Tag: disassembly

The Stakes of Plan A: Two APIs of CUPID, Twenty-Four Call Sites After the thumb BLX Amendment, and Three Gates of No-Ad Verified in Iron

The iQiyi TV ad campaign entered the survey-stake stage of Plan A (the forged no-ad callback): the chain structure fully mapped — CUPID carries two APIs, Java (JNI, the line cut in v10 that did nothing) and C++ (direct symbol-linked calls); the kernel libgalauniplayersdk.so DT_NEEDED-links libcupid.so and calls 24 C++ interfaces; the reason the earlier BL scan scored zero was a mask excluding thumb BLX, and after the fix all 24 call sites located in one pass; the C-bridge event bus surfaced (OnAdEventC/OnVVEventC/OnCreativeEventC converging into the state-machine skeleton); and the three gates of no-ad verified on iron — OnReceivedNoAds at 0x6f9f4, the event dispatcher at 0x6a964 (event 13 the failure branch, event 4 a re-request loop that must be avoided), and LoadNextAd has-no-ad path; a counter-intuitive field fact was also pinned — with Clash hijacking the CUPID gateway to 127.0.0.1 and every mixer request refused, ads still played from local cached creatives: cutting the net is not cutting the ads.