Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.mobile.android > #156557

Re: A quick look at the WhatsApp Meta Services Framework server-side 7 day update

From Maria Sophia <mariasophia@comprehension.com>
Newsgroups comp.mobile.android, alt.comp.os.windows-10
Subject Re: A quick look at the WhatsApp Meta Services Framework server-side 7 day update
Date 2026-10-21 16:40 -0400
Organization BWH Usenet Archive (https://usenet.blueworldhosting.com)
Message-ID <11bb80i$1fp2$1@nnrp.usenet.blueworldhosting.com> (permalink)
References <11b08kc$20fv$1@nnrp.usenet.blueworldhosting.com>

Cross-posted to 2 groups.

Show all headers | View raw

Maria Sophia wrote:
> WhatsApp is firing an Android Intent (android.intent.action.VIEW) 
> with a data URI pointing directly to a non-Google APK file.
> 
> Two days ago my WhatsApp 2.26.29.70 asked to update & said I had 7 days.
> Interestingly, the APK is *directly* from WhatsApp servers. Not Google.
>  <https://www.whatsapp.com/android/1/WhatsApp.apk>
>  C:\> wget -O WhatsApp.apk 'https://www.whatsapp.com/android/1/WhatsApp.apk'
>    ...or... 
>  C:\> curl.exe -L "https://www.whatsapp.com/android/1/WhatsApp.apk" -o WhatsApp.apk
>  Name: WhatsApp.apk
>  Size: 154517872 bytes (147 MiB)
>  SHA256: D89C24B2ECE176B060D5868FC8D60F6EE186E05F47083F948B54FFF7FD9DCA63
> 
> From Windows, anyone can install that app (w/o losing data) using adb:
>  C:\> adb install -r WhatsApp.apk
> 
> However, what's interesting is I have all automatic updates turned off in 
> the Google Play Store app & in the Aurora & in all my app updater apps. 
> 
> Which means WhatsApp is dialing into a server to query the version number.
> And then WhatsApp pops up an in-app intent, to obtain the latest version.
> 
> Usually I don't debug intents, but two days later I took a quick peek.
> I will see if that intent changes over the next 5 days w/o updating it.
>  Action: android.intent.action.VIEW
>  Data: https://www.whatsapp.com/android/1/WhatsApp.apk
>  MIME type:
>  Package name:
>  Class name:
>  User ID: 0
>  Identifier: 
>  URI: intent://www.whatsapp.com/android/1/WhatsApp.apk#Intent;scheme=https;launchFlags=0x3000000;S.MSF_INTENT_METADATA_ORIGIN_PACKAGE_NAME=com.whatsapp;l.MSF_INTENT_METADATA_LAUNCH_START_TIME=1792253039002;S.MSF_INTENT_METADATA_ID=JB0b67MnnjGpDkR0bqOBGh%3D%3D%0A;end
>  Categories: 
>  Flags: FLAG_ACTIVITY_PREVIOUS_IS_TOP FLAG_ACTIVITY_FORWARD_RESULT
>  Extras: MSF_INTENT_METADATA_ORIGIN_PACKAGE_NAME com.whatsapp
>          MSF_INTENT_METADATA_LAUNCH_START_TIME 1792253039002
>          MSF_INTENT_METADATA_ID JB0b67MnnjGpDkR0bqOBGh==
> 
> The Meta Services Framework (MSF) fields are apparently generated 
> by Meta's background services on the device when that intent fires.
> ------- 
> Windows WhatsApp installer:
>  <https://www.whatsapp.com/download>
>  <https://get.microsoft.com/installer/download/9NKSQGP7F2NH?cid=website_cta_psi>
>  Name: WhatsApp Installer.exe
>  Size: 813088 bytes (794 KiB)
>  SHA256: E537BD26AF9CD54AEB61231FFE22DAD2D54185D5B48DC345B236A7D8002E30C5

What's wonderful is how beautifully the Windows PC interacts with Android!

Today WhatsApp told me I had one more day to go for the forced update.
(All other debug indications were the same as reported in the prior OP).

I've already downloaded the APK onto my desktop.
 C:\> curl.exe -L "https://www.whatsapp.com/android/1/WhatsApp.apk" -o WhatsApp.apk
 Name: WhatsApp.apk
 Size: 154517872 bytes (147 MiB)
 SHA256: D89C24B2ECE176B060D5868FC8D60F6EE186E05F47083F948B54FFF7FD9DCA63

So once WhatsApp stops working, presumably tomorrow, I'll slide it over.
 C:\> adb install -r WhatsApp.apk

I don't expect any complications, where the only surprise (for me) here, 
was that the WhatsApp update APK is NOT coming from the Google Play Store.

So how do they compare cryptographic signatures? 
Turns out, you use the Android SDK Build-Tools package apksigner.bat file.

You run apksigner.bat on the existing WhatsApp base.apk.
And you run apksigner.bat on the newly downloaded WhatsApp installation APK.

When you compare the results, you find they're using the same signer, 
even though one came from the Google Play Repo and the other from WhatsApp.
 Signer #1 DN	CN=WhatsApp LLC, O=WhatsApp LLC, L=Menlo Park	
 Signer #1 SHA-256	fb920d381bee...f4a6c2	
 Signer #2 DN	CN=Brian Acton, OU=Engineering, O=WhatsApp Inc.	
 Signer #2 SHA-256	3987d043...ce5d44	

So how do we know if they're not exactly the same APK then?
A hash will tell us that, but this shows WHAT is different.
 C:\> aapt.exe" dump badging base.apk | findstr /C:"package:"
 C:\> aapt.exe" dump badging update.apk | findstr /C:"package:"

  a. The two signatures match (SHA-256 fb920d381bee...f4a6c2)
  b. But the VersionCode bumps from 262907030 to 264107133 
  c. And the VersionName bumps from 2.26.29.70 to 2.26.41.71

We know all this, using only the PC & WITHOUT installing anything!

In summary, we now know the existing whatsapp came from the google play 
repository (via Aurora, but that doesn't matter) and that the update does 
NOT come from the Google Play repository, but the signatures match. 

In addition, we now know that the version is upgraded between the two.
So the seamless replacement (keeping the original data) should work.

We know all this by debugging & WITHOUT actually installing anything!
-- 
When you run adb on Windows, you find out how seamless it is with Android.

Back to comp.mobile.android | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

A quick look at the WhatsApp Meta Services Framework server-side 7 day update Maria Sophia <mariasophia@comprehension.com> - 2026-10-17 12:43 -0400
  Re: A quick look at the WhatsApp Meta Services Framework server-side 7 day update Maria Sophia <mariasophia@comprehension.com> - 2026-10-21 16:40 -0400
    Re: A quick look at the WhatsApp Meta Services Framework server-side 7 day update Maria Sophia <mariasophia@comprehension.com> - 2026-10-22 16:27 -0400
      Re: A quick look at the WhatsApp Meta Services Framework server-side 7 day update Maria Sophia <mariasophia@comprehension.com> - 2026-10-22 18:21 -0400
        Re: A quick look at the WhatsApp Meta Services Framework server-side 7 day update Maria Sophia <mariasophia@comprehension.com> - 2026-10-24 14:20 -0400
          Re: A quick look at the WhatsApp Meta Services Framework server-side 7 day update Andy Burns <usenet@andyburns.uk> - 2026-10-25 21:13 +0000
            Re: A quick look at the WhatsApp Meta Services Framework server-side 7 day update Maria Sophia <mariasophia@comprehension.com> - 2026-10-26 09:23 -0400

csiph-web