mirror of
https://github.com/SimoneAvogadro/android-reverse-engineering-skill.git
synced 2026-10-20 23:49:45 +08:00
Simone Avogadro
e890e3abef
From research on the most-played children's Android apps of 2026: the ad SDKs and (equally important) the trackers/telemetry that these apps ship and the registry did not yet cover. Each entry was built from the official Maven AARs, inspected across versions with javap/jadx, every target method's real return type confirmed by a neutralize.sh dry-run on the real bytecode, and validated against _schema.json. Ads: - superawesome (tv.superawesome) — the kids-focused ad SDK (Talking Tom/Angela, Subway Surfers) - appodeal (com.appodeal.ads/com.explorestack, mediation; explorestack kept detection-only, not deep-stubbed, to avoid nulling its shaded-protobuf/IAB getters) - mytarget (com.my.target), hyprmx (com.hyprmx.android), maio (jp.maio, v1+v2) Trackers / analytics / attribution: - singular (com.singular.sdk), amplitude (com.amplitude, v1+v2 — v2 is a fluent builder so only flush() is stubbed, chained methods protected), google-analytics (Universal/legacy, distinct from the Firebase Analytics/GA4 entry) Crash / telemetry (Exodus classifies these as trackers): - sentry (io.sentry), bugsnag (com.bugsnag), backtrace (backtraceio) Init + capture/send stubbed and auto-init providers disabled, while object/scope getters and singletons the app chains on are protected so a stub cannot itself crash the app (e.g. Bugsnag's static facade throws before start(), so its delegators are stubbed to no-op). Verified on real decodes where present: Appodeal on 1945 Air Force, Singular and Google Analytics on Block Craft; the rest are AAR-verified pending a decoded app. Docs updated to 45 SDKs / 337 entry points / 281 ad operations. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014tae7iP5Zh8tax1Sn9p3A5