TT Festival App — Reverse Engineering Notes

This document records how the TT Festival Android app was obtained and decompiled, and what the resulting artifacts contain. It also documents the public Google Play store listing the app was sourced from.

Scope: Analysis is performed on v2.0.1 (versionCode 5), pulled directly from a physical device. An earlier mirror copy (v1.2.0) was discarded as out of scope.

1. Source listing (Google Play)

A snapshot of the listing HTML is archived alongside the analysis artifacts as ttfestival_playstore.html.

2. Process

2.1 Tooling

Tool Version Purpose
adb (Android platform-tools) bundled w/ Android SDK Locate & pull the installed APKs from the device
jadx 1.5.1 Decompile DEX bytecode to readable Java + extract resources
java (JDK) 17 Runtime for jadx

2.2 Steps

  1. Confirm the device is reachable over ADB

    adb devices -l
# 5B161JEA308016   device   model:Pixel_10a  device:stallion

  2. Identify the installed version and the on-device APK paths

    adb shell dumpsys package com.appmiral.ttfestival | Select-String "versionName|versionCode"
# versionCode=5  versionName=2.0.1

adb shell pm path com.appmiral.ttfestival
# base.apk
# split_config.arm64_v8a.apk
# split_config.xxhdpi.apk

    The app ships as an App Bundle (split APKs): a base APK plus per-ABI and per-density configuration splits.

  3. Pull every split off the device

    adb pull <.../base.apk>                  phone_v2.0.1\base.apk
adb pull <.../split_config.arm64_v8a.apk> phone_v2.0.1\split_config.arm64_v8a.apk
adb pull <.../split_config.xxhdpi.apk>    phone_v2.0.1\split_config.xxhdpi.apk

  4. Decompile the whole app (all splits merged into one tree so that resources from the density/ABI splits land next to the base code)

    jadx --no-debug-info -d phone_v2.0.1\decompiled `
    phone_v2.0.1\base.apk `
    phone_v2.0.1\split_config.arm64_v8a.apk `
    phone_v2.0.1\split_config.xxhdpi.apk

    jadx reports a handful of per-class failures (~28). This is expected for a large, partially obfuscated app and does not block analysis of the rest.

  5. Extract native libraries (jadx ignores .so files), pulled from the arm64_v8a split into decompiled\native_libs\.

3. Artifacts

All artifacts live in the session files\ folder (not committed to the repo):

files\
├── ttfestival_playstore.html        # archived Play Store listing
├── tools\jadx\                      # jadx 1.5.1 decompiler
└── phone_v2.0.1\
    ├── base.apk                     # base APK (≈41.5 MB) pulled from device
    ├── split_config.arm64_v8a.apk   # native libs split
    ├── split_config.xxhdpi.apk      # density resources split
    └── decompiled\
        ├── sources\                 # 16,931 decompiled .java files
        ├── resources\               # AndroidManifest.xml, res\, assets\, META-INF\
        └── native_libs\             # extracted .so files

4. App overview (from the decompiled v2.0.1)

Field Value
Package com.appmiral.ttfestival
Version 2.0.1 (versionCode 5)
Build type / flavor release / prod
minSdk / targetSdk / compileSdk 28 / 36 / 36
Core stack Kotlin, OkHttp/Retrofit, RxJava, ButterKnife, Dexter

4.1 Feature modules (com.appmiral.*)

The app uses a modular architecture. Packages present in v2.0.1:

advancedfilter, albums, app, base, basicmap, calendar, cards, consent, core, crowdconnected, databinding, dataconnector, edition, emergencybutton, explore, feed, fullmap, gamification, identityProvider, identityproviders, intake, interests, lineup, loyalty, musicplayer, notification, notificationcenter, performers, permissions, playlist, pois, practical, privacy, profile, recommendations, regions, schedule, search, settings, splash, sponsors, spotify, stagehosts, stages, tags, ticket, ticketscanner, tickettypes, toa, ttfestival, tutorial, user, usercontent, vendor, vendors, wallet, webview

Third-party SDKs — actually bundled in this build (verified by package presence, not just by the consent registry): AWS SDK (com.amazonaws — Cognito + SNS), Firebase / Google (Installations, Crashlytics, Analytics, Sessions, GMS, Maps), CrowdConnected (net.crowdconnected + libpositioner.so), Cookie Information CMP (com.cookieinformation), CM.com push (com.cm.cmpush), Spotify (account linking).

⚠️ The Appmiral consent registry (com.appmiral.consent.Sdk) additionally lists Salesforce, Braze, Permutive, Tealium, Insider and Facebook, but those packages are not bundled in TT Festival v2.0.1 — they are platform capability placeholders only. See trackers-and-sdks.md for the full registered-vs-bundled breakdown and an empirical first-launch network capture.

4.2 Declared permissions

ACCESS_NETWORK_STATE, RECEIVE_BOOT_COMPLETED, VIBRATE, INTERNET,
WRITE_EXTERNAL_STORAGE, ACCESS_COARSE_LOCATION, ACCESS_FINE_LOCATION,
READ_EXTERNAL_STORAGE, ACCESS_WIFI_STATE, CHANGE_WIFI_STATE,
ACCESS_LOCATION_EXTRA_COMMANDS, ACCESS_BACKGROUND_LOCATION, WAKE_LOCK,
POST_NOTIFICATIONS, NFC, FOREGROUND_SERVICE, C2DM RECEIVE,
BIND_GET_INSTALL_REFERRER_SERVICE, CAMERA, FOREGROUND_SERVICE_LOCATION,
BLUETOOTH_SCAN, BLUETOOTH_CONNECT, ACCESS_ADSERVICES_ATTRIBUTION,
ACCESS_ADSERVICES_AD_ID, DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION,
CHECK_LICENSE

These line up with the festival feature set: maps & indoor positioning (location + Bluetooth + Wi-Fi), NFC/cashless tickets, camera (ticket scanner), and push notifications.

5. Notes & caveats