1. Microphone Capture Methods Line 30
| Method | Class | Address | Purpose | Source |
|--------|-------|---------|---------|--------|
| `startAudioCaptureWithEchoCancellationEnabled:completion:` | FBCCAudioCapturer | 0x0000e38c | Primary capture start | SA-002, H5 |
| `stopAudioCaptureWithCompletion:` | FBCCAudioCapturer | - | Stop audio capture | SA-004 |
| `isAudioCaptureRunning` | FBCCAudioCapturer | - | Capture state check | SA-002, H5 |
| `createAudioPipelineIfNecessaryAndResume` | FBCCAudioPipelineController | - | Pipeline creation/resume | H5 |
| `_startAudioPipelineCaptureWithCompletion:` | FBCaptureManager | - | Pipeline capture start | SA-012 |
| `_createAudioCapturerWithCameraConfiguration:audioPipelineProviding:` | FBCaptureManager | - | Create audio capturer | Transcoding |
| `_configureAudioCaptureSessionInputOutput` | FBCaptureManager | - | Configure capture I/O | Transcoding |
| `enableEditingMicrophoneVolume:volumeMultiplier:` | Unknown | - | Mic volume manipulation | H5, Runtime |
| `audioCaptureIgnoreRTCClientNotification` | FBARKAudioSessionController | - | Bypass RTC notifications | SA-011, Ring-Buffer |
| `captureOutput:didOutputSampleBuffer:fromConnection:` | AVCaptureAudioDataOutputSampleBufferDelegate | - | iOS delegate callback | CMSampleBuffer |
2. Audio Pipeline Classes Line 47
| Class | Address | Purpose | Concern Level | Source |
|-------|---------|---------|---------------|--------|
| `FBCCAudioCapturer` | 0x01c52818 | Primary audio capture engine | CRITICAL | SA-005 |
| `FBCCAudioDataPipe` | 0x01c510f8 | Audio data streaming pipe | HIGH | SA-005 |
| `FBCCAudioPipelineController` | - | Pipeline state management | HIGH | SA-012 |
| `FBCCAudioPipelineProvider` | 0x01c823d8 | Audio pipeline factory | HIGH | SA-005 |
| `FBCCAudioPipelineControllingListeningAnnouncer` | 0x01c9af50 | Pipeline state announcer | MEDIUM | SA-005 |
| `FBSystemAudioSessionManager` | 0x01c89f98 | Central audio session control | CRITICAL | SA-005, SA-011 |
| `FBSystemAudioCaptureSessionInteractor` | 0x01c82298 | Direct capture session interface | CRITICAL | SA-005, SA-011 |
| `FBARKAudioSessionController` | 0x01c4c148 | AR audio session (category spoofing) | CRITICAL | SA-005, SA-011 |
| `FBAudioSessionManager` | - | Audio session management | HIGH | SA-004 |
| `FBAudioBufferHandler` | - | Audio buffer callbacks | HIGH | CMSampleBuffer |
| `FBAudioEchoCanceller` | - | Echo cancellation | MEDIUM | Transcoding |
| `FBAudioMuteController` | - | Audio mute control | MEDIUM | SA-004 |
| `FBMicrophonePermissionsManager` | - | Microphone permissions | MEDIUM | SA-004 |
| `FBBackgroundAudio` | - | Background audio subsystem | HIGH | SA-004, SA-005 |
| `FBFeedAudioSessionClient` | - | Feed audio session client | HIGH | H5, Runtime |
| `FBSpeechHelperAudioRecorder` | - | Speech audio recording | HIGH | SA-005 |
| `FBSpeechHelperEncodingOpusConverter` | - | OPUS encoding | HIGH | SA-005 |
| `FBSpeechHelperH2ServerSocket` | - | HTTP/2 server socket | CRITICAL | SA-005 |
| `FNFAudioQueue` | - | Audio queue infrastructure | HIGH | Ring-Buffer |
| `FNFOpusDecoder` | - | OPUS codec decoder | MEDIUM | SA-005 |
| `FNF360AudioEngine` | - | 360 spatial audio | LOW | Transcoding |
3.1 Triple-Buffer Architecture Line 77
| Component | Value | Source |
|-----------|-------|--------|
| Buffer structure | `[3{AQBufferState}]` | Ring-Buffer |
| Buffer state fields | `bufferRef`, `timestamp`, `enqueued`, `displayFramePts` | Ring-Buffer |
| Parameters structure | `{AQBufferParameters="bufferSize"I"packetCount"I}` | Ring-Buffer |
| Cycling rate | 9,900+ events in 35 seconds | Runtime | 3.2 Buffer Methods Line 86
| Method | Purpose | Source |
|--------|---------|--------|
| `_readDataIntoBuffer` | Key buffer filling function | SA-010 |
| `_createAudioQueue` | Create audio queue | SA-010 |
| `AudioQueueAllocateBufferWithPacketDescriptions` | iOS AudioQueue API | SA-010 |
| `_audioBufferCallback` | Main audio buffer callback | Ring-Buffer |
| `_audioBufferCallbackOutput` | Buffer output destination | Ring-Buffer |
