This is a full reversal of MICO, the Android caller-ID and spam-blocking app published by eyecon as com.eyecon.global, version 4.2026.04.23.1145. Everything below is derived from the shipped APK at eyecon-app.latest.apk, 65,604,949 bytes, 54,878 classes across six DEX files.

The analysis is static. None of it was observed running. There was no device capture and no traffic capture, and no server-side work of any kind. Nothing here claims what an endpoint actually returns. Where a claim is inferred from bytecode rather than read directly out of it, it says which one it is.

A clarification belongs here, at the top, because “caller ID app” invites a specific reading and gets it wrong. MICO is a commercial product doing a commercial job: it identifies who is calling and it blocks the calls you do not want. It ships advertising SDKs, which is ordinary for the category. There is no command-and-control channel, no dropper, no privilege escalation, no persistence beyond standard Android components, and no dynamic code loading beyond a bundled Meta Audience Network DEX. It does not record calls.

What makes the app worth reversing is narrower and more specific than the marketing suggests. The request authentication scheme is recoverable end to end, and once it is, any request the app can make can be reproduced by hand with curl. The clientId that anchors the whole identity chain is issued by one unauthenticated endpoint. The Facebook application secret sits in plaintext resources. Two of the bundled ByteDance libraries implement their own cryptography, and one of them seeds a permutation from the wall clock.

Three of the five native libraries are reversed here. Two are not, and I would rather say so plainly than let the count imply more than it does. libbuffer_pgl.so and libfile_lock_pgl.so are ByteDance Pangle libraries that appear in the APK, are never mentioned in the source documentation, and were never opened. Part VI says what that leaves unanswered.

How to read thish2

The document runs in seven parts. Each part opens with a short framing section written to give you the shape of what follows, and then reproduces the underlying analysis in full and unedited.

One convention. Class names in code listings are JADX’s obfuscated output with original names restored where the JADX INFO: renamed from comment survives, so you can grep either form.

Part I - Scope, target, methodh2

Before any findings, the ground rules: what was analysed, what tooling did the work, how much of the tree survived decompilation, and where the coverage ran out. This part also carries the deliverables list and the obfuscation-to-identity map, which is the lookup you will want most when reading Part VII.

Two numbers frame everything after this. Only 5,771 of the 38,575 decompiled Java files are first-party, which is 15.3 percent. The remaining 85 percent is advertising and analytics: Google AdMob alone accounts for 6,439 classes, Facebook Audience Network 3,152, Fyber FairBid plus Inneractive 1,148. The analysis budget went to the 15 percent, and the reason is that the other 85 percent is a solved problem that other people have already published.

The decompiler itself lost 392 classes outright, 162 of them hard failures at the file level. Every one of those is AndroidX or Compose internals, so the loss is real but it is loss in territory nobody needed. 31,911 files decompiled with no warnings at all.

Four packages resisted classification entirely: p293fh, gj, g8, and yi. They are catalogued in the C6 appendices with what is known about them, which is close to nothing.

MICO (com.eyecon.global) — Full Decompilation & Reconstructionh3

Generated from C:\Users\btc_e\Downloads\eyecon-app.latest.apk Method: JADX 1.5.6 CLI (--deobf --show-bad-code --comments-level debug) + targeted native inspection.

Deliverablesh4

Total footprint: 44,575 files / 314 MB.

Target identityh4

package       com.eyecon.global
versionCode   749
versionName   4.2026.04.23.1145
minSdk 23   targetSdk 35   compileSdk 36
size          65,604,949 bytes
DEX           6 files (classes.dex … classes6.dex) + assets/audience_network.dex (5,017,908 B)
classes       54,878 across 8,291 packages
ABIs          arm64-v8a, armeabi-v7a, x86, x86_64
processes     main, :notification_process, :restart_app

Corrections to BACKEND-FINDINGS.mdh4

The first pass left open questions that the deeper pass resolved:

1. CID origin — RESOLVED. clientId (the e-auth credential) is the join.jsp response body. It is server-issued, not a device identifier. See FEATURE-AND-FLOWS.md §A.
2. The AI SMS assistant does NOT use voice2text. It posts to numberlookup.instabridge.com over cleartext HTTP. voice2text.eyecon-app.com is the separate Talk-To-Me voicemail-to-text service. The first pass conflated them.
3. e-auth-k is rotatable. PgdtSBeR0MumR7fO is the compiled-in default, but Remote Config key circus_key can reflectively overwrite the static final field at runtime (p032b5.AbstractC3464e.m3668s()), and that Remote Config is fetched over cleartext HTTP.
4. EyeconRoomDB is dead code. The entity class is an image utility, the DAO is empty, it is never instantiated. MICO uses raw SQL exclusively.
5. App SharedPreferences is not Android SharedPreferences — it is a custom implementation backed by a shared_preference_v2 table inside contactdb.
6. Native libraries are not app protection. libpglarmor.so / libtobEmbedPagEncrypt.so / libnms.so / libbuffer_pgl.so are ByteDance Pangle ad-SDK components. Nothing in native code strengthens the API auth. (The first pass suspected a packer; that was wrong.)

Obfuscation → identity maph4

Recovered from JADX renamed from comments during the flow reconstruction:

Two classes look like third-party code but are app code: com.facebook.appevents.AbstractC9039h and androidx.fragment.app.RunnableC2598c.

Top findings by severityh4

Criticalh5

• Facebook app secret shipped in the client — verified in res/values/strings.xml: facebook_app_id = 1716660955257637, facebook_client_token = afa3f38c55f24c73b177afc962969b15, and fct = the pair as app_id|app_secret. Facebook documents the app secret as server-only. Severity depends on the app’s Graph permissions and whether any Eyecon endpoint trusts app-level auth — both need the Meta app console.
• Cleartext unauthenticated remote control plane — ~400 A/B flags plus store_url, search_url, links_script, big_url_script fetched over plain HTTP from cloudfront-cdn-all.eyecon-app.com. Enables JS injection, cards-host repointing (leaking cli+cid), and audio redirection. (This replaces the retracted “rc_key rotation” claim.)

Highh5

• AI SMS assistant is unauthenticated and cleartext — x5.p.m38847d POSTs up to 50 messages from inbox and sent, plus contact name, number and display name, to numberlookup.instabridge.com/respond-sms over plain HTTP. A MITM can therefore make MICO send attacker-chosen SMS from the user’s phone.
• Premium entitlement is 100% client-side — no Google Play purchase verification exists; the only confirmation is a client-authored mysettings POST. Purchase tokens and a page-chosen offerToken are handed to remote web content.
• StoreActivity leaks the bearer token — remote-config store_url with no scheme, host or pinning validation, loaded into a JS WebView exposing clientId (the e-auth bearer), GAID, MSISDN and an unfiltered SharedPreferences reader. WebviewPaywallActivity implements exactly the missing validation, so the fix is known internally and applied in one place only.
• MyPhoneReceiver is exported with no permission and honours CALL_SCREENING_NEW_CALL and INTENT_ACTION_START_CALL_WHATSAPP, taking state and incoming_number verbatim from the broadcast — any installed app can drive the caller-ID screen for an arbitrary number.
• Unencrypted Opus-over-UDP voice to ptt.eyecon-app.com; push-to-talk via ACTION_DOWN/ACTION_UP, except the notification-answer path starts the mic with no release.
• Unencrypted contactdb to Google Drive (full SMS bodies, notification text, voicemail transcripts), restored by a renameTo swap.
• PhotosTrackerWorker silently harvests Facebook avatars of every Facebook-linked contact every 3 days, via a hidden people-search in an invisible JS WebView with a spoofed Pixel 2 / Chrome 79 User-Agent.
• EyeconAnalyticsWorker can ZIP and upload the entire call log; disabled by default but remotely flippable, with a from_date rewind for re-upload.
• Contact-photo “encryption”: Blowfish/ECB keyed "Ewu" + nextInt(999) + "sTQHGK" → 999 possible keys, key stored plaintext in prefs as cipher_key, with ObjectInputStream.readObject() reached twice over decryptable file bytes.

Mediumh5

• PII in URL query strings: GET cantalk.jsp?recvcli=…&message=<SMS body>; the first-party spam report sends name + caller-id as GET params. IMEI/MAC/android_id/GAID fingerprint on join.jsp, cli_auth/gettransport, addcontacts.jsp.
• Singular (e1) harvests GAID via reflection and discards isLimitAdTrackingEnabled() — Limit-Ad-Tracking is read then thrown away. It also enumerates all location providers and reverse-geocodes to a country code; coarse location alone suffices.
• Amplitude Session Replay (p000) records caller-ID card screens via rrweb.
• eo.b.m31717e calls clearApplicationUserData() on DB corruption and System.exit(0) on any prefs read error, destroying clientId and forcing re-registration.
• Moloco banner WebView: JS enabled + evaluateJavascript("beginVideo(" + <VAST data> …), with creative URLs passed to an unschematised external ACTION_VIEW intent.
• PhoneAccount is a dead stub — getAuthToken throws UnsupportedOperationException.
• 401 + E-Mark triggers a destructive client-side wipe of auth state, reachable via the same cleartext path. eyecon://browser?url= intent redirection; exported PhoneNumberValidationActivity.onNewIntent extras injection.

Explicitly NOT findings / NOT presenth5

• No call recording exists. No MediaRecorder, no VOICE_CALL/DOWNLINK/UPLINK, no MediaProjection. The only AudioRecord app-wide is an AMR voice-note. The Documents/Eyecon/RecordedCalls directory is index/scan/migrate/promote/ACTION_SEND only.
• SMS broadcast receivers are permission-guarded and never call abortBroadcast.
• All other exported services/receivers are permission-guarded.
• No mutable PendingIntent; no certificate-pinning bypass; backup is correctly disabled.
• The pgl native libraries are ByteDance Pangle ad SDK, not a packer or app protector.
• e-auth-c (m38421e) is a trivial checksum, not a challenge-response.
• No CRITICAL permission-granting defect.

Explicitly NOT findingsh5

SMS broadcast receivers are permission-guarded and never call abortBroadcast; all other exported services/receivers are permission-guarded; no mutable PendingIntent; no certificate pinning bypass; backup is correctly disabled; there is no CRITICAL permission-granting defect.

Provider / tooling stateh4

Note: opencode reads both opencode.json and opencode.jsonc in ~\.config\opencode\. ida-pro-mcp wrote to the .json; REA wrote to the .jsonc. Both are active.

