Groups > comp.mobile.android > #156440 > unrolled thread

A quick look at the WhatsApp Meta Services Framework server-side 7 day update

Started by	Maria Sophia <mariasophia@comprehension.com>
First post	2026-10-17 12:43 -0400
Last post	2026-10-26 09:23 -0400
Articles	7 — 2 participants

Back to article view | Back to comp.mobile.android

  A quick look at the WhatsApp Meta Services Framework server-side 7 day update Maria Sophia <mariasophia@comprehension.com> - 2026-10-17 12:43 -0400
    Re: A quick look at the WhatsApp Meta Services Framework server-side 7 day update Maria Sophia <mariasophia@comprehension.com> - 2026-10-21 16:40 -0400
      Re: A quick look at the WhatsApp Meta Services Framework server-side 7 day update Maria Sophia <mariasophia@comprehension.com> - 2026-10-22 16:27 -0400
        Re: A quick look at the WhatsApp Meta Services Framework server-side 7 day update Maria Sophia <mariasophia@comprehension.com> - 2026-10-22 18:21 -0400
          Re: A quick look at the WhatsApp Meta Services Framework server-side 7 day update Maria Sophia <mariasophia@comprehension.com> - 2026-10-24 14:20 -0400
            Re: A quick look at the WhatsApp Meta Services Framework server-side 7 day update Andy Burns <usenet@andyburns.uk> - 2026-10-25 21:13 +0000
              Re: A quick look at the WhatsApp Meta Services Framework server-side 7 day update Maria Sophia <mariasophia@comprehension.com> - 2026-10-26 09:23 -0400

#156440 — A quick look at the WhatsApp Meta Services Framework server-side 7 day update

From	Maria Sophia <mariasophia@comprehension.com>
Date	2026-10-17 12:43 -0400
Subject	A quick look at the WhatsApp Meta Services Framework server-side 7 day update
Message-ID	<11b08kc$20fv$1@nnrp.usenet.blueworldhosting.com>

WhatsApp is firing an Android Intent (android.intent.action.VIEW) 
with a data URI pointing directly to a non-Google APK file.

Two days ago my WhatsApp 2.26.29.70 asked to update & said I had 7 days.
Interestingly, the APK is *directly* from WhatsApp servers. Not Google.
 <https://www.whatsapp.com/android/1/WhatsApp.apk>
 C:\> wget -O WhatsApp.apk 'https://www.whatsapp.com/android/1/WhatsApp.apk'
   ...or... 
 C:\> curl.exe -L "https://www.whatsapp.com/android/1/WhatsApp.apk" -o WhatsApp.apk
 Name: WhatsApp.apk
 Size: 154517872 bytes (147 MiB)
 SHA256: D89C24B2ECE176B060D5868FC8D60F6EE186E05F47083F948B54FFF7FD9DCA63

From Windows, anyone can install that app (w/o losing data) using adb:
 C:\> adb install -r WhatsApp.apk

However, what's interesting is I have all automatic updates turned off in 
the Google Play Store app & in the Aurora & in all my app updater apps. 

Which means WhatsApp is dialing into a server to query the version number.
And then WhatsApp pops up an in-app intent, to obtain the latest version.

Usually I don't debug intents, but two days later I took a quick peek.
I will see if that intent changes over the next 5 days w/o updating it.
 Action: android.intent.action.VIEW
 Data: https://www.whatsapp.com/android/1/WhatsApp.apk
 MIME type:
 Package name:
 Class name:
 User ID: 0
 Identifier: 
 URI: intent://www.whatsapp.com/android/1/WhatsApp.apk#Intent;scheme=https;launchFlags=0x3000000;S.MSF_INTENT_METADATA_ORIGIN_PACKAGE_NAME=com.whatsapp;l.MSF_INTENT_METADATA_LAUNCH_START_TIME=1792253039002;S.MSF_INTENT_METADATA_ID=JB0b67MnnjGpDkR0bqOBGh%3D%3D%0A;end
 Categories: 
 Flags: FLAG_ACTIVITY_PREVIOUS_IS_TOP FLAG_ACTIVITY_FORWARD_RESULT
 Extras: MSF_INTENT_METADATA_ORIGIN_PACKAGE_NAME com.whatsapp
         MSF_INTENT_METADATA_LAUNCH_START_TIME 1792253039002
         MSF_INTENT_METADATA_ID JB0b67MnnjGpDkR0bqOBGh==

The Meta Services Framework (MSF) fields are apparently generated 
by Meta's background services on the device when that intent fires.
-- 
Windows WhatsApp installer:
 <https://www.whatsapp.com/download>
 <https://get.microsoft.com/installer/download/9NKSQGP7F2NH?cid=website_cta_psi>
 Name: WhatsApp Installer.exe
 Size: 813088 bytes (794 KiB)
 SHA256: E537BD26AF9CD54AEB61231FFE22DAD2D54185D5B48DC345B236A7D8002E30C5

[toc] | [next] | [standalone]

#156557

From	Maria Sophia <mariasophia@comprehension.com>
Date	2026-10-21 16:40 -0400
Message-ID	<11bb80i$1fp2$1@nnrp.usenet.blueworldhosting.com>
In reply to	#156440

