# DeDuplicate

状态：active
Platform：android
Package：dev.campione.DeDuplicate
Version：2.7.0
Opportunity：2026-06-10-deduplicate-cloud-cleaner

## 摘要

- 包类型：xapk，inner APK 数：5
- 引擎 / 框架：native
- SDK 线索：appsflyer, firebase, mixpanel, onesignal, revenuecat
- Endpoint candidates：23
- 结论口径：本报告只基于静态 ZIP / Manifest / 字符串证据；不代表真实运行路径已验证。

## 直接证据

- [high] Manifest package id is dev.campione.DeDuplicate（source: `AndroidManifest.xml`，status: `verified`）
- [high] Manifest declares 12 permissions（source: `AndroidManifest.xml`，status: `verified`）
- [high] Engine/framework markers: native（source: `APK file inventory`，status: `verified`）
- [high] Static strings include 23 endpoint candidates（source: `Text/string scan`，status: `verified`）
- [high] Package contains 4 native libraries（source: `APK file inventory`，status: `verified`）

## 推断

- [medium] SDK markers suggest: appsflyer, firebase, mixpanel, onesignal, revenuecat（source: `Manifest, filenames, and text strings`，status: `inferred`）

## 权限和组件

### 权限

- `android.permission.ACCESS_ADSERVICES_AD_ID`
- `android.permission.ACCESS_ADSERVICES_ATTRIBUTION`
- `android.permission.ACCESS_NETWORK_STATE`
- `android.permission.INTERNET`
- `android.permission.READ_EXTERNAL_STORAGE`
- `android.permission.WAKE_LOCK`
- `android.permission.WRITE_EXTERNAL_STORAGE`
- `com.android.vending.BILLING`
- `com.android.vending.CHECK_LICENSE`
- `com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE`
- `com.google.android.gms.permission.AD_ID`
- `dev.campione.DeDuplicate.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION`

### 组件

- Activities：com.android.billingclient.api.ProxyBillingActivity, com.android.billingclient.api.ProxyBillingActivityV2, com.capacitorjs.plugins.browser.BrowserControllerActivity, com.google.android.gms.common.api.GoogleApiActivity, com.google.android.play.core.common.PlayCoreDialogWrapperActivity, com.pairip.licensecheck.LicenseActivity, com.revenuecat.purchases.SimulatedStoreErrorDialogActivity, com.revenuecat.purchases.amazon.purchasing.ProxyAmazonBillingActivity, dev.campione.DeDuplicate.MainActivity
- Services：com.google.android.datatransport.runtime.backends.TransportBackendDiscovery, com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService, com.google.android.gms.measurement.AppMeasurementJobService, com.google.android.gms.measurement.AppMeasurementService, com.google.firebase.components.ComponentDiscoveryService
- Receivers：androidx.profileinstaller.ProfileInstallReceiver, com.amazon.device.iap.ResponseReceiver, com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver, com.google.android.gms.measurement.AppMeasurementReceiver
- Providers：androidx.core.content.FileProvider, androidx.startup.InitializationProvider, com.google.firebase.provider.FirebaseInitProvider, com.pairip.licensecheck.LicenseContentProvider, io.sentry.android.core.SentryInitProvider, io.sentry.android.core.SentryPerformanceProvider

## SDK / Endpoint

### SDK

- `appsflyer`
- `firebase`
- `mixpanel`
- `onesignal`
- `revenuecat`

### Endpoint candidates

- https://deduplicate.app/api/updates/ota
- https://capacitorjs.com/
- https://stackoverflow.com/questions/29249132/wkwebview-complex-communication-between-javascript-native-code/49474323#49474323
- https://issues.chromium.org/issues/40450316
- https://stackoverflow.com/a/57382543
- https://support.google.com/googleplay/answer/7018481
- https://support.google.com/googleplay/answer/7018481)ご覧ください。
- https://support.google.com/googleplay/answer/7018481)。
- https://react.dev/errors/
- https://www.i18next.com/translation-function/formatting
- http://localhost
- https://reactrouter.com/en/main/routers/picking-a-router.`}function
- https://github.com/ungap/url-search-params
- https://firebaseinstallations.googleapis.com/v1
- https://firebase.googleapis.com/v1alpha/projects/-/apps/{app-id}/webConfig
- https://www.googletagmanager.com/gtag/js
- http://www.apache.org/licenses/LICENSE-2.0
- http://jsperf.com/b64tests
- https://issues.apache.org/jira/browse/CB-11522
- http://developer.android.com/guide/developing/tools/proguard.html
- https://issues.apache.org/jira/browse/CB-362
- http://www.google.com
- http://cordova.apache.org/ns/1.0 

## Warnings

- apktool manifest decode skipped 4 split APK(s)
- binary AndroidManifest.xml decoded with apktool

## 下一步

- 真机/模拟器验证 onboarding、paywall、首个可感知价值和崩溃路径。
- 把 endpoint candidates 与 HAR / MITM / Frida 动态证据对齐，避免只凭静态字符串下结论。
- 多版本对比权限、SDK、endpoint、native libs 和资源路径变化。
- 订阅/广告 SDK 线索存在，后续需拆 paywall、free trial、退款和广告频率。