Measure The Web

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Provenance: design:mobile_and_app_measurement ======

Working notes behind [[design:mobile_and_app_measurement]] — every query with its population and denominator, the report script and its unedited output, the fold and its complete residue, the probe regexes and the case-sensitivity trap they walked into, the figures checked against the source PDFs, the external sources verified and the ones rejected, and what could not be established. Corpus-level caveats that apply to every page on this site are on [[literature:corpus]] and are not restated here.

//Contemporaneous.// Written during the run that produced the content page, 2026-08-27, not reconstructed afterwards.

===== 1. What this page is backing =====

^ Item ^ Value ^
| Content page | [[design:mobile_and_app_measurement]] — **new page**, created 2026-08-27 |
| Report script | ''scripts/report_mobile.mjs'' (new) → ''scripts/report_mobile-output.txt'' |
| Fold it depends on | ''scripts/mobile_fold.mjs'' (new) — folds ''tools[].name'' into mobile tool families |
| Quote/figure check | ''scripts/quotecheck_mobile.mjs'' (new) → ''scripts/quotecheck_mobile-output.txt'' |
| Full-text probes | ''scripts/mobile_probes.sh'' (new) → ''scripts/mobile_probes-output.txt'' |
| Number guard | ''scripts/mobile_number_guard.mjs'' (new) → ''scripts/mobile_number_guard-output.txt'' |
| External tool currency | ''scripts/mobile_tool_currency.sh'' (new) → ''scripts/mobile_tool_currency-output.txt'' |
| Data | ''data/extract/run1/extractions.jsonl'', 5,859 papers, 7 venues, 2010–2026 |
| Bibliography additions | 17 new entries, ''pages/bib_additions_mobile.bib'' |
| Previous figures | **none.** No mobile page existed. No figure was carried over from an earlier page, dossier or ''METHOD.md'', and none of the ''bench-*'' dossiers were consulted. |

===== 2. Scope and namespace: the judgement calls =====

==== Does a page already exist? ====

No. Checked 2026-08-27 by ''node scripts/sitemap.mjs'' (80 pages) plus ''core.searchPages'' for ''mobile'' and ''android'':

<code>
node scripts/dw.mjs search mobile   # 40 hits, all provenance/content pages on other topics
node scripts/dw.mjs search android  # 32 hits, likewise
</code>

Every hit was an incidental mention inside a page about something else (''privacy:consent'', ''practices:legal_enforcement'', ''literature:bibliography''). **No page owns mobile or app measurement.** So this is a creation, not an extension, and not an overlap that needed a neighbour broadened.

Four pages own an adjacent piece, and each is linked out to rather than restated:

^ Page ^ What it owns ^ What it leaves open for this page ^
| [[design:website_selection]] | ranking lists, their provenance, their manipulation and their churn | says nothing about store charts, which are per-country, per-day and unarchived — strictly worse |
| [[design:sampling]] | how to draw a sample and version the draw | the app-specific pin is package + version code + binary hash, and there is no Tranco to cite |
| [[design:crawling_location]] | the vantage point | on mobile there are **two** geographies — the network egress and the //storefront// — and only the first is that page's subject |
| [[programming:traffic_files]] | what to do with captured traffic | assumes you captured it; the whole certificate-pinning section of this page is about whether you did |

==== Why design: and not a new namespace ====

The item as specified said "propose the namespace placement before creating it". The decision, and it was a decision rather than an obvious call:

  * **Chosen: ''design:mobile_and_app_measurement''.** ''design:'' already holds the site's cross-cutting "how do you set this measurement up" pages — ''website_selection'', ''sampling'', ''crawling_location'', ''archives'', ''longitudinal'', ''website_classification'', ''ip_classification''. This page is exactly that shape for a different platform: sampling frame, vantage, instrumentation, what to report.
  * **Rejected: a new top-level ''mobile:'' namespace.** It would strand one page in a namespace of its own and duplicate what ''design:'' is for. The site's existing platform-flavoured pages (''design:platforms:facebook'' and friends) already live under ''design:'', so a sibling namespace would also be inconsistent.
  * **Rejected: ''programming:mobile_instrumentation''.** ''programming:'' is where per-tool pages live (''programming:crawler:openwpm'', ''programming:crawler:webxray''). A future Frida-, Appium- or mitmproxy-on-mobile how-to belongs there and should be created there. But this page is study design, not a tool manual, and putting sampling and reporting guidance under ''programming:'' would misfile it.
  * **Rejected: broadening ''design:automated_measurements''.** It is a red link. Creating a page in order to broaden it is not broadening it.