| `_audioBufferCallbackQueue` | Dispatch queue for callbacks | Ring-Buffer |
| `setAudioBufferCallbackWithQueue:completion:` | Callback routing setup | Ring-Buffer |
| `_audioBufferDidEnqueue:actualStartTime:lastFramePts:` | Post-enqueue notification | Ring-Buffer |
| `_audioPutDataIntoBufferCallback:timestamp:framePts:isfirstPacket:` | Buffer fill callback | Ring-Buffer |
| `_audioEnqueueFrameDataCallback:metadata:` | Frame data with metadata | Ring-Buffer |
| `audioQueueConverterOutputCallback:forBuffer:` | Codec conversion output | Ring-Buffer |
| `_saveAudioBuffer:` | Local buffer storage | CMSampleBuffer |
| `audioBufferDidEnqueue:actualStartTime:lastFramePts:` | Enqueue for processing | CMSampleBuffer |
| `audioBufferIsFull` | Buffer full check | Ring-Buffer |
| `_currentAudioBufferIndex` | Current buffer index | Ring-Buffer |
| `_activeBufferIndex` | Active buffer index | Ring-Buffer |
3.3 Ring Buffer Paths Line 107
| Function | Purpose | Source |
|----------|---------|--------|
| `getRingBufferPath()` | Standard ring buffer location | Ring-Buffer |
| `getLargeRingBufferPath()` | Extended capacity buffer | Ring-Buffer |
| `getAlternateRingBufferPath()` | Fallback/secondary buffer | Ring-Buffer |
3.4 Data Pipes Line 115
| Pipe | Purpose | Source |
|------|---------|--------|
| `audioDataPipe` | Primary audio data flow | Ring-Buffer |
| `videoDataPipe` | Video data flow | Ring-Buffer |
| `platformAlgorithmDataPipe` | ML/processing pipeline | Ring-Buffer |
| `lightEstimationDataPipe` | Environment sensing | Ring-Buffer |
| `worldTrackingFrameDataPipe` | AR tracking data | Ring-Buffer |
4.1 Key Derivation Line 129
| Component | Address | Purpose | Source |
|-----------|---------|---------|--------|
| `walibra_hkdf_info` | 0x01503628 | HKDF implementation | SA-006 |
| `walibra_derive_key` | - | Key derivation function | SA-006 |
| `audioEncryptionKey` | - | Audio encryption key storage | H3 |
| `audioWithAudioEncryptionKey:audio:` | 0x00e32d5c | Audio encryption application | SA-006, SA-002 |
| `encryptionKeyWithData:` | - | Key generation from data | SA-006 |
4.2 Decryption Methods Line 139
| Method | Address | Purpose | Source |
|--------|---------|---------|--------|
| `decrypt:keyId:iv:error:` | 0x01076a18 | Primary decryption with key ID and IV | SA-006 |
| `_decryptFrame:metaData:track:error:` | 0x0119fd80 | Frame-level decryption | SA-006 |
4.3 Encryption Classes Line 146
| Class | Purpose | Source |
|-------|---------|--------|
| `MNSecureOutgoingAttachmentContent` | Secure attachment wrapper | SA-006 |
| `MNSecureMessagingAttachmentEncryptionConfig` | Encryption configuration | SA-006 |
| `FBDrmLicenseLoader` | DRM license management | SA-006 |
| `FNFDashDecryptor` | DASH content decryption | SA-006 |
4.4 Encryption Parameters Line 155
| Parameter | Value | Source |
|-----------|-------|--------|
| Algorithm | AES-256-GCM | SA-006 |
| Key Size | 256-bit | SA-006 |
| IV Source | Per-frame generated | SA-006 |
| Mode | GCM (Galois/Counter Mode) | SA-006 |
| Protocol | E2EE/Noise protocol integration | SA-006 |
4.5 Encryption Layers (Triple-Layer) Line 165
| Layer | Purpose | Source |
|-------|---------|--------|
| Layer 1 | E2EE frame encryption | H3 |
| Layer 2 | SRTP encryption | H3 |
| Layer 3 | DTLS Transport (TLS 1.2) | H3 |
5.1 Upload Classes Line 177
| Class | Address | Purpose | Source |
|-------|---------|---------|--------|
| `FBSnacksThreadMediaPostMedia` | 0x003d1ae0 | Network upload function | SA-001, SA-002 |
| `FBSnacksEditingAttachmentFromMediaAttachment` | 0x00def958 | Editing attachment upload | SA-001 |
| `FBSnacksSurfaceLoggingCreateImpressionLogAttachment` | 0x010cf820 | Impression logging | SA-001 |
| `FBOptimisticPostingCoordinator` | 0x0004c3a0 | Optimistic posting | SA-002 |
| `FBOptimisticPostingCoordinationAnnouncerForSession` | 0x0004c7e8 | Posting announcer | SA-002 |
| `FBMediaUploadManager` | - | Chunk-based upload | SA-009 |
| `FBStoryUpload*` classes | - | Story upload orchestration | SA-008 |
