CLI tool to check F-Droid apps with Exodus

Rudloff · March 12, 2019, 2:40pm

Hello,

I wanted a way to check F-Droid apps with Exodus, so I can make sure that we did not forget to remove a tracker (or add the Tracking anti-feature) to some app.
So I wrote a small PHP CLI tool that downloads an APK from https://f-droid.org/ and uses the Exodus Python tool to scan it.

I mostly created this for myself (also as a way to experiment with php-fdroid and exodus-standalone) but I thought it could be useful to other people so I am sharing it here.

Ox0p54 · March 12, 2019, 2:42pm

If there is a public-feed of updated apps to easily follow I’d be happy to host a static scanner.

Rudloff · March 12, 2019, 3:02pm

I am not sure we have such a feed; I think you would have to fetch the whole index and check the lastupdated field for each app.

hans · March 12, 2019, 6:09pm

@Rudloff sounds quite useful!

The public feed is the index, it is a JSON file in a signed JAR file. Here is the f-droid.org one: https://f-droid.org/repo/index-v1.jar

Sounds like a useful thing to have running in the fdroiddata gitlab-ci, so it checks all apps as they are added. With PHP, that should be easy, just apt-get install the packages you need.

Ox0p54 · March 12, 2019, 8:48pm

Hi, sounds like you’re intending to run this over at f-droid itself. Otherwise I could host this on my Server and make it public. (Planning to do some parsing with the feed in rust )
Though obviously doing it directly with the f-droid system makes it more public and the results can be used for flagging directly.

hans · March 13, 2019, 9:32pm

My idea is to have it running in gitlab-ci on each merge request. gitlab-ci is based on Docker, so you can easily setup any kind of server that you need. I’d be happy to setup the core part for you to run your service in. Just let me know which distro and packages need to be installed.

oF2pks · March 21, 2019, 12:05am

@Rudloff @Izzy , following is an extract of F-Droid apks with embedded Exodus classes; like Sanity , somes seem a bit “weird”

Complete scans can be parsed here :

light summaryLIGHTmapboxNOacra.txt · master · oF2pks / 3xodusPrivacy-toolbox · GitLab
full (acra + mapbox) summaryFULL.txt · master · oF2pks / 3xodusPrivacy-toolbox · GitLab


https://github.com/HugoGresse/Anecdote

Anecdote
2017-05-06========>io.gresse.hugo.anecdote_23.apk##Tracking_NonFreeAssets
  Class descriptor  : 'Lly/count/android/sdk/a$1;'
...
  Class descriptor  : 'Lly/count/android/sdk/n;'
  Class descriptor  : 'Lly/count/android/sdk/ReferrerReceiver;'


https://github.com/jereksel/Bucket

Bucket_-_Overlay_Manager
2017-12-15========>com.jereksel.libresubstratum_3.apk##
  Class descriptor  : 'Lcat/ereza/customactivityoncrash/activity/DefaultErrorActivity$1;'
...
  Class descriptor  : 'Lcat/ereza/customactivityoncrash/R;'


https://github.com/sreichholf/dreamDroid

DreamDroid
2019-01-29========>net.reichholf.dreamdroid_433.apk##
  Class descriptor  : 'Lorg/matomo/sdk/BuildConfig;'
...
  Class descriptor  : 'Lorg/matomo/sdk/extra/DimensionQueue;'
  Class descriptor  : 'Lorg/matomo/sdk/extra/DownloadTracker$Extra$ApkChecksum;'
...
  Class descriptor  : 'Lorg/matomo/sdk/extra/DownloadTracker;'
  Class descriptor  : 'Lorg/matomo/sdk/extra/EcommerceItems$Item;'
  Class descriptor  : 'Lorg/matomo/sdk/extra/EcommerceItems;'
  Class descriptor  : 'Lorg/matomo/sdk/extra/InstallReferrerReceiver;'
  Class descriptor  : 'Lorg/matomo/sdk/extra/MatomoApplication;'
  Class descriptor  : 'Lorg/matomo/sdk/extra/MatomoExceptionHandler;'
  Class descriptor  : 'Lorg/matomo/sdk/extra/TrackHelper$1;'
...
  Class descriptor  : 'Lorg/matomo/sdk/extra/TrackHelper;'
...
  Class descriptor  : 'Lorg/matomo/sdk/Tracker$Callback;'
  Class descriptor  : 'Lorg/matomo/sdk/Tracker;'
  Class descriptor  : 'Lorg/matomo/sdk/TrackerBuilder;'
  Class descriptor  : 'Lorg/matomo/sdk/TrackMe;'


