Skip to main content
SA-018 Grade B+ Phase 3

SA-018: FBMediaUploadManager Chunk-Based Upload Mechanism Analysis

This report documents the chunk-based media upload architecture used by Facebook's iOS application. The upload system implements a sophisticated segmented upload mechanism with support for video and audio content, featuring resume capabilities, progress tracking, and integration with the central dispatcher at address `0x12e5fa4`.

Key Findings

Component Status / Finding
Central Dispatcher 0x12e5fa4
FBMediaUploadChunkDetail.init 0x00700350
FBVideoUploadChunkDetail.init 0x00917268
FBVideoUploadSession.init 0x00915f04
FBVideoSegmentUploadSession.init 0x00919654
startUpload 0x009198a8
_startGraphUploadRequest 0x00934480
didUpdateUploadProgress 0x00918a38
resumeUploadWithPriorityStatus 0x00f05e64
_isAtTerminalState 0x00918ac8

Technical Diagrams

2.1 Chunk Logging Keys (from string analysis) Line 92 
| String | Address | Purpose |
|--------|---------|---------|
| `fbuploader_video_file_chunk` | 0x01e897ad | Chunk identifier for video files |
| `chunk_size` | 0x01e82ce4 | Size parameter |
| `chunk_index` | 0x01e51c6d | Chunk sequence number |
| `chunk_start` | 0x01e7d6d6 | Start position |
| `chunk_end` | 0x01e7d6e2 | End position |
| `queued_chunks` | 0x01e4bbc1 | Number of chunks in queue |
| `chunk_duration_ms` | 0x01e64f9b | Temporal duration of chunk |
4.1 Retry-Related Strings Line 167 
| String | Address | Purpose |
|--------|---------|---------|
| `retry_with_new_pub` | 0x01dd4bbc | Retry publication |
| `retry_automatic` | 0x01dd4dab | Automatic retry flag |
| `retry_manual` | 0x01dd4d9e | Manual retry flag |
| `should_retry` | 0x01dd4e98 | Retry decision |
| `retry_count` | 0x01e51c79 | Number of retries |
| `retry_interval` | 0x01e12ec9 | Delay between retries |
| `retry_on_error` | 0x01e55e1a | Error-triggered retry |
| `refresh_upload_state_on_retry` | 0x01e82f3a | State refresh on retry |
| `start_waiting_retry_timer` | 0x01dd4ed3 | Timer initiation |
| `did_exceed_waiting_retry` | 0x01dd4ed3 | Retry timeout |
+-- Segment 0 (contains multiple chunks) Line 271 
    |       |-- Chunk 0 (chunkStartOffset: 0, chunkEndOffset: N)
    |       |-- Chunk 1 (chunkStartOffset: N, chunkEndOffset: M)
    |       +-- Chunk K
    |
    +-- Segment 1
    |       |-- Chunk 0
    |       +-- ...
    |
    +-- Segment N (final segment)
11. Appendix: Key Addresses Line 405 
| Component | Address |
|-----------|---------|
| Central Dispatcher | 0x12e5fa4 |
| FBMediaUploadChunkDetail.init | 0x00700350 |
| FBVideoUploadChunkDetail.init | 0x00917268 |
| FBVideoUploadSession.init | 0x00915f04 |
| FBVideoSegmentUploadSession.init | 0x00919654 |
| startUpload | 0x009198a8 |
| _startGraphUploadRequest | 0x00934480 |
| didUpdateUploadProgress | 0x00918a38 |
| resumeUploadWithPriorityStatus | 0x00f05e64 |
| _isAtTerminalState | 0x00918ac8 |