Residual unknownsh4

Static analysis only. Nothing here observed execution.

1. Response schemas for every endpoint — only request shapes are recoverable statically.
2. Whether e-auth-k is validated server-side at all.
3. E-Mark / CID 401 semantics — needs runtime or server-side evidence.
4. 392 classes (1.2%) failed decompilation; contents unknown.
5. The phone-call audio capture call site was not located; only Toki’s AudioRecord exists in app code.
6. PhoneAccount.SyncService.onPerformSync is empty — the contacts account is registered and unused.
7. The GhidraMCP extension declares ghidraVersion=11.3.2 against Ghidra 12.1.2; it may fail to load.

Part II - Attack surfaceh2

What the app declares to the platform. This is the cheapest part of any Android reversal to read and often the most revealing, because the manifest states intentions that the code then softens.

Three things dominate. The app requests android:usesCleartextTraffic="true" globally, and pairs that with a network security config that permits cleartext for specific hosts. It declares 96 activities, of which a substantial number are reachable only through deep links. And it ships a <queries> block naming roughly 30 messaging apps, which is a platform-level statement that the user wants to know which messengers are installed.

The cleartext configuration matters more than it first appears, because it interacts with the 401 handling in Part III. A client-side auth wipe is triggered by a response condition that an on-path attacker can manufacture over an unencrypted channel. That chain is spelled out there.

MICO / com.eyecon.global - Manifest & Security Surface Referenceh3

1. Manifest componentsh4

1.1 Processesh5

MyApplication.onCreate (MyApplication.java:471-474) returns immediately for non-main processes, so DB / analytics / crash handling only initialise in the main process.

1.2 Activities (96)h5

Legend for exported: true = android:exported="true" (or effectively exported via a browsable/intent filter); default = no attribute -> defaults to false because the component declares no intent-filter.

App activitiesh6

Third-party / SDK activitiesh6

activity-aliases (4) - all exported="true" but enabled="false"h6

All four are disabled in the shipped build (branding-variant leftovers) - not reachable at runtime.

1.3 Services (27)h5

1.4 Receivers (27)h5

1.5 Providers (9)h5

Orphan resource: res/xml/image_share_filepaths.xml (files-path name="image_provider_images" path="image_provider/") exists and is referenced only from R.xml.image_share_filepaths (R.java:12701). No provider in the manifest points at it - dead config.

1.6 <meta-data>h5

On <application> (22)h6

On components (36)h6

<property> (foreground-service subtypes)h6

1.7 Self-declared <permission> (3)h5

1.8 <queries> - package visibilityh5

Messaging / social apps (detected via getInstalledApplications)h6

The detection primitive is AbstractC0062l0.m334C1(pkg) -> m333B1 (p008a7/AbstractC0062l0.java:123-163), which calls PackageManager.getInstalledApplications(128) and caches enabled package names in a HashSet (f324i). Without QUERY_ALL_PACKAGES (which the app does not request) this returns a filtered list on API 30+, so each package must be declared in <queries> - and all of these are.

<intent> queries (26)h6

2. Resources of interesth4

2.1 res/xml/network_security_config.xmlh5

<network-security-config>
    <base-config cleartextTrafficPermitted="true">
        <trust-anchors><certificates src="system"/></trust-anchors>
    </base-config>
    <debug-overrides cleartextTrafficPermitted="true">
        <trust-anchors><certificates src="user"/></trust-anchors>
    </debug-overrides>
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="true">127.0.0.1</domain>
    </domain-config>
</network-security-config>

• Cleartext is permitted globally (base-config), reinforced by android:usesCleartextTraffic="true" on <application>. Nothing is scoped down to a single legacy host.
• No certificate pinning anywhere.
• debug-overrides trusts user-installed CAs - correct Android behaviour, only active for debuggable builds / ro.debuggable. This is a release APK, so it is inert. Not a finding.
• domain-config for 127.0.0.1 is vestigial.

2.2 Backup configurationh5

android:allowBackup="false" and android:fullBackupContent="false". No android:dataExtractionRules (introduced API 31). With allowBackup="false" both adb backup and cloud/D2D transfer are disabled. This is correct and is a positive finding.

2.3 Provider path configsh5

res/xml/file_paths.xml (referenced by the FileProvider):

<external-path       name="external"        path="."/>
<external-files-path name="external_files"  path="."/>
<cache-path           name="cache"          path="."/>
<external-cache-path name="external_cache"  path="."/>
<files-path           name="files"          path="."/>

All five roots are path=".". Combined with android:grantUriPermissions="true", any file under shared external storage, external files, cache, external cache, or internal files can be handed out as a content://com.eyecon.global.fileprovider/... URI. The provider is exported="false", so only this app can mint URIs - and the single observed call site writes a File.createTempFile(..., getFilesDir()) camera output (PhotoPickerActivity.java:775 + :1012). Exploitability therefore depends on some other code path handing a URI to a third-party app; none was found. Hardening issue, not an exploitable bug (L-06).

res/xml/image_share_filepaths.xml - orphan, not referenced by any provider.

2.4 Account / sync-adapter XMLh5

• eyecon_contacts_account_auth.xml - accountType="com.eyecon.global", label/icon from the app.
• eyecon_account_sync_adapter.xml - accountType="com.eyecon.global", contentAuthority="com.android.contacts", userVisible="true", supportsUploading="false", allowParallelSyncs="false", isAlwaysSyncable="true".
• eyecon_contacts_account.xml - full ContactsAccountType EditSchema (name/photo/phone/email/nickname/im/postal/organization/website/sip/note/event/relationship DataKinds).

2.5 res/xml/ad_services_config.xmlh5

<ad-services-config>
    <attribution allowAllToAccess="true"/>
    <custom-audiences allowAllToAccess="true"/>
    <topics allowAllToAccess="true"/>
</ad-services-config>

All three Privacy Sandbox surfaces fully opened. Combined with ACCESS_ADSERVICES_ATTRIBUTION/AD_ID/CUSTOM_AUDIENCE/TOPICS and com.google.android.gms.permission.AD_ID this is the maximum ad-tracking posture.

2.6 Otherh5

• res/xml/global_tracker.xml - legacy Google Analytics for Firebase config; ga_logLevel=verbose, ga_dryRun=false, ga_autoActivityTracking=true, dispatch every 1800 s.
• res/xml/splits0.xml - Play feature-split (APK set) metadata.

3. Security / privacy surfaceh4

3.1 Permissions that grant access to personal data, and who consumes themh5

Headline privacy items

1. NotificationListenerService scrapes WhatsApp/Telegram notification title (= phone number) and text (= message body) - p252ds/RunnableC16004e.java:442-518. Gated by user-granted Notification Access plus the readNotificationTelegramEnable remote flag / IS_TELEGRAM_WINDOW_ENABLE_BY_USER pref.
2. MessageAssistantBroadcastReceiver forwards full incoming SMS bodies to MessageAssistantReplyWorker, which requires network connectivity.
3. AudioRecord(VOICE_CALL, ...) records live call audio for Talk-To-Me and uploads it to voice2text.eyecon-app.com.
4. Device fingerprint sent with every API call (p620w6.C21280h): device_id (ANDROID_ID), adv_id, imei, mc = MAC address of wlan0, installer, SIM count, locale, timezone, manufacturer/model.

3.2 Exported components reachable by other appsh5

3.3 Dynamic receiver registrationh5

ContextCompat.registerReceiver flag constants: 2 = RECEIVER_EXPORTED, 4 = RECEIVER_NOT_EXPORTED.

Internal broadcasts are package-scoped by convention: AbstractC0062l0.m343L1(ctx, intent, src, true) calls intent.setPackage(getPackageName()) before sendBroadcast (p008a7/AbstractC0062l0.java:267-273). Good hygiene where used.

3.4 WebView usageh5

EyeWebViewClient base class (p284f7/AbstractC16490r) only handles onRenderProcessGone. It does not override onReceivedSslError, so the platform default (SslErrorHandler.cancel()) applies - there is no handler.proceed() anywhere in the app. TLS errors are correctly refused.

Bridge capabilities:

• Eyecon = p262e7.C16132d - getStringSP(key, default) / getBooleanSP / getIntSP / getFloatSP / getLongSP (arbitrary read of the app’s default SharedPreferences file, via MyApplication.m10340b -> new SharedPreferencesC16497y(context)), getAdvertisingId(), getPublicId(), getCid(), getMyName(), reportEvent(name, json), getVersionCode() / getVersionName(), getScreenWidth/Height, getLanguageCode, getCountryISO.
• EyeconStore = p379k5.C17757i - purchase(...), downloadItem(...), itemSelected(...), getProductsInfo(...), getPurchasedProducts(cb), getDownloadItemsState(cb), getSelectedItems(cb), getUiTextForSubPeriod(key), getPeriodIntoDays, onError, close.
• Android = C5838e - paywall-specific callbacks.

3.5 PendingIntent / implicit-intent / intent-redirection audith5

• Every PendingIntent.get* in com.eyecon.global routes through AbstractC0046d0.m185D(flags) (p008a7/AbstractC0046d0.java:70-72), which ORs in a constant on API >= 31. Callers pass 134217728 (FLAG_UPDATE_CURRENT) or 1073741824 (FLAG_ONE_SHOT); no caller passes FLAG_MUTABLE. Sites: CallService:133,156,289, CallStateService:1049,1062,1090,1104,1105,1265,1291,1305,1306, TokiService:53, SmsJobService:127, ForegroundLauncherService:43, RegistrationActivity:828-829, PhoneNumberValidationActivity:535-536, p008a7/AbstractC0077t:175,450, p008a7/AbstractC0060k0:119 (pin-shortcut). NOTE ON CONFIDENCE: JADX printed the ORed constant’s symbolic name as AccessibilityEventCompat.TYPE_VIEW_TARGETED_BY_SCROLL (0x40000000) rather than PendingIntent.FLAG_IMMUTABLE (0x04000000). FLAG_UPDATE_CURRENT | FLAG_ONE_SHOT with neither mutability flag would throw IllegalArgumentException on API 31+, and this is a working targetSdk-35 app, so the constant is almost certainly the immutability flag. See section 6.
• Empty-intent PendingIntents: CallService:156 and ForegroundLauncherService:43 use PendingIntent.getActivity(ctx, 777, new Intent(), ...) as the notification contentIntent - tapping does nothing. Harmless but sloppy (L-11).
• Intent redirection: MainActivity.java:836 - the host.equals("browser") branch builds new Intent(ACTION_VIEW, Uri.parse(URLDecoder.decode(data2.getQueryParameter("url"), "UTF-8"))) and then intent5.putExtras(bundleM32028w) (the whole incoming extras bundle), then startActivity(intent5). No scheme allow-list. See M-03.
• Implicit sendBroadcast helper AbstractC0062l0.m343L1 is package-scoped when the boolean is true; all call sites examined pass true.