https://github.com/shymmq/librus-client-kotlin

Dziennik
2018-04-27========>com.wabadaba.dziennik_10.apk##NonFreeNet
  Class descriptor  : 'Lcom/bugsnag/android/AppData;'
...
  Class descriptor  : 'Lcom/bugsnag/android/User;'


http://hg.mozilla.org

Fennec_F-Droid
2019-02-16========>org.mozilla.fennec_fdroid_650110.apk##NonFreeAdd_Tracking
  Class descriptor  : 'Lorg/mozilla/gecko/telemetry/measurements/CampaignIdMeasurements;'
...
  Class descriptor  : 'Lorg/mozilla/gecko/telemetry/TelemetryUploadService;'


https://github.com/mozilla-mobile/focus-android

Firefox_Klar
2018-08-20========>org.mozilla.klar_22.apk##
  Class descriptor  : 'Lorg/mozilla/telemetry/config/TelemetryConfiguration;'
...
  Class descriptor  : 'Lorg/mozilla/telemetry/util/StringUtils;'


https://github.com/flyve-mdm/android-mdm-agent/

Flyve_MDM_Agent
2019-01-15========>org.flyve.mdm.agent.mqtt_3238.apk##
  Class descriptor  : 'Lcom/bugsnag/android/AppData;'
...
  Class descriptor  : 'Lcom/bugsnag/android/User;'


https://github.com/flyve-mdm/android-mdm-agent/

Flyve_MDM_Agent
2018-12-07========>org.flyve.mdm.agent_3085.apk##NoSourceSince
  Class descriptor  : 'Lcom/bugsnag/android/AppData;'
...
  Class descriptor  : 'Lcom/bugsnag/android/User;'


