GitHub, Why?

Last weekend GitHub decided to suspend my account for no apparent reason(No it wasn’t a DMCA from Google). I got an email saying for me to “reverify my academic status” for the student developer pack at the same time I got suspended. I tried to do that but… you can’t reverify without being logged in, and you can’t login when you are suspended. So I contacted support and they asked “how [I] plan to use GitHub” and that “[my] account was flagged by [their] abuse-detection systems for manual review, as it may conflict with [their] Terms of Service”. I responded but haven’t gotten any response since then(that was a week ago). I ended up moving at least temporarily to GitLab. While I had a copy of the git repository on my development machine, unfortunately this doesn’t include GitHub releases. I created a new one on GitLab but there aren’t any before the newest one.

Anyhow, lets get to the new features:

• Fix crashing when exiting causing lingering threads
• Add support for the space key & several special characters including Enter for newlines
• Add support for different font sizes
• Add support for downloading and applying font families at runtime (Huge thanks to Jonathan Neal for Google Fonts catalog)
• Improve install script by supporting powershell 5(the one included in windows) and fixing several errors
• Fix bug where installer’s progress bar wouldn’t update until completed
• Cache parsed Savekeys to prevent additional wasted compute
• Update installers to use GitLab

Anyhow, those are the recent updates! Hopefully GitHub reviews my reinstatement request soon. :)

Lots more marginal improvements + New Rendering Engine + Pain

Recently I have been adding:

• Support for more keys(symbols, numbers, numpad numbers & arrow keys)
• Paste (CTRL + V) support
• More verbose logging
• New Rendering Engine
  • Can include additional data(underline color, etc) for the future
  • Seems more stable(the old one was kind of jank)

But to be honest, most of the time was spent trying to fix some unliveable bugs, when typing to quickly, stuff appears after the cursor. In addition when typing, bold text after the cursor seems to offset. I learned something that can help with the latter bug, but I wasn’t able to fix either.

Building Up to Release

I’ve been working on numerous small issues that I have been putting off. One of these is that all documents over ~1.5 pages were getting cut off, it turns out the contents of the document is split into multiple chunks, each around ~1.5 pages long. It was a relatively simple problem, just needed to fix it. Also binding(incoming changes) now runs on a separate thread so that the UI doesn’t freeze when somebody else types. Saving also now runs on a separate thread, it auto saves every ~1 second, which caused another problem, outgoing changes got relayed back as incoming changes by Google’s servers, meaning everything you typed got duplicated. Again, simple fix, just needed doing. The main thing however is the caret/cursor behavior, which was/is doing some funky stuff, jumping around whenever you changed lines. I added a binary search to help with this, which helped but didnt completely fix it. So there is still some work there. I also added some savekeys to minimize the log output, because before…… there were almost a MB of logs from each run. The main things that stand before release are to finish the cursor behaviour, bolds & italics shifting, and add a home screen with your documents.

HUGE Progress

The past few hours I have worked on this project have been extremely productive. I found a header that genuine Google Docs sends, “X-Same-Domain”, which I believe just indicates whether the request is being sent to the same domain as the sender. It turns out that Google actively blocks requests from other domains, but luckily we can just send “X-Same-Domain” with a value of 1, pretending to be coming from the “docs.google.com” domain. After this realization the “/save” endpoint returned 200 (OK). This was huge progress, this has been a major blocker for months. The one problem was that while the status code stated that the request was successful, the actual request payload contained an error “XSRF” and a string of numbers and letters, which I thought was probably some kind of authentication/coordination token. After a quick Google search, I realized that this was a token to prevent other websites in the same browser from sending requests impersonating Google Docs as the browser auto attaches authentication cookies. To my surprise, when I added “&token=XXXXXX” (with XXXXXX being the string of numbers and letters) to the request url, we get a different error! This one was very ambiguous though, it just was a JSON payload containing nothing but the number “400”, as in 400 (Bad Request) which I had become to dread. After searching around the codebase for a while I found a problem with the url encoding logic, Url encoding is the proccess of replacing invalid character with %XX (XX being the ASCII code for the invalid character), it turns out “&“s are valid characters……. but I was replacing them. Ampersands are also the seperator for parameters. I think the problem was that within the Google Docs server code, it seperates the parameters then decodes each one. With this problem fixed, saving worked!!!! There were a few tiny bugs I wont get into, but largely it worked. I implemented merging changes(sending “hello” rather than “h” + “e” + “l”+ “l”+ “o”). With saving working, I decided to start working on seeing whether these solutions also worked on “/bind” (real-time incoming changes), they didn’t immediately, but after a few tweaks trying to replicate the URL parameters that Google Docs uses, we had incoming changes! I had to do some fancy async enumerable shenanigans to get them to come in asynchronously. The main thing left to do on incoming changes is to set up a seperate thread.