A reasonable person could have gone with ''mobile:'' as a namespace on the argument that mobile deserves the same treatment as the web and will eventually need several pages. If that happens, the page should move; nothing on it assumes the ''design:'' prefix except its own id.

==== Reachability ====

Nothing linked here, so a bullet was added to [[:start]] under //Research design// in the same sitting. Without it the page is invisible.

===== 3. Populations and denominators =====

Every figure on the content page is a share of one of these. The rule was applied without exception: **name the denominator before the numerator, and never write "of 5,859 papers".**

^ Name ^ Definition ^ N ^
| ''all'' | every extracted paper | 5,859 |
| **''appAnalysis''** | ''studyTypes'' contains ''mobile-app-analysis'' | **529** |
| ''mobilePlat'' | ''platforms'' contains ''mobile'' | 1,075 |
| either | ''appAnalysis'' OR ''mobilePlat'' | 1,079 |
| both | | 525 |
| ''mobile-instrumentation'' users | any ''tools[].category == "mobile-instrumentation"'' | 364 |
| mobile-apps population | any ''population[].unit == "mobile-apps"'' | 502 |
| ''appAnalysis'' with a classification tuple | | 472 |
| ''appAnalysis'' with a vantage tuple | | 430 |
| ''appAnalysis'' with a mobile-apps population | | 400 |
| ''appAnalysis'' with a ''crawlConfig'' object | | 115 |

**''appAnalysis'' (529) is the page's population, and that was a choice.** ''mobilePlat'' (1,075) is twice as large and would have produced friendlier percentages, but it contains cellular-network measurement, Bluetooth-tracker security, handset firmware work and smartphone user studies. A reader planning to take apps apart is not in that population. The content page states both and says which one every table is on.

**The item's brief carried stale numbers.** It said "409 mobile-app-analysis papers, ''population.sourceList'' Google Play 183 and AndroZoo 35, ''tools'' category ''mobile-instrumentation'' 271". Those were computed on the 4,322-paper corpus. On the current run: **529**, Google Play 134 under its largest single spelling (250 after merging spellings), AndroZoo 46, ''mobile-instrumentation'' **364**. Every one was re-derived; none was carried over.

**Sentinels are never answers.** ''not-stated'', ''none-mentioned'', ''not-applicable'', ''unclear'' and ''unknown'' are reported as themselves. The sharpest case on this page is ''vantage.locations'': 430 ''appAnalysis'' papers have a vantage tuple, 117 state a location, and **313 produce only a sentinel**. Counting the sentinel as an answer would have turned "72.8% of mobile app studies do not say where they measured from" into silence.

**Papers, never tuples.** ''paperCounts()'' in ''scripts/lib.mjs'' does the counting; a paper naming Frida in five tuples is one paper.

===== 4. Running it =====

<code bash>
cd /workspace/artifacts/wiki
node scripts/report_mobile.mjs      > scripts/report_mobile-output.txt
node scripts/quotecheck_mobile.mjs  > scripts/quotecheck_mobile-output.txt
sh   scripts/mobile_probes.sh       > scripts/mobile_probes-output.txt
node scripts/mobile_number_guard.mjs > scripts/mobile_number_guard-output.txt
sh   scripts/mobile_tool_currency.sh > scripts/mobile_tool_currency-output.txt
</code>

The guard is the last gate: it harvests every numeric token from the content page and requires each one to appear in one of the three committed outputs, or to be listed in an ''ALLOW'' map **with a written reason**. Its own accounting is printed in the output block below rather than restated here, because restating it is how it goes stale: an earlier version of this paragraph said "305 of 366 … 61 allowed" after the output had moved to 367 and 62. Read the numbers from the block, not from this sentence.

**What the guard does not do**, and this matters: it proves a number //appears// in a source. It does not prove it is the right number for the sentence around it, and it cannot see figures inside quoted phrases. The two worst errors on this page (see §12) were both invisible to it and were caught by re-reading the prose against the script output by hand.