Maria Sophia wrote:
> WhatsApp is firing an Android Intent (android.intent.action.VIEW) 
> with a data URI pointing directly to a non-Google APK file.
> 
> Two days ago my WhatsApp 2.26.29.70 asked to update & said I had 7 days.
> Interestingly, the APK is *directly* from WhatsApp servers. Not Google.
>  <https://www.whatsapp.com/android/1/WhatsApp.apk>
>  C:\> wget -O WhatsApp.apk 'https://www.whatsapp.com/android/1/WhatsApp.apk'
>    ...or... 
>  C:\> curl.exe -L "https://www.whatsapp.com/android/1/WhatsApp.apk" -o WhatsApp.apk
>  Name: WhatsApp.apk
>  Size: 154517872 bytes (147 MiB)
>  SHA256: D89C24B2ECE176B060D5868FC8D60F6EE186E05F47083F948B54FFF7FD9DCA63
> 
> From Windows, anyone can install that app (w/o losing data) using adb:
>  C:\> adb install -r WhatsApp.apk
> 
> However, what's interesting is I have all automatic updates turned off in 
> the Google Play Store app & in the Aurora & in all my app updater apps. 
> 
> Which means WhatsApp is dialing into a server to query the version number.
> And then WhatsApp pops up an in-app intent, to obtain the latest version.
> 
> Usually I don't debug intents, but two days later I took a quick peek.
> I will see if that intent changes over the next 5 days w/o updating it.
>  Action: android.intent.action.VIEW
>  Data: https://www.whatsapp.com/android/1/WhatsApp.apk
>  MIME type:
>  Package name:
>  Class name:
>  User ID: 0
>  Identifier: 
>  URI: intent://www.whatsapp.com/android/1/WhatsApp.apk#Intent;scheme=https;launchFlags=0x3000000;S.MSF_INTENT_METADATA_ORIGIN_PACKAGE_NAME=com.whatsapp;l.MSF_INTENT_METADATA_LAUNCH_START_TIME=1792253039002;S.MSF_INTENT_METADATA_ID=JB0b67MnnjGpDkR0bqOBGh%3D%3D%0A;end
>  Categories: 
>  Flags: FLAG_ACTIVITY_PREVIOUS_IS_TOP FLAG_ACTIVITY_FORWARD_RESULT
>  Extras: MSF_INTENT_METADATA_ORIGIN_PACKAGE_NAME com.whatsapp
>          MSF_INTENT_METADATA_LAUNCH_START_TIME 1792253039002
>          MSF_INTENT_METADATA_ID JB0b67MnnjGpDkR0bqOBGh==
> 
> The Meta Services Framework (MSF) fields are apparently generated 
> by Meta's background services on the device when that intent fires.
> ------- 
> Windows WhatsApp installer:
>  <https://www.whatsapp.com/download>
>  <https://get.microsoft.com/installer/download/9NKSQGP7F2NH?cid=website_cta_psi>
>  Name: WhatsApp Installer.exe
>  Size: 813088 bytes (794 KiB)
>  SHA256: E537BD26AF9CD54AEB61231FFE22DAD2D54185D5B48DC345B236A7D8002E30C5

What's wonderful is how beautifully the Windows PC interacts with Android!

Today WhatsApp told me I had one more day to go for the forced update.
(All other debug indications were the same as reported in the prior OP).

I've already downloaded the APK onto my desktop.
 C:\> curl.exe -L "https://www.whatsapp.com/android/1/WhatsApp.apk" -o WhatsApp.apk
 Name: WhatsApp.apk
 Size: 154517872 bytes (147 MiB)
 SHA256: D89C24B2ECE176B060D5868FC8D60F6EE186E05F47083F948B54FFF7FD9DCA63

So once WhatsApp stops working, presumably tomorrow, I'll slide it over.
 C:\> adb install -r WhatsApp.apk

I don't expect any complications, where the only surprise (for me) here, 
was that the WhatsApp update APK is NOT coming from the Google Play Store.

So how do they compare cryptographic signatures? 
Turns out, you use the Android SDK Build-Tools package apksigner.bat file.

You run apksigner.bat on the existing WhatsApp base.apk.
And you run apksigner.bat on the newly downloaded WhatsApp installation APK.

When you compare the results, you find they're using the same signer, 
even though one came from the Google Play Repo and the other from WhatsApp.
 Signer #1 DN	CN=WhatsApp LLC, O=WhatsApp LLC, L=Menlo Park	
 Signer #1 SHA-256	fb920d381bee...f4a6c2	
 Signer #2 DN	CN=Brian Acton, OU=Engineering, O=WhatsApp Inc.	
 Signer #2 SHA-256	3987d043...ce5d44	

So how do we know if they're not exactly the same APK then?
A hash will tell us that, but this shows WHAT is different.
 C:\> aapt.exe" dump badging base.apk | findstr /C:"package:"
 C:\> aapt.exe" dump badging update.apk | findstr /C:"package:"

  a. The two signatures match (SHA-256 fb920d381bee...f4a6c2)
  b. But the VersionCode bumps from 262907030 to 264107133 
  c. And the VersionName bumps from 2.26.29.70 to 2.26.41.71

We know all this, using only the PC & WITHOUT installing anything!

In summary, we now know the existing whatsapp came from the google play 
repository (via Aurora, but that doesn't matter) and that the update does 
NOT come from the Google Play repository, but the signatures match. 

In addition, we now know that the version is upgraded between the two.
So the seamless replacement (keeping the original data) should work.

We know all this by debugging & WITHOUT actually installing anything!
-- 
When you run adb on Windows, you find out how seamless it is with Android.

[toc] | [prev] | [next] | [standalone]

#156583

From	Maria Sophia <mariasophia@comprehension.com>
Date	2026-10-22 16:27 -0400
Message-ID	<11bdrjl$1367$1@nnrp.usenet.blueworldhosting.com>
In reply to	#156557

Maria Sophia wrote:
> What's wonderful is how beautifully the Windows PC interacts with Android!
> 
> Today WhatsApp told me I had one more day to go for the forced update.

Every bit of this debugging is being done on Windows as I don't even know
where the phone is, as all it has to be is on Wi-Fi and I can operate it.

We've been running this experiment for a week and the expiry happened.
Suddenly, as expected, I can no longer use WhatsApp on my Android phone.
Which means I can complete the test for the team using Windows to fix it.

When I tap on the WhatsApp icon, up comes a full-page activity saying: 
  Update WhatsApp
  This version of WhatsApp became out of date on Oct 21, 2026. 
  Tap "Download" to get the latest version.
  Your device's date is Oct 22, 2026. 
  If this is incorrect, please correct your device's date settings
  then restart WhatsApp.

Pressing on "date settings" brings me to the Android/Samsung GUI for
  "Date and time"
And pressing the "back" button brings me back to the WhatsApp activity.

As before, pressing on "Update" pulls up an Android intent but
interestingly, what changes is the URL and the URI this time.