https://github.com/fossasia/open-event-android

FOSSASIA_2017
2017-03-24========>org.fossasia.openevent_101.apk##
  Class descriptor  : 'Lcom/facebook/appevents/AccessTokenAppIdPair$1;'
  Class descriptor  : 'Lcom/facebook/appevents/AccessTokenAppIdPair$SerializationProxyV1;'
  Class descriptor  : 'Lcom/facebook/appevents/AccessTokenAppIdPair;'
  Class descriptor  : 'Lcom/facebook/appevents/AnalyticsUserIDStore$1;'
  Class descriptor  : 'Lcom/facebook/appevents/AnalyticsUserIDStore$2;'
  Class descriptor  : 'Lcom/facebook/appevents/AnalyticsUserIDStore;'
  Class descriptor  : 'Lcom/facebook/appevents/AppEvent$1;'
...
  Class descriptor  : 'Lcom/facebook/appevents/FlushReason;'
  Class descriptor  : 'Lcom/facebook/appevents/FlushResult;'
  Class descriptor  : 'Lcom/facebook/appevents/FlushStatistics;'
  Class descriptor  : 'Lcom/facebook/appevents/internal/ActivityLifecycleTracker$1;'
  Class descriptor  : 'Lcom/facebook/appevents/internal/ActivityLifecycleTracker$2;'
  Class descriptor  : 'Lcom/facebook/appevents/internal/ActivityLifecycleTracker$3;'
  Class descriptor  : 'Lcom/facebook/appevents/internal/ActivityLifecycleTracker$4$1;'
  Class descriptor  : 'Lcom/facebook/appevents/internal/ActivityLifecycleTracker$4;'
  Class descriptor  : 'Lcom/facebook/appevents/internal/ActivityLifecycleTracker;'
...
  Class descriptor  : 'Lcom/facebook/login/DeviceAuthMethodHandler;'
  Class descriptor  : 'Lcom/facebook/login/DeviceLoginManager;'
  Class descriptor  : 'Lcom/facebook/login/FacebookLiteLoginMethodHandler$1;'
  Class descriptor  : 'Lcom/facebook/login/FacebookLiteLoginMethodHandler;'
  Class descriptor  : 'Lcom/facebook/login/GetTokenClient;'
  Class descriptor  : 'Lcom/facebook/login/GetTokenLoginMethodHandler$1;'
  Class descriptor  : 'Lcom/facebook/login/GetTokenLoginMethodHandler$2;'
  Class descriptor  : 'Lcom/facebook/login/GetTokenLoginMethodHandler$3;'
  Class descriptor  : 'Lcom/facebook/login/GetTokenLoginMethodHandler;'
  Class descriptor  : 'Lcom/facebook/login/KatanaProxyLoginMethodHandler$1;'
  Class descriptor  : 'Lcom/facebook/login/KatanaProxyLoginMethodHandler;'
  Class descriptor  : 'Lcom/facebook/login/LoginBehavior;'
...
  Class descriptor  : 'Lcom/facebook/login/LoginManager;'
  Class descriptor  : 'Lcom/facebook/login/LoginMethodHandler;'
  Class descriptor  : 'Lcom/facebook/login/LoginResult;'
  Class descriptor  : 'Lcom/facebook/login/NativeAppLoginMethodHandler;'
...
  Class descriptor  : 'Lcom/facebook/share/ShareApi;'
  Class descriptor  : 'Lcom/facebook/share/ShareBuilder;'
...
  Class descriptor  : 'Lcom/facebook/share/widget/ShareDialog;'
  Class descriptor  : 'Lio/branch/indexing/AppIndexingHelper$1;'
  Class descriptor  : 'Lio/branch/indexing/AppIndexingHelper;'
  Class descriptor  : 'Lio/branch/indexing/BranchUniversalObject$1;'
  Class descriptor  : 'Lio/branch/indexing/BranchUniversalObject$CONTENT_INDEX_MODE;'
  Class descriptor  : 'Lio/branch/indexing/BranchUniversalObject$LinkShareListenerWrapper;'
  Class descriptor  : 'Lio/branch/indexing/BranchUniversalObject$RegisterViewStatusListener;'
  Class descriptor  : 'Lio/branch/indexing/BranchUniversalObject;'
  Class descriptor  : 'Lio/branch/indexing/ContentDiscoverer$1;'
  Class descriptor  : 'Lio/branch/indexing/ContentDiscoverer$HashHelper;'
  Class descriptor  : 'Lio/branch/indexing/ContentDiscoverer;'
  Class descriptor  : 'Lio/branch/indexing/ContentDiscoveryManifest$CDPathProperties;'
  Class descriptor  : 'Lio/branch/indexing/ContentDiscoveryManifest;'
  Class descriptor  : 'Lio/branch/referral/AnimatedDialog$1;'
  Class descriptor  : 'Lio/branch/referral/AnimatedDialog$2;'
  Class descriptor  : 'Lio/branch/referral/AnimatedDialog;'
  Class descriptor  : 'Lio/branch/referral/ApkParser;'
  Class descriptor  : 'Lio/branch/referral/Base64$Coder;'
  Class descriptor  : 'Lio/branch/referral/Base64$Decoder;'
  Class descriptor  : 'Lio/branch/referral/Base64$Encoder;'
  Class descriptor  : 'Lio/branch/referral/Base64;'
  Class descriptor  : 'Lio/branch/referral/Branch$1;'
...
  Class descriptor  : 'Lio/branch/referral/Branch$IBranchViewControl;'
  Class descriptor  : 'Lio/branch/referral/Branch$IChannelProperties;'
  Class descriptor  : 'Lio/branch/referral/Branch$INTENT_STATE;'
  Class descriptor  : 'Lio/branch/referral/Branch$LogoutStatusListener;'
  Class descriptor  : 'Lio/branch/referral/Branch$SESSION_STATE;'
  Class descriptor  : 'Lio/branch/referral/Branch$ShareLinkBuilder;'
  Class descriptor  : 'Lio/branch/referral/Branch;'
  Class descriptor  : 'Lio/branch/referral/BranchApp;'
  Class descriptor  : 'Lio/branch/referral/BranchAsyncTask;'
  Class descriptor  : 'Lio/branch/referral/BranchContentUrlBuilder;'
...
  Class descriptor  : 'Lio/branch/referral/BranchViewHandler;'
  Class descriptor  : 'Lio/branch/referral/BuildConfig;'
...
  Class descriptor  : 'Lio/branch/referral/DeviceInfo;'
...
  Class descriptor  : 'Lio/branch/referral/SystemObserver;'
  Class descriptor  : 'Lio/branch/referral/util/BranchEvent;'
  Class descriptor  : 'Lio/branch/referral/util/CommerceEvent;'
  Class descriptor  : 'Lio/branch/referral/util/CurrencyType;'
  Class descriptor  : 'Lio/branch/referral/util/LinkProperties$1;'
  Class descriptor  : 'Lio/branch/referral/util/LinkProperties;'
  Class descriptor  : 'Lio/branch/referral/util/Product;'
  Class descriptor  : 'Lio/branch/referral/util/ProductCategory;'
  Class descriptor  : 'Lio/branch/referral/util/ShareSheetStyle;'


