Skip to main content
SA-022 Grade A Phase 3

SA-022: GraphQL RealtimeConfig and Alternative Config Push Mechanisms

Analysis of FBSharedFramework reveals a multi-layered configuration push architecture that enables Facebook to remotely control audio behavior through multiple pathways. The investigation confirms four distinct config update mechanisms working in coordination, with the sound toggle setting changes broadcast via `NSNotification` to all listening components.

Technical Diagrams

**Active Subscription Types found:** Line 41 
| Subscription | String Offset |
|--------------|---------------|
| `FBSnacksTraySubscription` | 0x01dfc9b3 |
| `FBFeedbackLikeCoreSubscription` | 0x01dacb86 |
| `FBAllTypingNotificationsSubscription` | 0x01dc624e |
| `FBVideoLiveStatusUpdateWithoutFeedbackSubscription` | 0x01e921fd |
| `FBSnacksTraySuggestedBucketsQuery` | 0x01dee749 |
2.1 Primary Notifications Line 100 
| Notification Key | String Offset | Purpose |
|------------------|---------------|---------|
| `kFeedSoundToggleSettingChangeNotification` | 0x01dfb2a5 | Main audio state change broadcast |
| `kFeedSoundToggleSettingStoreVolumeRockerNotification` | 0x01e0c30d | Volume rocker triggered state change |
| `FBSoundOnSettingNotification` | 0x01dfb2cf | Sound-on state notification |
| `kFBAutoPlaySettingsChangedNotification` | 0x01dcde1f | Autoplay settings changed |
| `FBFeedClientRankingGraphQLConnectionsForceRefreshNotification` | 0x01dcf064 | Feed force refresh |
5. Feed Refresh Notifications Line 240 
| Notification | Purpose |
|--------------|---------|
| `FBFeedClientRankingGraphQLConnectionsForceRefreshNotification` | Forces feed reconnection |
| `FBFeedDeliveryCoordinatorClearCacheNotification` | Clears cached content |
| `didReceiveForceRefreshNotification` | Handler for force refresh |
v Line 285 
+------------------+
| Config Service   |
| (MobileConfig)   |
+--------+---------+
         |
v Line 291 
+-------------------+
| FBVideoSoundToggle|
| PluginSettingStore|
+--------+----------+
         |
         | updateCurrentSettingAndNotify:
v Line 298 
+-----------------------------+
| NSNotificationCenter post:  |
| kFeedSoundToggle            |
| SettingChangeNotification   |
+--------+--------------------+
         |
    +----+----+----+----+
    |    |    |    |    |
Appendix: Key Offsets Line 327 
| Symbol | Offset |
|--------|--------|
| FBVideoSoundTogglePluginSettingStore | 0x01c69b08 |
| FBSoundToggleListener | 0x01c243c8 |
| FBMCExperimentManager | 0x01cab0a8 |
| FBMobileConfigStartupConfigs | 0x01c7ac78 |
| FBMediaUploadQualitySettingsService | 0x01c36d98 |
| kFeedSoundToggleSettingChangeNotification | 0x01dfb2a5 |
| SoundToggleSettingOnByIgnoreHWSwitch | 0x01e69f84 |
| SoundToggleSettingOnProgrammatically | 0x01e69fcc |