Up until today:
 Data: https://www.whatsapp.com/android/1/WhatsApp.apk
 URI: intent://www.whatsapp.com/android/1/WhatsApp.apk#Intent;scheme=https;launchFlags=0x3000000;S.MSF_INTENT_METADATA_ORIGIN_PACKAGE_NAME=com.whatsapp;l.MSF_INTENT_METADATA_LAUNCH_START_TIME=1792253039002;S.MSF_INTENT_METADATA_ID=JB0b67MnnjGpDkR0bqOBGh%3D%3D%0A;end

After today:
 Data: https://www.whatsapp.com/android/current/WhatsApp.apk
 URI: intent://www.whatsapp.com/android/current/WhatsApp.apk#Intent;scheme=https;launchFlags=0x3400000;end

Now that's interesting. 

I'm going to guess that WhatsApp has a 1-week folder, cleverly
named as "1", with the next-release "WhatsApp.apk" in it, which 
then moves to the current-version folder, but are they the same?

 C:\> curl.exe -L "https://www.whatsapp.com/android/1/WhatsApp.apk" -o 1.apk
 Name: 1.apk
 Size: 153404958 bytes (146 MiB)
 SHA256: 07837B33C86D40E59A1FED89CF2688459ACE75D36C0D079BC3927F666F760677
 C:\> curl.exe -L "https://www.whatsapp.com/android/current/WhatsApp.apk" -o current.apk
 Name: current.apk
 Size: 153404958 bytes (146 MiB)
 SHA256: 07837B33C86D40E59A1FED89CF2688459ACE75D36C0D079BC3927F666F760677

So, right now, "/1/WhatsApp.apk" and "/current/WhatsApp.apk" are the same.
But let's check with the installed WhatsApp that is the older version
but which was installed from the Google Play Store repository (Aurora).
 C:\> adb shell pm path com.whatsapp
      package:/data/app/~~Q0AH2roDwIp1Sab6n2Zk7w==/com.whatsapp-SuTfaV-YTnPJBe_GGlwL0w==/base.apk
 C:\> adb pull "/data/app/~~Q0AH2roDwIp1Sab6n2Zk7w==/com.whatsapp-SuTfaV-YTnPJBe_GGlwL0w==/base.apk"
      Name: base.apk
      Size: 138691679 bytes (132 MiB)
      SHA256: 0C0AEDB9A99151F1F9569A6FB6F26BA25D3E7571CC61188CE781DF7E3A2057F4

Let's look at the cryptographic signatures because they must match in
order to update/replace an existing installed version with another.
 C:\> apksigner.bat verify --print-certs base.apk
 C:\> apksigner.bat verify --print-certs current.apk

Two distinct signing blocks appear because modern Android apps use 
multiple signing schemes (in this case, v2/v3/v4 & v1/JAR signing).

For Android 13+
 DN: CN=WhatsApp LLC, O=WhatsApp LLC, L=Menlo Park, ST=California, C=US
 SHA-256 Digest: fb920d381bee1b2093f27dc8f13d994da629dc91887d0529b35c9a2dc4f4a6c2
For older Android versions
 DN: CN=Brian Acton, OU=Engineering, O=WhatsApp Inc., L=Santa Clara, ST=California, C=US
 SHA-256 Digest: 3987d043d10aefaf5a8710b3671418fe57e0e19b653c9df82558feb5ffce5d44

Let's check versions between the installed and the update before updating:
C:\> aapt2.exe dump badging base.apk | findstr /C:"package:"
      package: name='com.whatsapp' 
      versionCode='262907030'  <======= important
      versionName='2.26.29.70'  <======= important
      platformBuildVersionName='17' 
      platformBuildVersionCode='37' 
      compileSdkVersion='37' 
      compileSdkVersionCodename='17'
C:\> aapt2.exe dump badging current.apk | findstr /C:"package:"
      package: name='com.whatsapp' 
      versionCode='264207033'  <======= important
      versionName='2.26.42.70' <======= important
      platformBuildVersionName='17' 
      platformBuildVersionCode='37' 
      compileSdkVersion='37' 
      compileSdkVersionCodename='17'
Which tells us the version code & the version name will be incremented.
But apparently there are no more stringent SDK versions required of it.

I want to use "apkanalyzer" but in C:\app\editor\android\sdk\tools\bin
apkanalyzer is a Linux/macOS script, I need to convert it to Windows.
 C:\> gvim C:\app\editor\android\sdk\tools\bin\apkanalyzer.bat
      I'll post the before:after scripts separately as every post from
      me is intended to help thousands of others over a period of time.
 C:\> apkanalyzer.bat manifest application-id base.apk

Drat. My version of apkanalyzer belongs to a legacy 2017 SDK package that 
relies on Java 8's built-in XML libraries (JAXB) but OpenJDK 17 dropped 
JAXB (javax.xml.bind) so first I have to add that which is needed.

 C:\> powershell -Command "Invoke-WebRequest -Uri 'https://repo1.maven.org/maven2/org/glassfish/jaxb/jaxb-runtime/2.3.5/jaxb-runtime-2.3.5.jar' -OutFile 'C:\app\editor\android\sdk\tools\lib\jaxb-runtime.jar'"                                                              

Then I found it's missing the companion API jar (jaxb-api), 
which contains the javax.xml.bind class definitions.

