HUGE Progress

The past few hours I have worked on this project have been extremely productive. I found a header that genuine Google Docs sends, “X-Same-Domain”, which I believe just indicates whether the request is being sent to the same domain as the sender. It turns out that Google actively blocks requests from other domains, but luckily we can just send “X-Same-Domain” with a value of 1, pretending to be coming from the “docs.google.com” domain. After this realization the “/save” endpoint returned 200 (OK). This was huge progress, this has been a major blocker for months. The one problem was that while the status code stated that the request was successful, the actual request payload contained an error “XSRF” and a string of numbers and letters, which I thought was probably some kind of authentication/coordination token. After a quick Google search, I realized that this was a token to prevent other websites in the same browser from sending requests impersonating Google Docs as the browser auto attaches authentication cookies. To my surprise, when I added “&token=XXXXXX” (with XXXXXX being the string of numbers and letters) to the request url, we get a different error! This one was very ambiguous though, it just was a JSON payload containing nothing but the number “400”, as in 400 (Bad Request) which I had become to dread. After searching around the codebase for a while I found a problem with the url encoding logic, Url encoding is the proccess of replacing invalid character with %XX (XX being the ASCII code for the invalid character), it turns out “&“s are valid characters……. but I was replacing them. Ampersands are also the seperator for parameters. I think the problem was that within the Google Docs server code, it seperates the parameters then decodes each one. With this problem fixed, saving worked!!!! There were a few tiny bugs I wont get into, but largely it worked. I implemented merging changes(sending “hello” rather than “h” + “e” + “l”+ “l”+ “o”). With saving working, I decided to start working on seeing whether these solutions also worked on “/bind” (real-time incoming changes), they didn’t immediately, but after a few tweaks trying to replicate the URL parameters that Google Docs uses, we had incoming changes! I had to do some fancy async enumerable shenanigans to get them to come in asynchronously. The main thing left to do on incoming changes is to set up a seperate thread.

Anyhow, Big Devlog, just felt that if I wrote a devlog, it would be outdated within the hour.

See ya next time! ; )

Polish ™

Worked on polishing up the UI, now the title of the document along with your Google account name and profile picture are displayed in the open document screen. Also text wrapping behaves much better. I also have been expermenting alot on how to get saving and realtime collaboration, since the last piece of progress, not much, just alot of 400 (Bad Request)s

Progress on Collaboration and saving

Made some substantial progress on realtime collaboration, now I can successfully authenticate by posting to /bind to get a SID to then eventually make requests to /bind and /save. This was made possible by scraping the main web endpoint.

Linux Compatibility And Polish

The past few hours have been spent on refining the installer and associated scripts to work better on Linux and give a more reliable experience. Along with cleaning up some unimplemented features. A clear permission prompt for browser-scraping has been added. The past few Devlogs were focused on Internal Mode(Logging in without an external Browser), I still have plans to work on this but it is no longer the most pressing for me right now. School is starting soon for me, and I will have less time to work on this. I Want to get this ready to ship before the start of school so I can get this shipped before the end of the challenge. I will be focusing more on polish, installers, and getting it into a shippable state, If I can get saving to work before then, that’s great. But if not, I want to be able to ship a polished product even if it is missing a crucial feature(saving). But there is no guarantee that I will get it working by sinking more time into it, because it needs more reverse-engineering, I could get it to work in 3 Hours or 500, its down to how quickly I can crack the code in Wireshark(if ever).

Welp, so much for that

2 Devlogs Ago I said I would create a CEF based C# app to authenticate with google. I did not realize that google explicitly blocks this. You might think, just change the “User-Agent: xxxxxx”, but no, Google has an entire JS detection system to stop exactly that. So then I tried making a web wrapper around “accounts.google.com” but Google has a CORS policy around this. So back to Servo it is!

Progress! See Previous devlog.

Internal Mode

Been working on a Servo based google login (Internal Mode )(based on the servo slint example) in rust. I got far enough to be able to login, but it would take a lot more work in order to get to actually being able to login to google docs. This is my first rust project that goes beyond “Hello World!” so I have been trial and erroring my way through this proccess. I have realised that:

• My rust is not even close enough to being able to complete this within a reasonable timeframe(or ever)
• Servo doesn’t have any C#(my first and most experienced language) bindings(or not that I can find)
• CEF(Chromium Embedded Framework) does have C# bindings (Unfortunately is ALOT more bloated compared to Servo), aand Avalonia integration (I use Avalonia for the rest of the Google Docs App)

Servo based login: doopyelephant/ServoGoogleLogin

I Have started work on a CEF based google login in C#.