Code Evidence

Plain Text 
handleIncomingMQTTMessage:          offset 0x020fbbbf
addMQTTListeners:                   offset 0x0211eebc
removeMQTTListeners:                offset 0x0211eebc
_onMQTTConnectionStatusChange:      offset 0x020f352e
startWithMQTTInterface:shouldStartBgTask: offset 0x0211ee80
Plain Text 
backgroundFetchCadenceInSeconds      offset 0x01f973dc
_backgroundFetchInterval             offset 0x02144a2a
_backgroundFetchIntervalStep         offset 0x02144a43
_backgroundFetchManager              offset 0x0214d183
_backgroundFetchObserverHandle       offset 0x02163c33
_backgroundFetchObserverHandling:    offset 0x020a3a5c
Objective-C 
class FBMediaUploadQualitySettingsService
initWithSession:                    offset 0x0021b588
forceFetchSettingsFromServer        offset 0x00ca19cc
_syncSettingsIfNeeded               offset 0x0021b720
_didPullSettings:requestContext:    offset 0x0046d730
_didPushMediaSettings:              offset 0x00f6272c
handleWarmStart                     offset 0x00359e0c
addListener:                        offset 0x00a55a4c
removeListener:                     offset 0x00ca74d0
Plain Text 
SoundToggleSettingOff                   offset 0x01e69f0d
SoundToggleSettingOnByToggle            offset 0x01e69f23
SoundToggleSettingOnByToggleManual      offset 0x01e69f40
SoundToggleSettingOnByPreference        offset 0x01e69f63
SoundToggleSettingOnByIgnoreHWSwitch    offset 0x01e69f84  <- CRITICAL
SoundToggleSettingOnByVolumeRocker      offset 0x01e69fa9
SoundToggleSettingOnProgrammatically    offset 0x01e69fcc  <- CRITICAL
SoundToggleSettingUnset                 offset 0x01e69ff1
SoundToggleSettingUnsetByCasting        offset 0x01e6a009
SoundToggleSettingUnsetByBackgroundAudio offset 0x01e6a02a
Objective-C 
class FBVideoSoundTogglePluginSettingStore
initWithSession:                        offset 0x001c9990
currentSetting                          offset 0x00015f4c
updateCurrentSetting:                   offset 0x004214c4
updateCurrentSettingAndNotify:          offset 0x004be9f8
logMuteStateChanged:isMuted:withMuteReason:forVideoID: offset 0x004a9ebc
audioSessionManagerUpdatedAudioSession: offset 0x0020402c
audioSessionManagerFinishedRouteChange: offset 0x003b1da4
_unmuteOnVolumeChange:                  offset 0x0053a4c0  <- CRITICAL
_applicationDidBecomeActive:            offset 0x00299d44
_applicationWillEnterForeground:        offset 0x0020dfc0
_applicationDidEnterBackground:         offset 0x0020d88c
_startFunnel                            offset 0x001c9ea8
_didStartBugReport:                     offset 0x009bc324
Objective-C 
class FBSoundToggleListener
initWithSoundConfig:                           offset 0x00c8c6f4
dealloc                                        offset 0x00c800b0
shouldTurnOnSound                              offset 0x000237e8
_updateVideoMuteStateFromSettingStoreIfAllowed offset 0x00d64024
_subscribeToSettingStoreNotifications          offset 0x00dbac20
_unsubscribeFromSettingStoreNotifications      offset 0x00dbabd4
Objective-C 
class FBMCExperimentManager
initWithUserSession:           offset 0x00802d74
isFeatureEnabled:              offset 0x0080c100
isFeatureEnabledWithoutLogging: offset 0x0080c09c
getFeatureIntValue:            offset 0x0003788c
getFeatureIntValueWithoutLogging: offset 0x0003788c
Objective-C 
class FBMobileConfigStartupConfigs
init                           offset 0x01318530
getBool:withDefault:           offset 0x0131865c
getInt64:withDefault:          offset 0x013186b0
getDouble:withDefault:         offset 0x01318704
getString:withDefault:         offset 0x01318760
getParamInfo:                  offset 0x013187dc
isOverrideValue:               offset 0x01318834
getLoggingID:                  offset 0x01318874
hasValue:                      offset 0x013188b4
toJSON                         offset 0x01318944
setOverrideForParam:andValue:  offset 0x01318a58
removeOverrideForParam:        offset 0x01318a58
clearOverrides                 offset 0x01318b3c
getInstance                    offset 0x013185ec (class method)
Plain Text 
FNFExperimentContext            offset 0x01c42e68
FNFDashAssetExperimentContext   offset 0x01c42e18
FNFMp3ExperimentContext         offset 0x01c42f08
Plain Text 
Server Push (MQTT/GraphQL)
        |
        v
+------------------+
| Config Service   |
| (MobileConfig)   |
+--------+---------+
         |
         v
+-------------------+
| FBVideoSoundToggle|
| PluginSettingStore|
+--------+----------+
         |
         | updateCurrentSettingAndNotify:
         v
+-----------------------------+
| NSNotificationCenter post:  |
| kFeedSoundToggle            |
| SettingChangeNotification   |
+--------+--------------------+
         |
    +----+----+----+----+
    |    |    |    |    |
    v    v    v    v    v
  [All FBSoundToggleListener instances]
         |
         | _updateVideoMuteStateFromSettingStoreIfAllowed
         v
  [Audio State Changed]

**Agent ID:** SA-022 **Binary:** `./analysis/facebook/345.0/Facebook.app/Frameworks/FBSharedFramework.framework/FBSharedFramework` **Date:** 2025-12-30

Executive Summary

Analysis of FBSharedFramework reveals a multi-layered configuration push architecture that enables Facebook to remotely control audio behavior through multiple pathways. The investigation confirms four distinct config update mechanisms working in coordination, with the sound toggle setting changes broadcast via `NSNotification` to all listening components.