3.6 Logging of sensitive datah5

• All app logging funnels through p410lo.C18416a.m34588y(tag, msg, args...), which is gated on C18416a.f46357c, initialised false and set from the remote-config flag print_logs_in_release at p008a7/RunnableC0074r0.java:264 and p672y5/C21867v.java:862. So verbose logging - including the log lines that contain phone numbers, SMS-derived data, product ids, referral data and full request URLs - is off by default but can be switched on in production by the server (L-01).
• C18416a.m34565a(str) appends to getFilesDir()/eye_log.txt, rotating at 5 MiB (keeps the last 50 + tail lines). Internal file only; no world-readable exposure found.
• Only two android.util.Log imports remain in com.eyecon, and both are Log.isLoggable("ShortcutBadge", 3) - no actual writes.
• Ungated System.out.println -> logcat in release: Registration/InstallReferrerReceiver.java:38,42,62,89,91,94,99,107,110,118 dumps every key and value of the install-referrer bundle plus the raw referrer string; Others/Activities/RestartAppActivity.java:28 prints the pid. Also several System.out.println in p005a4/RunnableC0031c, p008a7/AbstractC0046d0:80, p599v7/RunnableC20908f:496 (L-02).

3.7 The 401 / E-Mark state-wipe pathh5

Fully traced:

C21273a.m38420d(conn, url)                       p620w6/C21273a.java:112-126
  if (responseCode != 401) return responseCode;
  if ( !(url.startsWith("https://api.eyecon-app.com/app/") || url.contains("eyecon-app.com"))
       || isEmpty(conn.getHeaderField("E-Mark")) )   return TYPE_DURATION; // 0
  if (!MyApplication.f12170o) return 401;           // main process only
  AbstractC9039h.m10641U(conn.getHeaderField("CID"), "401 1 from url = " + url);

AbstractC9039h.m10641U (com/facebook/appevents/AbstractC9039h.java:592-636) -> unAuthorizedUser:

1. Bail-outs: already in RegistrationActivity, real phone number known, or SP_unAuthorizedUser_isCleared already true (one-shot latch).

2. Sets SP_unAuthorizedUser_isCleared = true, clear_data_by_eyecon = true.

3. C16945i.m32773e(DBContacts.f11708K, new RunnableC19874r(4)) -> wipe (p516r5/RunnableC19874r.java:99-118):

   SQLiteDatabase db = C0041b.m156t().m160D(500L);
   db.delete("history",        null, null);
   db.delete("contacts",       null, null);
   db.delete("social",         null, null);   // jadx rendered the literal via NotificationCompat.CATEGORY_SOCIAL
   db.delete("fresh_pics",     null, null);
   db.delete("block_list",     null, null);
   db.delete("recorded_notes", null, null);

4. Stops the foreground notification (EYECON, STOP_FOREGROUND_NOTIFICATION -> CallService).

5. Logs analytics ("User unauthorized").

6. If an activity is up, re-registers after 1 s; otherwise kills the process.

m38420d is invoked from the GET path (C21273a:198), the GZIP POST path (:259) and :357. Consequences in M-01.

3.8 Other observationsh5

• installLocation="auto" - SD-card install permitted.
• android:profileable android:shell="true" - simpleperf / ART profiling by shell only. Normal.
• <uses-library android:name="org.apache.http.legacy" required="false"/> plus androidx.window.extensions / androidx.window.sidecar - legacy HTTP client available.
• android:largeHeap="true", android:hardwareAccelerated="true", android:extractNativeLibs="false", supportsRtl="false".
• Notification channels created: caller_id_status, caller_id_v2.
• MyApplication installs itself as the process-wide UncaughtExceptionHandler (MyApplication.java:469-470) and forwards to Firebase Crashlytics.
• assets/audience_network.dex (5 MB) is a dynamically loaded Meta Audience Network DEX, separate from the six main DEX files.

4. Ranked findingsh4

Severity is the realistic worst-case impact for a device that already has an untrusted app installed, unless stated otherwise.

CRITICALh5

None.

HIGHh5

H-01 - Cleartext remote config can control the URL loaded into a JS-bridged WebView; the bridge reads arbitrary SharedPreferences

• Severity: High
• Evidence:
  • res/xml/network_security_config.xml - base-config cleartextTrafficPermitted="true", no pinning; AndroidManifest.xml:272 usesCleartextTraffic="true".
  • p236d5/AbstractC15804d.java:300 - map.put("eyecon_remote_config_url", "http://cloudfront-cdn-all.eyecon-app.com/configs/ab-test.txt") (plain HTTP), fetched by p005a4/RunnableC0031c.java:463 via C21273a.m38423g. Response is parsed as JSON (C18416a.m34586w(str).m14606i()) with only an HTTP status-code check (:465) - no signature, MAC, nonce or version binding.
  • Billing/Store/StoreActivity.java:213 reads store_url from that config; :218-226 enables JS, sets setAcceptThirdPartyCookies(true) and attaches the Eyecon and EyeconStore bridges. C5846m (the WebViewClient) does not override shouldOverrideUrlLoading, so the WebView will navigate anywhere while keeping the bridges.
  • p262e7/C16132d.getStringSP(String, String) -> p358j5/AbstractC17503r.m33607k -> MyApplication.m10348j() -> the app’s default SharedPreferences. Arbitrary key read from any page loaded in that WebView, plus getAdvertisingId(), getPublicId(), getCid(), getMyName(), reportEvent(), and EyeconStore.purchase(product_id, ...).
• Impact: a network MITM (or anyone who can poison the CDN path / DNS) rewrites one JSON blob and obtains an arbitrary-URL WebView with a JS bridge that can read the app’s private preferences, exfiltrate stable device identifiers, and drive the purchase flow. Requires a network position (or CDN compromise), which is why this is High and not Critical.
• Mitigating: WebviewPaywallActivity.java:282-287 shows the team already knows how to do an origin allow-list - it is just not applied to the store WebView.

H-02 - Caller-ID UI can be triggered by any app with an arbitrary phone number (spoofed incoming-call screen)

• Severity: High (caller-ID spoofing / vishing primitive inside a trusted, brand-recognised UI; also drives real side effects - CallService start, caller-ID DB writes, reporting calls, and the WhatsApp-call path)
• Evidence:
  • AndroidManifest.xml:391-401 - com.eyecon.global.Call.MyPhoneReceiver is android:exported="true" with no android:permission, priority 2147483647, and listens for com.eyecon.global.action.INTENT_ACTION_START_CALL_WHATSAPP and com.eyecon.global.action.CALL_SCREENING_NEW_CALL - two unprotected, app-defined actions alongside the protected PHONE_STATE / NEW_OUTGOING_CALL.
  • com/eyecon/global/Call/MyPhoneReceiver.java:48-53 accepts any of the four and forwards the raw Bundle to RunnableC17334k case 7.
  • im/RunnableC17334k.java:868-924 - action is coerced to PHONE_STATE, state + incoming_number are read straight from the broadcast extras, incoming_number is normalised and CallService is started.
  • The identical payload shape is what the trusted IdPlus/NotificationReader/NotificationReaderService.m10223a uses (NotificationReaderService.java:38-46), so nothing distinguishes an attacker broadcast from a real one.
• Attack: adb shell am broadcast -a com.eyecon.global.action.INTENT_ACTION_START_CALL_WHATSAPP --es state RINGING --es incoming_number "+14155550123" -n com.eyecon.global/.Call.MyPhoneReceiver - no permission needed. Also an NPE (DoS) if state is omitted while incoming_number is present (string3.equals(...) at line 906).
• Mitigating: a local attacker app could in principle draw its own activity, but it could not present the screen with MICO’s identity, icons and styling, nor reuse MICO’s backend enrichment of the number.

MEDIUMh5

M-01 - Server-header-triggered local data wipe, reachable via the cleartext config channel

• Severity: Medium
• Evidence: p620w6/C21273a.java:112-126 (see 3.7) + p516r5/RunnableC19874r.java:99-118 (wipes history, contacts, social, fresh_pics, block_list, recorded_notes).
• The gate is a response header (E-Mark) on a 401. The URL test is a substring match (str.contains("eyecon-app.com")), and the HTTP client sets setInstanceFollowRedirects(true) (C21273a:191). The remote-config fetch at http://cloudfront-cdn-all.eyecon-app.com/configs/ab-test.txt uses exactly this code path.
• Impact: a network MITM who can answer that cleartext request with HTTP/1.1 401 + E-Mark: 1 forces a full local data wipe and a forced re-registration. No credential or PII is disclosed; the blast radius is the app’s own SQLite state, which is re-fetchable.
• The one-shot latch (SP_unAuthorizedUser_isCleared) limits repeat abuse per install.

M-02 - Exported PhoneNumberValidationActivity.onNewIntent trusts arbitrary caller extras

• Severity: Medium
• Evidence: AndroidManifest.xml:580-593 (exported="true", launchMode="singleTask"). Registration/PhoneNumberValidationActivity.java:1273-1282 reads state, phoneNumber and smscode from any sender and calls m10473L0(phone, code) (:429-459), which (a) fills and locks the four code fields with attacker-chosen digits, (b) sets sendSmsEnded = true so the genuine SMS flow is suppressed, and (c) submits the code to the backend via C21280h.m38435h(..., EnumC19662h1.SO_SMS, true).
• Preconditions: the activity must be on the code-entry step (ViewFlipper.getDisplayedChild() == 1); singleTask means an external startActivity reuses the existing task and routes through onNewIntent.
• Also a crash primitive: a smscode shorter than 4 characters (or absent) hits str2.charAt(0..3) unguarded -> uncaught NPE / StringIndexOutOfBoundsException on the UI thread.
• The phone number itself comes from SharedPreferences (tempAuthenticatedCli), not the intent, so this is an integrity/DoS issue rather than account takeover.