Code Evidence

Objective-C 
// Key methods:
- (id)initWithContentSource:videoUploadChunkDetail:     @ 0x00700350
- (id)initWithCoder:                                     @ 0x00c8dee8
- (void)encodeWithCoder:                                 @ 0x00933df8
- (id)copyWithZone:                                      @ 0x011ba9e8
Objective-C 
// Critical initialization with segment boundaries:
- (id)initWithSegmentType:chunkStartOffset:chunkEndOffset:segmentStartOffset:segmentEndOffset:segmentEndTime:
    @ 0x00917268
Objective-C 
// Lifecycle methods:
- (id)initWithWaterfallID:assetID:uploadConfig:asset:enableEventExtraDebugLogging:networkDispatcher:kvObjectStore:loggingInfo:session:fixUploaderRestart:
    @ 0x00915f04
- (void)startUploadWithSettings:estimatedFileSize:       @ 0x00917520
- (void)updateStateByAddingSegmentToBeUploaded:          @ 0x009179e0
- (void)addSegment:                                       @ 0x0091797c
- (void)addSegment:streamAnnouncer:                      @ 0x00d940fc
- (void)didFinishAddingAllSegments:                      @ 0x009336f4
- (void)cancelUpload                                      @ 0x00a75850
- (void)recoverStateAndUploadIfStateFoundInCache:        @ 0x010b7064

// State management:
- (id)state                                               @ 0x00020224
- (void)setState:                                         @ 0x004cf7f8
- (BOOL)_isAtTerminalState                                @ 0x00918ac8
- (BOOL)_canResumeWithCachedUploadState:                  @ 0x00ecdc2c
Objective-C 
// Initialization:
- (id)initWithSegment:uploadSessionID:targetID:actorID:waterfallID:enableEventExtraDebugLogging:userFBID:uploadServiceHandler:networkDispatcher:delegate:logger:optionalConfig:extraReceiveRequestParams:
    @ 0x00919654

// Upload operations:
- (void)startUpload                                       @ 0x009198a8
- (void)startUploadWithStreamAnnouncer:                   @ 0x01012ccc
- (void)cancelUpload                                      @ 0x00b7a478
- (void)_startGraphUploadRequest                          @ 0x00934480
Plain Text 
media_upload_chunk_transfer_start    @ 0x01ecfdc9
media_upload_chunk_transfer_dequeue  @ 0x01ecfdeb
media_upload_chunk_transfer_success  @ 0x01ecfe0f
media_upload_chunk_transfer_response @ 0x01ecfe33
media_upload_chunk_transfer_failure  @ 0x01ecfe58
media_upload_chunk_transfer_cancel   @ 0x01ecfe7c
Plain Text 
x-fb-dynamic-predictive-response-chunk-size @ 0x01e64b06
Objective-C 
- (id)initWithObjectStore:                               @ 0x009161a8
- (void)removeItemForKey:                                @ 0x0094841c
Assembly 
; Terminal state check (decompiled):
x0 = state
sub x8, x0, 4      ; Subtract 4 from state value
cmp x8, 3          ; Compare with 3
cset w0, lo        ; Set if state-4 < 3 (states 4, 5, 6 are terminal)
Plain Text 
[Created] --> [Starting] --> [Uploading] --> [Processing] --> [Completed]
                   |              |               |
                   v              v               v
             [Cancelled]    [Failed]        [Failed]
Objective-C 
- (void)resumeUploadWithPriorityStatus:(id)status isRetry:(BOOL)retry {
    // Delegates to wrapped coordinator
    [self.wrappedCoordinator resumeUploadWithPriorityStatus:status isRetry:retry];
}
Objective-C 
- (void)resumeUploadWithPriorityStatus:isRetry:          @ 0x006fc080
Assembly 
0x009172b8    bl 0x12e5fa4    ; Dispatcher call for chunk setup
Assembly 
0x009198fc    bl 0x12e5fa4    ; Dispatcher call for upload start
Assembly 
0x00918a44    bl 0x12e5fa4    ; Progress update via dispatcher
0x00918ab4    bl 0x12e5fa4    ; Additional progress dispatch
Assembly 
0x00934570    bl 0x12e5fa4    ; Graph API upload dispatch
0x00934580    bl 0x12e5fa4    ; Additional dispatch
0x00934590    bl 0x12e5fa4    ; Delegate notification
0x009345a0    bl 0x12e5fa4    ; Status update
0x009345cc    bl 0x12e5fa4    ; Completion callback
0x009345e0    bl 0x12e5fa4    ; Final dispatch
Plain Text 
multipart/form-data; boundary=%@ @ 0x01e9639c
Plain Text 
is_transfer_chunked @ 0x01e64b55
chunked @ 0x01e89817
Plain Text 
Upload Session
    |
    +-- Segment 0 (contains multiple chunks)
    |       |-- Chunk 0 (chunkStartOffset: 0, chunkEndOffset: N)
    |       |-- Chunk 1 (chunkStartOffset: N, chunkEndOffset: M)
    |       +-- Chunk K
    |
    +-- Segment 1
    |       |-- Chunk 0
    |       +-- ...
    |
    +-- Segment N (final segment)
Plain Text 
segment_start_offset @ 0x01e82f7c
segment_end_offset @ 0x01e82f91
segment_duration_ms @ 0x01e5726b
segment_type @ 0x01e5736f
Objective-C 
// In FBVideoUploadSession:
- (void)networkerRequest:didUpdateUploadProgress:complete:   @ 0x00918a38

