Agent Handoff Document

Primary Analysis:
./analysis/facebook/345.0/Facebook.app/

Secondary Analysis:
./tools/nuked-ipas/instagram/

Reports Output:
./analysis/facebook/345.0/ANALYSIS/
├── reports/           <- Technical findings
├── regulatory/        <- Legal/compliance evidence
└── public/            <- Public disclosure drafts

// ReactMobileConfigMetadata.json lines 334-343
"ama_hide_camera_permissions_dialog_apple_hig:enabled": {
  "defaultValue": true  // <- DEFAULT is to HIDE
}

// PHASE 2 FINDING: Full disassembly at 0x100358c2c
Swizzle IMP:
  mov x0, x2           ; Pass completion handler
  ldr x2, [x2, #0x10]  ; Extract callback
  mov x1, #0           ; Set status to 0 (BYPASS)
  br x2                ; Branch directly to callback

// Key addresses:
category_t:           0x10050f9d8
Swizzle IMP:          0x100358c2c
class_replaceMethod:  0x1003EDCD8

// CORRECTION: activateSilently is 2FA/Code Generator, NOT audio
// REAL audio activation methods:
startSessionWithBlock:isCasting:enableBackgroundAudio:  <- PRIMARY
setEnableBackgroundAudio:
FBSystemAudioSessionManager
cumulativeBackgroundAudioTime  (CONFIRMED at offset 0x66a7be)
AVAudioSessionCategoryPlayAndRecord

prefetch_typing: true (DEFAULT)
prefetch_typing_idletimeout: 800ms
keyboard_banging_regex_negative
offensive_regex_negative

<!-- Info.plist -->
com.facebook.papaya.power0-network0  (battery, offline)
com.facebook.papaya.power0-network1  (battery, online)
com.facebook.papaya.power1-network0  (charging, offline)
com.facebook.papaya.power1-network1  (charging, online)

// 6-tier fallback hierarchy when ATT denied:
1. IDFA (when ATT authorized)
2. FBFamilyDeviceID (cross-app shared container)
3. FBSecureFamilyDevice (keychain stored)
4. app_scoped_device_id
5. backup_app_device_id
6. security_device_id (keychain)

// Shared containers for cross-app tracking:
group.com.facebook.family
group.com.facebook.family.securefamilydeviceid
group.com.facebook.family.appgrouptokenshare
group.com.facebook.family.instagramtokenshare.service

getBoolWithoutLogging
getDoubleWithoutLogging
getStringWithoutLogging
getInt64WithoutLogging

defcon_level_updated_silent_push
silent_plugins_enabled
pcm_send_conversions_from_nse

# Extract strings from main binary
strings /path/to/Facebook > strings_output.txt

# Search for specific patterns
grep -i "activateSilently\|WithoutLogging\|swizzle" strings_output.txt

# For frameworks with encoding issues
cat /path/to/binary | tr -d '\0' | grep -ao 'pattern.\{0,50\}'

# Search ReactMobileConfigMetadata.json
grep -n "hide_camera\|skip_privacy\|suppress" ReactMobileConfigMetadata.json

# Search params_map.txt
grep -n "bypass\|suppress\|silent\|without" params_map.txt

# Permission Bypass
ama_hide_camera_permissions_dialog
PHPhotoLibraryPreventAutomaticLimitedAccessAlert
skip_privacy_dialog
suppress_*

# ATT Bypass (KEY ADDRESSES FROM PHASE 2)
swizzle                     # Swizzle IMP: 0x100358c2c
ATTrackingManager           # category_t: 0x10050f9d8
adTracking                  # class_replaceMethod: 0x1003EDCD8
class_replaceMethod

# Silent Operations
# CORRECTION: activateSilently is 2FA, use these instead:
startSessionWithBlock:isCasting:enableBackgroundAudio:  # REAL audio activation
WithoutLogging
silent_push
defcon_level

# Background Execution
cumulativeBackgroundAudioTime  # CONFIRMED: offset 0x66a7be
cumulativeBackgroundTime
timeContributionFrom*
beginBackgroundTask
PushKit

# Audio/Microphone (CORRECTED)
AVAudioSession
enableBackgroundAudio          # PRIMARY audio enable
setEnableBackgroundAudio:
FBSystemAudioSessionManager    # MAIN audio class
FBSpeechHelper
FNFOpusDecoder

# Tracking Persistence (PHASE 2 COMPLETE)
FBFamilyDeviceID              # Primary fallback
FBSecureFamilyDevice          # Keychain fallback
app_scoped_device_id
backup_app_device_id
security_device_id
analytics_device_id
platformFamily
keychain
group.com.facebook.family     # Cross-app container