Anyhow, Big Devlog, just felt that if I wrote a devlog, it would be outdated within the hour.

See ya next time! ; )

Polish ™

Worked on polishing up the UI, now the title of the document along with your Google account name and profile picture are displayed in the open document screen. Also text wrapping behaves much better. I also have been expermenting alot on how to get saving and realtime collaboration, since the last piece of progress, not much, just alot of 400 (Bad Request)s

Progress on Collaboration and saving

Made some substantial progress on realtime collaboration, now I can successfully authenticate by posting to /bind to get a SID to then eventually make requests to /bind and /save. This was made possible by scraping the main web endpoint.

Hackpad With TouchPad Devlog #3

I’ve fixed a few issues in the PCB, the microcontroller was inset from the edge of the PCB in a way where it would be difficult to access the usb port, so I rewired the PCB to bring it to the edge, also fixed a few clearence issues in Kicad. Also added more padding on the USB port hole to make sure the cable will fit.

HackPad With TouchPad Devlog #2

I’ve been working on polishing up the case by adding the hole for the USB, along with adding “HACKPAD” to the top of the case and filleting most edges.

Linux Compatibility And Polish

The past few hours have been spent on refining the installer and associated scripts to work better on Linux and give a more reliable experience. Along with cleaning up some unimplemented features. A clear permission prompt for browser-scraping has been added. The past few Devlogs were focused on Internal Mode(Logging in without an external Browser), I still have plans to work on this but it is no longer the most pressing for me right now. School is starting soon for me, and I will have less time to work on this. I Want to get this ready to ship before the start of school so I can get this shipped before the end of the challenge. I will be focusing more on polish, installers, and getting it into a shippable state, If I can get saving to work before then, that’s great. But if not, I want to be able to ship a polished product even if it is missing a crucial feature(saving). But there is no guarantee that I will get it working by sinking more time into it, because it needs more reverse-engineering, I could get it to work in 3 Hours or 500, its down to how quickly I can crack the code in Wireshark(if ever).

HackPad With TouchPad Devlog #1

I am Working on a HackPad with 16 keys(4x4) and a touch/track pad, The Touchpad is salvaged from a broken keyboard. I plan to use the touchpad in software to do swipe gestures, etc. The PCB is done(it has a FFC(Flat Flexible Connecter) on it to plug into the touchpad). The Case is nearing completion but still needs a few finishing touches.

Welp, so much for that

2 Devlogs Ago I said I would create a CEF based C# app to authenticate with google. I did not realize that google explicitly blocks this. You might think, just change the “User-Agent: xxxxxx”, but no, Google has an entire JS detection system to stop exactly that. So then I tried making a web wrapper around “accounts.google.com” but Google has a CORS policy around this. So back to Servo it is!

Progress! See Previous devlog.