1. Config Update Paths Identified

1.1 MQTT Push (Primary Real-time)

**Classes involved:**

    undefined

**Key methods:**

Plain Text 
handleIncomingMQTTMessage:          offset 0x020fbbbf
addMQTTListeners:                   offset 0x0211eebc
removeMQTTListeners:                offset 0x0211eebc
_onMQTTConnectionStatusChange:      offset 0x020f352e
startWithMQTTInterface:shouldStartBgTask: offset 0x0211ee80

**Evidence strings:**

    undefined

1.2 GraphQL Realtime Subscriptions (Secondary)

**Service Status Protocol:** `FBGraphQLRealtimeServiceStatus`

**Active Subscription Types found:**

SubscriptionString Offset
`FBSnacksTraySubscription`0x01dfc9b3
`FBFeedbackLikeCoreSubscription`0x01dacb86
`FBAllTypingNotificationsSubscription`0x01dc624e
`FBVideoLiveStatusUpdateWithoutFeedbackSubscription`0x01e921fd
`FBSnacksTraySuggestedBucketsQuery`0x01dee749

**Token management:**

    undefined

1.3 Background Fetch

**Methods found:**

Plain Text 
backgroundFetchCadenceInSeconds      offset 0x01f973dc
_backgroundFetchInterval             offset 0x02144a2a
_backgroundFetchIntervalStep         offset 0x02144a43
_backgroundFetchManager              offset 0x0214d183
_backgroundFetchObserverHandle       offset 0x02163c33
_backgroundFetchObserverHandling:    offset 0x020a3a5c

**Key string:** `backgroundFetch` (offset 0x01d8835c)

Background fetch allows config synchronization even when app is not actively in use.

1.4 Force Fetch (Manual Refresh)

**Primary implementation:** `FBMediaUploadQualitySettingsService.forceFetchSettingsFromServer`

    undefined

**Full class signature:**

Objective-C 
class FBMediaUploadQualitySettingsService
initWithSession:                    offset 0x0021b588
forceFetchSettingsFromServer        offset 0x00ca19cc
_syncSettingsIfNeeded               offset 0x0021b720
_didPullSettings:requestContext:    offset 0x0046d730
_didPushMediaSettings:              offset 0x00f6272c
handleWarmStart                     offset 0x00359e0c
addListener:                        offset 0x00a55a4c
removeListener:                     offset 0x00ca74d0

**Force fetch disassembly shows:**

    undefined

2. Notification Chain - Sound Toggle

2.1 Primary Notifications

Notification KeyString OffsetPurpose
`kFeedSoundToggleSettingChangeNotification`0x01dfb2a5Main audio state change broadcast
`kFeedSoundToggleSettingStoreVolumeRockerNotification`0x01e0c30dVolume rocker triggered state change
`FBSoundOnSettingNotification`0x01dfb2cfSound-on state notification
`kFBAutoPlaySettingsChangedNotification`0x01dcde1fAutoplay settings changed
`FBFeedClientRankingGraphQLConnectionsForceRefreshNotification`0x01dcf064Feed force refresh

2.2 Sound Toggle Setting States

Plain Text 
SoundToggleSettingOff                   offset 0x01e69f0d
SoundToggleSettingOnByToggle            offset 0x01e69f23
SoundToggleSettingOnByToggleManual      offset 0x01e69f40
SoundToggleSettingOnByPreference        offset 0x01e69f63
SoundToggleSettingOnByIgnoreHWSwitch    offset 0x01e69f84  <- CRITICAL
SoundToggleSettingOnByVolumeRocker      offset 0x01e69fa9
SoundToggleSettingOnProgrammatically    offset 0x01e69fcc  <- CRITICAL
SoundToggleSettingUnset                 offset 0x01e69ff1
SoundToggleSettingUnsetByCasting        offset 0x01e6a009
SoundToggleSettingUnsetByBackgroundAudio offset 0x01e6a02a

**Critical states:**

    undefined

2.3 Sound Toggle Plugin Setting Store

**Class:** `FBVideoSoundTogglePluginSettingStore` (offset 0x01c69b08)

Objective-C 
class FBVideoSoundTogglePluginSettingStore
initWithSession:                        offset 0x001c9990
currentSetting                          offset 0x00015f4c
updateCurrentSetting:                   offset 0x004214c4
updateCurrentSettingAndNotify:          offset 0x004be9f8
logMuteStateChanged:isMuted:withMuteReason:forVideoID: offset 0x004a9ebc
audioSessionManagerUpdatedAudioSession: offset 0x0020402c
audioSessionManagerFinishedRouteChange: offset 0x003b1da4
_unmuteOnVolumeChange:                  offset 0x0053a4c0  <- CRITICAL
_applicationDidBecomeActive:            offset 0x00299d44
_applicationWillEnterForeground:        offset 0x0020dfc0
_applicationDidEnterBackground:         offset 0x0020d88c
_startFunnel                            offset 0x001c9ea8
_didStartBugReport:                     offset 0x009bc324

**Critical method:** `_unmuteOnVolumeChange:` - Automatically unmutes on volume change

2.4 Sound Toggle Listener

**Class:** `FBSoundToggleListener` (offset 0x01c243c8)

Objective-C 
class FBSoundToggleListener
initWithSoundConfig:                           offset 0x00c8c6f4
dealloc                                        offset 0x00c800b0
shouldTurnOnSound                              offset 0x000237e8
_updateVideoMuteStateFromSettingStoreIfAllowed offset 0x00d64024
_subscribeToSettingStoreNotifications          offset 0x00dbac20
_unsubscribeFromSettingStoreNotifications      offset 0x00dbabd4