<file - mobile_number_guard-output.txt>
figures harvested from pages/design_mobile_and_app_measurement.txt: 374
allowed with a written reason: 65
traced to 3 committed outputs: 309

UNACCOUNTED: none
</file>

All three read ''/workspace/publications_dataset/data'' via ''dataRoot()'' in ''scripts/lib.mjs'', which probes both the current and the older mount layout. The probe script regenerates its own path list from the extraction, so the probes and the report can never drift apart on the population.

===== 5. The fold, and its residue in full =====

''tools[].name'' is free text and agrees run-to-run on roughly 20% of exact strings, so it is never aggregated by exact string. The generic ''skeleton()'' fold in ''scripts/lib.mjs'' normalises case and punctuation, which is **not enough here**: it leaves "Android Debug Bridge (adb)", "adb" and "Android Debug Bridge" as three tools.

''scripts/mobile_fold.mjs'' adds an ordered alias table. How much it changes the answer, from §2 of the report output:

^ Family ^ Folded ^ Largest single spelling ^ Distinct spellings ^
| ''adb'' | **71** | "Android Debug Bridge (ADB)" = 28 | 11 |
| ''Frida'' | 74 | "Frida" = 69 | 10 |
| ''Xposed'' | 31 | "Xposed" = 22 | 5 |
| ''Monkey'' | 34 | "Monkey" = 13 | 12 |
| ''UI Automator'' | 15 | "Android UI Automator" = 4 | 8 |
| ''Play store scraper'' | 30 | "google-play-scraper" = 12 | 12 |

''adb'' is the worst case: reporting the largest single spelling would have undercounted it by **61%**. ''Monkey'' and ''UI Automator'' are next, at 12 and 8 spellings each for a single tool.

**Two fold decisions where a reasonable person could disagree:**

  - **''objection'' is folded into ''pinning-bypass helper'', not ''Frida''.** It is a Frida front-end, so ''Frida'' would be defensible. It went the other way because 8 of its 10 ''used'' tuples in this corpus give SSL-pinning bypass as the purpose (the other two are generic hooking and APK repackaging), so counting it as Frida would have inflated Frida and emptied the pinning-bypass family. The purposes are quoted in the fold file's comment.
  - **''frida-ios-dump'' is folded into ''iOS app acquisition'', not ''Frida''.** It uses Frida but it is an IPA extractor, not an instrumentation use. The rule order was changed after a smoke test showed it landing in ''Frida''.

**The fold is deliberately targeted, not a complete taxonomy.** It defines families for mobile-specific tooling and leaves everything else alone. So it maps only **921 of 3,306 "used" tool tuples (27.9%)** in ''appAnalysis'', and the residue is **2,385 tuples across 1,732 distinct names**. That is not a failure: the residue is dominated by VirusTotal (58 tuples), Python (22), Selenium (21), Chrome (19), scikit-learn (15) and a long tail of one-off custom tools, none of which is a mobile tool and none of which belongs in a mobile tool family. The content page states the 27.9% figure so no reader mistakes the folded table for a complete tool census.

**The residue is printed in full in §8 of the report output below**, in two parts: every name with ≥2 tuples in a table, then all 1,466 names appearing exactly once, listed alphabetically. Nothing is truncated.

The fold source, since it is the load-bearing decision on this page:

<file javascript mobile_fold.mjs>
// Fold mobile tool names into families, for design:mobile_and_app_measurement.
//
// WHY: tool names in `tools[].name` are free text and ~20% stable run-to-run by
// exact string (data/extract/README.md). The generic skeleton() fold in lib.mjs
// canonicalises case and punctuation, which is not enough here: "Android Debug
// Bridge (adb)" (29 papers), "adb" (9) and "Android Debug Bridge" (5) are one
// tool under three spellings, and counting them separately undercounts adb by a
// factor of three. Same for Frida (Frida / frida-tools / frida-server / Frida
// Gadget), Xposed (Xposed / Xposed framework / LSPosed) and Monkey (Monkey /
// Android Monkey / Application Exerciser Monkey / three more).
//
// Rules are ordered; the first match wins. Anything that matches no rule keeps
// its skeleton-folded name and is reported as residue by report_mobile.mjs, so
// the part this file cannot classify stays visible.