 C:\> powershell -Command "Invoke-WebRequest -Uri 'https://repo1.maven.org/maven2/javax/xml/bind/jaxb-api/2.3.1/jaxb-api-2.3.1.jar' -OutFile 'C:\app\editor\android\sdk\tools\lib\jaxb-api.jar'"

Then I had to add them to the classpath in the apkanalyzer script.
 C:\> gvim C:\app\editor\android\sdk\tools\bin\apkanalyzer.bat
 ...;%APP_HOME%\lib\guava-22.0.jar;%APP_HOME%\lib\jaxb-runtime.jar;%APP_HOME%\lib\jaxb-api.jar"

Drat. More dependencies that JAXB runtime expects
 C:\> powershell -Command "Invoke-WebRequest -Uri 'https://repo1.maven.org/maven2/com/sun/istack/istack-commons-runtime/3.0.12/istack-commons-runtime-3.0.12.jar' -OutFile 'C:\app\editor\android\sdk\tools\lib\istack-commons-runtime.jar'"
 C:\> powershell -Command "Invoke-WebRequest -Uri 'https://repo1.maven.org/maven2/com/sun/istack/istack-commons-runtime/3.0.12/istack-commons-runtime-3.0.12.jar' -OutFile 'C:\app\editor\android\sdk\tools\lib\istack-commons-runtime.jar'"
 C:\> powershell -Command "Invoke-WebRequest -Uri 'https://repo1.maven.org/maven2/jakarta/activation/jakarta.activation-api/1.2.2/jakarta.activation-api-1.2.2.jar' -OutFile 'C:\app\editor\android\sdk\tools\lib\jakarta.activation-api.jar'"
And more classpaths to append to apkanalyzer.bat also.
 C:\> gvim C:\app\editor\android\sdk\tools\bin\apkanalyzer.bat
 ...;%APP_HOME%\lib\jaxb-api.jar;%APP_HOME%\lib\istack-commons-runtime.jar;%APP_HOME%\lib\jakarta.activation-api.jar"

But now I have the macOS/Linux apkanalyzer.bat working on Windows.
 C:\> apkanalyzer.bat manifest application-id base.apk 
       com.whatsapp
 C:\> apkanalyzer.bat manifest application-id current.apk
       com.whatsapp
 C:\> apkanalyzer manifest version-code base.apk
       262907030
 C:\> apkanalyzer manifest version-code current.apk
       264207033
 C:\> apkanalyzer manifest version-name base.apk
       2.26.29.70
 C:\> apkanalyzer manifest version-name current.apk
       2.26.42.70

Finally, it's time to install, but, drat. I don't have the space.
It's because I removed my sd card to give to my wife (long story).

 C:\> adb install -r current.apk
      Performing Streamed Install
      adb: failed to install current.apk:
      Exception occurred while executing 'install':
      android.os.ParcelableException: java.io.IOException: 
      Requested internal only, but not enough space

Looks like 139MB is the minimum I have to delete on the phone.
 C:\> apkanalyzer.bat apk file-size base.apk
       138691679

 C:\> adb shell df -h /data
      Filesystem       Size Used Avail Use% Mounted on
      /dev/block/dm-47  50G  50G  306M 100% /data/user/0

 C:\> adb shell df -h /data/local/tmp
      Filesystem       Size Used Avail Use% Mounted on
      /dev/block/dm-47  50G  50G  306M 100% /data/user/0

Whew. All that and it's still not installed, but not for any 
technical reason related to debugging WhatsApp processes so that
I can learn more about how things work (& so that you can too).

Here's the comment section of the working apkanalyzer.bat
 C:\> gvim C:\app\editor\android\sdk\tools\bin\apkanalyzer.bat
  :: --------------------------------------------------------------------
  :: apkanalyzer.bat
  ::  Conversion of Android sdk Linux/macOS apkanalyzer script to Windows
  :: --------------------------------------------------------------------
  :: Tested on the base apk installed 20261022 using the commands below:
  ::  C:\> curl.exe -L "https://www.whatsapp.com/android/current/WhatsApp.apk" 
  ::  C:\> adb -r WhatsApp.apk
  ::  C:\> adb shell pm path com.whatsapp
  ::  C:\> adb pull "... that path ... app-SuTfaV-YTnPJBe_GGlwL0w==/base.apk"
  :: --------------------------------------------------------------------
  :: To use: 
  ::  C:\> apkanalyzer.bat manifest application-id base.apk
  ::  C:\> apkanalyzer.bat manifest version-code base.apk
  ::  C:\> apkanalyzer.bat manifest version-name base.apk
  ::  C:\> apkanalyzer.bat manifest min-sdk base.apk
  ::  C:\> apkanalyzer.bat manifest target-sdk base.apk
  ::  C:\> apkanalyzer.bat manifest permissions base.apk
  ::  C:\> apkanalyzer.bat manifest debuggable base.apk
  ::  C:\> apkanalyzer.bat apk summary base.apk
  ::  C:\> apkanalyzer.bat apk file-size base.apk
  ::  C:\> apkanalyzer.bat apk download-size base.apk
  ::  C:\> apkanalyzer.bat files list base.apk
  ::  C:\> apkanalyzer.bat manifest print base.apk
  ::  C:\> apkanalyzer.bat dex list base.apk
  ::  C:\> apkanalyzer.bat dex references base.apk
  ::  C:\> apkanalyzer.bat apk features base.apk
  ::  C:\> apkanalyzer.bat files cat --file "AndroidManifest.xml" base.apk
  ::  C:\> apkanalyzer.bat dex packages base.apk
  ::  C:\> apkanalyzer.bat resources packages base.apk
  ::  C:\> apkanalyzer.bat resources names --config default --type string base.apk
  ::  C:\> apkanalyzer.bat files list base.apk | findstr /i "\.xml"
  ::  C:\> apkanalyzer.bat resources xml --file "res/xml/splits0.xml" base.apk
  ::  C:\> apkanalyzer.bat --help 
  ::  C:\> apkanalyzer.bat apk --help 
  ::  C:\> apkanalyzer.bat dex --help 
  ::  C:\> apkanalyzer.bat resources --help
  :: --------------------------------------------------------------------
  :: v1p7 20261022 Added and tested example help command syntax above
  :: v1p6 20261022 Added and tested example command syntax above
  :: v1p5 20261022 Added jakarta.activation-api.jar to Windows and classpath
  :: v1p4 20261022 Added istack-commons-runtime.jar to Windows and classpath
  :: v1p3 20261022 Added jaxb-api-2.3.1.jar to Windows and classpath
  :: v1p2 20261022 Added jaxb-runtime-2.3.5.jar to Windows and classpath
  :: v1p1 20261022 Added variables to set custom paths to dependencies
  :: v1p0 20261022 Convert C:\app\editor\android\sdk\tools\bin\apkanalyzer 
  :: -------------------------------------------------------------------

RELATED WINDOWS SOFTWARE REFERENCES: (needed for the software run above)
 <https://developer.android.com/tools/aapt2>
 <https://zxtech.wordpress.com/2021/12/11/install-android-sdk-tools-without-android-studio-via-command-line-tools/>
 <https://helpcenter.appviewx.com/frontend/web/Published%20Guides/2025.0.0.0/SIGN/SIGN%20Guides/webhelp-responsive/installation_of_apksigner.html>
-- 
Sometimes, you just don't know how hard something so simple can end up.

