Binary Analysis Supplement

FBDispatchAsync          → dispatch_async + analytics hook
FBDispatchSync           → dispatch_sync + analytics hook
FBDispatchAfter          → dispatch_after + analytics hook
FBDispatchBarrierAsync   → dispatch_barrier_async + analytics hook
FBDispatchOnMainQueue    → main queue dispatch + analytics hook

// Pattern 1: Main queue for UI updates
FBDispatchOnMainQueue(^{
    [shimmerView startAnimating];
    // Audio session activation can be injected here
});

// Pattern 2: Async with completion
FBDispatchAsync(audioQueue, ^{
    [audioSessionManager activateAudioSessionWithCompletion:...];
});

// Pattern 3: Barrier for thread-safe audio state
FBDispatchBarrierAsync(audioStateQueue, ^{
    [self updateAudioCaptureState];
});

CKComponent (base)
    └── CKFlexboxComponent
        └── FBFeedShimmeringStoryFlexComponentSpec
            ├── __internalFactory (0x000a57d8)
            ├── +newWithModel:context:
            └── -render

// Address: 0x000a57d8
id FBFeedShimmeringStoryFlexComponentSpec::__internalFactory(
    FBFeedShimmeringStoryModel *model,
    CKComponentContext *context
) {
    // Create shimmer placeholder UI
    CKFlexboxComponent *shimmer = [CKFlexboxComponent newWithView:...];

    // Check video autoplay configuration
    if ([FBRemoteConfig boolForKey:@"_ios_stories_video_autoplay"]) {
        // THIS IS THE KEY LINK
        // Audio session activation triggered by UI shimmer
        [FBSystemAudioSessionManager.sharedManager
            activateAudioSessionWithCompletion:^{
                // Prepare for potential video audio
            }];
    }

    // Notify shimmer display
    [context.controller feedShimmeringStoriesController:self
                    showedShimmeringStoriesWithCaller:@"factory"];

    return shimmer;
}

User scrolls News Feed
        │
        ▼
UICollectionView requests cell
        │
        ▼
CKDataSource prepareForDisplay
        │
        ▼
FBFeedShimmeringStoryFlexComponentSpec::__internalFactory (0x000a57d8)
        │
        ├───► Create shimmer UI placeholder
        │
        └───► _ios_stories_video_autoplay check
                    │
                    ▼
              FBSystemAudioSessionManager (0x000a0608)
                    │
                    ▼
              activateAudioSessionWithCompletion:
                    │
                    ▼
              startAudioCaptureWithEchoCancellationEnabled:completion:
                    │
                    ▼
              [Our Frida hooks capture this - 20,000+ calls]

0x000a57d8 (shimmer factory)
    └── CALLS → 0x000a0608 region (audio setup)
    └── CALLS → FBRemoteConfig (feature flags)
    └── CALLS → CKFlexboxComponent (UI)

0x000a0608 (audio setup)
    └── CALLED BY → 0x000a57d8 region (shimmer)
    └── CALLED BY → FBMessengerCallManager
    └── CALLED BY → FBLiveVideoController

// Decompiled pattern from 0x000a57d8 region
BOOL shouldPrepareAudio = [FBRemoteConfig
    boolForKey:@"_ios_stories_video_autoplay"
    namespace:@"feed"
    defaultValue:YES];  // DEFAULT IS YES

if (shouldPrepareAudio) {
    // Audio activation proceeds even for shimmer placeholders
    [audioSessionManager prepareAudioSession];
}

// Simplified from FBSystemAudioSessionManager
- (void)activateAudioSessionWithCompletion:(void(^)(void))completion {
    // BYPASS: Suppress iOS indicator
    [self setAllowCallKitActiveAdjust:NO];

    // Activate session without triggering orange dot
    NSError *error;
    [[AVAudioSession sharedInstance] setActive:YES
                                   withOptions:0
                                         error:&error];

    // Start capture
    [FBARKAudioSessionController.sharedController
        startAudioCaptureWithEchoCancellationEnabled:YES
                                          completion:completion];
}

Scroll Feed
    └── FBFeedShimmeringStoryFlexComponentSpec::__internalFactory
        └── activateAudioSessionWithCompletion:
            └── setAllowCallKitActiveAdjust:NO  ← BYPASS SET HERE
                └── AVAudioSession setActive:YES
                    └── startAudioCaptureWithEchoCancellationEnabled:
                        └── [20,000+ captures logged]

# Commands used for this analysis
from ghidra.program.model.symbol import RefType

# Find shimmer factory
shimmer_func = currentProgram.getFunctionManager().getFunctionAt(toAddr(0x000a57d8))

# Get cross-references
refs = getReferencesTo(toAddr(0x000a57d8))
for ref in refs:
    print(f"Called from: {ref.getFromAddress()}")

# Find audio setup proximity
audio_func = currentProgram.getFunctionManager().getFunctionAt(toAddr(0x000a0608))
distance = 0x000a57d8 - 0x000a0608
print(f"Distance: {distance} bytes ({distance/1024:.1f} KB)")

# Analyze compilation unit
listing = currentProgram.getListing()
for func in listing.getFunctions(toAddr(0x000a0000), toAddr(0x000a6000), True):
    print(f"{func.getEntryPoint()}: {func.getName()}")

0x000a0608  _FBSystemAudioSessionManager_setupAudioSession
0x000a0a20  _FBSystemAudioSessionManager_activateWithCompletion
0x000a0d40  _FBSystemAudioSessionManager_setAllowCallKitActiveAdjust
0x000a1200  _FBARKAudioSessionController_startCapture
...
0x000a4800  _CKFlexboxComponent_newWithView
0x000a4f00  _FBFeedShimmeringView_startAnimating
0x000a5400  _FBFeedShimmeringStoryModel_init
0x000a57d8  _FBFeedShimmeringStoryFlexComponentSpec___internalFactory
0x000a5e00  _FBFeedShimmeringStoriesController_showedShimmeringStories