// [canonical family, matcher]. Matchers are tested against the raw name.
export const FAMILIES = [
  // --- dynamic instrumentation / hooking
  // frida-ios-dump is an IPA extractor, not an instrumentation use of Frida, so it
  // is matched by the 'iOS app acquisition' rule below and excluded here.
  ['Frida', /^frida(?![- ]?ios)|frida[- ]?(tools|server|gadget|trace|inject)/i],
  ['Xposed', /xposed|^lsposed$|^edxposed$|^taichi$/i],
  ['Magisk', /^magisk/i],
  ['adb', /^adb$|android (debug|debugging) bridge|^adb shell$/i],
  ['TaintDroid', /^taintdroid$/i],
    // objection is a Frida front-end, but 8 of its 10 'used' tuples in this corpus
  // give SSL-pinning bypass as the purpose, so it is counted here and not as Frida.
  ['pinning-bypass helper', /just ?trust ?me|ssl ?(un)?kill ?switch|trust ?me ?already|^unpinning|nsc ?patch|^objection$/i],

  // --- UI automation / app exercisers
  ['Monkey', /monkey(?!runner)/i],
  ['monkeyrunner', /monkeyrunner/i],
  ['UI Automator', /ui ?automator|uiautomator/i],
  ['Appium', /^appium/i],
  ['DroidBot', /^droidbot|^humanoid$|^droidmate|^stoat$/i],
  ['AndroidViewClient', /androidviewclient|^culebra$/i],
  ['Accessibility Service', /accessibility service/i],
  ['RERAN', /^reran$/i],

  // --- static analysis / reverse engineering
  ['apktool', /^apk ?tool/i],
  ['jadx', /^jadx/i],
  ['Soot', /^soot$/i],
  ['FlowDroid', /^flowdroid$/i],
  ['Androguard', /^androguard$/i],
  ['smali/baksmali', /^(bak)?smali$|^apkid$|^dex2jar$|^dexdump$|^dexlib/i],
  ['WALA', /^wala$/i],
  ['IDA Pro', /^ida( pro)?$|^idapython$/i],
  ['Ghidra', /^ghidra$/i],
  ['MobSF', /^mobsf$|mobile[- ]security[- ]framework/i],
  ['LibRadar', /^libradar/i],
  ['LibScout', /^libscout/i],
  ['PScout', /^pscout$|^axplorer$/i],

  // --- traffic interception
  ['mitmproxy', /^mitm ?(proxy|dump|web)/i],
  ['Burp Suite', /^burp/i],
  ['tcpdump', /^tcpdump$/i],
  ['Wireshark', /^wireshark$|^tshark$/i],
  ['Fiddler', /^fiddler/i],
  ['Charles Proxy', /^charles/i],

  // --- app acquisition / store scraping
  ['Play store scraper', /google[- ]?play[- ]?scraper|^gplaycli$|^playstoredownloader$|google play (api|protobuf api|developer api|store api)|^apkeep$|^raccoon$/i],
  ['third-party APK mirror', /^apkpure$|^apkmirror$|^apkcombo$|^aptoide$|^androidrank$|^appbrain$|^apkfab$/i],
  ['AndroZoo', /^androzoo$|^androidzoo$/i],
  ['F-Droid', /^f[- ]?droid$/i],
  ['iOS app acquisition', /^ipatool|^ipa ?tool|^clutch$|frida[- ]?ios[- ]?dump|^flexdecrypt$|^bagbak$|^itunes/i],

  // --- iOS device access
  ['libimobiledevice', /libimobiledevice|^ideviceinstaller$|^idevice|^cfgutil$/i],
  ['jailbreak tool', /^checkra1n$|^palera1n$|^unc0ver$|^checkm8$|^taurine$/i],

  // --- devices and emulation
  ['Android emulator', /android emulator|^avd$|android virtual device|^genymotion$|^qemu$/i],
];

export function foldTool(raw) {
  const name = String(raw).trim();
  for (const [family, re] of FAMILIES) if (re.test(name)) return { family, mapped: true };
  return { family: name, mapped: false };
}

// Fold a paper's tool tuples to a Set of family names, counting each family once
// per paper. `filter` selects which tuples count (e.g. usedOrMentioned==='used').
export function paperFamilies(paper, filter = (t) => t.usedOrMentioned === 'used') {
  const fams = new Set();
  const unmapped = new Set();
  for (const t of paper.tools) {
    if (!filter(t)) continue;
    const { family, mapped } = foldTool(t.name);
    fams.add(family);
    if (!mapped) unmapped.add(family);
  }
  return { fams, unmapped };
}
</file>

===== 6. The probes, and the case-sensitivity trap =====

The extraction schema has no field for "did you use a handset or an emulator", "did the app pin", "which storefront". Those questions were answered with full-text probes over the same 529 papers, whitespace collapsed and soft hyphens rejoined first, reading ''paper.cols.txt'' and never ''paper.norm.txt''.