M-03 - eyecon://browser?url= is an unvalidated intent-redirection sink

• Severity: Medium

• Evidence: MainScreen/MainActivity.java:833-842, reachable from the BROWSABLE eyecon scheme filter (AndroidManifest.xml:445-450):

  if (host.equals("browser")) {
      Intent i5 = new Intent(ACTION_VIEW, Uri.parse(URLDecoder.decode(data2.getQueryParameter("url"), "UTF-8")));
      i5.putExtras(bundleM32028w);      // the entire incoming extras bundle is forwarded
      startActivity(i5);
  }

  No scheme allow-list, and the incoming extras are copied verbatim. Classic intent-redirection: an intent://...#Intent;...;end payload is passed straight to the system resolver, so MICO acts as an open launcher for arbitrary exported components on the device with attacker-chosen extras.

• Impact is device-dependent (depends on which target app has a dangerous exported component), which is why this is Medium rather than High.

M-04 - Exported DummyActivity accepts arbitrary action + extras via explicit intent and renders attacker content in-app

• Severity: Medium
• Evidence: AndroidManifest.xml:661-675 (exported="true", taskAffinity=".eyecon", excludeFromRecents="true"). Others/Activities/DummyActivity.java:87-194 switches on getIntent().getAction() and, for action EYECON.INTENT_ACTION_SHOW_NOTE, parses the caller-supplied note extra as JSON (C18416a.m34586w(string6).m14606i(), line 150) and displays it in the app’s dialog with caller-supplied cli / name / source; EYECON.INTENT_ACTION_THANK_YOU_DIALOG calls AbstractC21601b.m38812e(...) (an API call) with caller-supplied cis / cli / src; EYECON.INTENT_ACTION_SHOW_WARNING_FACEBOOK shows a Facebook warning for a caller-supplied fid; EYECON.INTENT_ACTION_UNLOCK_KEYGUARD* reaches KeyguardManager.requestDismissKeyguard.
• The custom-scheme path itself is tightly restricted (scheme must be eyecon_request, and only host=caller_id_role does anything), but exported="true" means a local app can bypass the filter entirely with an explicit intent.
• requestDismissKeyguard on a secure keyguard still requires credential entry, so this is UI spoofing / unwanted navigation, not a lock bypass.

M-05 - Call recordings and voice notes written to world-readable shared storage

• Severity: Medium
• Evidence: Others/MyApplication.java:467 - f12172q = new File(Environment.getExternalStoragePublicDirectory(Environment.DIRECTORY_DOCUMENTS), "Eyecon"). p260e5/AbstractC16098a.java:97 - new File(MyApplication.f12172q, "RecordedNotes") / "RecordedCalls"; p008a7/RunnableC0070p0.java:123-124; p420m7/C18517d.java:47 - new File(MyApplication.f12172q, "ContactsPhotos"). AudioRecording/RecordingsFragment.java:152 also uses Environment.getExternalStorageDirectory() as the recordings root.
• On API 23-28 (and API 29 with requestLegacyExternalStorage="true" + WRITE_EXTERNAL_STORAGE) Documents/Eyecon/ is readable and writable by every app. Sensitive call audio and personal notes in shared storage. Blocked by scoped storage from API 30, so this is an old-device exposure.

M-06 - Recording of the live call audio stream (Talk-To-Me)

• Severity: Medium (privacy, not a code-execution bug)
• Evidence: p599v7/RunnableC20908f.java:507-512 - AmrEncoder.init(0); new AudioRecord(1 /* MediaRecorder.AudioSource.VOICE_CALL */, 8000, 16, 2, 16000); audioRecord.startRecording();, with Process.setThreadPriority(-19). Streamed AMR frames are POSTed to voice2text.eyecon-app.com (see BACKEND-FINDINGS.md). p633wl/RunnableC21441d is the companion player loop.
• Requires RECORD_AUDIO, an opt-in product, and - on modern Android - the default-dialer role. Rated Medium because the capability (third-party capture of a telephony audio source) is exceptionally sensitive and the recording path runs at elevated thread priority.

LOW / INFORMATIONALh5

L-01 - Logging can be remotely re-enabled in release builds. C18416a.f46357c defaults false and is set from the remote-config flag print_logs_in_release (p008a7/RunnableC0074r0.java:264, p672y5/C21867v.java:862). When on, m34588y writes log lines that include phone numbers, SMS-derived data, referral strings, product ids and full request URLs, to getFilesDir()/eye_log.txt and logcat. Not exploitable by a third party without READ_LOGS, but a server-side misconfiguration re-enables verbose PII logging in production.

L-02 - Ungated System.out.println of the install-referrer bundle. Registration/InstallReferrerReceiver.java:38,42,62,89-118 prints every key/value of the referrer intent and the raw referrer string to logcat unconditionally. Attribution data only (no credentials), but an unconditional write to a world-readable-on-old-Android buffer.

L-03 - Spoofable SMS send-result broadcasts. RegistrationActivity:837-838 and PhoneNumberValidationActivity:541-542 register ACTION_SMS_SENT_EYECON / ACTION_SMS_DELIVERED_EYECON with RECEIVER_EXPORTED (flag 2) although both are app-private strings. Any app can forge a “verification SMS sent” result.

L-04 - Spoofable Bluetooth-device-picked broadcast. DefaultDialer/CallActivity:2483 registers android.bluetooth.devicepicker.action.DEVICE_SELECTED with RECEIVER_EXPORTED. Unprotected action; a local app can inject a fake selected device into the dialer’s BT picker.

L-05 - Ad-SDK activities exported with no guard. tech.crackle.cracklertbsdk.vast.ShowFullScreenVideo, tech.crackle.cracklertbsdk.ShowFullScreenStatic, tech.crackle.core_sdk.ads.CrackleFullScreenActivity, com.amazon.aps.ads.activity.ApsInterstitialActivity, com.amazon.device.ads.DTBInterstitialActivity are all android:exported="true" with no filter and no permission. Any installed app can startActivity them explicitly to force an ad impression (revenue theft / nuisance). Third-party-SDK defect, not app code.

L-06 - Over-broad FileProvider path roots. res/xml/file_paths.xml maps all five roots with path="." and the provider has grantUriPermissions="true". Only one call site was found and it uses an internal files/ temp file, so nothing is currently exposed; latent hardening problem.

L-07 - com.facebook.FacebookContentProvider exported with no permission. Authority com.facebook.app.FacebookContentProvider1716660955257637; any app can query the FB SDK’s installreferrer / bridge tables. Standard FB SDK behaviour (needed for multi-process), low impact.

L-08 - Dead / vestigial declarations. res/xml/image_share_filepaths.xml (orphan), res/xml/splits0.xml (Play splits for a standalone APK - see com.android.stamp.type=STAMP_TYPE_STANDALONE_APK), the <permission android:name="android.permission.INTERACT_ACROSS_USERS" android:protectionLevel="signature"/> re-declaration of a framework permission (a no-op that grants nothing), the <uses-permission android:name="BILL"/> request for an undeclared permission, and androidx.startup.InitializationProvider meta-data for classes not in the APK (e.g. androidx.p725lifecycle.ProcessLifecycleInitializer). None exploitable.

L-09 - Privacy Sandbox fully opened + RTB on. res/xml/ad_services_config.xml sets allowAllToAccess="true" for attribution, custom audiences and topics; com.google.android.gms.ads.flag.rtb_enabled=true; ACCESS_ADSERVICES_* x4 and AD_ID requested. Maximum ad-tracking posture - a policy/privacy statement, not a bug.

L-10 - Unrestricted Google Maps / Crackle API keys. com.google.android.geo.API_KEY = AIzaSyD1LLixZGTwP6i3Ts8AzX4jxdb9zuaikKo in the manifest, plus a second Google key inside crackle_key. These must be restricted server-side (package + SHA-1 + API); nothing in the artifact proves they are.

L-11 - Empty-intent PendingIntents used as notification content intents. CallService.java:156, ForegroundLauncherService.java:43, TokiService.java:53 - PendingIntent.getActivity(ctx, 777, new Intent(), ...). Tapping those notifications does nothing. Cosmetic.

Checked and explicitly NOT a findingh5

• Sms.MySmsReceiver and DefaultDialer.assistant.MessageAssistantBroadcastReceiver - both guarded by android.permission.BROADCAST_SMS (system-only sender) and neither calls abortBroadcast(). No SMS interception.
• NotificationReaderService, CallStateService, EyeconCallScreeningService, JobsService, SmsJobService, ShareMediaJob, SystemJobService, DiagnosticsReceiver, ProfileInstallReceiver, FirebaseInstanceIdReceiver, RevocationBoundService - all exported but protected by signature/system permissions. Standard Android patterns, not exploitable.
• PhoneAccount.SyncService / EyeconAccountAuthService exported with no permission - only the system SyncManager / AccountManager can bind them. Standard.
• com.mbridge...NetWorkChangeReceiver exported for CONNECTIVITY_CHANGE - protected broadcast, system-only sender.
• SCREEN_OFF / CLOSE_SYSTEM_DIALOGS registered with RECEIVER_EXPORTED - both protected broadcasts.
• AndroidManifest.xml:224-226 - declaring android.permission.INTERACT_ACROSS_USERS does not let the app use it; platform permissions cannot be redefined by third-party apps. No escalation.
• debug-overrides with <certificates src="user"/> - correct Android default, inert in a release build.
• onReceivedSslError is not overridden anywhere in app code, so the platform default (cancel) applies; there is no handler.proceed().
• android:allowBackup="false" + android:fullBackupContent="false" - adb / cloud / D2D backup disabled.
• No FLAG_MUTABLE PendingIntent, no QUERY_ALL_PACKAGES, no root/emulator detection in app code (the Genymotion/BlueStacks queries come from the Facebook SDK).
• <queries> does not include QUERY_ALL_PACKAGES; all package-visibility is declared per-package.