https://github.com/AllanWang/Frost-for-Facebook

Frost_for_Facebook
2019-02-13========>com.pitchedapps.frost_2020200.apk##NonFreeNet
  Class descriptor  : 'Lcom/bugsnag/android/a;'
...
  Class descriptor  : 'Lcom/bugsnag/android/z;'


https://github.com/gotify/android

Gotify
2019-03-03========>com.github.gotify_8.apk##
  Class descriptor  : 'Lcom/hypertrack/hyperlog/BuildConfig;'
...
  Class descriptor  : 'Lcom/hypertrack/hyperlog/utils/HLDateTimeUtility;'
  Class descriptor  : 'Lcom/hypertrack/hyperlog/utils/Utils;'
  Class descriptor  : 'Lcom/hypertrack/hyperlog/utils/VolleyUtils;'


https://github.com/manmal/hn-android

HN
2016-08-26========>com.manuelmaly.hn_25.apk##UpstreamNonFree
  Class descriptor  : 'Lcom/google/android/apps/analytics/AdHitIdGenerator;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/AdMobInfo;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/AnalyticsParameterEncoder;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/AnalyticsReceiver;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/Dispatcher$Callbacks;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/Dispatcher;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/GoogleAnalyticsTracker;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/Hit;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/Item$Builder;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/Item;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/Transaction$Builder;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/Transaction;'


https://ftp.gnu.org/gnu/gnuzilla/

IceCatMobile
2019-02-19========>org.gnu.icecat_600511.apk##
  Class descriptor  : 'Lorg/mozilla/gecko/telemetry/measurements/CampaignIdMeasurements;'
...
  Class descriptor  : 'Lorg/mozilla/gecko/telemetry/TelemetryUploadService;'


https://github.com/flyve-mdm/android-inventory-agent/

Inventory
2018-08-21========>org.flyve.inventory.agent_39160.apk##
  Class descriptor  : 'Lcom/bugsnag/android/AppData;'
...
  Class descriptor  : 'Lcom/bugsnag/android/User;'


https://github.com/irssiconnectbot/irssiconnectbot

Irssi_ConnectBot
2012-07-02========>org.woltage.irssiconnectbot_393.apk##
  Class descriptor  : 'Lcom/bugsense/trace/ActivityAsyncTask;'
  Class descriptor  : 'Lcom/bugsense/trace/BugSense$1;'
...
  Class descriptor  : 'Lcom/bugsense/trace/BugSenseHandler;'
  Class descriptor  : 'Lcom/bugsense/trace/DefaultExceptionHandler;'
  Class descriptor  : 'Lcom/bugsense/trace/G;'


https://github.com/federicoiosue/Omni-Notes

Omni_Notes_FOSS
2018-09-17========>it.feio.android.omninotes.foss_247.apk##
  Class descriptor  : 'Lorg/piwik/sdk/CustomVariables;'
...
  Class descriptor  : 'Lorg/piwik/sdk/TrackMe;'


https://github.com/ctodobom/OpenNoteScanner

Open_Note_Scanner
2018-11-14========>com.todobom.opennotescanner_32.apk##
  Class descriptor  : 'Lorg/piwik/sdk/BuildConfig;'
...
  Class descriptor  : 'Lorg/piwik/sdk/TrackMe;'


https://github.com/OpenArchive/openarchive-android

OpenArchive
2017-12-04========>net.opendasharchive.openarchive.release_17.apk##
  Class descriptor  : 'Lio/cleaninsights/sdk/piwik/CleanInsightsApplication;'
...
  Class descriptor  : 'Lio/cleaninsights/sdk/piwik/tools/UrlHelper;'