[toc] | [prev] | [next] | [standalone]

#156584

From	Maria Sophia <mariasophia@comprehension.com>
Date	2026-10-22 18:21 -0400
Message-ID	<11be29d$2l98$1@nnrp.usenet.blueworldhosting.com>
In reply to	#156583

Maria Sophia wrote:
> RELATED WINDOWS SOFTWARE REFERENCES: (needed for the software run above)
>  <https://developer.android.com/tools/aapt2>
>  <https://zxtech.wordpress.com/2021/12/11/install-android-sdk-tools-without-android-studio-via-command-line-tools/>
>  <https://helpcenter.appviewx.com/frontend/web/Published%20Guides/2025.0.0.0/SIGN/SIGN%20Guides/webhelp-responsive/installation_of_apksigner.html>

Below is the latest version of apkanalyzer.bat as a result of this effort.

I posted the before:after scripts to the Windows 11, Linux and macOS 
newsgroups in a separate set of posts, but for this thread, all we need is 
the final version, provided below, of the working apkanalyzer.bat script.

Had I known how much work it turned out to be to port the Linux/macOS 
script to Windows, I likely wouldn't even have tried, since apksigner.bat 
tells us the cryptography when comparing APKs, and aapt/aapt2 tells us 
about the version differences, although certainly apkanalyzer does more.

These are the fundamental APK debugging commands used in this process:
 C:\> apksigner.bat verify --print-certs base.apk
 C:\> aapt2.exe dump badging base.apk | findstr /C:"package:"
 C:\> apkanalyzer.bat manifest application-id base.apk
 C:\> apkanalyzer.bat manifest version-code base.apk

  :: --------------------------------------------------------------------
  :: apkanalyzer.bat
  ::  Conversion of Android sdk Linux/macOS apkanalyzer script to Windows
  :: --------------------------------------------------------------------
  :: v2p1 20261022 Added aapt/aapt2 and apksigner.bat debugging examples
  :: v2p0 20261022 Made APP_HOME portable using dynamic-script-path resolution
  :: v1p9 20261022 Shortened CLASSPATH using wildcard and multiline execution
  :: v1p8 20261022 Split CLASSPATH to overcome 1K-characters-per-line limits
  :: v1p7 20261022 Added and tested example help command syntax above
  :: v1p6 20261022 Added and tested example command syntax above
  :: v1p5 20261022 Added jakarta.activation-api.jar to Windows and classpath
  :: v1p4 20261022 Added istack-commons-runtime.jar to Windows and classpath
  :: v1p3 20261022 Added jaxb-api-2.3.1.jar to Windows and classpath
  :: v1p2 20261022 Added jaxb-runtime-2.3.5.jar to Windows and classpath
  :: v1p1 20261022 Added variables to set custom paths to dependencies
  :: v1p0 20261022 Convert C:\app\editor\android\sdk\tools\bin\apkanalyzer 
  :: --------------------------------------------------------------------
  :: Tested on the base apk installed 20261022 using the commands below:
  ::  C:\> curl.exe -L "https://www.whatsapp.com/android/current/WhatsApp.apk" 
  ::  C:\> adb -r WhatsApp.apk
  ::  C:\> adb shell pm path com.whatsapp
  ::  C:\> adb pull "... that path ... app-SuTfaV-YTnPJBe_GGlwL0w==/base.apk"
  :: --------------------------------------------------------------------
  :: To use: 
  ::  C:\> apkanalyzer.bat manifest application-id base.apk
  ::  C:\> apkanalyzer.bat manifest version-code base.apk
  ::  C:\> apkanalyzer.bat manifest version-name base.apk
  ::  C:\> apkanalyzer.bat manifest min-sdk base.apk
  ::  C:\> apkanalyzer.bat manifest target-sdk base.apk
  ::  C:\> apkanalyzer.bat manifest permissions base.apk
  ::  C:\> apkanalyzer.bat manifest debuggable base.apk
  ::  C:\> apkanalyzer.bat apk summary base.apk
  ::  C:\> apkanalyzer.bat apk file-size base.apk
  ::  C:\> apkanalyzer.bat apk download-size base.apk
  ::  C:\> apkanalyzer.bat files list base.apk
  ::  C:\> apkanalyzer.bat manifest print base.apk
  ::  C:\> apkanalyzer.bat dex list base.apk
  ::  C:\> apkanalyzer.bat dex references base.apk
  ::  C:\> apkanalyzer.bat apk features base.apk
  ::  C:\> apkanalyzer.bat files cat --file "AndroidManifest.xml" base.apk
  ::  C:\> apkanalyzer.bat dex packages base.apk
  ::  C:\> apkanalyzer.bat resources packages base.apk
  ::  C:\> apkanalyzer.bat resources names --config default --type string base.apk
  ::  C:\> apkanalyzer.bat files list base.apk | findstr /i "\.xml"
  ::  C:\> apkanalyzer.bat resources xml --file "res/xml/splits0.xml" base.apk
  ::  C:\> apkanalyzer.bat --help 
  ::  C:\> apkanalyzer.bat apk --help 
  ::  C:\> apkanalyzer.bat dex --help 
  ::  C:\> apkanalyzer.bat resources --help
  :: See also:
  ::  C:\> apkanalyzer.bat files list base.apk
  ::  C:\> apksigner.bat verify --print-certs base.apk
  ::  C:\> apksigner.bat verify --verbose --print-certs base.apk
  ::  C:\> aapt2.exe dump badging base.apk | findstr /C:"package:"
  ::  C:\> aapt2.exe dump permissions base.apk
  ::  C:\> aapt2.exe dump xmltree base.apk --file AndroidManifest.xml
  :: --------------------------------------------------------------------
  @ECHO OFF
  setlocal
  