5. Permissions, grouped (78 entries)h4

Dangerous / runtime (personal data)h5

Normal / specialh5

INTERNET - ACCESS_NETWORK_STATE - ACCESS_WIFI_STATE - CHANGE_NETWORK_STATE - WAKE_LOCK - VIBRATE - MODIFY_AUDIO_SETTINGS - RECEIVE_BOOT_COMPLETED - REORDER_TASKS - KILL_BACKGROUND_PROCESSES - REQUEST_IGNORE_BATTERY_OPTIMIZATIONS - MANAGE_OWN_CALLS (+ uses-permission-sdk-23 duplicate) - ACCESS_NOTIFICATION_POLICY - BLUETOOTH (deprecated) - BLUETOOTH_ADMIN (deprecated) - SYSTEM_ALERT_WINDOW (appop) - WRITE_SETTINGS (appop) - DISABLE_KEYGUARD (deprecated) - FOREGROUND_SERVICE - FOREGROUND_SERVICE_PHONE_CALL - FOREGROUND_SERVICE_SPECIAL_USE - com.android.launcher.permission.INSTALL_SHORTCUT

Billing / install-referrer / ads / pushh5

com.android.vending.BILLING - com.android.vending.CHECK_LICENSE - BIND_GET_INSTALL_REFERRER_SERVICE - com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE - com.google.android.gms.permission.AD_ID - ACCESS_ADSERVICES_ATTRIBUTION - ACCESS_ADSERVICES_AD_ID - ACCESS_ADSERVICES_CUSTOM_AUDIENCE - ACCESS_ADSERVICES_TOPICS - com.google.android.c2dm.permission.RECEIVE - com.eyecon.global.permission.C2D_MESSAGE (self, signature)

OEM / launcher badges (16)h5

android.permission.READ_APP_BADGE - com.sec.android.provider.badge.permission.READ - com.sec.android.provider.badge.permission.WRITE - com.sonyericsson.home.permission.BROADCAST_BADGE - com.sonymobile.home.permission.PROVIDER_INSERT_BADGE - com.htc.launcher.permission.READ_SETTINGS - com.htc.launcher.permission.UPDATE_SHORTCUT - com.anddoes.launcher.permission.UPDATE_COUNT - com.majeur.launcher.permission.UPDATE_BADGE - com.huawei.android.launcher.permission.CHANGE_BADGE - com.huawei.android.launcher.permission.READ_SETTINGS - com.huawei.android.launcher.permission.WRITE_SETTINGS - com.oppo.launcher.permission.READ_SETTINGS - com.oppo.launcher.permission.WRITE_SETTINGS - me.everything.badger.permission.BADGE_COUNT_READ - me.everything.badger.permission.BADGE_COUNT_WRITE

OEM vendorh5

oppo.permission.OPPO_COMPONENT_SAFE - com.huawei.permission.external_app_settings.USE_COMPONENT

Selfh5

com.eyecon.global.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Requested but undeclaredh5

BILL - requested but never declared anywhere in the manifest; a no-op.

<uses-feature> (all required="false")h5

<uses-library>h5

org.apache.http.legacy (false) - androidx.window.extensions (false) - androidx.window.sidecar (false)

6. Confidence / unknownsh4

High confidence (directly read in source)

• Every component, filter, permission, permission-guard, exported flag, process, launchMode, taskAffinity, provider authority and meta-data value in sections 1 and 5 - all extracted programmatically from AndroidManifest.xml via XML parsing, not summarised from memory.
• network_security_config.xml, file_paths.xml, ad_services_config.xml, eyecon_account_sync_adapter.xml, eyecon_contacts_account_auth.xml, the MyApplication process gate, the JS-bridge classes C16132d / C17757i, the 401 / E-Mark chain, the DB wipe table list, RemoteConfigDebugTestReceiver being a no-op, MySmsReceiver not aborting the broadcast, m343L1 package-scoping, the print_logs_in_release gating, and the AudioRecord(VOICE_CALL) call.
• BACKEND-FINDINGS.md claims about the e-auth scheme, the endpoint list and the fingerprint fields were re-verified where they intersect this document’s scope (E-Mark, C21273a.m38420d, C21280h).

Medium confidence

• PendingIntent immutability. AbstractC0046d0.m185D is the single choke point for every PendingIntent in app code, and no caller passes FLAG_MUTABLE. But JADX printed the ORed constant as AccessibilityEventCompat.TYPE_VIEW_TARGETED_BY_SCROLL (0x40000000) rather than PendingIntent.FLAG_IMMUTABLE (0x04000000). The immutability conclusion is inferred: FLAG_UPDATE_CURRENT | FLAG_ONE_SHOT with neither mutability flag would throw IllegalArgumentException on API 31+, and this is a working targetSdk-35 app. A DEX-level read of the constant pool would confirm it.
• eyecon://browser reachability. MainActivity’s intent router is heavily decompiled and JADX inverted several conditions around MainActivity.java:694-712. The host-dispatch chain (showdialog … browser … menifa … url … tel) is unambiguous, and every branch that matters is guarded only by host.equals(...). I am confident the branch is reachable from an eyecon://browser?url=... intent; I could not prove it by execution.
• JADX constant substitution. Several integer literals were resolved to unrelated framework constants (e.g. RunnableC19874r:104 renders the "social" table name as NotificationCompat.CATEGORY_SOCIAL; C5846m.f11594d = 4 is a field-initialiser artefact of a constructor parameter). Table names and enum discriminators in 3.7 should be treated as approximate where quoted from JADX.

Low confidence / unresolved

1. store_url reachability at runtime. The shipped default is the empty string (AbstractC15804d.java:295); the actual value comes from the remote config, which was not fetched. If the remote store_url is empty, StoreActivity would throw on Uri.parse("").getHost().replace(...) (StoreActivity.java:215) before the WebView is ever configured. The bridge exposure in H-01 is real iff store_url is populated, which the codebase strongly implies (theme/ringtone purchase flows, premium_products_ids_list, EyeconStore.getSelectedItems).
2. E-Mark semantics. The server-side meaning is unknown (see BACKEND-FINDINGS.md section 9). M-01 is rated on the client-side trigger conditions, which are fully readable; the attacker-chosen value the server expects may be validated in a way not visible here.
3. FragmentTransaction.TRANSIT_FRAGMENT_MATCH_ACTIVITY_OPEN and similar appear as enum-constant substitutes for integer IDs in EnumC19861h0 (e.g. SMS(1048576, ...), CALL(4101, ...)). The values look right but were not cross-checked against the DEX.
4. Third-party SDK internals. Ad/analytics/attribution SDK behaviour (InMobi, Pangle, Mbridge, Fyber, Crackle, Vungle, Singular, Amplitude, DataTransport) was not audited beyond its manifest footprint. Some declared permissions may be used only by those SDKs.
5. No dynamic analysis. Nothing here observes execution. No traffic was captured, no intent was actually broadcast, no WebView was loaded. All conclusions are static.
6. Which uses-permission entries are actually exercised was determined by grepping com.eyecon for permission strings. Permissions consumed only inside SDK code (e.g. ACCESS_FINE_LOCATION for ad targeting) are marked “no app-code consumer found”, not “unused”.
7. NotificationListenerService coverage. The full set of packages whose notifications are read could not be enumerated exhaustively from the static path (packageName.contains("telegram"), contains("com.whatsapp")); a .contains() test could match more packages than intended.

Generated from the JADX export at C:\Users\btc_e\Downloads\mico-analysis\src. Sources read-only; this document is the only file written.

Part III - Backendh2

Fifty endpoints across 36 hosts, all reachable, all reconstructable. The credential scheme is called e-auth v1 and it is fully reversible: a shared secret, an m38421e checksum, and a timestamp. With those three, a request can be forged by hand.

The single highest-value finding in this part is the clientId chain, which is covered in Part IV because it straddles backend and storage. In short: the value is read from com.facebook.appevents.AbstractC9039h.m10662s(), written by two sites in q7, persisted to contactdb.shared_preference_v2 under key clientId, and issued by join.jsp. It cannot be minted offline. That last constraint is what turns an otherwise ordinary identifier into the app’s trust anchor.

A second string is worth pulling out of this part rather than leaving it in a table. The Facebook application ID 1716660955257637 and its client token afa3f38c55f24c73b177afc962969b15 are both present in strings.xml in plaintext, along with the combined fct value. Verified independently, not inferred from the SDK.

MICO (com.eyecon.global) - Backend API Referenceh3

Target: com.eyecon.global (Eyecon / MICO caller-ID & spam blocker), version 4.2026.04.23.1145, versionCode 749. Source tree analysed: C:\Users\btc_e\Downloads\mico-analysis\src\sources (+ ..\resources). Method: static reading of the JADX decompilation only. No traffic was generated and no server was contacted.

How to read this documenth5

• Observation = literally visible in the decompiled code (a literal, a call site, a constant).
• Inference = my reasoned conclusion drawn from those observations.
• Each endpoint entry gives: exact URL, HTTP method, every request parameter and where its value comes from, the issuing class/method, whether it is fire-and-forget or has a callback, and how the response is consumed.
• ProGuard renaming: p008a7 = original a7, p620w6 = w6, p284f7 = f7, p494q7 = q7, p647x6 = x6, p420m7 = m7, p673y6 = y6, p466oq = oq, p315h7 = h7. com.facebook.appevents.* and androidx.fragment.app.RunnableC2598c are application code deliberately packed into third-party-looking package names. ir.AbstractC17448b is really kotlin.jvm.internal.Intrinsics. p420m7.C18533l / p466oq.C19231e0 are OkHttp. bm.C3645j1 is OkHttp Request.Builder.

0. Executive summaryh4

Top findings (severity ordered)h5

1. CRITICAL - hard-coded, remotely overridable auth secret. rc_key = "PgdtSBeR0MumR7fO" ships in the APK and is the compiled-in default of Remote Config key circus_key. p032b5.AbstractC3464e.m3668s() reads the remote value and reflectively overwrites the private static final field C21273a.rc_key. Control of the Remote Config project therefore changes the e-auth-k credential presented by every installed client, with no app update.
2. HIGH - SMS transcript, contact name and phone number over cleartext HTTP. POST http://numberlookup.instabridge.com/respond-sms (Retrofit/Moshi: p636wo.C21474f, p646x5.InterfaceC21626a) with {contactName, number, messages:[{role,message}], locale, messagesInSession, userName}.
3. HIGH - full call-log exfiltration endpoint. EyeconAnalyticsWorker zips data.json ({cli, fake_cli, call_logs:[{phone, date, duration_in_seconds, type, name}]}) and multipart-POSTs it to the Remote-Config-controlled analytics_worker_url. Off by default ("disabled_by_remote") but one remote flip away; it also carries a from_date rewind that can re-upload history.
4. MEDIUM - device fingerprint including IMEI and Wi-Fi MAC address sent on join.jsp, cli_auth/gettransport, addcontacts.jsp and others (section 7).
5. MEDIUM - contact names sent to Google Translate (GET translate.google.com/translate_a/single?...&q=MY NAME IS <name>).
6. MEDIUM - Eyecon’s own config/A-B JSON is fetched over cleartext HTTP (http://cloudfront-cdn-all.eyecon-app.com/configs/ab-test.txt), and that JSON populates the very map that holds circus_key and every endpoint URL.
7. MEDIUM - all query parameters (CLIs, IMEI, MAC, contact lists, names) travel in the URL, including for POSTs issued through the main helper (empty body, params in query string).
8. LOW/MEDIUM - numerous hard-coded third-party credentials, including a usable PaperQuotes bearer token and a LocationIQ key (section 8).