https://github.com/ThirtyDegreesRay/OpenHub

OpenHub
2019-02-06========>com.thirtydegreesray.openhub_30.apk##
  Class descriptor  : 'Lcom/tencent/bugly/a;'
  Class descriptor  : 'Lcom/tencent/bugly/b;'
...
  Class descriptor  : 'Lcom/tencent/bugly/beta/interfaces/BetaPatchListener;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/R$string;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/R$xml;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/R;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/tinker/TinkerApplicationLike;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/tinker/TinkerLoadReporter$1;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/tinker/TinkerLoadReporter;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/tinker/TinkerLogger;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/tinker/TinkerManager$1;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/tinker/TinkerManager$2;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/tinker/TinkerManager$TinkerListener;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/tinker/TinkerManager$TinkerPatchResultListener;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/tinker/TinkerManager;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/tinker/TinkerPatchListener;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/tinker/TinkerPatchReflectApplication;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/tinker/TinkerPatchReporter;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/tinker/TinkerReport$Reporter;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/tinker/TinkerReport;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/tinker/TinkerResultService$1;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/tinker/TinkerResultService$2;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/tinker/TinkerResultService;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/tinker/TinkerUncaughtExceptionHandler;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/tinker/TinkerUtils$ScreenState$1;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/tinker/TinkerUtils$ScreenState$a;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/tinker/TinkerUtils$ScreenState;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/tinker/TinkerUtils;'
  Class descriptor  : 'Lcom/tencent/bugly/beta/ui/a$1;'
...
  Class descriptor  : 'Lcom/tencent/bugly/proguard/z;'


https://github.com/open-keychain/open-keychain

OpenKeychain
2018-07-28========>org.sufficientlysecure.keychain_52009.apk##
  Class descriptor  : 'Lorg/piwik/sdk/dispatcher/DefaultDispatcher$1;'
...
  Class descriptor  : 'Lorg/piwik/sdk/Tracker;'
  Class descriptor  : 'Lorg/piwik/sdk/TrackerConfig;'
  Class descriptor  : 'Lorg/piwik/sdk/TrackMe;'


https://github.com/Papuh/PapuhWalls

Papuh
2016-02-12========>com.alexcruz.papuhwalls_10.apk##
  Class descriptor  : 'Lcat/ereza/customactivityoncrash/activity/DefaultErrorActivity$1;'
...
  Class descriptor  : 'Lcat/ereza/customactivityoncrash/R;'


https://github.com/playmusicexporter/playmusicexporter

Play_Music_Exporter
2017-04-17========>re.jcg.playmusicexporter_110.apk##NonFreeDep_Tracking
  Class descriptor  : 'Lly/count/android/sdk/AdvertisingIdAdapter$1;'
...
  Class descriptor  : 'Lly/count/android/sdk/DeviceInfo;'
...
  Class descriptor  : 'Lly/count/android/sdk/UserData;'


https://gitlab.com/antoniotari/reactive-ampache/

Power_Ampache
2018-12-23========>com.antoniotari.reactiveampacheapp_58.apk##
  Class descriptor  : 'Lcom/crashlytics/android/Crashlytics;'
  Class descriptor  : 'Lio/fabric/sdk/android/Fabric;'


https://github.com/metinkale38/prayer-times-android

Prayer_Times_(Islamic_Tools)
2018-01-29========>com.metinkale.prayer_193.apk##
  Class descriptor  : 'Lcom/crashlytics/android/answers/Answers;'
  Class descriptor  : 'Lcom/crashlytics/android/answers/ContentViewEvent;'
  Class descriptor  : 'Lcom/crashlytics/android/answers/CustomEvent;'
  Class descriptor  : 'Lcom/crashlytics/android/Crashlytics;'
  Class descriptor  : 'Lcom/mapbox/mapboxsdk/telemetry/MapboxEvent;'
  Class descriptor  : 'Lcom/mapbox/mapboxsdk/telemetry/MapboxEventManager$1;'
  Class descriptor  : 'Lcom/mapbox/mapboxsdk/telemetry/MapboxEventManager$FlushEventsTimerTask;'
  Class descriptor  : 'Lcom/mapbox/mapboxsdk/telemetry/MapboxEventManager$FlushTheEventsTask;'
  Class descriptor  : 'Lcom/mapbox/mapboxsdk/telemetry/MapboxEventManager;'
  Class descriptor  : 'Lcom/mapbox/mapboxsdk/telemetry/TelemetryLocationReceiver;'
  Class descriptor  : 'Lcom/mapbox/mapboxsdk/telemetry/TelemetryService;'


