# Habitica

状态：active
Platform：android
Package：com.habitrpg.android.habitica
Version：4.9.7
Opportunity：2026-06-10-habitica-gamify-your-tasks

## 摘要

- 包类型：xapk，inner APK 数：3
- 引擎 / 框架：native
- SDK 线索：facebook, firebase
- Endpoint candidates：2
- 结论口径：本报告只基于静态 ZIP / Manifest / 字符串证据；不代表真实运行路径已验证。

## 直接证据

- [high] Manifest package id is com.habitrpg.android.habitica（source: `AndroidManifest.xml`，status: `verified`）
- [high] Manifest declares 10 permissions（source: `AndroidManifest.xml`，status: `verified`）
- [high] Engine/framework markers: native（source: `APK file inventory`，status: `verified`）
- [high] Static strings include 2 endpoint candidates（source: `Text/string scan`，status: `verified`）
- [high] Package contains 3 native libraries（source: `APK file inventory`，status: `verified`）

## 推断

- [medium] SDK markers suggest: facebook, firebase（source: `Manifest, filenames, and text strings`，status: `inferred`）

## 权限和组件

### 权限

- `android.permission.ACCESS_NETWORK_STATE`
- `android.permission.INTERNET`
- `android.permission.POST_NOTIFICATIONS`
- `android.permission.RECEIVE_BOOT_COMPLETED`
- `android.permission.SCHEDULE_EXACT_ALARM`
- `android.permission.VIBRATE`
- `android.permission.WAKE_LOCK`
- `com.android.vending.BILLING`
- `com.google.android.c2dm.permission.RECEIVE`
- `com.habitrpg.android.habitica.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION`

### 组件

- Activities：androidx.compose.ui.tooling.PreviewActivity, androidx.credentials.playservices.HiddenActivity, androidx.credentials.playservices.IdentityCredentialApiHiddenActivity, com.android.billingclient.api.ProxyBillingActivity, com.android.billingclient.api.ProxyBillingActivityV2, com.google.android.gms.auth.api.signin.internal.SignInHubActivity, com.google.android.gms.common.api.GoogleApiActivity, com.google.android.play.core.common.PlayCoreDialogWrapperActivity, com.habitrpg.android.habitica.ui.activities.AddTaskWidgetActivity, com.habitrpg.android.habitica.ui.activities.AdventureGuideActivity, com.habitrpg.android.habitica.ui.activities.ArmoireActivity, com.habitrpg.android.habitica.ui.activities.BirthdayActivity, com.habitrpg.android.habitica.ui.activities.ChallengeFormActivity, com.habitrpg.android.habitica.ui.activities.ClassSelectionActivity, com.habitrpg.android.habitica.ui.activities.FixCharacterValuesActivity, com.habitrpg.android.habitica.ui.activities.FullProfileActivity, com.habitrpg.android.habitica.ui.activities.GemPurchaseActivity, com.habitrpg.android.habitica.ui.activities.GiftGemsActivity, com.habitrpg.android.habitica.ui.activities.GiftSubscriptionActivity, com.habitrpg.android.habitica.ui.activities.GroupFormActivity, com.habitrpg.android.habitica.ui.activities.GroupInviteActivity, com.habitrpg.android.habitica.ui.activities.GuidelinesActivity, com.habitrpg.android.habitica.ui.activities.HabitButtonWidgetActivity, com.habitrpg.android.habitica.ui.activities.MainActivity, com.habitrpg.android.habitica.ui.activities.MaintenanceActivity, com.habitrpg.android.habitica.ui.activities.NotificationsActivity, com.habitrpg.android.habitica.ui.activities.OnboardingActivity, com.habitrpg.android.habitica.ui.activities.PrefsActivity, com.habitrpg.android.habitica.ui.activities.PrivacyPreferencesActivity, com.habitrpg.android.habitica.ui.activities.ReportMessageActivity, com.habitrpg.android.habitica.ui.activities.SkillMemberActivity, com.habitrpg.android.habitica.ui.activities.SkillTasksActivity, com.habitrpg.android.habitica.ui.activities.TaskFormActivity, com.habitrpg.android.habitica.ui.activities.TaskSummaryActivity
- Services：androidx.credentials.playservices.CredentialProviderMetadataHolder, com.google.android.datatransport.runtime.backends.TransportBackendDiscovery, com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService, com.google.android.gms.auth.api.signin.RevocationBoundService, com.google.firebase.components.ComponentDiscoveryService, com.google.firebase.messaging.FirebaseMessagingService, com.habitrpg.android.habitica.helpers.notifications.HabiticaFirebaseMessagingService, com.habitrpg.android.habitica.receivers.DeviceCommunicationService, com.habitrpg.android.habitica.widget.DailiesWidgetService, com.habitrpg.android.habitica.widget.HabitButtonWidgetService, com.habitrpg.android.habitica.widget.TodosWidgetService
- Receivers：androidx.profileinstaller.ProfileInstallReceiver, com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver, com.google.firebase.iid.FirebaseInstanceIdReceiver, com.habitrpg.android.habitica.receivers.LocalNotificationActionReceiver, com.habitrpg.android.habitica.receivers.NotificationPublisher, com.habitrpg.android.habitica.receivers.TaskAlarmBootReceiver, com.habitrpg.android.habitica.receivers.TaskReceiver, com.habitrpg.android.habitica.widget.AvatarStatsWidgetProvider, com.habitrpg.android.habitica.widget.DailiesWidgetProvider, com.habitrpg.android.habitica.widget.HabitButtonWidgetProvider, com.habitrpg.android.habitica.widget.TodoListWidgetProvider
- Providers：androidx.core.content.FileProvider, androidx.startup.InitializationProvider, com.google.firebase.provider.FirebaseInitProvider

## SDK / Endpoint

### SDK

- `facebook`
- `firebase`

### Endpoint candidates

- http://www.apache.org/licenses/
- http://www.apache.org/licenses/LICENSE-2.0

## Warnings

- apktool manifest decode skipped 2 split APK(s)
- binary AndroidManifest.xml decoded with apktool

## 下一步

- 真机/模拟器验证 onboarding、paywall、首个可感知价值和崩溃路径。
- 把 endpoint candidates 与 HAR / MITM / Frida 动态证据对齐，避免只凭静态字符串下结论。
- 多版本对比权限、SDK、endpoint、native libs 和资源路径变化。