Internal Mode

Been working on a Servo based google login (Internal Mode )(based on the servo slint example) in rust. I got far enough to be able to login, but it would take a lot more work in order to get to actually being able to login to google docs. This is my first rust project that goes beyond “Hello World!” so I have been trial and erroring my way through this proccess. I have realised that:

• My rust is not even close enough to being able to complete this within a reasonable timeframe(or ever)
• Servo doesn’t have any C#(my first and most experienced language) bindings(or not that I can find)
• CEF(Chromium Embedded Framework) does have C# bindings (Unfortunately is ALOT more bloated compared to Servo), aand Avalonia integration (I use Avalonia for the rest of the Google Docs App)

Servo based login: doopyelephant/ServoGoogleLogin

I Have started work on a CEF based google login in C#.

Hopefully it plays out :)

Started a Personal Website! Nothing Crazy right now. Just my profile, with links to my socials so far.

Chromium App-Based-Encryption

I have been working on chromium based browser support.

Chrome & other modern Chromium based browsers use App-Bound-Encryption to encrypt their cookies. This is the reason why this unofficial Google Docs Client is currently unable to fully decrypt cookies from modern chromium based browsers out of the box on Windows. Chromium encrypts its cookies using the Windows DDAPI(Figure 2). Chromium used to decrypt cookies using the methods implemented in this repository before Chromium 127, this repository should decrypt cookies from chromium versions 127 and below(Figure 1).

Figure 1 (C4 Bomb: Blowing up Chrome’s Appbound Cookie Encryption, www.cyberark.com/resources/threat-research-blog/c4-bomb-blowing-up-chromes-appbound-cookie-encryption. Accessed 13 July 2026.)

Figure 2 (C4 Bomb: Blowing up Chrome’s Appbound Cookie Encryption, www.cyberark.com/resources/threat-research-blog/c4-bomb-blowing-up-chromes-appbound-cookie-encryption. Accessed 13 July 2026. )

Path forward

On Windows

ABE is in full effect, we would need SYSTEM perms, and try to impersonate Chrome. I plan to integrate xaitax/Chrome-App-Bound-Encryption-Decryption but this likely will not work forever, it is an arms race with Google and xaitax. Currently it works but likely Google with shut it down eventually.

On Linux

ABE is only used on Windows, on Linux Chromium uses the system Keychain over DBUS. (Gnome or KWallet) If these are unavailable it uses a completely exposed key in a file(basic encyption). This is very surpassable, it just needs implementation.

Dynamic Path Support!

Dynamic Paths are now enabled by default! Currently only Firefox works reliably from my limited testing. Zen(Fork of Firefox) works like 1/2 the time, and chromium based browsers get found but don’t work properly. The UI is kind of broken but it works for now(Working on it). Beta 3 is now released on Github with builds from the new Package&Release Script mentioned in the previous devlog.

Platforms Platforms Platforms!

Today I worked on yet more build scripts, now .zip files can be generated for every supported platform and placed in a folder with a single command! I still need to update the installer to fetch the corresponding .zip for the OS and Arch automatically. I am planning on doing my first ship once the installer & associated scripts are in a finished state where you can just paste one command into the terminal (for Win/Linux) and it opens the installer application which walks through the installation. After the installation the application should be able to be launched from the Start Menu/App Launcher along with an icon. Also the Dynamic Browser Paths(automatically finding the cookie directory of the user’s installed browser) should be stable, or if not then Internal Mode(planned mode which packages a Servo based browser to login with google to get cookies for auth).

Beta 2: Unofficial Google Docs Client I have worked more on RE’ing in Wireshark to RE saving and binding to a document(receive realtime updates), Implemented the infrastructure in the application, but both currently return a 400 (Bad Request), I am still working on it. There is a new material 3 theme with some other subtle UI changes. Various little fixes aswell. Also, you used to have to unzip and run the installer manually, but now there is a curl install command on the repo that downloads it to AppData and runs it.

Finished Installer Flow!

The installer now successfully downloads & installs the Google Docs application. It downloads the icon and adds a shortcut to the start menu, and adds Registry entries to add the uninstall script to the Add & Remove Programs Page in the windows settings app.

Installer flow complete! It doesnt do any installing yet but we have a framework that calls a powershell script with progress updates and a progress bar