**A probe hit is a //mention//.** It is an upper bound on doing the thing and a lower bound on nothing: a paper can state its handset model without writing the words "physical device". Every probe figure on the content page is labelled as a mention.

**The trap, and it is a big one.** Tool names are proper nouns and must be matched case-sensitively. The first pass ran everything case-insensitively and produced:

^ Probe ^ Case-insensitive ^ Case-sensitive ^ Why ^
| Xposed | **256** | **40** | ''/xposed/i'' matches the word "exposed" |
| LLM / GPT | 167 | 42 | ''/llm/i'' matches inside other words; ''/gpt/i'' likewise |
| App Store | 243 | 142 | matches generic lower-case "app store" |
| TaintDroid | 84 | 84 | no difference — a name with no lower-case homograph |

A 6.4× over-count on Xposed would have been published as "Xposed is mentioned by half the field", which is the opposite of the page's actual finding that Xposed is dead. The committed probe script prints **both** variants for the four terms where the difference is large, so the trap is visible in the audit trail rather than only in these notes. Every probe number on the content page is the case-sensitive one.

**Probes whose regex was deliberately widened or narrowed after a first look:**

^ Probe ^ First form ^ Problem ^ Published form ^
| physical device | ''/Pixel [0-9]\|Nexus [0-9]\|Galaxy S[0-9]\|physical device\|.../'' → 263 | matched figure labels and unrelated model numbers | dropped the handset-model alternatives; 109 |
| ran on an emulator | case-sensitive → 18 | "we used an emulator" is usually lower-case prose, not a product name | case-insensitive; 25 |
| ProGuard/R8/DexGuard | case-insensitive → 39 | ''/r8/i'' matched unrelated tokens | case-sensitive; 29 |
| store region / VPN | ''/storefront\|...\|VPN/'' → 133 | bare ''VPN'' matched every VPN-security paper | **dropped entirely** — no defensible narrow form was found, so no number is published for "states its storefront" |
| Exodus/AppCensus/Lumen | ''/Lumen/i'' → 29 | ''Lumen'' is also an ISP and a common word | ''/Lumen Privacy/'', case-sensitive; 23 |

The "store region" row is the honest one: the content page wanted a number for "how many papers state which storefront they sampled" and **there is no probe that answers it**, so the page uses the ''vantage.locations'' sentinel rate (313 of 430) and says what that does and does not cover.

Unedited probe output:

<file - mobile_probes-output.txt>
population: mobile-app-analysis papers with full text = 529

--- certificate pinning and TLS interception
    71  mentions certificate/SSL/TLS pinning
    33  describes bypassing pinning
    33  names a pinning-bypass tool
    13  mentions the Android Network Security Configuration
    13  mentions Certificate Transparency

--- instrumentation
    87  mentions Frida (case-sensitive)
   100    ... same probe case-insensitively, for comparison
    40  mentions Xposed (case-sensitive)
   256    ... case-insensitively: matches the word "exposed"
    18  mentions Magisk
    59  mentions mitmproxy
    35  mentions root detection / SafetyNet / Play Integrity
    15  mentions emulator detection

--- device or emulator
   109  says "physical/real device" (or phone/smartphone/handset)
    51  names an Android emulator product or phrase
    25  says plainly that it ran on an emulator

--- what defeats static analysis
   144  mentions native code / JNI / NDK
    85  mentions packing or unpacking
    29  names ProGuard / R8 / DexGuard
   256  mentions obfuscation (any sense -- wide, includes crypto/traffic obfuscation)

--- app acquisition and the store
    46  names a third-party APK/IPA mirror or downloader
    68  mentions AndroZoo
    11  mentions F-Droid
   142  mentions "App Store" (case-sensitive)
   243    ... case-insensitively: also matches generic "app store"
    80  names the Apple App Store specifically
    51  mentions jailbreaking or a jailbreak tool
     8  mentions store terms of service near scraping/downloading
    55  mentions privacy labels / Data Safety
    23  names Exodus Privacy / AppCensus / Lumen

--- driving the app
    72  mentions Monkey (case-sensitive)
    61  names a UI-exploration driver
    48  reports a coverage measure

