Twenty-One Rounds Against the Samsung Pill: NowHub and Its Three-Layer Battlefield, the Breakthrough Moment of the Package-Name Impersonation, and the Control Experiment Left for the Morning

The little pill at the bottom of a Samsung S24U lock screen is a throne One UI reserves for a handful of official partners — food delivery, ride-hailing and navigation may sit; third parties may only look up. NowHub wanted the seat, and fought twenty-one rounds in one night.

I. A Three-Layer Battlefield, Two Layers Won

The night ledger was kept in three layers: the app crash fixed (zero flash-quits tonight); the lock-screen large card taken — the NowHub · P9 pill blueprint-icon card visible all evening on the master own lock screen; the notification live-activity card taken (from P8 on). The grant war was the bitterest: PROMOTED_ONGOING fell only in round sixteen, the culprit a missing POST_PROMOTED_NOTIFICATIONS permission — once fixed, the dumpsys flags matched kakao bit for bit. All eighteen cloud builds stayed green (on the instabox cloud machine; the no-local-builds red line never crossed).

II. Into the Basement of the Pill: The Whitelist Filter

The only unyielding layer was the bottom pill slot. SystemUI internal logs (NowBarItemManager.filterVisibleList) nailed the truth: NowHub activity data entered Samsung OngoingActivity pipeline in full — title, icon, dynamic text, background color all present — but the slot filter admits by package-name whitelist; during the test window it admitted only Samsung own Tonight Briefing (which occupies the slot after 22:00), and both of ours were blocked. How did the kakao network-speed app get in? The break was clean: its whole APK impersonates com.kakao.taxi (Kakao T ride-hailing, an official Samsung partner) — package name, R class and applicationId, the full costume. An impersonated Naver package (com.nhn.android.search), dressed by the same recipe, rendered on the lock screen as a promoted activity on the spot, beside the briefing card — the filter admitted it.

III. The Complete Map of Twenty-One Rounds

The gate table is now drawn: ① the promoted grant (POST_PROMOTED_NOTIFICATIONS) — broken at P16; ② the lock-screen large card (grant plus continuous updates) — rendered; ③ the bottom pill slot (whitelisted partner package names) — technically passable by impersonation, but the briefing card outranks, and after 22:00 no third party gets a turn; ④ the time-window interference — the Tonight Briefing holding the slot in the evening, discovered in P17-P21. The judgment follows: in the daytime competition (no briefing) an impersonated package would most likely take the pill — that is how kakao shows in daylight. The impersonated test package was left running (its heartbeat process alive), and the real package kept alongside as the control — one glance at tomorrow morning lock screen finishes the verification.

IV. Three Roads Left to the Master

The product fork waits for the master: A, close here (recommended) — the pill slot being closed to non-partner packages is the hard reality of One UI 9, and NowHub can stand on the lock-screen large card plus the notification live card; delivery, ride-hailing, parcels and pomodoros were never information that fits one pill, and the network-speed number stays with the network-speed app; B, an impersonated personal build — applicationId permanently changed to com.kakao.taxi would most likely take the pill, and it would run, but an open-source project shipping under a partner false identity is a publishing problem; C, reverse the filter to the end — dig the exact rules of that SystemUI filter (a smali-grade work, possibly signature or whitelist-file checks, no guarantee of results). The recipes and conclusions of all twenty-one rounds are fixed into the skill and the ledger — whichever road is chosen, the map dug this night remains.