https://github.com/moezbhatti/qksms

QKSMS
2019-03-07========>com.moez.QKSMS_193.apk##
  Class descriptor  : 'Lcom/bugsnag/android/AppData;'
...
  Class descriptor  : 'Lcom/bugsnag/android/User;'


https://github.com/vector-im/riot-android

Riot.im
2019-03-15========>im.vector.alpha_82500.apk##NonFreeNet
  Class descriptor  : 'Lorg/piwik/sdk/extra/PiwikApplication;'
  Class descriptor  : 'Lorg/piwik/sdk/Piwik;'
  Class descriptor  : 'Lorg/piwik/sdk/Tracker;'
  Class descriptor  : 'Lorg/piwik/sdk/TrackerConfig;'


https://gitlab.com/vijai/screenrecorder

ScreenCam
2019-03-10========>com.orpheusdroid.screenrecorder_32.apk##
  Class descriptor  : 'Lly/count/android/sdk/AdvertisingIdAdapter$1;'
...
  Class descriptor  : 'Lly/count/android/sdk/DeviceInfo;'
  Class descriptor  : 'Lly/count/android/sdk/Event;'
...
  Class descriptor  : 'Lly/count/android/sdk/ReferrerReceiver;'
  Class descriptor  : 'Lly/count/android/sdk/UserData;'


https://gitlab.com/vijai/SqliteDBViewer

SQLiteViewer
2019-02-16========>com.orpheusdroid.sqliteviewer_1.apk##
  Class descriptor  : 'Lly/count/android/sdk/AdvertisingIdAdapter$1;'
...
  Class descriptor  : 'Lly/count/android/sdk/DeviceId;'
  Class descriptor  : 'Lly/count/android/sdk/DeviceInfo;'
...
  Class descriptor  : 'Lly/count/android/sdk/UserData;'


https://projects.tigase.org/projects/tigase-mobilemessenger/repository

Tigase_Messenger
2016-03-31========>org.tigase.messenger.phone.pro_15.apk##
  Class descriptor  : 'Lcom/google/android/apps/analytics/AdHitIdGenerator;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/AdMobInfo;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/AnalyticsParameterEncoder;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/AnalyticsReceiver;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/CustomVariable;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/CustomVariableBuffer;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/Dispatcher$Callbacks;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/Dispatcher;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/Event;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/GoogleAnalyticsTracker$1;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/GoogleAnalyticsTracker$DispatcherCallbacks$1;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/GoogleAnalyticsTracker$DispatcherCallbacks;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/GoogleAnalyticsTracker;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/Hit;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/HitBuilder;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/HitStore;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/Item$1;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/Item$Builder;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/Item;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/NetworkDispatcher$1;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/NetworkDispatcher$DispatcherThread$AsyncDispatchTask;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/NetworkDispatcher$DispatcherThread$RequesterCallbacks;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/NetworkDispatcher$DispatcherThread;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/NetworkDispatcher;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/PersistentHitStore$DataBaseHelper;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/PersistentHitStore;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/PipelinedRequester$Callbacks;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/PipelinedRequester;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/Referrer;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/Transaction$1;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/Transaction$Builder;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/Transaction;'
  Class descriptor  : 'Lcom/google/android/apps/analytics/Utils;'


https://github.com/wikimedia/apps-android-wikipedia

Wikipedia
2019-02-27========>org.wikipedia_270.apk##Tracking
  Class descriptor  : 'Lnet/hockeyapp/android/adapters/MessagesAdapter;'
  Class descriptor  : 'Lnet/hockeyapp/android/Constants$1;'
...
  Class descriptor  : 'Lnet/hockeyapp/android/views/PaintView;'


