This post is part of AppLovin Nonconsensual Installs > Execution Path. See important disclosures.
In DirectDownloadActivity, I presented code in which execution flows to DirectDownloadMainFragment C3374l2. Then C3374l2’s constructor creates C3298a3:
// DirectDownloadMainFragment
public C3374l2(C1947f c1947f, C3743e c3743e, InterfaceC3372l0 interfaceC3372l0, C1059x c1059x, C1059x c1059x2, boolean z) {
...
this.f10629x0 = c1947f;
this.f10630y0 = c3743e;
this.f10631z0 = interfaceC3372l0;
this.f10620A0 = c1059x;
this.f10621B0 = c1059x2;
this.f10622C0 = z;
this.f10623D0 = AbstractC3379m0.m5742a(interfaceC3372l0);
this.f10624E0 = AbstractC3379m0.m5743b(interfaceC3372l0);
C3367k2 c3367k2 = new C3367k2(new C0597a(4, this), 1);
InterfaceC6440g m9576c = AbstractC6434a.m9576c(EnumC6441h.f19368t, new C5289f(9, new C5289f(8, this)));
this.f10625F0 = new C5732d(AbstractC4237v.f12869a.mo6593b(C3298a3.class), new C0733o(1, m9576c), c3367k2, new C0733o(2, m9576c));
this.f10627H0 = true;
}
Next C3298a3’s constructor creates C5252f, which acts as a WebView interceptor manager:
//WebView interceptor manager
public C3298a3(Application application, C1947f c1947f, C3743e c3743e, InterfaceC3372l0 interfaceC3372l0) {
AbstractC4226k.m6579e(c1947f, "mergedConfig");
AbstractC4226k.m6579e(c3743e, "analyticsEventContext");
AbstractC4226k.m6579e(interfaceC3372l0, "appLookupKey");
C2325b c2325b = new C2325b(23);
C4863a c4863a = new C4863a(application);
C5252f c5252f = new C5252f(c4863a, c1947f, c3743e, interfaceC3372l0, AbstractC4118e.m6305K(c4863a).f12518G, c2325b);
Then C5252f registers endpoint handlers. The HTTP endpoint handler for /install-app is C5461u:
//create endpoint handlers
public C5252f(C4863a c4863a, C1947f c1947f, C3743e c3743e, InterfaceC3372l0 interfaceC3372l0, C2495r1 c2495r1, C2325b c2325b) {
AbstractC4226k.m6579e(c1947f, "mergedConfig");
AbstractC4226k.m6579e(c3743e, "analyticsEventContext");
AbstractC4226k.m6579e(interfaceC3372l0, "appLookupKey");
AbstractC4226k.m6579e(c2495r1, "directDownloadPackageManager");
C2608d1 c2608d1M4552b = AbstractC2611e1.m4552b(7);
this.f15673b = c2608d1M4552b;
this.f15674c = c2608d1M4552b;
C4281e c4281e = AbstractC1870m0.f5700a;
C3660c c3660cM382i = AbstractC0001a.m382i(c4281e, c4281e);
C4147i c4147iM6305K = AbstractC4118e.m6305K(c4863a);
PackageManager packageManager = c4863a.getPackageManager();
AbstractC4226k.m6578d(packageManager, "getPackageManager(...)");
C5247c0 c5247c0M4916q = C2866e0.m4916q("install-app", new C5461u(c4147iM6305K, c3743e, c1947f, interfaceC3372l0, packageManager, c2495r1, c4147iM6305K.f12513B, c2325b));
C5247c0 c5247c0M4916q2 = C2866e0.m4916q("cancel-install-app", new C5437h(c4147iM6305K, c3743e, c2495r1, 1));
C5247c0 c5247c0M4916q3 = C2866e0.m4916q("launch-app", new C5465y(c3743e, c4147iM6305K));
C5247c0 c5247c0M4915p = C2866e0.m4915p("install-app-state", new C5437h(c4147iM6305K, c3743e, c2495r1, 2));
C5247c0 c5247c0M4915p2 = C2866e0.m4915p("await-install-state", new C5437h(c4147iM6305K, c3743e, c2495r1, 0));