  REM Dynamically resolve Android SDK Tools Root Path from script location (\tools\bin\ -> \tools\)
  for %%I in ("%~dp0..") do set "APP_HOME=%%~fI"
  
  REM Custom OpenJDK 17 Path (Adjust if your Java path changes)
  set "JAVA_EXE=C:\Program Files\Microsoft\jdk-17.0.18.8-hotspot\bin\java.exe"
  
  REM All JARs in the SDK lib directory via wildcard
  set "CLASSPATH=%APP_HOME%\lib\*"
  
  "%JAVA_EXE%" "-Dcom.android.sdklib.toolsdir=%APP_HOME%" ^
    -classpath "%CLASSPATH%" ^
    com.android.tools.apk.analyzer.ApkAnalyzerCli %*
  
  endlocal
  :: end of apkanalyzer.bat
-- 
We learned a lot about how to debug and compare similar APKs.

[toc] | [prev] | [next] | [standalone]

#156639

From	Maria Sophia <mariasophia@comprehension.com>
Date	2026-10-24 14:20 -0400
Message-ID	<11bisu7$2hnq$1@nnrp.usenet.blueworldhosting.com>
In reply to	#156584

Andy Burns wrote:
> I've had Activity Launcher v2.4.1 installed for some time
> 
> <https://play.google.com/store/apps/details?id=de.szalkowski.activitylauncher>
> 
> Recently, it sees an update available, downloads it and fails to 
> install;  anyone else seeing the same?
> 
> p.s. it seems to have an abundance (81) of trackers according to 
> AppManager, is that something it's got noticeably worse at with recent 
> updates?

Hi Andy, 

I'm glad you finally were able to get Muntashirakon working & you use it.

I don't update 'nuttin, unless I have to, but recently I accidentally got
fooled because Aurora, by default, now auto-updates all apps, and since I
had Shizuku enabled (for spoofing reasons), everything updated seamlessly.

So I got burned and no longer have the older, better, original versions.

Let me check de.szalkowski.activitylauncher in Muntashirakon App Manager.
  Activity Launcher de.szalkowski.activitylauncher Version 2.2.4 (7400)
  4 trackers
   com.google.android.gms.measurementReceiver
   com.google.android.gms.measurementService
   com.google.android.gms.measurementJobService     
   com.google.android.gms.ads.AdActivity

Looking them up, here's an output from the search engine:
 measurementReceiver receives events such as app installs, updates, and
device boot that can help the analytics library schedule or resume work.

measurementService handles analytics tasks, such as recording app events
and preparing measurement data.

measurementJobService lets Android schedule analytics work in the
background.

ads.AdActivity is an activity used to display Google ads; it may also
support ad-related measurement.

I use Activity Launcher only sporadically, but when I just opened it, my
(older-than-yours) version didn't ask to be updated. But if it does ask to
be updated, I'll try to use the same debugging procedure that I used with
WhatsApp here.
 Newsgroups: comp.mobile.android
 Subject: A quick look at the WhatsApp Meta Services Framework server-side
7 day update
 Date: Sat, 17 Oct 2026 12:43:55 -0400
 Message-ID: <11b08kc$20fv$1@nnrp.usenet.blueworldhosting.com>

Since Android won't install an update if its signature doesn't match, 
you might want to check the provenance and/or the signature differences.

You can use the debugging procedure I outlined in that thread to confirm.
 apksigner.bat verify --verbose --print-certs base.ap

You can also check the installer string to see if that also matches:
 adb shell pm list packages -i | grep de.szalkowski.activitylauncher
  package:de.szalkowski.activitylauncher  installer=com.android.vending

If you have your system set up like mine is, you can trap the call to 
the updater, so you can see *exactly* what URL it's asking to retrieve.

You need the error message though, as that will lead the way forward.
The cheapest way to get the error might be to try to manually install.
   adb install -r ActivityLauncher.apk

If you don't have the ActivityLauncher.apk, you can try the base apk:
   adb install -r base.apk
Which I explain in that thread so no need to go over it again here.

Also, there's logcat and logfox, if you need to trap the error message.

Maria Sophia wrote:
>   Activity Launcher de.szalkowski.activitylauncher Version 2.2.4 (7400)
>   4 trackers

Off the cuff, I'd try a few things to get more data about the delta 
between your existing installed base APK and the reputed update APK.

Going from 4 to 81 trackers indicates something changed but I couldn't find 
an ownership change, although who is building and signing it apparently 
changed when the project moved from Adam Szalkowski's personal repo to a 
GitHub organisation, with butzist as the active maintainer.

The latest commits are from butzist, and the repo has been substantially 
reworked (Kotlin migration, CI, plugin architecture, a Discord support 
server). 

F-Droid still lists the source as github.com/butzist/ActivityLauncher and 
the donation link as github.com/sponsors/butzist. So: same project, same 
ISC licence, but maybe different hands on the keyboard? Dunno. 

The signing detail is the more likely culprit

F-Droid builds and signs its own APKs, and says so explicitly for this 
package. Google Play builds are signed with the developer's key. 

If your installed copy came from one source and the "update" from the 
other, the signatures won't match and Android will refuse the install.

Your error should be something like: INSTALL_FAILED_UPDATE_INCOMPATIBLE

When you run install -r, you'll probably get to see the error outright.

