SA-013 Phase 3

SA-013: Upload Dispatcher Decompilation Report

The function at `0x12e5fa4` is a **central Objective-C message dispatch stub** (objc_msgSend trampoline) that serves as the universal message routing mechanism for Facebook's entire upload infrastructure. It has **120,473 cross-references** throughout the binary, making it one of the most frequently called functions in the framework.

Technical Diagrams

Primary Upload Classes (calling 0x12e5fa4) Line 55

| Class | Key Methods | Address |
|-------|-------------|---------|
| `FBMediaUploadFlowCoordinatorWrapper` | Main wrapper coordinating uploads | 0x1be12f8 |
| `FBMediaUploadFlowCoordinator` | Core upload flow management | 0x1c57548 |
| `FBMediaItemUploadFlowSession` | Individual upload session handling | Multiple |
| `FBImageUploadSession` | Photo/image upload specialization | 0x724c44 |
| `FBMediaUploadManagersTracker` | Tracks all active upload managers | 0x1bdf8b8 |
| `FBUploadServiceQualitySettingsNetworkDispatcher` | Network quality negotiation | Multiple |

Key Event Strings Found (from __RODATA.__cstring) Line 265

| Event | Description |
|-------|-------------|
| `media_upload_start` | Upload initiated |
| `media_upload_pause` | Upload paused by user/system |
| `media_upload_success` | Upload completed successfully |
| `media_upload_failure` | Upload failed |
| `media_upload_cancel` | Upload cancelled |
| `media_upload_transfer_start` | Network transfer began |
| `media_upload_transfer_success` | Network transfer completed |
| `media_upload_process_start` | Server processing began |
| `media_upload_batch_start` | Batch upload initiated |
| `optimistic upload` | Pre-publish upload mode |

Appendix A: Key Addresses Line 321

| Address | Symbol/Function |
|---------|----------------|
| 0x012e5fa4 | Central Dispatch Stub |
| 0x1b3fad0 | __objc_selrefs base |
| 0x006fbab0 | _startUploadFlowForAssetID:... |
| 0x006fcd40 | _startUpload (session) |
| 0x00727408 | startUploadWithSettings:estimatedFileSize: |
| 0x00729720 | _makeUploadRequestFromParameters:withPath: |
| 0x0132a2d0 | FBParseMediaStreamingUploadRequestResponse (import) |
| 0x01011ff8 | sendUploadSettingsRequest:... |

Code Evidence

ARM64

; XREFS(120473)
fcn.012e5fa4:
    0x012e5fa4  adrp  x16, 0x1b3f000
    0x012e5fa8  add   x16, x16, 0xad0     ; 0x1b3fad0 - __DATA.__objc_selrefs
    0x012e5fac  ldr   w1, [x30]           ; Load selector index from return address
    0x012e5fb0  ldr   x1, [x16, x1]       ; Load actual selector from table
    0x012e5fb4  add   x30, x30, 4         ; Advance return address past index
    0x012e5fb8  b     sym.imp.objc_msgSend ; Tail call to objc_msgSend

// Dynamic Objective-C message dispatcher
// Uses inline selector indices for compact call sites
void fcn_012e5fa4(id self, ...) {
    uint32_t selector_index = *(uint32_t*)__return_address;
    SEL selector = __objc_selrefs[selector_index];
    __return_address += 4;  // Skip the inline data

    // Tail call to objc_msgSend with resolved selector
    return objc_msgSend(self, selector, ...);
}

Plain Text

FBMediaUploadFlowCoordinatorWrapper.startUploadMediaAttachmentsFromPublisherData:discardAndReupload:isPreupload:
    Address: 0x0072c49c
    Calls dispatcher at: 0x0072c4c8

FBMediaUploadFlowCoordinator._startUploadFlowForAssetID:waterfallID:mediaProcessor:mediaUploader:mediaUploadSettingsFetcher:...
    Address: 0x006fbab0
    Multiple dispatcher calls for session management

FBMediaItemUploadFlowSession._startUpload
    Address: 0x006fcd40
    Initiates actual upload process

FBImageUploadSession.startUploadWithSettings:estimatedFileSize:
    Address: 0x00727408
    Photo-specific upload initialization

Objective-C

- (void)sendUploadSettingsRequest:waterfallID:actorID:completionBlock:callbackQueue:
    // Prepares JSON payload
    // Uses FBMediaUploadContentSource.localWithUploadData:
    // Creates FBMediaUploadConfig object
    // Headers include: X_FB_VIDEO_WATERFALL_ID (0x01e36f64)

