# SparkReceipt 状态：active Platform：android Package：com.valorbyte.sparkreceipt Version：2.2.4 Opportunity：2026-06-10-sparkreceipt-receipt-scanner ## 摘要 - 包类型：xapk，inner APK 数：20 - 引擎 / 框架：flutter - SDK 线索：firebase, revenuecat - Endpoint candidates：80 - 结论口径：本报告只基于静态 ZIP / Manifest / 字符串证据；不代表真实运行路径已验证。 ## 直接证据 - [high] Manifest package id is com.valorbyte.sparkreceipt（source: `AndroidManifest.xml`，status: `verified`） - [high] Manifest declares 18 permissions（source: `AndroidManifest.xml`，status: `verified`） - [high] Engine/framework markers: flutter（source: `APK file inventory`，status: `verified`） - [high] Static strings include 80 endpoint candidates（source: `Text/string scan`，status: `verified`） - [high] Package contains 16 native libraries（source: `APK file inventory`，status: `verified`） ## 推断 - [medium] SDK markers suggest: firebase, revenuecat（source: `Manifest, filenames, and text strings`，status: `inferred`） ## 权限和组件 ### 权限 - `android.permission.ACCESS_ADSERVICES_AD_ID` - `android.permission.ACCESS_ADSERVICES_ATTRIBUTION` - `android.permission.ACCESS_NETWORK_STATE` - `android.permission.CAMERA` - `android.permission.INTERNET` - `android.permission.POST_NOTIFICATIONS` - `android.permission.READ_EXTERNAL_STORAGE` - `android.permission.RECORD_AUDIO` - `android.permission.USE_BIOMETRIC` - `android.permission.USE_FINGERPRINT` - `android.permission.VIBRATE` - `android.permission.WAKE_LOCK` - `android.permission.WRITE_EXTERNAL_STORAGE` - `com.android.vending.BILLING` - `com.google.android.c2dm.permission.RECEIVE` - `com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE` - `com.google.android.gms.permission.AD_ID` - `com.valorbyte.sparkreceipt.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION` ### 组件 - Activities：androidx.credentials.playservices.HiddenActivity, androidx.credentials.playservices.IdentityCredentialApiHiddenActivity, com.android.billingclient.api.ProxyBillingActivity, com.android.billingclient.api.ProxyBillingActivityV2, com.geniusscansdk.readablecodeflow.ReadableCodeScanActivity, com.geniusscansdk.scanflow.ScanActivity, com.google.android.gms.auth.api.signin.internal.SignInHubActivity, com.google.android.gms.common.api.GoogleApiActivity, com.google.android.play.core.common.PlayCoreDialogWrapperActivity, com.valorbyte.sparkreceipt.MainActivity, com.yalantis.ucrop.UCropActivity, io.flutter.plugins.urllauncher.WebViewActivity - Services：androidx.camera.core.impl.MetadataHolderService, androidx.credentials.playservices.CredentialProviderMetadataHolder, com.google.android.datatransport.runtime.backends.TransportBackendDiscovery, com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService, com.google.android.gms.auth.api.signin.RevocationBoundService, com.google.android.gms.measurement.AppMeasurementJobService, com.google.android.gms.measurement.AppMeasurementService, com.google.android.gms.metadata.ModuleDependencies, com.google.firebase.components.ComponentDiscoveryService, com.google.firebase.messaging.FirebaseMessagingService, com.google.mlkit.common.internal.MlKitComponentDiscoveryService, io.flutter.plugins.firebase.messaging.FlutterFirebaseMessagingBackgroundService, io.flutter.plugins.firebase.messaging.FlutterFirebaseMessagingService - Receivers：androidx.profileinstaller.ProfileInstallReceiver, com.dexterous.flutterlocalnotifications.ActionBroadcastReceiver, com.dexterous.flutterlocalnotifications.BackgroundActionBroadcastReceiver, com.dexterous.flutterlocalnotifications.DismissedActionReceiver, com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver, com.google.android.gms.measurement.AppMeasurementReceiver, com.google.firebase.iid.FirebaseInstanceIdReceiver, dev.fluttercommunity.plus.share.SharePlusPendingIntent, io.flutter.plugins.firebase.messaging.FlutterFirebaseMessagingReceiver - Providers：androidx.startup.InitializationProvider, com.google.firebase.provider.FirebaseInitProvider, com.google.mlkit.common.internal.MlKitInitProvider, dev.fluttercommunity.plus.share.ShareFileProvider, io.flutter.plugins.firebase.messaging.FlutterFirebaseMessagingInitProvider, io.flutter.plugins.imagepicker.ImagePickerFileProvider, io.sentry.android.core.SentryPerformanceProvider ## SDK / Endpoint ### SDK - `firebase` - `revenuecat` ### Endpoint candidates - http://www.apache.org/licenses/ - http://www.unicode.org/terms_of_use.html - http://www.unicode.org/reports/tr44/ - http://www.unicode.org/reports/tr24/ - http://www.unicode.org/reports/tr24/#Assignment_Script_Values - http://www.unicode.org/reports/tr24/#Assignment_ScriptX_Values - http://www.apache.org/licenses/LICENSE-2.0 - http://sourceforge.net/adobe/aglfn/ - http://www.unicode.org/unicode/reports/tr9/ - https://tika.apache.org/ - http://www.isotc211.org/2005/gmd - http://purl.org/atom/ns - http://tools.ietf.org/html/rfc7049 - http://docs.oasis-open.org/namespace - https://tech.ebu.ch/docs/tech/tech3264.pdf - http://www.digitalpreservation.gov/formats/fdd/fdd000317.shtml - http://en.wikipedia.org/wiki/Adobe_Illustrator_Artwork - http://justsolve.archiveteam.org/wiki/Adobe_Illustrator_Artwork - http://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx - http://en.wikipedia.org/wiki/.jar - https://www.rfc-editor.org/rfc/rfc9239.html#name-text-javascript - https://www.loc.gov/marc/community/cileader.html - http://www.iana.org/assignments/media-types/application/msword - http://en.wikipedia.org/wiki/.doc - http://en.wikipedia.org/wiki/PDF - http://www.adobe.com/devnet/pdf/pdf_reference_archive.html - http://schemas.microsoft.com/office/word/2003/wordml - http://schemas.microsoft.com/office/2006/xmlPackage - http://purl.org/rss/1.0/ - https://github.com/Sereal/Sereal/blob/master/sereal_spec.pod - http://ns.adobe.com/xdp/ - http://ns.adobe.com/xfdf/ - http://developer.apple.com/namespaces/keynote2 - http://developer.apple.com/namespaces/sl - http://developer.apple.com/namespaces/ls - http://support.digilite.eu/?digilite=library - http://en.wikipedia.org/wiki/Forms_Data_Format - http://www.adobe.com/devnet/acrobat/fdftoolkit.html - http://www.opengis.net/kml/2.2 - http://earth.google.com/kml/2.0 ## Warnings - apktool manifest decode skipped 19 split APK(s) - binary AndroidManifest.xml decoded with apktool ## 下一步 - 真机/模拟器验证 onboarding、paywall、首个可感知价值和崩溃路径。 - 把 endpoint candidates 与 HAR / MITM / Frida 动态证据对齐，避免只凭静态字符串下结论。 - 多版本对比权限、SDK、endpoint、native libs 和资源路径变化。 - 订阅/广告 SDK 线索存在，后续需拆 paywall、free trial、退款和广告频率。