| `FBComposerPublish*` classes | - | Publishing with media | SA-008 |
| `FBDraft*` classes | - | Draft saving with embeddings | SA-008 |
| `CreateInspirationEditingAttachmentMutation` | 0x0091b8a4 | GraphQL mutation | CMSampleBuffer |
5.2 Upload Addresses Line 192
| Address | Function | Source |
|---------|----------|--------|
| **0x12e5fa4** | Central upload dispatcher | SA-009 |
| **0xb7a50** | Upload session creation | SA-009 |
| **0x1a15d0** | Upload processor | SA-009 |
| **0x144464** | Format metadata extraction | SA-009 |
| **0x1b84000 + 0x928** | Upload method selector | SA-009 |
5.3 Media Upload Flag Line 202
| Location | Purpose | Source |
|----------|---------|--------|
| Object offset 0x56 | Determines if media should be uploaded | SA-009 |
5.4 Network Endpoints Line 208
| Endpoint | Purpose | Source |
|----------|---------|--------|
| `graph.facebook.com` | GraphQL API | SA-002 |
| `shortwave.facebook.com` | WebSocket traffic | H3 |
5.5 GraphQL Fields Line 215
| Field | Purpose | Source |
|-------|---------|--------|
| `music_embeddings_for_editing_attachment` | Audio embeddings in GraphQL | SA-001 |
| `visualEmbeddings` | Visual embeddings upload | SA-008 |
6. Bridge Functions Line 224
| Bridge | Address | Size | Purpose | Source |
|--------|---------|------|---------|--------|
| Bridge 1: VideoKind | 0x00b10b2c | 68 bytes | Video type annotation | SA-002, SA-009 |
| Bridge 2: Anonymous | 0x010a2e08 | - | Ad tracking channel routing | SA-002, SA-009 |
| Bridge 3: CMSampleBuffer | 0x0018f5d8 | - | CMSampleBuffer format validation | SA-002, SA-009 |
| Bridge 4: FBMediaData | 0x001a0e20 | - | Media data to upload session | SA-002, SA-009 |
| Bridge 5: OGVBuffer | 0x011eec1c | - | Timing extraction & encoding prep | SA-002, SA-009 |
7.1 Master Audio Flags Line 255
| Flag | Address | Type | Purpose | Source |
|------|---------|------|---------|--------|
| `_FBCCMobileConfigEnableFBAudio` | 0x39066340 | MobileConfig | **Master audio enable switch** | H5, SA-004, SA-012 |
| `_FBCCMobileConfigEnableFBAudioForCaptureInARAds` | 0x38941125 | MobileConfig | Audio capture for AR ads | H5, SA-012 |
| `enableMicInPreview` | 0x36710792 | FBCCAudioPipelineConfiguration | Mic during camera preview | H5 |
| `enableBackgroundAudio` | Multiple | FBMobileConfigOptions | Background audio recording | H5, SA-004 |
| `isAudioPipelineStateMachineEnabled` | - | FBCCAudioPipelineConfiguration | Pipeline state machine | H5 |
7.2 FBCCAudioPipelineConfiguration (10 Boolean Flags) Line 265
| Flag | Type | Remote Controlled | Source |
|------|------|-------------------|--------|
| `enableMicInPreview` | BOOL | YES | H5 |
| `startOutputOnStartInput` | BOOL | YES | H5 |
| `startOutputOnSubgraphInsert` | BOOL | YES | H5 |
| `enableSetAudioMixing` | BOOL | YES | H5 |
| `enableFBAAllowSpeakerDuringRecording` | BOOL | YES | H5 |
| `enableFBAShouldPauseBackgroundWhenApplyingEffect` | BOOL | YES | H5 |
| `enablePushGraph` | BOOL | YES | H5 |
| `isUsingCameraAudioManager` | BOOL | YES | H5 |
| `isAudioPipelineStateMachineEnabled` | BOOL | YES | H5 |
| `shouldConfigureStereoCapture` | BOOL | YES | H5 |
7.3 Sound Toggle Settings Enum (0x31891422) Line 280
| Value | Purpose | Source |
|-------|---------|--------|
| `SoundToggleSettingOff` | Sound off | H5 |
| `SoundToggleSettingOnByToggle` | User toggle | H5 |
| `SoundToggleSettingOnByToggleManual` | Manual toggle | H5 |
| `SoundToggleSettingOnByPreference` | By preference | H5 |
| `SoundToggleSettingOnByIgnoreHWSwitch` | Ignore hardware switch | H5 |
| `SoundToggleSettingOnByVolumeRocker` | Volume rocker | H5 |
| **`SoundToggleSettingOnProgrammatically`** | **SERVER CONTROLLED** | H5, SA-012 |
| `SoundToggleSettingUnset` | Unset | H5 |
| `SoundToggleSettingUnsetByCasting` | Unset by casting | H5 |
| `SoundToggleSettingUnsetByBackgroundAudio` | Unset by background | H5 |
7.4 Server Push Infrastructure Line 295
| Component | Address Range | Purpose | Source |
|-----------|---------------|---------|--------|
| MQTT Infrastructure | 0x32038144+ | Real-time bidirectional messaging | H5, SA-012 |