Objective-C

- (FBNetworkRequest *)_makeUploadRequestFromParameters:(NSDictionary *)params
                                              withPath:(NSString *)path
    // Address: 0x00729720
    // Constructs request using configured base URL + path

struct FBMediaUploadConfig {
    id contentSource;      // FBMediaUploadContentSource
    id waterfallID;        // NSString - X_FB_VIDEO_WATERFALL_ID
    id actorID;            // User/entity identifier
    id headers;            // NSDictionary with custom headers
    // ... additional fields
};

struct MediaItemInfo {
    id imageAttachment;    // Photo data
    id publisherData;      // Publication metadata
    id photoAssetEdits;    // Edit operations applied
    uint64_t state;        // Upload state (offset 0x50)
    id estimatedFileSize;  // Size for progress tracking
};

ARM64

ldr x0, [x0, 0x50]     ; Load upload state from object

ARM64

ldrb w8, [x20, 0x30]   ; Load byte at offset 0x30
   cbz w8, 0x6fbbe8       ; Branch if zero (upload not ready)
   tbnz w21, 0, 0x6fbbe8  ; Test bit 0 of optimistic flag

ARM64

mov w8, 3
     str x8, [x0, 0x50]   ; Set state to 3 (uploading)

bool shouldStartUpload(FBMediaItemUploadFlowSession *session) {
    uint8_t readyFlag = *(uint8_t *)(session + 0x30);
    bool isOptimistic = session->isOptimisticUpload & 1;

    if (readyFlag == 0) return false;
    if (isOptimistic) return false;  // Wait for explicit trigger

    return true;
}

Plain Text

0x01b84928: 55 08 0c 02 00 00 00 00  ; Pointer to selector string
0x01b84930: b1 98 0e 02 00 00 00 00  ; Next selector

Plain Text

FBMediaUploadManagersTracker (0x1bdf8b8)
    |-- Tracks multiple FBMediaUploadFlowCoordinatorWrapper instances
    |-- createNewUploadManagerForPublicationIdentifier: (0x005bb208)
    |-- cleanUpUploadManagerForPublicationIdentifier: (0x0073cfbc)

FBMediaUploadFlowCoordinatorWrapper (0x1be12f8)
    |-- Wraps FBMediaUploadFlowCoordinator
    |-- Handles: startUploadMediaAttachmentsFromPublisherData
    |-- Delegates to: FBMediaUploadFlowCoordinator

FBMediaUploadFlowCoordinator (0x1c57548)
    |-- Manages: FBMediaItemUploadFlowSession instances
    |-- startUploadFlow: (0x006fb558)
    |-- _startUploadFlowForAssetID:... (0x006fbab0)

Plain Text

1. Publisher calls FBMediaUploadManagersTracker
2. Tracker creates FBMediaUploadFlowCoordinatorWrapper for publication
3. Wrapper initializes FBMediaUploadFlowCoordinator
4. Coordinator creates FBMediaItemUploadFlowSession per asset
5. Session calls FBImageUploadSession for photos
6. All method calls route through dispatcher at 0x12e5fa4

Agent ID: SA-013

Target: Central Upload Dispatcher at 0x12e5fa4

Binary: FBSharedFramework (40.7 MB)

Executive Summary

1. Full Decompilation of 0x12e5fa4

Raw Assembly

ARM64

; XREFS(120473)
fcn.012e5fa4:
    0x012e5fa4  adrp  x16, 0x1b3f000
    0x012e5fa8  add   x16, x16, 0xad0     ; 0x1b3fad0 - __DATA.__objc_selrefs
    0x012e5fac  ldr   w1, [x30]           ; Load selector index from return address
    0x012e5fb0  ldr   x1, [x16, x1]       ; Load actual selector from table
    0x012e5fb4  add   x30, x30, 4         ; Advance return address past index
    0x012e5fb8  b     sym.imp.objc_msgSend ; Tail call to objc_msgSend

Pseudocode

// Dynamic Objective-C message dispatcher
// Uses inline selector indices for compact call sites
void fcn_012e5fa4(id self, ...) {
    uint32_t selector_index = *(uint32_t*)__return_address;
    SEL selector = __objc_selrefs[selector_index];
    __return_address += 4;  // Skip the inline data