// In FBVideoSegmentUploadSession:
- (void)networkerRequest:didUpdateUploadProgress:complete:   @ 0x009348cc
- (void)videoSegmentUploadSession:didUpdateProgressTo:from:  @ 0x0091a6c8
Assembly 
; Progress multiplier calculation
ldr d0, [x8, 0x680]    ; Load multiplier constant
fmul d0, d8, d0        ; Multiply progress by factor
fadd d0, d0, d1        ; Add base offset
str d0, [x19, 0x48]    ; Store calculated progress
Plain Text 
upload_progress @ 0x01e09a94
com.facebook.uploadflow.transcodeprogress @ 0x01e7748f
Objective-C 
- (void)transcodeWithProgress:onSegmentStarted:onSegmentFinished:onImageSample:completion:
    @ 0x00a22d10

- (NSUInteger)numberOfSegments                           @ 0x0017cffc
- (NSUInteger)estimatedOutputFileSize                    @ 0x00783954
Objective-C 
- (id)initWithAssetWriter:assetReader:assetOutput:videoProcessor:segmentDuration:imageSampleFrameInterval:imageSampleTimestamp:transcodeTracer:optionalConfig:queue:
    @ 0x009b9a24

- (void)startEncodingWithFinishCallback:progressCallback:imageCallback:
    @ 0x009b9b6c
Objective-C 
// Flow lifecycle:
- (void)startUploadFlow:                                 @ 0x006fb558
- (void)_startUploadFlowForAssetID:waterfallID:...       @ 0x006fbab0

// Session callbacks:
- (void)mediaItemUploadFlowSessionDidStart:              @ 0x006fc59c
- (void)mediaItemUploadFlowSessionDidFinish:fbid:response: @ 0x00706ce0
- (void)mediaItemUploadFlowSessionDidFinishProcessing:   @ 0x007029b8
- (void)mediaItemUploadFlowSessionDidCancel:processingFinished: @ 0x00b7a544
- (void)mediaItemUploadFlowSession:didFailWithError:processingFinished: @ 0x00f34ccc
- (void)mediaItemUploadFlowSession:didUpdateToProgress:fromProgress: @ 0x007006b4
- (void)mediaItemUploadFlowSessionRestart:newSession:    @ 0x00c742b4
Objective-C 
- (NSDictionary *)assetIDsToMediaIDs                     @ 0x00942e44
- (NSString *)mediaIDforAssetID:                         @ 0x00775674
- (NSString *)uploadSessionIDForMediaFBID:               @ 0x00746974

**Agent ID:** SA-018 **Mission:** Analyze FBMediaUploadManager chunk-based upload mechanism **Binary:** `./analysis/facebook/345.0/Facebook.app/Frameworks/FBSharedFramework.framework/FBSharedFramework` **Date:** 2025-12-30

Executive Summary

This report documents the chunk-based media upload architecture used by Facebook's iOS application. The upload system implements a sophisticated segmented upload mechanism with support for video and audio content, featuring resume capabilities, progress tracking, and integration with the central dispatcher at address `0x12e5fa4`.