| Silent Push | 0x32811862 | Background config refresh | H5, SA-012 |
| GraphQL Subscription | 0x34907354 | Live updates subscription | H5, SA-012 |
| Background Fetch | 0x34884139+ | Periodic refresh | H5 |
| `syncConfig` | 0x34040108+ | Config sync | SA-012 |
7.5 Kill Switch Infrastructure Line 305
| Component | Address | Purpose | Source |
|-----------|---------|---------|--------|
| `_killSwitchToggled:` | 0x33847876 | Kill switch toggle handler | H5 |
| `setKillSwitchEnabled:` | 0x33848217 | Enable/disable kill switch | H5 |
| `FBClashManagementInternalSettingsKillSwitchActiveKey` | - | Internal kill switch | SA-004 |
| `_ios_composer_killswitches` | - | Composer kill switches | SA-004 |
7.6 Auto-Activation Triggers Line 314
| Trigger | Class | Purpose | Source |
|---------|-------|---------|--------|
| `newsFeedWasPresented` | FBFeedAudioSessionClient | Audio activated when feed visible | H5, Runtime |
| `_applicationDidBecomeActive` | FBFeedAudioSessionClient | Audio reactivated on foreground | H5 |
| `_activateFeedAudioClient:` | 0x001d9450 | Internal activation method | H5 |
8.1 Primary Suppression Flag Line 326
| Flag | Hex ID | Config Path | Type | Default | Source |
|------|--------|-------------|------|---------|--------|
| `should_hide_microtray` | 0x2942 | `marketplace_growth_notification:should_hide_microtray` | boolValue | false | H2 |
8.2 Related Suppression Flags Line 332
| Flag | Hex ID | Purpose | Source |
|------|--------|---------|--------|
| `microtray_border_fix` | 0x2943 | UI adjustment for microtray | H2 |
| `twilight_can_access_setting_voice_log` | 0x27c6 | Voice logging access control | H2 |
| `skip_privacy_dialog` | 0x29db | Bypass privacy prompts | H2 |
| `skip_privacy_dialog_v2` | 0x29dc | Updated bypass mechanism | H2 |
8.3 UI Suppression Methods Line 341
| Method | Purpose | Source |
|--------|---------|--------|
| `_setIsTrayVisible:` | Tray visibility control | H2 |
| `setIsTrayVisible:` | Tray visibility setter | H2 |
| `isTrayVisible` | Tray visibility getter | H2 |
| `tray_not_visible` | Tray hidden state | H2 |
| `tray_no_longer_visible` | Tray hiding event | H2 |
| `_reRankBucketsWhenTrayIsNotVisible` | Bucket reranking | H2 |
| `trayVisibilityChangedWithTrayLogInfo:visible:` | Visibility change handler | H2 |
8.4 UI Elements Affected Line 353
| Element | Evidence | Source |
|---------|----------|--------|
| Microtray | `should_hide_microtray`, `microtray_border_fix` | H2 |
| Privacy indicator | `privacyIndicatorUnit`, `story_viewer_privacy_indicator` | H2 |
| Status bar | `shouldHideStatusBar`, `hideStatusBar`, `isHidingStatusBar` | H2, SA-004 |
| Recording indicators | `shouldShowIndicatorExpansion`, `shouldShowStartIndicator` | H2 |
| Attribution | `isAttributionSuppressedValue` | SA-004 |
8.5 Privacy Bypass Evidence Line 363
| String | Purpose | Source |
|--------|---------|--------|
| `Passed Privacy Consent GK but could not find Plugin. Skipping Privacy Consent step.` | Privacy consent bypass | SA-004 |
| `allowPrivacyEducation` | Allow/disallow privacy education | SA-004 |
| `privacySettingSavePermission` | Privacy setting save | SA-004 |
| `openCameraWithoutPromptingClearMediaSelection` | Camera without prompt | H5 |
| `post_without_prompt` | Post without prompt | H5 |
9.1 GPU Filter Classes Line 377
| Class | Address | Purpose | Source |
|-------|---------|---------|--------|
| `FBDynamicImageOverlayFilter` | 0x01c7b678 | GPU filter for overlay | SA-001, SA-007 |
| `FBDynamicImageOverlayModel` | 0x01c7b6c8 | Overlay data model | SA-001 |
| `FBDynamicImageOverlayPosition` | 0x01c7b718 | Overlay positioning | SA-001 |
| `FBOpenGLFilter` | - | Base class | SA-001 |
| `FBImageOverlayFilter` | - | Image overlay with audio sync | SA-007 |
9.2 GPU Shader Methods Line 387
| Method | Address | Purpose | Source |
|--------|---------|---------|--------|
| `init` | 0x00b4e148 | Initialize filter | SA-007 |
| `setParameters:` | 0x00b4e1a4 | Set overlay parameters | SA-007 |