    // Tail call to objc_msgSend with resolved selector
    return objc_msgSend(self, selector, ...);
}

Key Observations

undefined

2. Call Targets and Upload Flow Hierarchy

Primary Upload Classes (calling 0x12e5fa4)

Class	Key Methods	Address
`FBMediaUploadFlowCoordinatorWrapper`	Main wrapper coordinating uploads	0x1be12f8
`FBMediaUploadFlowCoordinator`	Core upload flow management	0x1c57548
`FBMediaItemUploadFlowSession`	Individual upload session handling	Multiple
`FBImageUploadSession`	Photo/image upload specialization	0x724c44
`FBMediaUploadManagersTracker`	Tracks all active upload managers	0x1bdf8b8
`FBUploadServiceQualitySettingsNetworkDispatcher`	Network quality negotiation	Multiple

Critical Upload Methods Identified

Plain Text

FBMediaUploadFlowCoordinatorWrapper.startUploadMediaAttachmentsFromPublisherData:discardAndReupload:isPreupload:
    Address: 0x0072c49c
    Calls dispatcher at: 0x0072c4c8

FBMediaUploadFlowCoordinator._startUploadFlowForAssetID:waterfallID:mediaProcessor:mediaUploader:mediaUploadSettingsFetcher:...
    Address: 0x006fbab0
    Multiple dispatcher calls for session management

FBMediaItemUploadFlowSession._startUpload
    Address: 0x006fcd40
    Initiates actual upload process

FBImageUploadSession.startUploadWithSettings:estimatedFileSize:
    Address: 0x00727408
    Photo-specific upload initialization

3. Network Endpoint Identification

Upload Settings Request Flow

The `FBUploadServiceQualitySettingsNetworkDispatcher` class handles upload quality negotiation:

Objective-C

- (void)sendUploadSettingsRequest:waterfallID:actorID:completionBlock:callbackQueue:
    // Prepares JSON payload
    // Uses FBMediaUploadContentSource.localWithUploadData:
    // Creates FBMediaUploadConfig object
    // Headers include: X_FB_VIDEO_WATERFALL_ID (0x01e36f64)

Key Network Components

undefined

Endpoint Construction Pattern

The upload system uses a path-based approach:

Objective-C

- (FBNetworkRequest *)_makeUploadRequestFromParameters:(NSDictionary *)params
                                              withPath:(NSString *)path
    // Address: 0x00729720
    // Constructs request using configured base URL + path

4. Payload Structure Analysis

Upload Configuration (FBMediaUploadConfig)

From `sendUploadSettingsRequest` at 0x01011ff8:

struct FBMediaUploadConfig {
    id contentSource;      // FBMediaUploadContentSource
    id waterfallID;        // NSString - X_FB_VIDEO_WATERFALL_ID
    id actorID;            // User/entity identifier
    id headers;            // NSDictionary with custom headers
    // ... additional fields
};

Media Item Info Structure

From `_getMediaItemInfo` selector (0x1f32222):

struct MediaItemInfo {
    id imageAttachment;    // Photo data
    id publisherData;      // Publication metadata
    id photoAssetEdits;    // Edit operations applied
    uint64_t state;        // Upload state (offset 0x50)
    id estimatedFileSize;  // Size for progress tracking
};

Content Source Types

The `FBMediaUploadContentSource` class provides:

undefined

5. Media Object Upload Flag Check (Offset 0x56)

Analysis

The offset 0x56 check was not found as a direct field access at that specific offset. However, the upload state is managed through:

undefined

Upload Ready Check Pattern

bool shouldStartUpload(FBMediaItemUploadFlowSession *session) {
    uint8_t readyFlag = *(uint8_t *)(session + 0x30);
    bool isOptimistic = session->isOptimisticUpload & 1;

    if (readyFlag == 0) return false;
    if (isOptimistic) return false;  // Wait for explicit trigger

    return true;
}

6. Selector at 0x1b84000 + 0x928

Analysis of 0x1b84928

The data at this location is part of the `__DATA.__objc_selrefs` section:

Plain Text

0x01b84928: 55 08 0c 02 00 00 00 00  ; Pointer to selector string
0x01b84930: b1 98 0e 02 00 00 00 00  ; Next selector

The first 4 bytes (`0x020c0855`) point to a selector string in the `__RODATA.__objc_methname` section.

