Primer paso de la investigacion. Se aportan el .apk, las carpetas con el apk extraido y el apk descompilado. El archivo API_DOCUMENTATION.md es un archivo donde se anotaran los descubrimientos del funcionamiento de la API, y los .py son scripts para probar la funcionalidad de la API con los métodos que vayamos encontrando. Finalmente, los archivos .js son scripts de Frida para extraer informacion de la APP durante la ejecucion.

apk_decompiled/sources/com/google/firebase/remoteconfig/internal/rollouts/RolloutsStateFactory.java

@@ -0,0 +1,47 @@
+package com.google.firebase.remoteconfig.internal.rollouts;
+
+import android.util.Log;
+import com.google.firebase.remoteconfig.FirebaseRemoteConfig;
+import com.google.firebase.remoteconfig.FirebaseRemoteConfigClientException;
+import com.google.firebase.remoteconfig.internal.ConfigContainer;
+import com.google.firebase.remoteconfig.internal.ConfigGetParameterHandler;
+import com.google.firebase.remoteconfig.interop.rollouts.RolloutAssignment;
+import com.google.firebase.remoteconfig.interop.rollouts.RolloutsState;
+import java.util.HashSet;
+import org.json.JSONArray;
+import org.json.JSONException;
+import org.json.JSONObject;
+
+/* loaded from: classes3.dex */
+public class RolloutsStateFactory {
+    ConfigGetParameterHandler getParameterHandler;
+
+    public RolloutsStateFactory(ConfigGetParameterHandler configGetParameterHandler) {
+        this.getParameterHandler = configGetParameterHandler;
+    }
+
+    public static RolloutsStateFactory create(ConfigGetParameterHandler configGetParameterHandler) {
+        return new RolloutsStateFactory(configGetParameterHandler);
+    }
+
+    public RolloutsState getActiveRolloutsState(ConfigContainer configContainer) throws FirebaseRemoteConfigClientException {
+        JSONArray rolloutMetadata = configContainer.getRolloutMetadata();
+        long templateVersionNumber = configContainer.getTemplateVersionNumber();
+        HashSet hashSet = new HashSet();
+        for (int i = 0; i < rolloutMetadata.length(); i++) {
+            try {
+                JSONObject jSONObject = rolloutMetadata.getJSONObject(i);
+                String string = jSONObject.getString(ConfigContainer.ROLLOUT_METADATA_ID);
+                JSONArray jSONArray = jSONObject.getJSONArray(ConfigContainer.ROLLOUT_METADATA_AFFECTED_KEYS);
+                if (jSONArray.length() > 1) {
+                    Log.w(FirebaseRemoteConfig.TAG, String.format("Rollout has multiple affected parameter keys.Only the first key will be included in RolloutsState. rolloutId: %s, affectedParameterKeys: %s", string, jSONArray));
+                }
+                String optString = jSONArray.optString(0, "");
+                hashSet.add(RolloutAssignment.builder().setRolloutId(string).setVariantId(jSONObject.getString("variantId")).setParameterKey(optString).setParameterValue(this.getParameterHandler.getString(optString)).setTemplateVersion(templateVersionNumber).build());
+            } catch (JSONException e4) {
+                throw new FirebaseRemoteConfigClientException("Exception parsing rollouts metadata to create RolloutsState.", e4);
+            }
+        }
+        return RolloutsState.create(hashSet);
+    }
+}

apk_decompiled/sources/com/google/firebase/remoteconfig/internal/rollouts/RolloutsStateSubscriptionsHandler.java