https://github.com/nus-mtp/worldscope

WorldScope
2016-04-29========>com.litmus.worldscope_1.apk##NonFreeNet
  Class descriptor  : 'Lcom/facebook/appevents/AppEventsConstants;'
  Class descriptor  : 'Lcom/facebook/appevents/AppEventsLogger$1;'
...
  Class descriptor  : 'Lcom/facebook/login/DeviceAuthMethodHandler;'
  Class descriptor  : 'Lcom/facebook/login/GetTokenClient;'
  Class descriptor  : 'Lcom/facebook/login/GetTokenLoginMethodHandler$1;'
...
  Class descriptor  : 'Lcom/facebook/login/LoginBehavior;'
...
  Class descriptor  : 'Lcom/facebook/share/widget/ShareDialog;'


https://github.com/otakuhqz/ZimLX

ZimLX
2019-02-06========>org.zimmob.zimlx_2707.apk##
  Class descriptor  : 'Lcat/ereza/customactivityoncrash/activity/DefaultErrorActivity$1;'
...
  Class descriptor  : 'Lcat/ereza/customactivityoncrash/R;'


https://github.com/bronydell/Android-MGKEapp

Расписание_МГКЭ
2016-11-30========>ru.equestriadev.mgke_27.apk##
  Class descriptor  : 'Lcom/yandex/metrica/a;'
...
  Class descriptor  : 'Lcom/yandex/metrica/CounterConfiguration$1;'
...
  Class descriptor  : 'Lcom/yandex/metrica/impl/GoogleAdvertisingIdGetter$1;'
  Class descriptor  : 'Lcom/yandex/metrica/impl/GoogleAdvertisingIdGetter$2;'
  Class descriptor  : 'Lcom/yandex/metrica/impl/GoogleAdvertisingIdGetter$a;'
  Class descriptor  : 'Lcom/yandex/metrica/impl/GoogleAdvertisingIdGetter$b;'
  Class descriptor  : 'Lcom/yandex/metrica/impl/GoogleAdvertisingIdGetter$c;'
  Class descriptor  : 'Lcom/yandex/metrica/impl/GoogleAdvertisingIdGetter$GoogleAdvertisingInfo$GoogleAdvertisingInfoBinder$GoogleAdvertisingInfoImplementation;'
  Class descriptor  : 'Lcom/yandex/metrica/impl/GoogleAdvertisingIdGetter$GoogleAdvertisingInfo$GoogleAdvertisingInfoBinder;'
  Class descriptor  : 'Lcom/yandex/metrica/impl/GoogleAdvertisingIdGetter$GoogleAdvertisingInfo;'
  Class descriptor  : 'Lcom/yandex/metrica/impl/GoogleAdvertisingIdGetter;'
...
  Class descriptor  : 'Lcom/yandex/metrica/impl/i;'
  Class descriptor  : 'Lcom/yandex/metrica/impl/interact/CellularNetworkInfo$1;'
  Class descriptor  : 'Lcom/yandex/metrica/impl/interact/CellularNetworkInfo;'
  Class descriptor  : 'Lcom/yandex/metrica/impl/interact/DeviceInfo$1;'
  Class descriptor  : 'Lcom/yandex/metrica/impl/interact/DeviceInfo;'
  Class descriptor  : 'Lcom/yandex/metrica/impl/j$a;'
...
  Class descriptor  : 'Lcom/yandex/metrica/impl/z;'
  Class descriptor  : 'Lcom/yandex/metrica/IReporter;'
  Class descriptor  : 'Lcom/yandex/metrica/MetricaEventHandler;'
  Class descriptor  : 'Lcom/yandex/metrica/MetricaService$1;'
  Class descriptor  : 'Lcom/yandex/metrica/MetricaService$a;'
  Class descriptor  : 'Lcom/yandex/metrica/MetricaService;'
  Class descriptor  : 'Lcom/yandex/metrica/p;'
  Class descriptor  : 'Lcom/yandex/metrica/PreloadInfo$Builder;'
  Class descriptor  : 'Lcom/yandex/metrica/PreloadInfo;'
  Class descriptor  : 'Lcom/yandex/metrica/YandexMetrica;'
  Class descriptor  : 'Lcom/yandex/metrica/YandexMetricaConfig$Builder;'
  Class descriptor  : 'Lcom/yandex/metrica/YandexMetricaConfig;'
  Class descriptor  : 'Lcom/yandex/metrica/YandexMetricaDefaultValues;'

Izzy · March 21, 2019, 6:56am

Ouch. Such results should at least trigger a warning. And we might need to “disable” some of those, or at least mark with AntiFeatures. But several of them are proprietary.