| `fullVertexShader` | 0x00b4e480 | Get vertex shader source | SA-007 |
| `fullFragmentShader` | 0x00b4e4d8 | Get fragment shader source | SA-007 |
| `render:to:program:time:` | 0x00b4e664 | Main render method | SA-007 |
| `metalVertexShader` | 0x00c40d54 | Metal vertex shader | SA-007 |
| `metalFragShader` | 0x00c40d40 | Metal fragment shader | SA-007 |
9.3 extractFromSample Shader (CRITICAL) Line 399
| Parameter | Value | Source |
|-----------|-------|--------|
| Pixel samples | 14 locations | SA-007 |
| Channels per pixel | 3 (BGR) | SA-007 |
| Bits per float | ~42 | SA-007 |
| Floats per frame | 2 (X, Z offsets) | SA-007 |
| **Total bits per frame** | **84 bits** | SA-007 |
9.4 Steganographic Capacity Line 409
| Duration | Capacity | Source |
|----------|----------|--------|
| 1 second (30 FPS) | 2,520 bits (315 bytes) | SA-007 |
| 1 minute | 151,200 bits (18.9 KB) | SA-007 |
| 10 minutes | 1.51 Mbit (189 KB) | SA-007 |
9.5 Audio Frame Checksum Infrastructure Line 417
| Method | Address | Purpose | Source |
|--------|---------|---------|--------|
| `init` | 0x0044f688 | Initialize buffer | SA-007 |
| `resetBuffer` | 0x0044f8a8 | Clear buffer | SA-007 |
| `addChecksum:forPresentationTimeMs:` | 0x00c264bc | Add checksum at timestamp | SA-007 |
| `getAudioFrameChecksumsForPresentationTimeMs:numElements:` | 0x00c26110 | Retrieve checksums | SA-007 |
9.6 Embedding Evidence Line 426
| Parameter | Value | Source |
|-----------|-------|--------|
| `disableUploadOverlayInputData` | Boolean (default FALSE = upload enabled) | SA-001 |
| `should_fetch_audio_frame_hashes` | Flag | SA-007 |
| `audioFrameHashes` | Storage | SA-007 |
| `audioFrameChecksumBuffer` | Buffer class | SA-007 |
9.7 ML Embedding Infrastructure Line 435
| Class | Purpose | Source |
|-------|---------|--------|
| `FBMediaAnalyzerXRayInput` | Audio input processing | SA-001 |
| `FBMediaAnalyzerXRayOutput` | Embedding output | SA-001, SA-008 |
| `FBMediaAnalyzerXRayConcept` | Concept classification | SA-001, SA-008 |
| `FBMediaAnalyzerProcessorBase` | Base processor | SA-008 |
| `FBARXRayRemoteAssetsModels` | Remote-loaded XRay models | SA-008 |
| `FBInspirationEditorXRayProcessor` | XRay editing processor | SA-008 |
| `setXrayEmbedding:` | Store computed embeddings | SA-001 |
9.8 Model Files Line 447
| File | Location | Format | Source |
|------|----------|--------|--------|
| `aml_fd_model_v1.bin` | `FBSharedFramework/Unzipped/` | Caffe2/PyTorch Mobile | SA-008 |
| `xraymobile_v3_embedding_calibrated` | - | On-device ML model | SA-001 |
10.1 Categories Found Line 458
| Category | Address | Mic Required | Source |
|----------|---------|--------------|--------|
| `AVAudioSessionCategoryAmbient` | 0x02554d5f | NO | SA-011 |
| `AVAudioSessionCategoryPlayAndRecord` | 0x025d4e6b | **YES** | SA-011 |
| `AVAudioSessionCategoryPlayback` | 0x025b3bf6 | NO | SA-011 |
| `AVAudioSessionCategoryRecord` | 0x025d4e4d | **YES** | SA-011 |
| `AVAudioSessionCategorySoloAmbient` | 0x02554d7e | NO | SA-011 |
10.2 Audio Session Modes Line 468
| Mode | Purpose | Source |
|------|---------|--------|
| `AVAudioSessionModeVoicePrompt` | Minimal UI - quick voice commands | H2 |
| `AVAudioSessionModeDefault` | Standard behavior | H2 |
| `AVAudioSessionModeVideoChat` | Full indicator | H2 |
| `AVAudioSessionModeVideoRecording` | Recording mode | SA-005 |
| `AVAudioSessionModeVoiceChat` | Voice chat mode | SA-005 |
10.3 Category Spoofing Methods Line 478
| Method | Address | Purpose | Source |
|--------|---------|---------|--------|
| `_updateAVAudioSessionProperties:active:activeOptions:category:categoryOptions:preferredInputOrientations:forceupdate:mode:categoryUpdated:clientIsCasting:prefersExternalMic:error:` | 0x000a7ab4 | Dynamic category setting | SA-011 |
| `propertiesForClients:routeIsExternal:active:activeOptions:category:categoryOptions:mode:...` | 0x000a6e70 | Consolidate audio requirements | SA-011 |
| `updateAVAudioSessionWithCategory:mode:options:completion:` | 0x00e8a06c | Update category dynamically | SA-011 |
10.4 Spoofing Parameters Line 486
