[Xposed Framework Modules] badabing2003:
Thanks that tip is awesome :)

I checked one of the other apps and I see this.

02-10 12:39:26.738 29702 29702 I XLua.Xposed: Optional hook=Privacy.MixpanelAPI.flush: java.lang.ClassNotFoundException: com.mixpanel.android.mpmetrics.MixpanelAPI
02-10 12:39:26.741 29702 29702 I XLua.Xposed: Optional hook=Privacy.MixpanelAPI.flushNoDecideCheck: java.lang.ClassNotFoundException: com.mixpanel.android.mpmetrics.MixpanelAPI
02-10 12:39:26.743 29702 29702 I XLua.Xposed: Optional hook=Privacy.MixpanelAPI.track: java.lang.ClassNotFoundException: com.mixpanel.android.mpmetrics.MixpanelAPI
02-10 12:39:26.744 29702 29702 I XLua.Xposed: Optional hook=Privacy.MixpanelAPI.track/json: java.lang.ClassNotFoundException: com.mixpanel.android.mpmetrics.MixpanelAPI
02-10 12:39:26.746 29702 29702 I XLua.Xposed: Optional hook=Privacy.MixpanelAPI.track/json/auto: java.lang.ClassNotFoundException: com.mixpanel.android.mpmetrics.MixpanelAPI
02-10 12:39:26.748 29702 29702 I XLua.Xposed: Optional hook=Privacy.MixpanelAPI.trackMap: java.lang.ClassNotFoundException: com.mixpanel.android.mpmetrics.MixpanelAPI

I supposed most of the mixpanel using apps are utilizing obfuscation techniques?

That sucks, and I understand it would be super difficult to hook if not impossible.

blocking the api call by domain name would work, hoping that they don't utilize some other technique to resolve the name and make the call.

I looked at my apps using analytics and see that Answers (answers.io) is a very common one.

It looks like Answers is owned by fabric, and you have hooks for fabric, does that mean that Answers would also be blocked?

If not, I'd like to try to write some definitions (as a learning exercise), but am having difficulty finding the APIs, any tips?

Do you ever have to do reverse engineering to figure out things? (I assume you'd have to)

Thanks

BB

---------- Post added at 01:03 PM ---------- Previous post was at 12:55 PM ----------

Of course that's ultimate,

But how do you determine that everything is gathered through track methods and nothing else?

What about People related APIs

Sorry for all the noob questions.

Thanks

BB

---------- Post added at 01:15 PM ---------- Previous post was at 01:03 PM ----------

Here's something interesting.

I'm seeing this in the logs when I launched slack again. (some methods are not found)

02-10 12:56:10.140 32215 32215 I XLua.Xposed: Optional hook=Privacy.MixpanelAPI.flushNoDecideCheck: java.lang.NoSuchMethodException: flushNoDecideCheck
02-10 12:56:10.140 32215 32215 I XLua.Xposed: class com.mixpanel.android.mpmetrics.MixpanelAPI
02-10 12:56:10.140 32215 32215 I XLua.Xposed: public void com.mixpanel.android.mpmetrics.MixpanelAPI.track(java.lang.String,org.json.JSONObject)
02-10 12:56:10.140 32215 32215 I XLua.Xposed: Optional hook=Privacy.MixpanelAPI.track: java.lang.NoSuchMethodException: track
02-10 12:56:10.144 32215 32215 I XLua.Xposed: class com.mixpanel.android.mpmetrics.MixpanelAPI
02-10 12:56:10.144 32215 32215 I XLua.Xposed: public void com.mixpanel.android.mpmetrics.MixpanelAPI.track(java.lang.String,org.json.JSONObject)
02-10 12:56:10.144 32215 32215 I XLua.Xposed: Optional hook=Privacy.MixpanelAPI.track/json/auto: java.lang.NoSuchMethodException: track
02-10 12:56:10.144 32215 32215 I XLua.Xposed: class com.mixpanel.android.mpmetrics.MixpanelAPI
02-10 12:56:10.144 32215 32215 I XLua.Xposed: static void

But this method is found

02-10 12:56:11.385 1098 1530 I XLua.Provider: Hook Privacy.MixpanelAPI.track/json pkg=com.Slack:10239 event=use duration=0 restricted=1 function=before
02-10 12:56:11.391 32215 32215 I XLua.XParam: Get setting com.Slack:10239 value.android_id=null

How is that possible?

if the library is included, shouldn't all methods be found?

is it possible that some method calls are obfuscated but not others?

Man this thing is not trivial, amazing what you've accomplished in such a short period.

Thanks

BB