Primer paso de la investigacion. Se aportan el .apk, las carpetas con el apk extraido y el apk descompilado. El archivo API_DOCUMENTATION.md es un archivo donde se anotaran los descubrimientos del funcionamiento de la API, y los .py son scripts para probar la funcionalidad de la API con los métodos que vayamos encontrando. Finalmente, los archivos .js son scripts de Frida para extraer informacion de la APP durante la ejecucion.

apk_decompiled/sources/com/google/firebase/messaging/FcmBroadcastProcessor.java

@@ -0,0 +1,128 @@
+package com.google.firebase.messaging;
+
+import B0.w;
+import android.annotation.SuppressLint;
+import android.content.Context;
+import android.content.Intent;
+import android.util.Base64;
+import android.util.Log;
+import com.google.android.gms.common.annotation.KeepForSdk;
+import com.google.android.gms.common.util.PlatformVersion;
+import com.google.android.gms.tasks.Continuation;
+import com.google.android.gms.tasks.Task;
+import com.google.android.gms.tasks.Tasks;
+import java.util.concurrent.Callable;
+import java.util.concurrent.Executor;
+import java.util.concurrent.ExecutorService;
+import n.ExecutorC0507a;
+
+@KeepForSdk
+/* loaded from: classes3.dex */
+public class FcmBroadcastProcessor {
+    private static final String EXTRA_BINARY_DATA = "rawData";
+    private static final String EXTRA_BINARY_DATA_BASE_64 = "gcm.rawData64";
+    private static WithinAppServiceConnection fcmServiceConn;
+    private static final Object lock = new Object();
+    private final Context context;
+    private final Executor executor;
+
+    public FcmBroadcastProcessor(Context context) {
+        this.context = context;
+        this.executor = new ExecutorC0507a(1);
+    }
+
+    private static Task<Integer> bindToMessagingService(Context context, Intent intent, boolean z3) {
+        if (Log.isLoggable(Constants.TAG, 3)) {
+            Log.d(Constants.TAG, "Binding to service");
+        }
+        WithinAppServiceConnection serviceConnection = getServiceConnection(context, "com.google.firebase.MESSAGING_EVENT");
+        if (!z3) {
+            return serviceConnection.sendIntent(intent).continueWith(new ExecutorC0507a(1), new w(15));
+        }
+        if (ServiceStarter.getInstance().hasWakeLockPermission(context)) {
+            WakeLockHolder.sendWakefulServiceIntent(context, serviceConnection, intent);
+        } else {
+            serviceConnection.sendIntent(intent);
+        }
+        return Tasks.forResult(-1);
+    }
+
+    private static WithinAppServiceConnection getServiceConnection(Context context, String str) {
+        WithinAppServiceConnection withinAppServiceConnection;
+        synchronized (lock) {
+            try {
+                if (fcmServiceConn == null) {
+                    fcmServiceConn = new WithinAppServiceConnection(context, str);
+                }
+                withinAppServiceConnection = fcmServiceConn;
+            } catch (Throwable th) {
+                throw th;
+            }
+        }
+        return withinAppServiceConnection;
+    }
+
+    public static /* synthetic */ Integer lambda$bindToMessagingService$3(Task task) throws Exception {
+        return -1;
+    }
+
+    public static /* synthetic */ Integer lambda$startMessagingService$0(Context context, Intent intent) throws Exception {
+        return Integer.valueOf(ServiceStarter.getInstance().startMessagingService(context, intent));
+    }
+
+    public static /* synthetic */ Integer lambda$startMessagingService$1(Task task) throws Exception {
+        return 403;
+    }
+
+    public static /* synthetic */ Task lambda$startMessagingService$2(Context context, Intent intent, boolean z3, Task task) throws Exception {
+        return (PlatformVersion.isAtLeastO() && ((Integer) task.getResult()).intValue() == 402) ? bindToMessagingService(context, intent, z3).continueWith(new ExecutorC0507a(1), new w(14)) : task;
+    }
+
+    public static void reset() {
+        synchronized (lock) {
+            fcmServiceConn = null;
+        }
+    }
+
+    public static void setServiceConnection(WithinAppServiceConnection withinAppServiceConnection) {
+        synchronized (lock) {
+            fcmServiceConn = withinAppServiceConnection;
+        }
+    }
+
+    @KeepForSdk
+    public Task<Integer> process(Intent intent) {
+        String stringExtra = intent.getStringExtra(EXTRA_BINARY_DATA_BASE_64);
+        if (stringExtra != null) {
+            intent.putExtra("rawData", Base64.decode(stringExtra, 0));
+            intent.removeExtra(EXTRA_BINARY_DATA_BASE_64);
+        }
+        return startMessagingService(this.context, intent);
+    }
+
+    @SuppressLint({"InlinedApi"})
+    public Task<Integer> startMessagingService(final Context context, final Intent intent) {
+        boolean z3 = PlatformVersion.isAtLeastO() && context.getApplicationInfo().targetSdkVersion >= 26;
+        final boolean z4 = (intent.getFlags() & 268435456) != 0;
+        return (!z3 || z4) ? Tasks.call(this.executor, new Callable() { // from class: com.google.firebase.messaging.c
+            @Override // java.util.concurrent.Callable
+            public final Object call() {
+                Integer lambda$startMessagingService$0;
+                lambda$startMessagingService$0 = FcmBroadcastProcessor.lambda$startMessagingService$0(context, intent);
+                return lambda$startMessagingService$0;
+            }
+        }).continueWithTask(this.executor, new Continuation() { // from class: com.google.firebase.messaging.d
+            @Override // com.google.android.gms.tasks.Continuation
+            public final Object then(Task task) {
+                Task lambda$startMessagingService$2;
+                lambda$startMessagingService$2 = FcmBroadcastProcessor.lambda$startMessagingService$2(context, intent, z4, task);
+                return lambda$startMessagingService$2;
+            }
+        }) : bindToMessagingService(context, intent, z4);
+    }
+
+    public FcmBroadcastProcessor(Context context, ExecutorService executorService) {
+        this.context = context;
+        this.executor = executorService;
+    }
+}