| Parameter | Purpose | Source |
|-----------|---------|--------|
| `shouldBeHandsOff` | Audio session control opaque | SA-011 |
| `shouldEnableStereoCapture` | Enable stereo mic capture | SA-011 |
| `clientIsCasting` | Casting mode (different path) | SA-011 |
| `allowMixin` | Allow mixing with other audio | SA-011 |
11.1 CMSampleBuffer APIs Line 499
| API | Address | Purpose | Source |
|-----|---------|---------|--------|
| `CMSampleBufferCreate` | 0x0132826c | Create sample buffer | SA-002 |
| `CMAudioSampleBufferCreateReadyWithPacketDescriptions` | 0x013281ac | Create audio sample buffer | SA-002 |
| `CMSampleBufferGetAudioBufferListWithRetainedBlockBuffer` | 0x013282a8 | **Extract raw PCM audio** | SA-002, CMSampleBuffer |
| `CMSampleBufferGetFormatDescription` | 0x013282d8 | Get format info | SA-002 |
| `CMSampleBufferGetImageBuffer` | 0x013282e4 | Get image buffer | SA-002 |
| `CMSampleBufferCreateForImageBuffer` | 0x01328284 | Create for image | SA-002 |
| `CMSampleBufferGetDataBuffer` | - | Extract raw audio data | CMSampleBuffer |
| `CMSampleBufferGetNumSamples` | - | Get sample count | CMSampleBuffer |
| `CMSampleBufferGetSampleTimingInfoArray` | - | Get timing info | SA-009 |
11.2 Audio Format APIs Line 513
| API | Purpose | Source |
|-----|---------|--------|
| `CMAudioFormatDescriptionGetStreamBasicDescription` | Get AudioStreamBasicDescription | CMSampleBuffer |
| `CMAudioFormatDescriptionCreate` | Create format description | CMSampleBuffer |
| `CMFormatDescriptionGetMediaType` | Get media type | CMSampleBuffer |
| `CMFormatDescriptionEqual` | Compare formats | SA-009 |
| `CMVideoFormatDescriptionGetDimensions` | Get video dimensions | SA-009 |
| `CMVideoFormatDescriptionGetPresentationDimensions` | Get presentation dimensions | SA-009 |
| `CMTimeGetSeconds` | Convert CMTime to seconds | SA-009 |
11.3 Block Buffer APIs Line 525
| API | Purpose | Source |
|-----|---------|--------|
| `CMBlockBufferGetDataPointer` | Direct memory access | SA-002 |
11.4 Pixel Buffer APIs Line 531
| API | Purpose | Source |
|-----|---------|--------|
| `CVPixelBufferLockBaseAddress` | Lock for access | SA-007 |
| `CVPixelBufferUnlockBaseAddress` | Unlock after access | SA-007 |
| `CVPixelBufferGetBaseAddress` | Get base address | SA-007 |
| `CVPixelBufferGetBaseAddressOfPlane` | Get plane address | SA-007 |
11.5 Audio Processing Taps Line 540
| API | Purpose | Source |
|-----|---------|--------|
| `MTAudioProcessingTapCreate` | Apple's audio tap creation | Transcoding |
| `MTAudioProcessingTapGetSourceAudio` | Get source audio | Transcoding |
| `MTAudioProcessingTapGetStorage` | Get tap storage | Transcoding |
| `FBAudioProcessingTapCreate` | **Facebook's custom tap wrapper** | Transcoding |
11.6 Key Processing Functions Line 549
| Function | Address | Size | Purpose | Source |
|----------|---------|------|---------|--------|
| `FUN_011fd534` | 0x011fd534 | 484 bytes | **Primary audio extractor** | SA-002, CMSampleBuffer |
| `FUN_011de1d0` | 0x011de1d0 | 208 bytes | Audio normalization | SA-002, CMSampleBuffer |
| `FUN_001a1720` | 0x001a1720 | - | Direct buffer access | CMSampleBuffer |
| `FUN_002c5834` | 0x002c5834 | - | Audio/Video decoding | CMSampleBuffer |
| `FUN_00756f14` | 0x00756f14 | - | Sample timing extraction | CMSampleBuffer |
| `FBSampleBufferCreateFromPixelBuffer` | 0x00b39058 | - | Create from pixel buffer (stego path) | CMSampleBuffer |
12.1 Call Counts (Passive Browsing) Line 564
| Method | Count | Context | Source |
|--------|-------|---------|--------|
| `startAudioCaptureWithEchoCancellationEnabled:` | **50,700+** | Passive feed browsing | H5, Runtime |
| `enableEditingMicrophoneVolume:volumeMultiplier:` | 50,700+ | Mic volume manipulation | H5, Runtime |
| `isAudioCaptureRunning` | **874,700+** | Polling loop | H5, Runtime |
| `createAudioPipelineIfNecessaryAndResume` | 600+ | Pipeline creation | H5, Runtime |
| `rtcClientDeactivated` | **9,900+** | In 35 seconds | Ring-Buffer, Runtime |
| Background wakeups | **3,751/sec** | 25x over iOS limit (150/sec) | Runtime |