C5431e c5431e = new C5431e(c4147iM6305K, c1947f, c3743e, interfaceC3372l0, c4147iM6305K.f12513B);
AbstractC1838d0.m3857y(c3660cM382i, null, null, new C5250e(c5431e, this, null), 3);
C5247c0 c5247c0M4915p3 = C2866e0.m4915p("app-version-info", c5431e);
Map mapSingletonMap = Collections.singletonMap(C2587r.f7833d, new C5447m(c4147iM6305K, c3743e, c2325b));
AbstractC4226k.m6578d(mapSingletonMap, "singletonMap(...)");
this.f15675d = AbstractC0209q.m798M(c5247c0M4916q, c5247c0M4916q2, c5247c0M4916q3, c5247c0M4915p, c5247c0M4915p2, c5247c0M4915p3, new C5247c0("installation-on-dismiss-enabled", mapSingletonMap));
}
C5461u activates DirectDownloadPackageManager C2495r1:
//DirectDownloadPackageManager
public C5461u(C4147i c4147i, C3743e c3743e, C1947f c1947f, InterfaceC3372l0 interfaceC3372l0, PackageManager packageManager, C2495r1 c2495r1, C4120g c4120g, C2325b c2325b) {
AbstractC4226k.m6579e(c3743e, "analyticsEventContext");
AbstractC4226k.m6579e(c1947f, "mergedConfig");
AbstractC4226k.m6579e(interfaceC3372l0, "appLookupKey");
AbstractC4226k.m6579e(c2495r1, "directDownloadPackageManager");
AbstractC4226k.m6579e(c4120g, "appDetailRepository");
...
this.f16109f = packageManager;
this.f16110g = c2495r1;
...
C2495r1’s coroutine resume function m4446F() passes execution to C0033f0, which acts as a bridge to the T-Mobile InstallerHelper:
public final Object m4446F(C1947f c1947f, AbstractC1576c abstractC1576c) {
...
mo436z = ((C0033f0) c5119b2.f15215t).mo436z(c1947f, c2534z0);
Then C0033f0 creates C0023a0 (which acts as an installation executor), with execution flowing to coroutine resume function m431o():
public final Object m431o(C1947f c1947f, String str, InterfaceC6364j interfaceC6364j, int i, C6384t c6384t, EnumSet enumSet, InterfaceC0894d interfaceC0894d) {
...
C0023a0 c0023a0 = new C0023a0(c4236u, c0033f0, c1947f2, interfaceC6364j2, str2, enumSet2, null);
Finally, C0023a0 continuation entry point mo410r() activates T-mobile InstallerHelper’s startInstall():
import com.tmobile.p432dm.cmsdk.InstallerHelper;
import com.tmobile.p432dm.cmsdk.InstallerHelperResult;
...
public final Object mo410r(Object obj) {
...
InstallerHelperResult startInstall$default;
...
startInstall$default = InstallerHelper.startInstall$default((InstallerHelper) m458a, arrayList2, str, 1, this.f520F.contains(EnumC6366k.f19171a), 0, 0, 0, null, null, null, null, null, 4080, null);
...
InstallerHelperResult.Fail fail = (InstallerHelperResult.Fail) startInstall$default;
Throwable cause = fail.getCause();
String m5237p = AbstractC2945r1.m5237p("Failed to start install: ", fail.getMessage());
Object[] objArr3 = new Object[i3];
Object[] copyOf4 = Arrays.copyOf(objArr3, objArr3.length);
AbstractC4226k.m6579e(copyOf4, "args");
C6241b c6241b3 = AbstractC6243d.f18832a;
c6241b3.m9419f("Array/".concat("Installer"));
c6241b3.mo9417d(6, cause, m5237p, Arrays.copyOf(copyOf4, copyOf4.length));
Execution continues in T-Mobile InstallerHelper performs an install.