1. Core Upload Classes Identified

1.1 FBMediaUploadChunkDetail (Class 7306)

**Address Range:** `0x0001e9dc - 0x011ba9e8` (18,464,780 bytes)

Primary chunk metadata container:

Objective-C 
// Key methods:
- (id)initWithContentSource:videoUploadChunkDetail:     @ 0x00700350
- (id)initWithCoder:                                     @ 0x00c8dee8
- (void)encodeWithCoder:                                 @ 0x00933df8
- (id)copyWithZone:                                      @ 0x011ba9e8

1.2 FBVideoUploadChunkDetail (Class 7308)

**Address Range:** `0x0001e9dc - 0x0116c7c8` (18,144,748 bytes)

Video-specific chunk detail container with offset tracking:

Objective-C 
// Critical initialization with segment boundaries:
- (id)initWithSegmentType:chunkStartOffset:chunkEndOffset:segmentStartOffset:segmentEndOffset:segmentEndTime:
    @ 0x00917268

**Chunk Boundary Parameters:**

    undefined

1.3 FBVideoUploadSession (Class 6075)

**Address Range:** `0x00020224 - 0x010b7064` (17,395,264 bytes)

Main upload session coordinator:

Objective-C 
// Lifecycle methods:
- (id)initWithWaterfallID:assetID:uploadConfig:asset:enableEventExtraDebugLogging:networkDispatcher:kvObjectStore:loggingInfo:session:fixUploaderRestart:
    @ 0x00915f04
- (void)startUploadWithSettings:estimatedFileSize:       @ 0x00917520
- (void)updateStateByAddingSegmentToBeUploaded:          @ 0x009179e0
- (void)addSegment:                                       @ 0x0091797c
- (void)addSegment:streamAnnouncer:                      @ 0x00d940fc
- (void)didFinishAddingAllSegments:                      @ 0x009336f4
- (void)cancelUpload                                      @ 0x00a75850
- (void)recoverStateAndUploadIfStateFoundInCache:        @ 0x010b7064

// State management:
- (id)state                                               @ 0x00020224
- (void)setState:                                         @ 0x004cf7f8
- (BOOL)_isAtTerminalState                                @ 0x00918ac8
- (BOOL)_canResumeWithCachedUploadState:                  @ 0x00ecdc2c

1.4 FBVideoSegmentUploadSession (Class 6072)

**Address Range:** `0x00166abc - 0x0116534c` (16,771,216 bytes)

Individual segment upload handler:

Objective-C 
// Initialization:
- (id)initWithSegment:uploadSessionID:targetID:actorID:waterfallID:enableEventExtraDebugLogging:userFBID:uploadServiceHandler:networkDispatcher:delegate:logger:optionalConfig:extraReceiveRequestParams:
    @ 0x00919654

// Upload operations:
- (void)startUpload                                       @ 0x009198a8
- (void)startUploadWithStreamAnnouncer:                   @ 0x01012ccc
- (void)cancelUpload                                      @ 0x00b7a478
- (void)_startGraphUploadRequest                          @ 0x00934480

2. Chunk Size and Format

2.1 Chunk Logging Keys (from string analysis)

StringAddressPurpose
`fbuploader_video_file_chunk`0x01e897adChunk identifier for video files
`chunk_size`0x01e82ce4Size parameter
`chunk_index`0x01e51c6dChunk sequence number
`chunk_start`0x01e7d6d6Start position
`chunk_end`0x01e7d6e2End position
`queued_chunks`0x01e4bbc1Number of chunks in queue
`chunk_duration_ms`0x01e64f9bTemporal duration of chunk

2.2 Chunk Transfer Events

Identified logging events for chunk transfer lifecycle:

Plain Text 
media_upload_chunk_transfer_start    @ 0x01ecfdc9
media_upload_chunk_transfer_dequeue  @ 0x01ecfdeb
media_upload_chunk_transfer_success  @ 0x01ecfe0f
media_upload_chunk_transfer_response @ 0x01ecfe33
media_upload_chunk_transfer_failure  @ 0x01ecfe58
media_upload_chunk_transfer_cancel   @ 0x01ecfe7c

2.3 Dynamic Chunk Sizing

HTTP header for dynamic chunk sizing:

Plain Text 
x-fb-dynamic-predictive-response-chunk-size @ 0x01e64b06

This suggests Facebook uses adaptive chunk sizing based on network conditions.