1. Host inventoryh4

Third-party ad-network hosts (Google Ads/AdMob, Meta Audience Network, InMobi, Mintegral, Vungle, Pangle/ByteDance, Fyber FairBid, Inneractive, AppLovin, Adjust, Singular, AdColony, Digital Turbine, Amazon Ads) are present but constitute vendor SDK traffic and are out of scope except where the app hard-codes identifiers (section 8).

2. The HTTP core - p620w6.C21273a (orig. w6.a, TAG NetworkHelper)h4

2.1 Request primitivesh5

2.2 URL / query construction - p410lo.C18416a.m34580q(ArrayList)h5

Observation. Query strings are produced with OkHttp’s HttpUrl.Builder:

HttpUrl.Builder b = new HttpUrl.Builder();          // p420m7.C18533l
b.scheme("https"); b.host("example.com");
for (C21872a p : params) b.addQueryParameter(p.name, p.value);
return b.build().encodedQuery();

Consequences (inference, high confidence):

• Parameter names and values are percent-encoded with OkHttp’s canonical query-component set.
• Every parameter of every request issued through m38423g ends up in the URL query string, regardless of HTTP method; such POSTs carry an empty body.
• A null value is emitted as a bare name with no =.
• Parameter order equals insertion order into the ArrayList.

2.3 Headers set by m38423gh5

Observation (C21273a.m38423g, lines 171-198):

HttpURLConnection.setInstanceFollowRedirects(true) is also set here.

2.4 Timeoutsh5

retryOnConnectionFailure is left at the OkHttp default (true).

2.5 Response reading, gzip, redirectsh5

• m38426j(conn, gzip, headerResultMap) reads the body into a 1 KiB buffer that grows by 1024 bytes per fill and returns a UTF-8 String.
• Gzip is unwrapped only when gzip == true and the Content-Encoding response header equals "gzip".
• All response headers are copied into the caller’s HashMap headerResult through m38418b (first value per name). This is how join.jsp reads pi, sd, is_new, and how getupdatedcontactsinfo.jsp reads sms.
• The photo loader (C18540p.m34738g) sets setInstanceFollowRedirects(false) and follows 3xx manually: maximum 5 hops, scheme must be http/https, otherwise SecurityException("illegal URL redirect"). It special-cases Eyecon-hosted photos redirecting off eyecon-app.com/app/ and records the redirect so the caller can fall back.

2.6 rid (request id)h5

Observation. p647x6.AbstractC21650c generates UUID.randomUUID().toString() per queued request and passes it as the rid header. Direct calls (m38422f, or m38423g with "") send no rid. The queued serialisation stores the same value as uuid.

3. Authentication / header logich4

3.1 The four headersh5

Observation - C21273a.m38427k(HttpURLConnection) and C21273a.m38417a(req, true):

String cid = AbstractC9039h.m10662s();     // SharedPreferences "clientId"
if (isEmpty(cid)) throw new RuntimeException("Error missing CID");
conn.setRequestProperty("e-auth-v", "e1");
conn.setRequestProperty("e-auth",   cid);
conn.setRequestProperty("e-auth-c", m38421e(cid));
conn.setRequestProperty("e-auth-k", rc_key);

Exact e-auth-c algorithm (observation-faithful pseudo-code):

int n = 0;
for (String seg : cid.split("-")) {          // Java split() drops trailing empty strings
    char[] c = seg.toCharArray();
    if (c.length >= 1) n += Character.getNumericValue(c[0]);
}
return String.valueOf(n);

This is a non-cryptographic checksum, not a MAC: it is trivially computable from the CID and reveals only the sum of the first characters of each dash-separated segment. Note that Character.getNumericValue returns -1 for a first character that is not a decimal or hex digit, so the value can be negative.

3.2 When the headers are appliedh5

Two independent gates, both observations:

1. Host gate: url.startsWith("https://api.eyecon-app.com/app/") || url.contains("eyecon-app.com"). Consequence: the auth headers are also sent to voice2text.eyecon-app.com, ptt.eyecon-app.com, faq.eyecon-app.com, cloudfront-cdn-all.eyecon-app.com, apps.eyecon-app.com, join.eyecon-app.com, cards.eyecon-app.com - that is, any host whose name contains eyecon-app.com.
2. Per-call gate: addAutoHeaders, the 8th positional argument of m38423g (and the addAutoHeaders JSON field of a queued request). The C21653f / C21652e / C21651d constructors force it to true. Several call sites deliberately pass false: LocationIQ, degoo, getfreshpicsjson.jsp, all virality/*, eyecon_remote_config_url, social_auth/use_cli_validation, and join.jsp (no CID yet).

m38417a(request, true) adds the same four headers to the OkHttp request. m38417a(request, false) (quotes API, Instagram/Facebook scraping, translate.google, the OkHttp downloader, Facebook media fetch) adds none.

3.3 Remote override of e-auth-k - high severityh5

Observation, p032b5.AbstractC3464e.m3668s():

String k = AbstractC15804d.m31091l("circus_key", false);   // Remote Config value
Field f = C21273a.m38419c().getClass().getDeclaredField("rc_key");
f.setAccessible(true);
f.set(C21273a.m38419c(), k);

and the compiled-in default is p236d5.AbstractC15804d:103 -> map.put("circus_key", "PgdtSBeR0MumR7fO").

• Observation: the e-auth-k value is whatever Remote Config currently says, with the APK literal as fallback.
• Inference (high confidence): whoever can modify the Remote Config project changes the credential that every installed client presents to api.eyecon-app.com, with no app update required. Whether the reflective write succeeds against a static final field is ART-version dependent; the code clearly intends it to.
• Observation: the Eyecon-specific config channel itself (eyecon_remote_config_url) is cleartext HTTP, and its JSON is merged into the same config map by C15803c.m31073a(...). Whether circus_key is also settable over cleartext depends on a server-side allow-list that static analysis cannot see.

3.4 Other credential headersh5

3.5 401 / E-Mark / CID pathh5

Observation (C21273a.m38420d, plus AbstractC9039h.m10641U):

int code = conn.getResponseCode();
if (code != 401) return code;
if (!(url.startsWith(base) || url.contains("eyecon-app.com")) || isEmpty(conn.getHeaderField("E-Mark")))
    return 700;                                  // androidx TYPE_DURATION == 700
if (!MyApplication.f12170o) return 401;          // f12170o == "am I the main process?"
AbstractC9039h.m10641U(conn.getHeaderField("cid"), "401 1 from url = " + url);
return 401;

AbstractC9039h.m10641U(cid, reason) - “unAuthorizedUser” - is a destructive handler:

1. bails out if RegistrationActivity.f12898k1 != null (a join is already in flight) or if !m10665v() (not an Eyecon user);
2. bails out if the cid header equals the static AbstractC9039h.f13178e;
3. bails out if SP flag SP_unAuthorizedUser_isCleared is already true (one-shot);
4. otherwise sets SP_unAuthorizedUser_isCleared = true and clear_data_by_eyecon = true, posts EYECON, STOP_FOREGROUND_NOTIFICATION to stop CallService, fires the analytics event "User unauthorized", and finishes/kills the app.

Additional observation: the handler logs the raw CID and URL to logcat via C18416a.m34588y("Authenticator", "unAuthorizedUser reason = %s", reason).

Inference: a stolen or replayed CID therefore causes the victim’s client to wipe its own authenticated state - the server can remotely de-register a device by returning 401 with an E-Mark header.

4. Endpoint catalogue - Eyecon functional APIh4

Parameter-name note: cv (value vc_749_vn_4.2026.04.23.1145_a) is the build stamp; in the decompiled code it is spelled ApsMetricsDataMap.APSMETRICS_FIELD_APSVERSION, whose value is "cv". Unless stated otherwise, all endpoints below: Auth = yes, params in the URL query string, fire-and-forget unless a callback is named.

4.1 Registration, authentication, CLI validationh5

join.jsp - register an account (CID) for a phone numberh6

• URL / method: GET https://api.eyecon-app.com/app/join.jsp?<params>&cv=vc_749_vn_4.2026.04.23.1145_a
• Issuer: p365jd.RunnableC17614z case 1. URL cached in C21280h.f56467c.
• Auth headers: addAutoHeaders = false - the client has no CID yet.
• Callback: yes, p262e7.AbstractC16130b; C21280h.m38437j(...) maps the server result onto p494q7.EnumC19653e1.

• Response consumption: headers, not body. map.get("pi") becomes the new SP_UUID (public id); missing -> Exception("Join, missing public id") + failure. map.get("sd") == "0" -> isDeviceChanged. map.get("is_new") == "1" -> isJoin. The body is passed to the callback verbatim and to p268eh.AbstractC16257t1.m31616A(...).
• Error mapping (C21280h.m38437j -> EnumC19653e1): non-200 -> HTTP_RESPOND_CODE(i); -10 -> CLIENT_RETURN_WITH_NO_ERROR; HTTP 200 with an empty body -> JOIN_RESPOND_CODE_200_WITHOUT_CID.

cli_auth/gettransport - start phone-number validationh6

• URL / method: GET https://api.eyecon-app.com/app/cli_auth/gettransport?<params>
• Issuer: p365jd.RunnableC17614z case default. Auth: addAutoHeaders = z14 (is_already_social_auth), hence false on a first-time validation. Callback: yes, C19647c1.

• Response (JSON) keys read: error_status (int -> EnumC19653e1), subcode (0 = all retries failed, 1 = country not supported, 2 = deleteme over limit, 3 = banned by traffic analyzer), transport, and details{} with send_to, timeout, body, code (for MO_SMS) or pattern (for SO_FLASH).
• Notable: the SERVER_BANNED_BY_TRAFFIC_ANALYZER code demonstrates that server-side traffic-anomaly banning exists.

cli_auth/checkcode - submit the validation codeh6

• URL / method: GET https://api.eyecon-app.com/app/cli_auth/checkcode?<params>
• Issuer: p516r5.RunnableC19875s case 1. Callback: yes, AbstractC16130b.