You can get the Exodus Privacy report for the package by uploading the APK 
to reports.exodus-privacy.eu.org or you can try the Python tool
 pip install exodus-standalone
 exodus-standalone -j report.json -o out/ base.apk

If you want, you can try my apkanalyzer.bat to see the trackers:
 adb shell pm path de.szalkowski.activitylauncher

package:/data/app/~~uYiMqGD1munmi67mXYap3w==/de.szalkowski.activitylauncher-YYHJspyDlc5Qv9CjFt4Kog==/base.apk

package:/data/app/~~uYiMqGD1munmi67mXYap3w==/de.szalkowski.activitylauncher-YYHJspyDlc5Qv9CjFt4Kog==/split_config.xhdpi.apk

 adb pull
"/data/app/~~uYiMqGD1munmi67mXYap3w==/de.szalkowski.activitylauncher-YYHJspyDlc5Qv9CjFt4Kog==/base.apk"
al-installed-base.apk
 adb pull
"/data/app/~~uYiMqGD1munmi67mXYap3w==/de.szalkowski.activitylauncher-YYHJspyDlc5Qv9CjFt4Kog==/split_config.xhdpi.apk"
al-installed-xhdpi.apk	

 Look at the signature:
 apksigner.bat verify --print-certs al-installed-base.apk

 Look at the trackers:
 apkanalyzer.bat dex packages al-installed-base.apk | more
P d 30691       36661   9436459 <TOTAL>
P d 14376       14406   4432334 com
P d 14376       14406   4432334 com.google
P d 13710       13736   4232408 com.google.android
P d 12760       12786   3995469 com.google.android.gms
P d 12515       12541   3934180 com.google.android.gms.internal
P d 10995       11016   3544259 com.google.android.gms.internal.ads
C d 109 109     24875   com.google.android.gms.internal.ads.Rd
M d 1   1       993     com.google.android.gms.internal.ads.Rd
<init>(com.google.android.gms.internal.ads.Zd,U1.d,java.lang.String,boolean,com.google.android.gms.internal.ads.F3,com.google.android.gms.internal.ads.u6,com.google.android.gms.internal.ads.zc,com.google.android.gms.internal.ads.Li,f.t,com.google.android.gms.internal.ads.e5,com.google.android.gms.internal.ads.Wo,com.google.android.gms.internal.ads.Yo)
M d 1   1       104     com.google.android.gms.internal.ads.Rd void
x(com.google.android.gms.internal.ads.Rd)
M d 1   1       174     com.google.android.gms.internal.ads.Rd void
A(java.lang.String)
M d 1   1       90      com.google.android.gms.internal.ads.Rd void
A0(com.google.android.gms.internal.ads.c7)
M d 1   1       146     com.google.android.gms.internal.ads.Rd void
B(java.lang.Boolean)
M d 1   1       143     com.google.android.gms.internal.ads.Rd void
B0(java.lang.String,com.google.android.gms.internal.ads.a8)
M d 1   1       96      com.google.android.gms.internal.ads.Rd void C()
M d 1   1       375     com.google.android.gms.internal.ads.Rd void
C0(int,boolean,boolean)
M d 1   1       821     com.google.android.gms.internal.ads.Rd boolean D()
M d 1   1       95      com.google.android.gms.internal.ads.Rd boolean D0()
M d 1   1       117     com.google.android.gms.internal.ads.Rd v1.a E()
M d 1   1       198     com.google.android.gms.internal.ads.Rd void
E0(java.lang.String,com.goo-- More  --

aapt2.exe dump permissions al-installed-base.apk
 package: de.szalkowski.activitylauncher
uses-permission: name='com.android.launcher.permission.INSTALL_SHORTCUT'
uses-permission: name='android.permission.QUERY_ALL_PACKAGES'
uses-permission: name='android.permission.INTERNET'
uses-permission: name='android.permission.ACCESS_NETWORK_STATE'
uses-permission: name='com.google.android.gms.permission.AD_ID'
uses-permission: name='android.permission.ACCESS_ADSERVICES_AD_ID'
uses-permission: name='android.permission.ACCESS_ADSERVICES_ATTRIBUTION'
uses-permission: name='android.permission.ACCESS_ADSERVICES_TOPICS'
uses-permission: name='android.permission.WAKE_LOCK'
uses-permission:
name='com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE'
uses-permission: name='android.permission.FOREGROUND_SERVICE'
permission:
de.szalkowski.activitylauncher.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
uses-permission:
name='de.szalkowski.activitylauncher.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION'

aapt2.exe dump badging al-installed-base.apk | findstr /C:"package:"
 package: name='de.szalkowski.activitylauncher' versionCode='7400'
versionName='2.2.4' platformBuildVersionName='16'
platformBuildVersionCode='36' compileSdkVersion='36'
compileSdkVersionCodename='16'

 Look at the splits:
  apkanalyzer.bat apk summary al-installed-base.apk

 Look at the permissions:
  apkanalyzer.bat manifest permissions al-installed-base.apk

Basically, you need the error and the differences between the 
existing base.apk and the apk that the app is trying to install.

Worse case, you can delete and re-install from scratch.
But that loses any data you might have previously saved.

You can also downgrade if you have an older version archvied.
 adb install -d olderarchive.apk
-- 
Usenet is where kind people daily gather to voluntarily help others.

[toc] | [prev] | [next] | [standalone]

#156652

From	Andy Burns <usenet@andyburns.uk>
Date	2026-10-25 21:13 +0000
Message-ID	<nk79naFu3viU1@mid.individual.net>
In reply to	#156639

Maria Sophia wrote:

> Andy Burns wrote:
>> I've had Activity Launcher v2.4.1 installed for some time
>>
>> it seems to have an abundance (81) of trackers according to
>> AppManager
> 
> Let me check de.szalkowski.activitylauncher in Muntashirakon App Manager.
>    Activity Launcher de.szalkowski.activitylauncher Version 2.2.4 (7400)
>    4 trackers
>     com.google.android.gms.measurementReceiver
>     com.google.android.gms.measurementService
>     com.google.android.gms.measurementJobService
>     com.google.android.gms.ads.AdActivity

I downgraded to v2.3.1 from apkmirror and it still had the huge number 
of trackers, so I downgraded further to v2.2.4 an that just had the 4 
you list above.

> I use Activity Launcher only sporadically

Likewise ... my pixel launcher has a shortcut to notification history 
built-in, on my samsung tablet I use ActivityLauncher to manually add a 
shortcut to "NotificationHistory" but it seems oneUI 8.5 includes an 
option within settings ... can't remember if that was there bbefore or not?

[snip]

> Worse case, you can delete and re-install from scratch.
> But that loses any data you might have previously saved.
> 
> You can also downgrade if you have an older version archvied.
>   adb install -d olderarchive.apk

got them from from apkmirror, will stick with old version.