3. Upload Session State Machine

3.1 State Store Class

**FBVideoUploadStateStore** (Class 6076)

Objective-C 
- (id)initWithObjectStore:                               @ 0x009161a8
- (void)removeItemForKey:                                @ 0x0094841c

3.2 Session States (inferred from code analysis)

Based on the `_isAtTerminalState` method at `0x00918ac8`:

Assembly 
; Terminal state check (decompiled):
x0 = state
sub x8, x0, 4      ; Subtract 4 from state value
cmp x8, 3          ; Compare with 3
cset w0, lo        ; Set if state-4 < 3 (states 4, 5, 6 are terminal)

Inferred state values:

    undefined

3.3 State Transitions

Plain Text 
[Created] --> [Starting] --> [Uploading] --> [Processing] --> [Completed]
                   |              |               |
                   v              v               v
             [Cancelled]    [Failed]        [Failed]

4. Retry/Resume Logic

4.1 Retry-Related Strings

StringAddressPurpose
`retry_with_new_pub`0x01dd4bbcRetry publication
`retry_automatic`0x01dd4dabAutomatic retry flag
`retry_manual`0x01dd4d9eManual retry flag
`should_retry`0x01dd4e98Retry decision
`retry_count`0x01e51c79Number of retries
`retry_interval`0x01e12ec9Delay between retries
`retry_on_error`0x01e55e1aError-triggered retry
`refresh_upload_state_on_retry`0x01e82f3aState refresh on retry
`start_waiting_retry_timer`0x01dd4ed3Timer initiation
`did_exceed_waiting_retry`0x01dd4ed3Retry timeout

4.2 Resume Capability

**resumeUploadWithPriorityStatus:isRetry:** at `0x00f05e64`:

Objective-C 
- (void)resumeUploadWithPriorityStatus:(id)status isRetry:(BOOL)retry {
    // Delegates to wrapped coordinator
    [self.wrappedCoordinator resumeUploadWithPriorityStatus:status isRetry:retry];
}

Resume-related methods in FBMediaUploadFlowCoordinator:

Objective-C 
- (void)resumeUploadWithPriorityStatus:isRetry:          @ 0x006fc080

4.3 State Recovery

**recoverStateAndUploadIfStateFoundInCache:** at `0x010b7064`:

    undefined

5. Central Dispatcher Connection (0x12e5fa4)

5.1 Dispatcher Calls in Upload Flow

The central dispatcher is invoked at multiple critical points:

**In FBVideoUploadChunkDetail initialization (0x00917268):**

Assembly 
0x009172b8    bl 0x12e5fa4    ; Dispatcher call for chunk setup

**In FBVideoSegmentUploadSession.startUpload (0x009198a8):**

Assembly 
0x009198fc    bl 0x12e5fa4    ; Dispatcher call for upload start

**In didUpdateUploadProgress (0x00918a38):**

Assembly 
0x00918a44    bl 0x12e5fa4    ; Progress update via dispatcher
0x00918ab4    bl 0x12e5fa4    ; Additional progress dispatch

**In _startGraphUploadRequest (0x00934480):**

Assembly 
0x00934570    bl 0x12e5fa4    ; Graph API upload dispatch
0x00934580    bl 0x12e5fa4    ; Additional dispatch
0x00934590    bl 0x12e5fa4    ; Delegate notification
0x009345a0    bl 0x12e5fa4    ; Status update
0x009345cc    bl 0x12e5fa4    ; Completion callback
0x009345e0    bl 0x12e5fa4    ; Final dispatch

5.2 Dispatcher Integration Pattern

The dispatcher at `0x12e5fa4` serves as:

    undefined

6. Multipart Upload Structure

6.1 Content Type

Found multipart format string:

Plain Text 
multipart/form-data; boundary=%@ @ 0x01e9639c

6.2 Transfer Mode

Chunked transfer encoding indicator:

Plain Text 
is_transfer_chunked @ 0x01e64b55
chunked @ 0x01e89817

6.3 Segment-Based Upload

Video uploads are segment-based with the following structure:

Plain Text 
Upload Session
    |
    +-- Segment 0 (contains multiple chunks)
    |       |-- Chunk 0 (chunkStartOffset: 0, chunkEndOffset: N)
    |       |-- Chunk 1 (chunkStartOffset: N, chunkEndOffset: M)
    |       +-- Chunk K
    |
    +-- Segment 1
    |       |-- Chunk 0
    |       +-- ...
    |
    +-- Segment N (final segment)

6.4 Segment Parameters

Key segment tracking strings:

Plain Text 
segment_start_offset @ 0x01e82f7c
segment_end_offset @ 0x01e82f91
segment_duration_ms @ 0x01e5726b
segment_type @ 0x01e5736f