• Response: plain integer text. 0 + HTTP 200 -> success -> continues into the p308gj.C16770d join flow. Anything else -> C21280h.m38437j.
• Retry: attempted twice - on any Throwable the app sleeps 5000 ms (AbstractC0077t.m439X0(5000L)) then retries once (RunnableC19875s:137-139). The same pattern is used by social_auth/validatetoken.

social_auth/use_cli_validation - “join with real number” after social loginh6

• URL / method: GET https://api.eyecon-app.com/app/social_auth/use_cli_validation?<params>
• Issuer: p607vk.RunnableC21082e0 case 23.
• Observation: the internal label passed is "join.jsp" although the path is social_auth/use_cli_validation; the label only affects logging and DB naming.
• Params: device_id (android_id), cli (normalised), advid (Advertising ID), cv.
• Callback: yes (C19677n); the body is forwarded, then AbstractC16257t1.m31616A(false, null, false, true).

social_auth/validatetoken - exchange an OAuth token for a CLIh6

• URL / method: GET https://api.eyecon-app.com/app/social_auth/validatetoken?<params> (jsonAccept = true)
• Issuer: p607vk.RunnableC21093i case 25. Callback: yes (C15802b).

• Response: JSON that must contain a non-empty cli; otherwise p284f7.C16479l("validatetoken api return with missing info, json = ..."). A real key is read and discarded (AbstractC16468f0.m32025t("real", null, json)).
• Retry: once, after a 5 s sleep, on Throwable.
• Security note: C18416a.m34588y("Server", "validateTokenReg provider = %s, token = %s", provider, token) writes the raw provider access token to logcat unconditionally.

deleteme.jsp - account deletion / right-to-erasureh6

• URL / method: GET https://api.eyecon-app.com/app/deleteme.jsp?cv=...
• Issuer: p598v6.RunnableC20874a case default, from AboutActivity’s “Delete account” flow.
• Callback: yes (C18716e). The body is ignored; only the HTTP status matters.

4.2 Contactsh5

addcontacts.jsp - bulk contact upload (gzip POST)h6

• URL / method: POST https://api.eyecon-app.com/app/addcontacts.jsp
• Issuer: p620w6.C21280h.m38428a(String contacts, boolean init) -> new C21651d(url, "POST", init, 2, "addcontacts.jsp") -> C21649b.m38854c(...) -> row inserted into table_api_requests -> executed by ApiRequestWorker.
• Transport: C21273a.m38424h. The query string produced by C18416a.m34580q(params) is UTF-8 encoded, GZIP-compressed, and written as the request body, with Content-Type: application/x-www-form-urlencoded and Content-Encoding: gzip. The URL itself carries no query string.

• Response: read then discarded (the StringBuilder in m38424h is never returned) - fire-and-forget at payload level; only the HTTP status feeds the queue bookkeeping.
• On success: DBContacts.m10115r(); if isCameFromReg, DBContacts.m10143p(false, "updatePostRequest", true, false, null) re-syncs.
• Follow-up: may also issue getcontactslang.jsp.
• Caveat: C21280h.m38428a has no call site in the decompiled tree (section 11). The payload format is inferred from the matching removecontacts.jsp builder (inference, medium-high confidence).

removecontacts.jsp - bulk contact removalh6

• URL / method: POST https://api.eyecon-app.com/app/removecontacts.jsp?contacts=...&cv=... (params in the URL, empty body)
• Issuer: p541s5.RunnableC20065s case default -> new C21653f(params, url, "POST", "removecontacts.jsp") -> queued.
• Params: contacts = cli@a@name@z@cli@a@name... built from each contact’s cli_in_server + name; cv.
• Response: ignored.

getupdatedcontactsinfo.jsp - poll for server-side contact updatesh6

• URL / method: GET https://api.eyecon-app.com/app/getupdatedcontactsinfo.jsp?cv=..., gzip = false, addAutoHeaders = true, jsonAccept = false
• Issuer: p607vk.RunnableC21093i case 26 (private m38227a), driven from DBContacts.
• Params: cv only.
• Response header consumed: sms. C21280h.m38432e checks Integer.parseInt(map.get("sms")) > 0; on a positive value it re-enqueues RunnableC21276d(..., 5) (fetch new external SMS ids), sets SP sp_new_external_sms_in_server = true and calls back. NumberFormatException is swallowed.
• Response body format: a @z@-separated list of @a@-separated records; per record: [0] = cli_in_server, [1] = is_viewer, [2] = os_type, optional [3] = number of social pairs then repeated (social_type, social_id) pairs, then is_sub, then is_can_talk_enable, then vn. Values are written into the social table (DBContacts.f164K0/f167L0/f176O0/f216f/f179P0, f255s, f273y, f276z).

getfreshpicsjson.jsp - fetch “fresh” caller-ID photo URLsh6

• URL / method: GET https://api.eyecon-app.com/app/getfreshpicsjson.jsp?init=...&cv=...&trigger=...
• Issuer: androidx.fragment.app.RunnableC2598c (case 7 / default), invoked from DBContacts.m10143p(...) and p541s5.RunnableC3686q0.
• Callback: a Runnable (RunnableC20055i) plus an output ArrayList.

• Response (JSON array), keys read: cli (String -> cli_in_server), type (int -> pic_status_in_server), big_pic (String, optional -> big_pic_url), small_pic (String, optional -> small_pic_url), tag (String, optional -> fresh_pic_tag).
• 401 handling: on HTTP 401 an empty row carrying an "error 401" marker is appended to the result list and the callback still runs.

getnames.jsp - reverse lookup of caller name / spam verdicth6

• URL / method: GET https://api.eyecon-app.com/app/getnames.jsp?cli=...&lang=...&is_callerid=...&is_ic=...&cv=...&requestApi=...&source=...[&is_search=true]
• Issuer: RunnableC2598c case 6 (caller-ID path, jsonAccept = true) and p599v7.RunnableC20908f case 5 (photo-picker path, source = PhotoPicker).
• Callback: yes - p620w6.InterfaceC21279g.mo34917g(String[] names, C21657d result, int errorCode).

• Response (JSON array), keys read: name (String), spam_type (String, compared against "spam"), suspicious_spam (Boolean). C21280h.m38429b maps the name to "" when it is blank / "spam" / "maybe spam".
• Client-side caching: before hitting the network the app consults p648x7.C21670q and p554t5.C20337g caches; if a cached name exists it is returned with errorCode = 0 and no request is made.
• Failure modes mapped to errorCode: 2 = not an Eyecon user / skipped; 2 = no HTTP network or an exception; 2 = “trying to use cache” miss path or exception; 1 = non-200 HTTP or an empty body; -1 = a cache entry is invalidated when the HTTP code is 404 or 200.

notifyaddcontact.jsp - notify the server of a newly added contacth6

• URL / method: GET https://api.eyecon-app.com/app/notifyaddcontact.jsp?notifycli=<cli>&cv=...
• Issuer: as.RunnableC3316o case default. Fire-and-forget: result array int[] is initialised to {0} and never read; the call is wrapped in a try/catch that only prints a stack trace.
• Guard: only when notifycli is non-empty and AbstractC9039h.m10665v() (is an Eyecon user).

getcontactslang.jsp - negotiate the contact-name languageh6

• URL / method: GET https://api.eyecon-app.com/app/getcontactslang.jsp?cv=...
• Issuer: p620w6.C21280h.m38428a (post-addcontacts.jsp).
• Trigger condition: SP contactLangNeedUpdate, or the upload contains > 20 records, or (records * 100) / contactsInDb > 5 (more than 5 % of the address book is being re-sent).
• Response: a bare 2-letter language code, validated against [a-zA-Z]{2}; stored in SP contactLang, clears contactLangNeedUpdate, and if it differs from the currently selected quotes language a quotes reload is scheduled.
• Error handling: any exception is caught and discarded.

picapproval.jsp - user approval / rejection of a proposed contact photoh6

• URL / method: GET https://api.eyecon-app.com/app/picapproval.jsp?piccli=...&tag=...&isapproved=...&cv=...
• Issuer: p572u4.RunnableC20597o case 5, via C21280h.m38431d(...).
• Params:

• Transport difference (observation): when isapproved == "yes" the call is executed immediately and synchronously (m38423g, result returned through strArr[0]); when "no" it is queued into table_api_requests via C21649b.m38854c(new C21653f(...)).
• Guard: if the CLI list is empty, the tag is blank, or the user is not an Eyecon user, strArr[0] = "" and nothing is sent.

getoptionalpics.jsp - “survey” alternative photos for a contacth6

• URL / method: GET https://api.eyecon-app.com/app/getoptionalpics.jsp?clipics=<cli>&cv=...
• Issuer: p607vk.RunnableC21082e0 case 22, from PhotoPickerActivity.
• Params: clipics = the contact’s CLI; cv.
• Callback: yes. errorCode 1 = not an Eyecon user, 2 = exception, HTTP code otherwise.
• Response schema: NOT RECOVERED. The raw body is handed to PhotoPickerActivity’s callback; the consuming code path was not decompiled. The DB columns that the result must feed are is_survey_pic (AbstractC0039a.f243o), survey_pic_url (f246p) and survey_pic_tag (f249q) - inference from DBContacts.java:3099-3103.

pic?cli=... - caller-ID photo download (binary)h6

• URL / method: GET https://api.eyecon-app.com/app/pic?cli=<cli>&is_callerid=true&size=<small|big|null>&type=0&src=<src>&cancelfresh=0&cv=vc_749_vn_4.2026.04.23.1145_a
• Issuer: p620w6.C21280h.m38434g(String src, int size, String cli, InterfaceC18539o cb) -> C18540p.m34736e(...) -> C18540p.m34732a(...).
• Exact construction (C21280h.m38434g, lines 323-338):

• Guard: C18312b.m34437h().m34452q("+" + cli) must be true (a dialable number), else the callback fires with error 812 and a null bitmap.
• Response: raw image bytes -> BitmapFactory.decodeStream. Additional caching behaviour: the downloaded bitmap is PNG-compressed and stored as photo_bytes (rejected above 2048 KiB, or down-scaled to at most 1080x1920 first); a redirect and a photo_found boolean are stored in p554t5.C20337g.
• “Balwan” filter: C18540p.m34733b parses remote-config key balwan_recognizer and throws FileNotFoundException (surfacing as HTTP code -404) when the URL matches a blocked urls[] + segments[] combination, so blocked Facebook CDN photos are never cached.