3. A/B Test Targeting Mechanism

3.1 Experiment Manager

**Class:** `FBMCExperimentManager` (offset 0x01cab0a8)

Objective-C 
class FBMCExperimentManager
initWithUserSession:           offset 0x00802d74
isFeatureEnabled:              offset 0x0080c100
isFeatureEnabledWithoutLogging: offset 0x0080c09c
getFeatureIntValue:            offset 0x0003788c
getFeatureIntValueWithoutLogging: offset 0x0003788c

**isFeatureEnabled: disassembly analysis:**

    undefined

3.2 MobileConfig System

**Class:** `FBMobileConfigStartupConfigs` (offset 0x01c7ac78)

Objective-C 
class FBMobileConfigStartupConfigs
init                           offset 0x01318530
getBool:withDefault:           offset 0x0131865c
getInt64:withDefault:          offset 0x013186b0
getDouble:withDefault:         offset 0x01318704
getString:withDefault:         offset 0x01318760
getParamInfo:                  offset 0x013187dc
isOverrideValue:               offset 0x01318834
getLoggingID:                  offset 0x01318874
hasValue:                      offset 0x013188b4
toJSON                         offset 0x01318944
setOverrideForParam:andValue:  offset 0x01318a58
removeOverrideForParam:        offset 0x01318a58
clearOverrides                 offset 0x01318b3c
getInstance                    offset 0x013185ec (class method)

**Related MobileConfig classes:**

    undefined

3.3 Experiment Context Classes

Plain Text 
FNFExperimentContext            offset 0x01c42e68
FNFDashAssetExperimentContext   offset 0x01c42e18
FNFMp3ExperimentContext         offset 0x01c42f08

4. Config Did Change Handler

**Method string found:** `oldConfig:configDidChange:` (offset 0x0203fdbe)

This method signature suggests a delegate pattern where objects receive both the old and new config values, allowing them to:

    undefined

**Related:** `_configDidChange` (offset 0x020ff95e) - Private notification handler

5. Feed Refresh Notifications

NotificationPurpose
`FBFeedClientRankingGraphQLConnectionsForceRefreshNotification`Forces feed reconnection
`FBFeedDeliveryCoordinatorClearCacheNotification`Clears cached content
`didReceiveForceRefreshNotification`Handler for force refresh

6. Critical Findings

6.1 Remote Audio Control Capability

The architecture enables Facebook to remotely enable audio through:

    undefined

6.2 Hardware Switch Override

Evidence of deliberate hardware mute switch bypass:

    undefined

6.3 Automatic Unmute Triggers

    undefined

6.4 A/B Testing Integration

The `FBMCExperimentManager.isFeatureEnabled:` method gates features, meaning audio behavior changes can be:

    undefined

7. Notification Flow Diagram

Plain Text 
Server Push (MQTT/GraphQL)
        |
        v
+------------------+
| Config Service   |
| (MobileConfig)   |
+--------+---------+
         |
         v
+-------------------+
| FBVideoSoundToggle|
| PluginSettingStore|
+--------+----------+
         |
         | updateCurrentSettingAndNotify:
         v
+-----------------------------+
| NSNotificationCenter post:  |
| kFeedSoundToggle            |
| SettingChangeNotification   |
+--------+--------------------+
         |
    +----+----+----+----+
    |    |    |    |    |
    v    v    v    v    v
  [All FBSoundToggleListener instances]
         |
         | _updateVideoMuteStateFromSettingStoreIfAllowed
         v
  [Audio State Changed]

8. Recommendations for Further Analysis

    undefined

Appendix: Key Offsets

SymbolOffset
FBVideoSoundTogglePluginSettingStore0x01c69b08
FBSoundToggleListener0x01c243c8
FBMCExperimentManager0x01cab0a8
FBMobileConfigStartupConfigs0x01c7ac78
FBMediaUploadQualitySettingsService0x01c36d98
kFeedSoundToggleSettingChangeNotification0x01dfb2a5
SoundToggleSettingOnByIgnoreHWSwitch0x01e69f84
SoundToggleSettingOnProgrammatically0x01e69fcc

Related Reports

CMSampleBuffer Processing Analysis

Ring Buffer Infrastructure Analysis

Audio Transcoding Infrastructure Analysis

Review: Additional capture logs under `./analysis/facebook/`
Phase 2

Agent Handoff Document

Phase 3 Navigation

Previous SA-021 E2EE/Noise Protocol Key Negotiation Analysis Report
Next SA-023 Extended Steganographic Analysis Report