# pandora.com v15 xmlrpc encrypt/decrypt routines
# for data sent to /radio/xmlrpc/v15 in a POST
# usage:
# _xmlrpc_request_ = pandora_decrypt(_POST_data_)
# _POST_data_ = pandora_encrypt(_xmlrpc_request_)
def blowfish_round_function(XL):
F = S[0][XL>>24]
F += S[1][(XL>>16)&0xff]
F &= 0xffffffff
F ^= S[2][(XL>>8)&0xff]
F += S[3][XL&0xff]
F &= 0xffffffff
return F
def blowfish_intlist_decrypt(Li):
Lo = []
for i in xrange(0, len(Li), 2):
Lo.extend(blowfish_block_decrypt(Li[i], Li[i+1]))
return Lo
def blowfish_intlist_encrypt(Li):
Lo = []
for i in xrange(0, len(Li), 2):
Lo.extend(blowfish_block_encrypt(Li[i], Li[i+1]))
return Lo
def hexstr_to_intlist(H):
L = []
Hl = len(H)
Hm = Hl%8
for i in xrange(0, Hl-Hm, 8):
L.append(int(H[i:i+8],16))
if Hm > 0:
L.append(int(H[Hl-Hm:]+('0'*(8-Hm)),16))
return L
def intlist_to_hexstr(L):
H = ""
for I in L:
s = hex(I).replace('0x','').replace('L','')
H += ('0'*(8-len(s)))+s
return H
def str_to_intlist(S):
L = []
Sl = len(s)
Sm = Sl%4
if Sm > 0:
S += chr(0)*(4-Sm)
for i in xrange(0, len(S), 4):
L.append((ord(S[i])<<24)+(ord(S[i+1])<<16)+(ord(S[i+2])<<8)+ord(S[i+3]))
return L
def intlist_to_str(L):
S = ""
for I in L:
S += chr(I>>24&0xff)+chr(I>>16&0xff)+chr(I>>8&0xff)+chr(I&0xff)
return S
>>125
The built-in browser sends a key in the headers that the site can use to verify (and identify) the source if they have a contract with Sprint. Viewing the page with that browser yields a jar/jad download link, but I can't extract the URL. Viewing with Opera on the same phone shows the regular page.
Name:
Anonymous2008-02-16 23:01
>>126
What's the header name? Filling it with a random string should be enough to fool Pandora.
Name:
Anonymous2008-02-16 23:15
>>127
ClientID. And it's [a-zA-Z]{12}@sprintpcs.com.
Unfortunately I've tried copying the exact headers my phone sends into a netcat session, and all I get is "Sorry. Pandora does not support your device."
>>131
It's not done in the firmware, it's in the Squeezecenter software that runs on a separate PC. And it doesn't connect directly to Pandora, it goes through the Squeezenetwork web service.
You can download the source code at http://www.slimdevices.com/downloads/nightly/ and see for yourself (look at Slim\Plugin\Pandora and Slim\Networking), but I'm pretty sure it's a dead end.
Name:
Anonymous2008-02-17 9:12
>>126
If you download the file using that link, can you then copy it from your phone to your PC?
Name:
Anonymous2008-02-17 9:38
>>134
Nope. No way to access application storage. It's part of the J2ME security model.
I'll try whipping up a Java app later to spoof the request on the phone.