12.2 Crash Log Analysis Line 575
| Metric | Value | Source |
|--------|-------|--------|
| Crash samples analyzed | 16 | Runtime |
| AVAudioSession thread present | 14/16 (**87.5%**) | Runtime |
12.3 Runtime States Line 582
| State | Value | Duration | Source |
|-------|-------|----------|--------|
| `allowCallKitActiveAdjust` | false | 39+ minutes | Runtime |
| `isCallKitActive` | null | Throughout | Runtime |
| Category declared | Ambient | Continuous | Runtime |
| Category actual | PlayAndRecord via FBARK | Continuous | Runtime |
12.4 TCC Permissions Line 591
| Permission | Value | Meaning | Source |
|------------|-------|---------|--------|
| Microphone | auth=2 | ALLOWED | Runtime |
| Camera | auth=2 | ALLOWED | Runtime |
| Contacts | auth=2 | ALLOWED | Runtime |
| Photos | auth=3 | LIMITED | Runtime |
13.1 Tier 1 - Critical Functions Line 604
| Address | Function | Hypothesis | Source |
|---------|----------|------------|--------|
| 0x12e5fa4 | Central upload dispatcher | H4 | SA-009 |
| 0xb7a50 | Upload session creation | H4 | SA-009 |
| 0x011fd534 | Primary audio extractor | H1, H3, H4 | SA-002 |
| 0x000a7ab4 | Dynamic category setter | H2 | SA-011 |
| 0x00e32d5c | Audio encryption key application | H3 | SA-006 |
13.2 Tier 2 - Supporting Functions Line 614
| Address | Function | Purpose | Source |
|---------|----------|---------|--------|
| 0x01c7b678 | FBDynamicImageOverlayFilter | GPU stego filter | SA-001 |
| 0x003d1ae0 | FBSnacksThreadMediaPostMedia | Network upload | SA-001 |
| 0x00a4a408 | FBVideoTranscoderSetupReaderAudioOutput | Transcoding | SA-002 |
| 0x011de1d0 | Audio normalization | Processing | SA-002 |
| 0x0119fd80 | Frame-level decryption | Encryption | SA-006 |
| 0x01076a18 | Primary decryption | Encryption | SA-006 |
| 0x01503628 | walibra_hkdf_info | Key derivation | SA-006 |
13.3 Tier 3 - Bridge Functions Line 626
| Address | Function | Source |
|---------|----------|--------|
| 0x00b10b2c | VideoKind annotation | SA-009 |
| 0x010a2e08 | Anonymous bridge | SA-009 |
| 0x0018f5d8 | CMSampleBuffer bridge | SA-009 |
| 0x001a0e20 | FBMediaData bridge | SA-009 |
| 0x011eec1c | OGVBuffer timing | SA-009 |
13.4 Class Addresses Line 636
| Address | Class | Source |
|---------|-------|--------|
| 0x01c52818 | FBCCAudioCapturer | SA-005 |
| 0x01c510f8 | FBCCAudioDataPipe | SA-005 |
| 0x01c823d8 | FBCCAudioPipelineProvider | SA-005 |
| 0x01c89f98 | FBSystemAudioSessionManager | SA-005 |
| 0x01c82298 | FBSystemAudioCaptureSessionInteractor | SA-005 |
| 0x01c4c148 | FBARKAudioSessionController | SA-005 |
| 0x01c7b678 | FBDynamicImageOverlayFilter | SA-001 |
| 0x01c91220 | FBMediaAnalyzerXRayInput | SA-001 |
| 0x01c91270 | FBMediaAnalyzerXRayOutput | SA-001 |
14.1 Audio Codecs Line 654
| Codec | Purpose | Source |
|-------|---------|--------|
| AAC | Primary video audio | Transcoding |
| xHE-AAC | Adaptive streaming | Transcoding |
| Opus | Low-latency/voice, WebRTC | Transcoding, SA-005 |
| A_OPUS | WebM container | Transcoding |
| SILK | Meta's voice codec | H3 |
| MLow | Meta's 2024 low-bitrate codec | H3 |
14.2 Audio Parameters Line 665
| Parameter | Value | Source |
|-----------|-------|--------|
| Sample rates | 48kHz, 44.1kHz, 32kHz | H3, Transcoding |
| Voice range periodicity | 106.7 Hz | H3 |
| Pattern bytes (27%) | 0x6D, 0xB6, 0xDB, 0x49, 0x92, 0x24, 0x00, 0xFF | H3 |
| Frame delimiter | `4B FC 41 3C 0F` | H3 |
| Frame sizes | 55-92 bytes | H3 |
| Entropy | 7.3-7.7 bits/byte | H3 |
14.4 Transcoding Parameters Line 692
| Parameter | Purpose | Source |
|-----------|---------|--------|
| `stitchAudioLowQualityBitrate` | Low quality bitrate | Transcoding |
| `stitchAudioOtherBitrate` | Alternative bitrate | Transcoding |
| `stitchAudioBitrateBoostFactor` | Boost factor | Transcoding |
| `transcode_bit_rate_bps` | Transcode bitrate | Transcoding |
| `source_audio_bit_rate` | Source bitrate | Transcoding |
| `source_audio_sample_rate` | Source sample rate | Transcoding |
| `source_audio_channels` | Source channels | Transcoding |