@@ -0,0 +1,64 @@
+package com.google.firebase.remoteconfig.internal.rollouts;
+
+import android.util.Log;
+import com.google.android.gms.tasks.OnSuccessListener;
+import com.google.android.gms.tasks.Task;
+import com.google.firebase.remoteconfig.FirebaseRemoteConfig;
+import com.google.firebase.remoteconfig.FirebaseRemoteConfigException;
+import com.google.firebase.remoteconfig.internal.ConfigCacheClient;
+import com.google.firebase.remoteconfig.internal.ConfigContainer;
+import com.google.firebase.remoteconfig.interop.rollouts.RolloutsState;
+import com.google.firebase.remoteconfig.interop.rollouts.RolloutsStateSubscriber;
+import java.util.Collections;
+import java.util.Iterator;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.Executor;
+
+/* loaded from: classes3.dex */
+public class RolloutsStateSubscriptionsHandler {
+    private ConfigCacheClient activatedConfigsCache;
+    private Executor executor;
+    private RolloutsStateFactory rolloutsStateFactory;
+    private Set<RolloutsStateSubscriber> subscribers = Collections.newSetFromMap(new ConcurrentHashMap());
+
+    public RolloutsStateSubscriptionsHandler(ConfigCacheClient configCacheClient, RolloutsStateFactory rolloutsStateFactory, Executor executor) {
+        this.activatedConfigsCache = configCacheClient;
+        this.rolloutsStateFactory = rolloutsStateFactory;
+        this.executor = executor;
+    }
+
+    public /* synthetic */ void lambda$registerRolloutsStateSubscriber$1(Task task, RolloutsStateSubscriber rolloutsStateSubscriber, ConfigContainer configContainer) {
+        try {
+            ConfigContainer configContainer2 = (ConfigContainer) task.getResult();
+            if (configContainer2 != null) {
+                this.executor.execute(new b(rolloutsStateSubscriber, this.rolloutsStateFactory.getActiveRolloutsState(configContainer2), 0));
+            }
+        } catch (FirebaseRemoteConfigException e4) {
+            Log.w(FirebaseRemoteConfig.TAG, "Exception publishing RolloutsState to subscriber. Continuing to listen for changes.", e4);
+        }
+    }
+
+    public void publishActiveRolloutsState(ConfigContainer configContainer) {
+        try {
+            RolloutsState activeRolloutsState = this.rolloutsStateFactory.getActiveRolloutsState(configContainer);
+            Iterator<RolloutsStateSubscriber> it = this.subscribers.iterator();
+            while (it.hasNext()) {
+                this.executor.execute(new b(it.next(), activeRolloutsState, 1));
+            }
+        } catch (FirebaseRemoteConfigException e4) {
+            Log.w(FirebaseRemoteConfig.TAG, "Exception publishing RolloutsState to subscribers. Continuing to listen for changes.", e4);
+        }
+    }
+
+    public void registerRolloutsStateSubscriber(final RolloutsStateSubscriber rolloutsStateSubscriber) {
+        this.subscribers.add(rolloutsStateSubscriber);
+        final Task<ConfigContainer> task = this.activatedConfigsCache.get();
+        task.addOnSuccessListener(this.executor, new OnSuccessListener() { // from class: com.google.firebase.remoteconfig.internal.rollouts.a
+            @Override // com.google.android.gms.tasks.OnSuccessListener
+            public final void onSuccess(Object obj) {
+                RolloutsStateSubscriptionsHandler.this.lambda$registerRolloutsStateSubscriber$1(task, rolloutsStateSubscriber, (ConfigContainer) obj);
+            }
+        });
+    }
+}

apk_decompiled/sources/com/google/firebase/remoteconfig/internal/rollouts/b.java

@@ -0,0 +1,35 @@
+package com.google.firebase.remoteconfig.internal.rollouts;
+
+import com.google.firebase.remoteconfig.interop.rollouts.RolloutsState;
+import com.google.firebase.remoteconfig.interop.rollouts.RolloutsStateSubscriber;
+
+/* loaded from: classes3.dex */
+public final /* synthetic */ class b implements Runnable {
+
+    /* renamed from: a, reason: collision with root package name */
+    public final /* synthetic */ int f6055a;
+
+    /* renamed from: b, reason: collision with root package name */
+    public final /* synthetic */ RolloutsStateSubscriber f6056b;
+
+    /* renamed from: c, reason: collision with root package name */
+    public final /* synthetic */ RolloutsState f6057c;
+
+    public /* synthetic */ b(RolloutsStateSubscriber rolloutsStateSubscriber, RolloutsState rolloutsState, int i) {
+        this.f6055a = i;
+        this.f6056b = rolloutsStateSubscriber;
+        this.f6057c = rolloutsState;
+    }
+
+    @Override // java.lang.Runnable
+    public final void run() {
+        switch (this.f6055a) {
+            case 0:
+                RolloutsStateSubscriptionsHandler.b(this.f6056b, this.f6057c);
+                return;
+            default:
+                RolloutsStateSubscriptionsHandler.c(this.f6056b, this.f6057c);
+                return;
+        }
+    }
+}