4.3 User profile, settings, spam, sharingh5

uploadpic.jsp - user profile photo upload (hand-built multipart)h6

• URL / method: POST https://api.eyecon-app.com/app/uploadpic.jsp
• Issuer: p620w6.C21280h.m38441n(); URL cached in C21280h.f56468d; driven by com.eyecon.global.MoreMenuAndSettings.UploadProfileWorker.
• Guards: SP SP_KEY_NEED_UPDATE_PROFILE_PIC must be true; AbstractC9039h.m10665v(); the file <filesDir>/.Eyecon/.nomedia/temp_photo.jpg must decode to a bitmap. Returns -1 if any guard fails.
• Headers: Content-Type: multipart/form-data;boundary=*****; the four e-auth* headers via C21273a.m38427k. setDoInput(true), setDoOutput(true), setUseCaches(false). No timeouts set.
• Body (verbatim):

--*****\r\nContent-Disposition: form-data; name="msisdn"\r\n\r\n<clientId>\r\n
<JPEG bytes, compress format JPEG, quality 90>
\r\n--*****--\r\n

• Response: read line-by-line and discarded. On HTTP 200 the SP flag is cleared and 1 is returned; 0 on any non-200 or exception.

updateuserdetails.jsp - generic user-attribute update (many distinct params)h6

• URL / method: GET https://api.eyecon-app.com/app/updateuserdetails.jsp?<one-of-the-below>&cv=...
• Issuer: p620w6.RunnableC21275c cases 2/3/4, p607vk.RunnableC21082e0 case 24, p516r5.RunnableC19874r case 12, p475p6.RunnableC19310j case default.
• Response: ignored. Only the HTTP status gates a local SP write.

addfbtoken.jsp - associate a Facebook token with the accounth6

• URL / method: GET https://api.eyecon-app.com/app/addfbtoken.jsp?token=...&fbid=...&cv=...
• Issuer: p620w6.RunnableC21275c case 1 - fired from C21280h’s constructor, i.e. once per process start when both SP values exist.
• Params: token = SP facebookToken, fbid = SP facebookId, cv.
• Response: ignored. Fully wrapped in try/catch (stack trace only).

mysettings - read / write the server-side user settings blobh6

Two shapes:

Note the same "mysettings" endpoint name is also used as a (misleading) log label for spam (RunnableC21082e0:217) and GET share (RunnableC20880f:210).

spam - fetch the server-side spam block-list deltah6

• URL / method: GET https://api.eyecon-app.com/app/spam?list_version=<v>, gzip enabled, addAutoHeaders = true
• Issuer: p607vk.RunnableC21082e0 case 21, from com.eyecon.global.Others.Tasks.DailyWorker.
• Params: list_version = the client’s last-known list version string; no cv.
• Callback: yes (C16937a); HTTP != 200 -> "Error code N", empty -> "Result is empty", otherwise the raw body.
• Note: the remote flag spam_list_sync_interval defaults to -1 (disabled) and is read in a sibling class.

share - social-media share of a video/posth6

• GET response (JSON array), keys read by p621w7.C21295o.m38463e: id (String), type (String), cli (String), content (a JSON string which is re-parsed), provider (String, optional), share_ts (Long epoch ms).

spamreport - user “this number is spam” feedbackh6

• URL / method: POST https://api.eyecon-app.com/app/spamreport with a JSON body
• Issuer: p599v7.RunnableC20908f case 4, through new C21652e(json, "data", url, "reportBlock", "application/x-www-form-urlencoded", "POST") -> queued.
• Body: {type: "blocked", blocked_numbers: [<cli>, ...]}.
• Observation: the body is a raw JSON string but the Content-Type header is set to application/x-www-form-urlencoded. Server-side parsing of this is therefore server-dependent.
• Response: ignored. Bails out with an error log if the number list is empty or the user is not an Eyecon user.

name_report - “this name is wrong” feedbackh6

• URL / method: GET https://api.eyecon-app.com/app/name_report?name=<name>&cli=<cli> (no cv)
• Issuer: p544s8.RunnableC20081f case 1.
• Params: name = the name shown on the contact, cli = the number. Observation: the two arguments are the other way round at the call site - C21872a("name", str) where str is the raw number and C21872a("cli", buttonText). Either the call site or the parameter names are wrong (flagged, not resolved).
• Response: ignored. Guarded on Eyecon user + non-empty name + non-empty number.

social-mngr - report a social-media identity link/unlinkh6

• URL / method: POST https://api.eyecon-app.com/app/social-mngr with an application/json body
• Issuer: p541s5.RunnableC20060n case default -> C21652e -> queued.
• Body: [{cli, stype, sid, b_pic}] - the CLI, an integer social status (-1 = not linked, 2/11 = CanTalk states, etc.), the social id, and a boolean.
• Response: ignored.

grps/sgn - APK signing-certificate fingerprint report (RSA-encrypted)h6

• URL / method: POST https://api.eyecon-app.com/app/grps/sgn, body type text/plain
• Issuer: p516r5.RunnableC19874r case 11 -> C21652e -> queued.
• Plaintext before encryption: {signatures: [<sha?>...], cid: <clientId>, random: <Math.random()>}.
• Encryption: RSA with the public key R.string.pk_enc_2 (KeyFactory.getInstance("RSA").generatePublic(new X509EncodedKeySpec(Base64.decode(...)))), then C20369c.m37306n(...).
• Guards: SP SP_KEY_DID_UPDATE_V1453 not yet set; Eyecon user; remote sig_report_config.is_enable (default false); cooldown_days_after_join (default 1) elapsed since sp_join_time.
• Response: ignored. SP flag set immediately after enqueue.
• Related key: R.string.pk_enc (RSA-2048 public key) is used by p284f7.AbstractC16468f0:362 for a different purpose (local signature verification of the APK’s own certificate).

shorten-url - URL shortenerh6

• URL / method: POST https://api.eyecon-app.com/app/shorten-url, Content-Type: application/x-www-form-urlencoded, addAutoHeaders = true
• Issuer: p607vk.RunnableC21082e0 case 26, built as an OkHttp FormBody.
• Body params: url (the target URL, form-encoded), ead = "30".
• Response: raw body = a short token. On HTTP 2xx and a non-empty token the app synthesises https://api.eyecon-app.com/pub/su/<token> and hands that to the callback.
• Typical url value: https://api.eyecon-app.com/app/pub/redirectme.jsp?goto=geo:<lat>,<lon>?q=<lat>,<lon> (built in p308gj.C16770d:1166 with URLEncoder.encode(..., "UTF-8")). Observation: pub/redirectme.jsp itself is never requested directly - it is only ever embedded into shorten-url.

upgrade_pic2eyecon.jsp - legacy photo-migration triggerh6

• URL / method: GET https://api.eyecon-app.com/app/upgrade_pic2eyecon.jsp with no parameters at all (new ArrayList(2) is empty, so not even cv).
• Issuer: p620w6.RunnableC21275c case 6.
• Response: ignored.

resetupdatedstatus.jsp - acknowledge the contact-update pollh6

• Intended URL / method: GET https://api.eyecon-app.com/app/resetupdatedstatus.jsp?cv=..., issued from p607vk.RunnableC21082e0 case 25, labelled "resetupdatedstatus.jsp".
• Observation / probable bug: the URL passed to m38423g is C21280h.f56466b, i.e. the base URL https://api.eyecon-app.com/app/ with no endpoint path. Either a genuine defect or a stale build; static analysis cannot tell. The success flag is code == 200 && body.length() > 0.

4.4 CanTalk (“can I talk?”) flowh5

cantalk.jsp - send a CanTalk invitationh6

• URL / method: GET https://api.eyecon-app.com/app/cantalk.jsp?recvcli=<cli>&q=<message>
• Issuers: p474p5.RunnableC19300e.run() and p474p5.AsyncTaskC19296a (dispatch value 19).
• Params: recvcli = the normalised receiver CLI, q = the message text (CampaignEx.JSON_KEY_AD_Q == "q"), cv.
• Response: "-1" -> allow; "" or "0" -> deny; any other non-empty value -> allow with a message.

getcantalkstatus.jsp - poll the status of a CanTalk requesth6

• URL / method: GET https://api.eyecon-app.com/app/getcantalkstatus.jsp?notifiedcli=<cli>&cv=...
• Issuer: p474p5.RunnableC19300e.run(); polled in a loop with Thread.sleep(1000) until f49586e flips.
• Response: raw string; anything non-200 -> "".

cantalkreceived.jsp / cantalksaw.jsp - delivery/read receiptsh6

• URL / method: GET https://api.eyecon-app.com/app/cantalkreceived.jsp?sendercli=<cli>&cv=... and the identical cantalksaw.jsp.
• Issuer: both via p451o7.AbstractC19089d.m35398e -> AbstractC0062l0.m354i1(new AsyncTaskC19296a(), "", 34, cli, "cantalkreceived.jsp"), and com.eyecon.global.CanTalk.CanTalkActivity.onWindowFocusChanged -> "cantalksaw.jsp".
• Response: ignored (fire-and-forget, iArr == null).
• Note: both are triggered by FCM push payloads of type cantalk_q / cantalk_y / cantalk_n (see AbstractC19089d.m35398e).

4.5 History / eventsh5

sethistory.jsp - report a contact actionh6

• URL / method: GET https://api.eyecon-app.com/app/sethistory.jsp?cv=...&to=<cli>&time=<sec>&type=<int>
• Issuer: p607vk.RunnableC21088g0 case default.
• Params: to = C18312b.m34437h().m34444e(cli); time = timestampMillis / 1000; type = integer action code; cv.
• Guards: Eyecon user and !AbstractC9039h.m10667x() (i.e. not in the “not registered with real CLI” state).
• Response: ignored.

eventreport.jsp - generic in-app event reportingh6

• URL / method: POST https://api.eyecon-app.com/app/eventreport.jsp, body = a raw JSON object, Content-Type: application/x-www-form-urlencoded, dataName = "data" (so m38425i prefixes the body with data=).
• Issuer: p620w6.C21280h.m38436i(String name, String type, JSONObject attributes) -> RunnableC21129z.
• Body: {name, type, attributes: <caller JSONObject>, timestamp: <System.currentTimeMillis()/1000>}.
• Auth: AbstractC9039h.m10665v() is passed as addAutoHeaders, so unauthenticated users send no auth headers.
• Response: ignored. Exceptions are caught and reported to the global crash handler.

4.6 Voice2Text / TTM (voice2text.eyecon-app.com)h5

All of these receive e-auth-* headers because the host contains eyecon-app.com.

4.7 Virality / referralh5