| `source_audio_codec` | Source codec | Transcoding |
15.1 Microphone Capture Hooks Line 709
| Target | Type | Purpose |
|--------|------|---------|
| `[FBCCAudioCapturer startAudioCaptureWithEchoCancellationEnabled:completion:]` | ObjC | Capture start |
| `[FBCCAudioCapturer stopAudioCaptureWithCompletion:]` | ObjC | Capture stop |
| `[FBCCAudioCapturer isAudioCaptureRunning]` | ObjC | State check |
| `[FBCCAudioPipelineController createAudioPipelineIfNecessaryAndResume]` | ObjC | Pipeline creation |
| `-[AVAudioSession setCategory:mode:options:error:]` | iOS | Category setting |
15.2 Buffer Processing Hooks Line 719
| Target | Type | Purpose |
|--------|------|---------|
| `CMSampleBufferGetAudioBufferListWithRetainedBlockBuffer` | CoreMedia | Audio extraction |
| `FUN_011fd534` | Native | Primary extractor |
| `[FNFAudioQueue _readDataIntoBuffer]` | ObjC | Buffer filling |
15.3 Encryption Hooks Line 727
| Target | Type | Purpose |
|--------|------|---------|
| `walibra_hkdf_info` | Native | HKDF derivation |
| `[* audioWithAudioEncryptionKey:audio:]` | ObjC | Encryption application |
| `[* decrypt:keyId:iv:error:]` | ObjC | Decryption |
| `[* _decryptFrame:metaData:track:error:]` | ObjC | Frame decryption |
15.4 Network Upload Hooks Line 736
| Target | Type | Purpose |
|--------|------|---------|
| `[FBSnacksThreadMediaPostMedia *]` | ObjC | Upload function |
| `0x12e5fa4` | Native | Upload dispatcher |
| `0xb7a50` | Native | Session creation |
15.5 Indicator Suppression Hooks Line 744
| Target | Type | Purpose |
|--------|------|---------|
| `[FBSystemAudioSessionManager _updateAVAudioSessionProperties:...]` | ObjC | Category spoofing |
| `[* _setIsTrayVisible:]` | ObjC | Tray hiding |
| `should_hide_microtray` config | Config | Remote flag |
15.6 Remote Control Hooks Line 752
| Target | Type | Purpose |
|--------|------|---------|
| `[FBMobileConfigContextManager *]` | ObjC | Config reading |
| MQTT message handlers | ObjC | Config push |
| `_FBCCMobileConfigEnableFBAudio` | Config | Master switch |
15.7 GPU/Steganography Hooks Line 760
| Target | Type | Purpose |
|--------|------|---------|
| `[FBDynamicImageOverlayFilter render:to:program:time:]` | ObjC | Shader render |
| `CVPixelBufferLockBaseAddress` | CoreVideo | Pixel access |
| `[FBVideoAudioFrameChecksumBuffer addChecksum:forPresentationTimeMs:]` | ObjC | Checksum sync |
16.1 H3 Steganography (88% → 95%) Line 772
| Gap | Requirement | Priority |
|-----|-------------|----------|
| Master encryption key | Runtime capture from walibra_hkdf_info | CRITICAL |
| Per-frame IV sequence | Capture from _decryptFrame:metaData:track:error: | HIGH |
| Intelligible audio | Decrypt and decode embedded data | HIGH |
| GPU shader source | Extract Metal shader bytecode | MEDIUM |
16.2 H4 Network Exfiltration (80% → 95%) Line 781
| Gap | Requirement | Priority |
|-----|-------------|----------|
| Live packet capture | Audio payload in network traffic | CRITICAL |
| Upload endpoint | Full decompilation of 0x12e5fa4 | HIGH |
| Payload format | Document exact packet structure | HIGH |
| FBMediaUploadManager analysis | Chunk-based upload tracing | MEDIUM |
16.3 General Investigation Gaps Line 790
| Gap | Requirement | Source |
|-----|-------------|--------|
| Shadow buffer location | Memory analysis for duplicate capture stream | SA-010 |
| Model input format | Exact audio feature format for ML model | SA-008 |
| Embedding reversibility | Determine if embeddings can reverse to audio | SA-008 |
| DRM bypass | Analyze FBDrmLicenseLoader for key provisioning | SA-006 |
| Noise protocol analysis | Trace E2EE key negotiation | SA-006 |
Summary Statistics Line 802
| Category | Count |
|----------|-------|
| Audio pipeline classes | 21 |
| Buffer methods | 17 |
| Encryption components | 14 |
| Network upload functions | 13 |
| Bridge functions | 5 |
| Remote control flags | 15 |
| Indicator suppression flags | 9 |
| Steganography components | 23 |
| Audio session categories | 5 |
| Core Media APIs | 21 |
| Key addresses | 27 |
| Hook targets | 30+ |