7. Upload Progress Callbacks

7.1 Progress Delegate Methods

Objective-C 
// In FBVideoUploadSession:
- (void)networkerRequest:didUpdateUploadProgress:complete:   @ 0x00918a38

// In FBVideoSegmentUploadSession:
- (void)networkerRequest:didUpdateUploadProgress:complete:   @ 0x009348cc
- (void)videoSegmentUploadSession:didUpdateProgressTo:from:  @ 0x0091a6c8

7.2 Progress Calculation

From disassembly at `0x00918a38`:

Assembly 
; Progress multiplier calculation
ldr d0, [x8, 0x680]    ; Load multiplier constant
fmul d0, d8, d0        ; Multiply progress by factor
fadd d0, d0, d1        ; Add base offset
str d0, [x19, 0x48]    ; Store calculated progress

7.3 Progress Logging

Plain Text 
upload_progress @ 0x01e09a94
com.facebook.uploadflow.transcodeprogress @ 0x01e7748f

8. Segmented Transcoding

8.1 FBVideoSegmentedTranscoder (Class 7998)

Transcodes video into uploadable segments:

Objective-C 
- (void)transcodeWithProgress:onSegmentStarted:onSegmentFinished:onImageSample:completion:
    @ 0x00a22d10

- (NSUInteger)numberOfSegments                           @ 0x0017cffc
- (NSUInteger)estimatedOutputFileSize                    @ 0x00783954

8.2 FBVideoSegmentedEncoder (Class 7997)

Encodes individual segments:

Objective-C 
- (id)initWithAssetWriter:assetReader:assetOutput:videoProcessor:segmentDuration:imageSampleFrameInterval:imageSampleTimestamp:transcodeTracer:optionalConfig:queue:
    @ 0x009b9a24

- (void)startEncodingWithFinishCallback:progressCallback:imageCallback:
    @ 0x009b9b6c

9. Flow Coordination

9.1 FBMediaUploadFlowCoordinator (Class 6870)

High-level upload flow management:

Objective-C 
// Flow lifecycle:
- (void)startUploadFlow:                                 @ 0x006fb558
- (void)_startUploadFlowForAssetID:waterfallID:...       @ 0x006fbab0

// Session callbacks:
- (void)mediaItemUploadFlowSessionDidStart:              @ 0x006fc59c
- (void)mediaItemUploadFlowSessionDidFinish:fbid:response: @ 0x00706ce0
- (void)mediaItemUploadFlowSessionDidFinishProcessing:   @ 0x007029b8
- (void)mediaItemUploadFlowSessionDidCancel:processingFinished: @ 0x00b7a544
- (void)mediaItemUploadFlowSession:didFailWithError:processingFinished: @ 0x00f34ccc
- (void)mediaItemUploadFlowSession:didUpdateToProgress:fromProgress: @ 0x007006b4
- (void)mediaItemUploadFlowSessionRestart:newSession:    @ 0x00c742b4

9.2 Asset ID to Media ID Mapping

Objective-C 
- (NSDictionary *)assetIDsToMediaIDs                     @ 0x00942e44
- (NSString *)mediaIDforAssetID:                         @ 0x00775674
- (NSString *)uploadSessionIDForMediaFBID:               @ 0x00746974

10. Key Findings Summary

    undefined

11. Appendix: Key Addresses

ComponentAddress
Central Dispatcher0x12e5fa4
FBMediaUploadChunkDetail.init0x00700350
FBVideoUploadChunkDetail.init0x00917268
FBVideoUploadSession.init0x00915f04
FBVideoSegmentUploadSession.init0x00919654
startUpload0x009198a8
_startGraphUploadRequest0x00934480
didUpdateUploadProgress0x00918a38
resumeUploadWithPriorityStatus0x00f05e64
_isAtTerminalState0x00918ac8

**Report Generated:** 2025-12-30 **Agent:** SA-018 **Classification:** Technical Analysis

Related Reports

CMSampleBuffer Processing Analysis

Ring Buffer Infrastructure Analysis

Audio Transcoding Infrastructure Analysis

Review: Additional capture logs under `./analysis/facebook/`
Phase 2

Agent Handoff Document

Phase 3 Navigation

Previous SA-017 DRM and Encryption Key Provisioning Analysis Report
Next SA-019: Overlay Audio Segments and Muted Segment Analysis Report