[toc] | [prev] | [next] | [standalone]

#156664

From	Maria Sophia <mariasophia@comprehension.com>
Date	2026-10-26 09:23 -0400
Message-ID	<11bnk90$1l3f$1@nnrp.usenet.blueworldhosting.com>
In reply to	#156652

Andy Burns wrote:
> I downgraded to v2.3.1 from apkmirror and it still had the huge number 
> of trackers, so I downgraded further to v2.2.4 an that just had the 4 
> you list above.
> 
>> I use Activity Launcher only sporadically
> 
> Likewise ... my pixel launcher has a shortcut to notification history 
> built-in, on my samsung tablet I use ActivityLauncher to manually add a 
> shortcut to "NotificationHistory" but it seems oneUI 8.5 includes an 
> option within settings ... can't remember if that was there bbefore or not?
>
>> You can also downgrade if you have an older version archvied.
>>   adb install -d olderarchive.apk
> 
> got them from from apkmirror, will stick with old version.

Hi Andy,

Every post should add value that wasn't there, so thanks for that update.

Glad downgrading to v2.2.4 worked for you. I was surprised at even seeing 4 
trackers, 'cuz I generally deplore apps with trackers, but I do agree, I, 
myself, put notification logs and notification history shortcuts in my 
homescreen shortcuts folder (because things beep and I don't know why).

I looked in my archives and found an older version dated 20220923.
 Name: Activity Launcher-1.10.0_de.szalkowski.activitylauncher-18.apk
 Size: 184246 bytes (179 KiB)
 SHA256: AE8E2B9D935A1FD3EF92D9419ABA77A37DD3702BB0E41FF6A6A0A9645F0537F9

So I used Muntashirakon App Manager to "Save APK" the existing 2.2.4 APK.
 /storage/emulated/0/AppManager/apks/Activity Launcher_2.2.4.apks

Then I used copyapk.bat (previously posted) to copy over Wi-Fi to the PC.
 Name: Activity Launcher_2.2.4.apks
 Size: 3617046 bytes (3532 KiB)
 SHA256: BED56554A2FAC940A8BF53820CA026BB4459A1500DEB95B1DA48C1A669122BC9

Once safely archived, I downgraded my 2.2.4 to 1.10.0 to check trackers:
 adb install -d -r Activity Launcher-1.10.0_de.szalkowski.activitylauncher-18.apk
  Performing Streamed Install
  Success

Then I checked the trackers in Muntashirakon App Manager. Guess what? 
 Activity Launcher de.szalkowski.activitylauncher Version 1.10.0 (18)
 No trackers!

I looked up the functionality delta, which, supposedly, is this:
  v2.2.4 Added Features:
  Favorites and recently used activities - Track frequently accessed activities
  Sharing of shortcuts via URL - Export/create shortcuts through shareable links
  In-app reviews - Ability to review the app directly
  Translation updates - 78 languages supported
  Fixed app crashes when screen rotates
  Improved startup time (skips loading all packages when opening favorites/recents)
  Technical specs:
  Size: ~7.6 MB (vs 180 KB in v1.10.0)
  Android requirement: 6.0+ (vs 4.4+ in v1.10.0)
  Supports Android TV
  12 permissions, 2 features, 3 libraries

  v1.10.0 
  Size: 180 KB (much lighter)
  Android requirement: 4.4+ (works on older devices)

  Summary
  Version 2.2.4 adds organizational features (favorites/recent), sharing 
  and app store integration (reviews). However, it's about 42x larger in
  file size and requires a more recent Android version.

adb shell dumpsys package de.szalkowski.activitylauncher | findstr /i "versionCode installerPackageName firstInstallTime lastUpdateTime"
   versionCode=18 minSdk=19 targetSdk=29
    lastUpdateTime=2026-10-26 05:39:10
      firstInstallTime=2023-04-05 21:28:03
      firstInstallTime=1969-12-31 16:00:00

I decided to pull it and noticed it's not a split APK (like 2.2.4 is).
 adb shell pm path de.szalkowski.activitylauncher
  package:/data/app/~~bb2pgsYFKkX4zWADhQSfTg==/de.szalkowski.activitylauncher-ucrjZQ6ZlnhkDu6pA5AaNQ==/base.apk
 adb pull "/data/app/~~bb2pgsYFKkX4zWADhQSfTg==/de.szalkowski.activitylauncher-ucrjZQ6ZlnhkDu6pA5AaNQ==/base.apk"
 aapt2.exe dump permissions base.apk
  package: de.szalkowski.activitylauncher
  uses-permission: name='com.android.launcher.permission.INSTALL_SHORTCUT'
 apksigner.bat verify --print-certs base.apk
  The signer is the real developer key
  The certificate DN is CN=Adam Szalkowski, L=Z�rich, C=CH
  Adam Szalkowski is the developer of Activity Launcher 
  The fingerprints match published references for this app:
  (CN=Android, OU=Android, O=Google Inc.) is the Android source stamp.
  So an F-Droid APK will not match this certificate.

 apkanalyzer.bat dex packages --defined-only base.apk > p110.txt
 findstr /i "firebase appsflyer adjust onesignal amplitude mixpanel segment sentry bugsnag instabug braze appboy leanplum clevertap moengage countly flurry kochava branch datadog newrelic unity3d.ads applovin ironsource vungle chartboost mopub" p110.txt
  Didn't find any

I'm not sure what else to test.

For others to benefit, Activity Launcher asks Android's PackageManager for 
all the activities on your phone and presents them as a browsable tree.

Tap one and it launches that screen directly. 
It can also pin any of them to your home screen as a shortcut.

Lately I've been using Muntashirakon App Manager to do it, but I used to
use Activity Launcher before I started using Muntashirakon instead.
-- 
On Usenet, we can pool our knowledge and skills so everyone learns more.

[toc] | [prev] | [standalone]

csiph-web

A quick look at the WhatsApp Meta Services Framework server-side 7 day update

Contents

#156440 — A quick look at the WhatsApp Meta Services Framework server-side 7 day update

#156557

#156583

#156584

#156639

#156652

#156664