Claude tool usage for this investigation:
APK Decompilation:
- jadx — Java decompiler, converted DEX to readable Java source. Used--deobffor deobfuscation and--show-bad-codefor methods that failed normal decompilation
- apktool — extracted smali (assembly), resources, and AndroidManifest.xml. Used smali to read methods jadx couldn't fully decompile
Code Search:
- rg(ripgrep) — fast regex search across thousands of decompiled source files. Found affiliate patterns, URL handling, config keys, SDK references
API Probing:
- deno — wrote TypeScript scripts to query the DeviceNative API directly, using the hardcoded API key extracted from the APK
Standard:
- grep, find for targeted lookups
- jq, for JSON inspection
No dynamic analysis or device needed. Entire investigation was static analysis of the APK one live API call to confirm the ad catalog.