Hopefully it plays out :)

Chromium App-Based-Encryption

I have been working on chromium based browser support.

Chrome & other modern Chromium based browsers use App-Bound-Encryption to encrypt their cookies. This is the reason why this unofficial Google Docs Client is currently unable to fully decrypt cookies from modern chromium based browsers out of the box on Windows. Chromium encrypts its cookies using the Windows DDAPI(Figure 2). Chromium used to decrypt cookies using the methods implemented in this repository before Chromium 127, this repository should decrypt cookies from chromium versions 127 and below(Figure 1).

Figure 1 (C4 Bomb: Blowing up Chrome’s Appbound Cookie Encryption, www.cyberark.com/resources/threat-research-blog/c4-bomb-blowing-up-chromes-appbound-cookie-encryption. Accessed 13 July 2026.)

Figure 2 (C4 Bomb: Blowing up Chrome’s Appbound Cookie Encryption, www.cyberark.com/resources/threat-research-blog/c4-bomb-blowing-up-chromes-appbound-cookie-encryption. Accessed 13 July 2026. )

Path forward

On Windows

ABE is in full effect, we would need SYSTEM perms, and try to impersonate Chrome. I plan to integrate xaitax/Chrome-App-Bound-Encryption-Decryption but this likely will not work forever, it is an arms race with Google and xaitax. Currently it works but likely Google with shut it down eventually.

On Linux

ABE is only used on Windows, on Linux Chromium uses the system Keychain over DBUS. (Gnome or KWallet) If these are unavailable it uses a completely exposed key in a file(basic encyption). This is very surpassable, it just needs implementation.

Dynamic Path Support!

Dynamic Paths are now enabled by default! Currently only Firefox works reliably from my limited testing. Zen(Fork of Firefox) works like 1/2 the time, and chromium based browsers get found but don’t work properly. The UI is kind of broken but it works for now(Working on it). Beta 3 is now released on Github with builds from the new Package&Release Script mentioned in the previous devlog.

Platforms Platforms Platforms!

Today I worked on yet more build scripts, now .zip files can be generated for every supported platform and placed in a folder with a single command! I still need to update the installer to fetch the corresponding .zip for the OS and Arch automatically. I am planning on doing my first ship once the installer & associated scripts are in a finished state where you can just paste one command into the terminal (for Win/Linux) and it opens the installer application which walks through the installation. After the installation the application should be able to be launched from the Start Menu/App Launcher along with an icon. Also the Dynamic Browser Paths(automatically finding the cookie directory of the user’s installed browser) should be stable, or if not then Internal Mode(planned mode which packages a Servo based browser to login with google to get cookies for auth).

Beta 2: Unofficial Google Docs Client I have worked more on RE’ing in Wireshark to RE saving and binding to a document(receive realtime updates), Implemented the infrastructure in the application, but both currently return a 400 (Bad Request), I am still working on it. There is a new material 3 theme with some other subtle UI changes. Various little fixes aswell. Also, you used to have to unzip and run the installer manually, but now there is a curl install command on the repo that downloads it to AppData and runs it.

Finished Installer Flow!

The installer now successfully downloads & installs the Google Docs application. It downloads the icon and adds a shortcut to the start menu, and adds Registry entries to add the uninstall script to the Add & Remove Programs Page in the windows settings app.

Installer flow complete! It doesnt do any installing yet but we have a framework that calls a powershell script with progress updates and a progress bar

Avalonia Animations keep overlapping the pages!?!?

Made some fancy installer UI (Avalonia wwhhhyyy does your styling have to be so finicky!!!!!!)

Made a Build script to automate building and compiling the application for people!

-Demo of Unofficial Google Docs Client

This is the status of my Unofficial Google Docs Client(Most of what is demoed in this devlog is done before stardance, this is a recap before i get into new features)

Can authenticate with google to fetch public & private documents(using browser cookies)

Can view documents including text(including bolds and italics) and tables

Can move a cursor around and type, but cannot save to google’s servers yet