Related Methods in Upload Context

Based on cross-references, this selector table region contains methods called during:

undefined

7. Connection to FBMediaUploadManager

Class Hierarchy

Plain Text

FBMediaUploadManagersTracker (0x1bdf8b8)
    |-- Tracks multiple FBMediaUploadFlowCoordinatorWrapper instances
    |-- createNewUploadManagerForPublicationIdentifier: (0x005bb208)
    |-- cleanUpUploadManagerForPublicationIdentifier: (0x0073cfbc)

FBMediaUploadFlowCoordinatorWrapper (0x1be12f8)
    |-- Wraps FBMediaUploadFlowCoordinator
    |-- Handles: startUploadMediaAttachmentsFromPublisherData
    |-- Delegates to: FBMediaUploadFlowCoordinator

FBMediaUploadFlowCoordinator (0x1c57548)
    |-- Manages: FBMediaItemUploadFlowSession instances
    |-- startUploadFlow: (0x006fb558)
    |-- _startUploadFlowForAssetID:... (0x006fbab0)

Upload Flow Sequence

Plain Text

1. Publisher calls FBMediaUploadManagersTracker
2. Tracker creates FBMediaUploadFlowCoordinatorWrapper for publication
3. Wrapper initializes FBMediaUploadFlowCoordinator
4. Coordinator creates FBMediaItemUploadFlowSession per asset
5. Session calls FBImageUploadSession for photos
6. All method calls route through dispatcher at 0x12e5fa4

8. Upload Logging Events

Key Event Strings Found (from RODATA.cstring)

Event	Description
`media_upload_start`	Upload initiated
`media_upload_pause`	Upload paused by user/system
`media_upload_success`	Upload completed successfully
`media_upload_failure`	Upload failed
`media_upload_cancel`	Upload cancelled
`media_upload_transfer_start`	Network transfer began
`media_upload_transfer_success`	Network transfer completed
`media_upload_process_start`	Server processing began
`media_upload_batch_start`	Batch upload initiated
`optimistic upload`	Pre-publish upload mode

9. Technical Findings Summary

Dispatcher Characteristics

undefined

Upload Infrastructure

undefined

Data Format

undefined

10. Recommendations for Further Analysis

undefined

Appendix A: Key Addresses

Address	Symbol/Function
0x012e5fa4	Central Dispatch Stub
0x1b3fad0	__objc_selrefs base
0x006fbab0	_startUploadFlowForAssetID:...
0x006fcd40	_startUpload (session)
0x00727408	startUploadWithSettings:estimatedFileSize:
0x00729720	_makeUploadRequestFromParameters:withPath:
0x0132a2d0	FBParseMediaStreamingUploadRequestResponse (import)
0x01011ff8	sendUploadSettingsRequest:...

*Report generated by SA-013* *Analysis completed on FBSharedFramework v345.0*

Phase 3 Navigation

Previous Phase 3 Analysis Summary Report

Next SA-014 Metal Shader Extraction Report

Technical Diagrams

Code Evidence

Agent ID: SA-013

Target: Central Upload Dispatcher at 0x12e5fa4

Binary: FBSharedFramework (40.7 MB)

Executive Summary

1. Full Decompilation of 0x12e5fa4

Raw Assembly

Pseudocode

Key Observations

2. Call Targets and Upload Flow Hierarchy

Primary Upload Classes (calling 0x12e5fa4)

Critical Upload Methods Identified

3. Network Endpoint Identification

Upload Settings Request Flow

Key Network Components

Endpoint Construction Pattern

4. Payload Structure Analysis

Upload Configuration (FBMediaUploadConfig)

Media Item Info Structure

Content Source Types

5. Media Object Upload Flag Check (Offset 0x56)

Analysis

Upload Ready Check Pattern

6. Selector at 0x1b84000 + 0x928

Analysis of 0x1b84928

Related Methods in Upload Context

7. Connection to FBMediaUploadManager

Class Hierarchy

Upload Flow Sequence

8. Upload Logging Events

Key Event Strings Found (from __RODATA.__cstring)

9. Technical Findings Summary

Dispatcher Characteristics

Upload Infrastructure

Data Format

10. Recommendations for Further Analysis

Appendix A: Key Addresses

Related Reports

CMSampleBuffer Processing Analysis

Ring Buffer Infrastructure Analysis

Audio Transcoding Infrastructure Analysis

Review: Additional capture logs under `./analysis/facebook/`

Agent Handoff Document

Phase 3 Navigation

Key Event Strings Found (from RODATA.cstring)