerprints they need to [fully?] register.

I question fully register, as I would like to see what happens when I access the market with my baloney CH1 made up fingerprint, in the knowledge that it's been no where near google/open handset alliance. Should imagine that I see some apps as the CH1 key contains "2.1-update1"...

There's only one way to find out! :)

- Chris

[Guest Stevos]

I may have misunderstood, but I thought the API level was passed via the

ro.build.version.sdk=7

rather than the 2.1-update1 bit

and then the key string just identified the product to make sure it is supposed to be able to access stuff.

After all, it's the API level that's important for app compatibility, and it would make sense to use a numeric for this rather than a text string...

Is it possible that the 2.1-update1 business is just a human readable tag rather than part of the api level validation? I suppose it doesn't matter much if they register specific key strings anyway, but it's a matter of curiosity.

I suspected with a valid api level set, but an invalid key string, the market would be accessible and work for that API level apps, but be missing any that had specific requirements.

Edited June 10, 2010 by Stevos

[Guest chall32]

Agreed.

As the Version.Release string needs to be in "humanly readable" format it looks like that the whole fingerprint is just humanly readable string and that, as you say, the API level is used for app compatibility. It's this API that gives you access to just a base set of applications.

As the fingerprint can quite literally be anything you want, the killer is that the whole fingerprint needs to be registered with Google / Open Handset Alliance to ensure that the end user indeed has a compatible handset with those additional applications that potentially need it.

And there in lies the rub.

Yes we can use a different fingerprint to "trick the market" into allowing us to install additional applications that have not been specifically tested against our fingerprint (and hence our hardware and specific Android build) but we are potentially opening ourselves up for more force closes / crashes / reboots because of this.

Food for thought, next time you get a force close / crash / reboot.

- Chris

[Guest Sh4d0w940]

Agreed.

As the Version.Release string needs to be in "humanly readable" format it looks like that the whole fingerprint is just humanly readable string and that, as you say, the API level is used for app compatibility. It's this API that gives you access to just a base set of applications.

As the fingerprint can quite literally be anything you want, the killer is that the whole fingerprint needs to be registered with Google / Open Handset Alliance to ensure that the end user indeed has a compatible handset with those additional applications that potentially need it.

And there in lies the rub.

Yes we can use a different fingerprint to "trick the market" into allowing us to install additional applications that have not been specifically tested against our fingerprint (and hence our hardware and specific Android build) but we are potentially opening ourselves up for more force closes / crashes / reboots because of this.

Food for thought, next time you get a force close / crash / reboot.

- Chris

That's true, but I'd rather have an app that FC once in a while then no app at all :)

[Guest Simon O]

I'm using the ERE27 Verizon string as ERE27 is the build of Android 2.1 that Huawei supplied for our phones. ESE81 is the Droid build of 2.1, and ERD79 is a Nexus One build (or possibly HTC devices).

As I recall, ERE27 is the most common build of Android 2.1

[Guest titchu]

hi all, what ever i tried different fingerprints above , i still can not find "fxcamera" and "camera360" from market? can you?

Edited June 12, 2010 by titchu

[Guest thisweb]

I can't find ebay app or pkt auctions app, tried Eris fix on Oscillation rom. Is there any way to get all available apps?

[Guest DanWilson]

I can't find ebay app or pkt auctions app, tried Eris fix on Oscillation rom. Is there any way to get all available apps?

I don't think so, unless someone finds a mega fingerprint. Just try everything, and market enabler might help...

[Guest thisweb]

Thanks,

MarketEnabler with US worked for official ebay app.

Except now cn only se US searches and no option to change doh!

Anyone have a UK market key that works for this?

Edited June 13, 2010 by thisweb

[Guest Watt25]

I've tried most of these fingerprints just by editing the Build.prop file using RootExplorer.

But the search results are always the same...

Should it work this way? (I mean not building and flashing a new ROM, just editing the Build.prop file then restart the phone.)

[Guest Stevos]

I think at midnight the changes take effect and the new market keys are applied. You may be able to fake it by changing the clock on you phone to 23:59 and letting it roll over to a new day.