microg / microg/GmsCore

[pt.sibs.android.mbway] SMS-OTP onboarding broken due to microG's `versionName`

Open
#3,621 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
14.6k
Forks
3.2k
PR merge metrics
PR metrics pending

Description

**Affected app**
Name: MB WAY
Package id: pt.sibs.android.mbway

**Describe the bug**
Some apps read the **`versionName`** of the installed `com.google.android.gms` package, send it to their backend as a device attribute, and the backend then changes behavior based on it. Because microG reports a `versionName` like `0.3.15.250932` (obviously not a Google Play services version), these backends treat the device as "not real Google Play" and silently degrade.
Such is the case of the app in question, which refused to deliver an SMS OTP while still returning an HTTP `200 OK`.

**To Reproduce**
On a freshly-installed MB WAY app (or after clearing its data):
1. Go through the onboarding steps by entering the phone number associated with the MB WAY account — ensuring the SIM card of said number is inserted (_obviously_).
2. Selecting the option for "I am in the device with " to go through the OTP SMS screen.
3. Get stuck waiting for an SMS that will **never** arrive.

**Expected behavior**
SMS arrives, the app automatically fills the slot (it can't be manually typed in), app finalizes device registration.

**Screenshots**
Not necessary.

**System**
Android Version: 16
Custom ROM: crDroid 12.11

**microG**
microG Core version: 0.3.15.250932
microG Self-Check results: All ticked

**Additional context**
* Hooking the app's networking layer and rewriting only the reported version string in the outgoing request (`0.3.15.250932` → `26.24.34`), leaving everything else identical, caused the backend to immediately send the OTP SMS to the microG device, after which activation completed end-to-end (including subsequent provisioning calls, all `Status: OK`). Reverting the string reproduces the failure.
* I wrote a quick and stupid LSPosed module to get through this, but I'm pretty sure this can be avoided with the right feature/addition in microG. That or I am missing something obvious.

Contributor guide

No contributing guide indexed for this repository

Research direction

No source files or tests are named. Start by tracing how microG reports the installed com.google.android.gms package's versionName and how that value reaches outgoing app requests; compare the normal and rewritten values described in the report. Done means MB WAY receives its SMS OTP and completes registration without request rewriting.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, java, kotlin
Domain
authentication, mobile-dev
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.