Though the GA parts could also be “dummies” (the real thing replaced with a stub).

oF2pks · March 21, 2019, 3:18pm

For Расписание_МГКЭ ru.equestriadev.mgke_27.apk, didn’t know yandex metrica was open source (?); and for OpenHub, it seems a tencent aar inclusion : https://github.com/ThirtyDegreesRay/OpenHub/blob/f5db8c0544c02ba04eef3c9a92aadfe4f5687185/app/build.gradle#L166

@Rudloff , @Bubu what bothers me is obfuscation , especially when a tracking third party is active (with or without opt-in/out…). Is it possible to motivate or even impose devs to use -dontobfuscate in proguard-rules.pro (and to avoid -dontoptimize also). Maybe some devs don’t even know their apk is obfuscated (obfuscation has no intersect with optimization ?) ?

Here are somes that use track & obfuscation :

https://github.com/ThirtyDegreesRay/OpenHub
OpenHub
2019-02-06========>com.thirtydegreesray.openhub_30.apk##

https://github.com/bronydell/Android-MGKEapp
Расписание_МГКЭ
2016-11-30========>ru.equestriadev.mgke_27.apk##



https://github.com/HugoGresse/Anecdote
Anecdote
2017-05-06========>io.gresse.hugo.anecdote_23.apk##Tracking_NonFreeAssets


https://github.com/Floens/Clover
Clover
2019-03-15========>org.floens.chan_30002.apk##


https://github.com/emansih/FireflyMobile
Firefly_III_Mobile
2019-03-17========>xyz.hisname.fireflyiii_30.apk##


https://github.com/AllanWang/Frost-for-Facebook
Frost_for_Facebook
2019-02-13========>com.pitchedapps.frost_2020200.apk##NonFreeNet


https://github.com/R4md4c/GameDealz
GameDealz
2019-03-01========>de.r4md4c.gamedealz_8.apk##NonFreeNet


https://github.com/nikita36078/J2ME-Loader
J2ME_Loader
2019-02-27========>ru.playsoftware.j2meloader_59.apk##


https://github.com/zoenb/log28
log28
2018-08-09========>com.log28_10.apk##


https://github.com/mtotschnig/MyExpenses
My_Expenses
2019-03-15========>org.totschnig.myexpenses_369.apk##Ads


https://github.com/einmalfel/PodListen
PodListen
2016-02-24========>com.einmalfel.podlisten_1030600.apk##


https://github.com/aminecmi/ReaderforSelfoss
Reader_for_Selfoss
2019-02-02========>apps.amine.bou.readerforselfoss_1719010301.apk##


https://github.com/EmmanuelMess/Simple-Accounting
Simple_Accounting
2018-11-28========>com.emmanuelmess.simpleaccounting_20.apk##


https://github.com/zamojski/TowerCollector
Tower_Collector
2019-01-27========>info.zamojski.soft.towercollector_2000235.apk##


https://github.com/MarcusWolschon/osmeditor4android
Vespucci
2019-03-17========>de.blau.android_1006.apk##

z2z · April 10, 2019, 1:39pm

I think tools currently not checking for Google’s Android Billing API. This should be Anti-Feature.

import com.android.billingclient.api.BillingClient
import com.android.billingclient.api.BillingClient.BillingResponse
import com.android.billingclient.api.BillingClient.SkuType
import com.android.billingclient.api.BillingClientStateListener
import com.android.billingclient.api.BillingFlowParams
import com.android.billingclient.api.Purchase
import com.android.billingclient.api.PurchasesUpdatedListener
import com.android.billingclient.api.SkuDetails
import com.android.billingclient.api.SkuDetailsParams

hans · April 10, 2019, 5:50pm

Which Anti-Feature would that be? Is it proprietary? If those are free software, is there another Anti-Feature you have in mind?

Rudloff · April 10, 2019, 6:33pm

I think it is proprietary, so we would not even accept it.

system · June 12, 2019, 12:03pm

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.