Primer paso de la investigacion. Se aportan el .apk, las carpetas con el apk extraido y el apk descompilado. El archivo API_DOCUMENTATION.md es un archivo donde se anotaran los descubrimientos del funcionamiento de la API, y los .py son scripts para probar la funcionalidad de la API con los métodos que vayamos encontrando. Finalmente, los archivos .js son scripts de Frida para extraer informacion de la APP durante la ejecucion.

apk_decompiled/sources/com/google/firebase/messaging/EnhancedIntentService.java

@@ -0,0 +1,140 @@
+package com.google.firebase.messaging;
+
+import android.annotation.SuppressLint;
+import android.app.Service;
+import android.content.Intent;
+import android.os.Binder;
+import android.os.IBinder;
+import android.util.Log;
+import com.google.android.gms.common.annotation.KeepForSdk;
+import com.google.android.gms.tasks.OnCompleteListener;
+import com.google.android.gms.tasks.Task;
+import com.google.android.gms.tasks.TaskCompletionSource;
+import com.google.android.gms.tasks.Tasks;
+import com.google.firebase.messaging.WithinAppServiceBinder;
+import java.util.concurrent.ExecutorService;
+import n.ExecutorC0507a;
+
+@SuppressLint({"UnwrappedWakefulBroadcastReceiver"})
+/* loaded from: classes3.dex */
+public abstract class EnhancedIntentService extends Service {
+    static final long MESSAGE_TIMEOUT_S = 20;
+    private static final String TAG = "EnhancedIntentService";
+    private Binder binder;
+    private int lastStartId;
+    final ExecutorService executor = FcmExecutors.newIntentHandleExecutor();
+    private final Object lock = new Object();
+    private int runningTasks = 0;
+
+    private void finishTask(Intent intent) {
+        if (intent != null) {
+            WakeLockHolder.completeWakefulIntent(intent);
+        }
+        synchronized (this.lock) {
+            try {
+                int i = this.runningTasks - 1;
+                this.runningTasks = i;
+                if (i == 0) {
+                    stopSelfResultHook(this.lastStartId);
+                }
+            } catch (Throwable th) {
+                throw th;
+            }
+        }
+    }
+
+    /* JADX INFO: Access modifiers changed from: private */
+    public /* synthetic */ void lambda$onStartCommand$1(Intent intent, Task task) {
+        finishTask(intent);
+    }
+
+    /* JADX INFO: Access modifiers changed from: private */
+    public /* synthetic */ void lambda$processIntent$0(Intent intent, TaskCompletionSource taskCompletionSource) {
+        try {
+            handleIntent(intent);
+        } finally {
+            taskCompletionSource.setResult(null);
+        }
+    }
+
+    /* JADX INFO: Access modifiers changed from: private */
+    public Task<Void> processIntent(final Intent intent) {
+        if (handleIntentOnMainThread(intent)) {
+            return Tasks.forResult(null);
+        }
+        final TaskCompletionSource taskCompletionSource = new TaskCompletionSource();
+        this.executor.execute(new Runnable() { // from class: com.google.firebase.messaging.b
+            @Override // java.lang.Runnable
+            public final void run() {
+                EnhancedIntentService.this.lambda$processIntent$0(intent, taskCompletionSource);
+            }
+        });
+        return taskCompletionSource.getTask();
+    }
+
+    public Intent getStartCommandIntent(Intent intent) {
+        return intent;
+    }
+
+    public abstract void handleIntent(Intent intent);
+
+    public boolean handleIntentOnMainThread(Intent intent) {
+        return false;
+    }
+
+    @Override // android.app.Service
+    public final synchronized IBinder onBind(Intent intent) {
+        try {
+            if (Log.isLoggable(TAG, 3)) {
+                Log.d(TAG, "Service received bind request");
+            }
+            if (this.binder == null) {
+                this.binder = new WithinAppServiceBinder(new WithinAppServiceBinder.IntentHandler() { // from class: com.google.firebase.messaging.EnhancedIntentService.1
+                    @Override // com.google.firebase.messaging.WithinAppServiceBinder.IntentHandler
+                    @KeepForSdk
+                    public Task<Void> handle(Intent intent2) {
+                        return EnhancedIntentService.this.processIntent(intent2);
+                    }
+                });
+            }
+        } catch (Throwable th) {
+            throw th;
+        }
+        return this.binder;
+    }
+
+    @Override // android.app.Service
+    public void onDestroy() {
+        this.executor.shutdown();
+        super.onDestroy();
+    }
+
+    @Override // android.app.Service
+    public final int onStartCommand(final Intent intent, int i, int i4) {
+        synchronized (this.lock) {
+            this.lastStartId = i4;
+            this.runningTasks++;
+        }
+        Intent startCommandIntent = getStartCommandIntent(intent);
+        if (startCommandIntent == null) {
+            finishTask(intent);
+            return 2;
+        }
+        Task<Void> processIntent = processIntent(startCommandIntent);
+        if (processIntent.isComplete()) {
+            finishTask(intent);
+            return 2;
+        }
+        processIntent.addOnCompleteListener(new ExecutorC0507a(1), new OnCompleteListener() { // from class: com.google.firebase.messaging.a
+            @Override // com.google.android.gms.tasks.OnCompleteListener
+            public final void onComplete(Task task) {
+                EnhancedIntentService.this.lambda$onStartCommand$1(intent, task);
+            }
+        });
+        return 3;
+    }
+
+    public boolean stopSelfResultHook(int i) {
+        return stopSelfResult(i);
+    }
+}