--- LLMs
    42  mentions an LLM/GPT (case-sensitive)
   167    ... case-insensitively

--- historical
    84  mentions TaintDroid (only 7 of 529 papers actually USED it)

--- gaps a practitioner would ask about (added after review)
    14  mentions QUIC (case-sensitive)
    39  names an on-device-VPN capture tool or the VpnService API (narrow)
     8  describes the on-device-VPN capture technique (narrow)
     1  describes attributing traffic to a specific app or library (narrow)
</file>

===== 7. Figures checked against the source PDFs =====

Every measured figure quoted on the content page was checked against ''data/fulltext/<year>/<venue>/<slug>/paper.cols.txt'' by ''scripts/quotecheck_mobile.mjs''. The check is on **the substring the wiki page actually prints**, not on the extraction's ''evidence.quote'', because those are sometimes different sentences.

**40 figures across 13 papers: 38 verbatim, 2 present but fragmented by column reflow, 0 not located.**

Three findings worth recording:

  - **''oltrogge2021_mallory'', "5,511 (36.7%) vulnerable apps".** The extraction's ''evidence.quote'' for this tuple is a //different// sentence ("2,232 (14.8%) apps with vulnerable HostnameVerifier and 5,202 (34.7%) apps with vulnerable TrustManager"), whose numbers do not add to 5,511. The prevalence string was checked directly against the paper and the paper does say, verbatim, "Most of the affected apps implemented both vulnerabilities, resulting in 5,511 (36.7%) vulnerable apps total." The figure is right; the extraction's quote is a poor witness for it. **This is why the check is on the published substring and not on the quote.**
  - **Two FRAG verdicts** — ''lin2021_longitudinal'' ("1,129,615 app removal records, which correspond to 1,033,488 different mobile apps") and ''wang2019_evolution'' ("43.8% of apps in 2014 ... over 68% of apps in 2017"). In both, ''decolumn.mjs'' spliced a straddling line from the neighbouring column into the middle of the sentence, so the sentence is not contiguous in our rendering. Both were read in context by hand and both figures are correct. The script reports FRAG rather than MISS for exactly this case, and it distinguishes FRAG from a real miss by requiring every distinctive token inside a window twice the needle's length.
  - **''rodriguez2025_settings'', "3,245 apps (53.68%)".** Same reflow damage: the source renders as "245 face difficulties ... apps (53.68%) integrate at least one of these SDKs." The percentage and the clause are both present; the "3," was separated. The content page quotes the percentage, not the absolute count, for this reason.

Unedited output:

<file - quotecheck_mobile-output.txt>
quote/figure check over 13 papers, 40 figures

OK   IMC 2022  static pinning indicators 27%/33%
OK   IMC 2022  runtime pinning popular 11.4%/6.7%
OK   IMC 2022  runtime pinning random 0.9%/2.5%
OK   IMC 2022  circumvention 51.51%/66.15%
OK   IMC 2022  circumvention iOS 66.15%
OK   IMC 2022  Popular set n=1,000
OK   IMC 2022  Random set n=1,000
OK   USENIX 2021  NSC adoption 99,212 / 1,335,322
OK   USENIX 2021  NSC downgrades 88,174 (88.87%)
OK   USENIX 2021  NSC pinning 663 apps
OK   USENIX 2021  user-CA re-enable 8,606 / 1,098,479 (8.67%)
OK   USENIX 2021  vulnerable validation 5,511 (36.7%)
OK   USENIX 2024  Chinese apps 1529/2765 (55.3%)
OK   USENIX 2024  Play apps 322/5061 (6.4%)
OK   CCS 2023  NSC pinning 385 apps (3.89%)
OK   CCS 2023  static vs dynamic 54/281 vs 40/160
OK   USENIX 2018  FlowDroid >48%, Argus >73%, DroidSafe >4%
OK   USENIX 2018  13 undocumented FlowDroid flaws
OK   USENIX 2018  2,026 of 7,584 executable
OK   USENIX 2023  attrition 3654 analysed
OK   USENIX 2023  pre-consent 3013 (82.5%)
OK   USENIX 2023  identifiers 1285 (35.2%)
OK   USENIX 2023  TCF 146 (4.0%)
OK   PETS 2022  tracking libraries 88.73%/79.35%
OK   PETS 2022  pre-consent contact 81.44%/68.46%
OK   PETS 2022  12k per platform
OK   PETS 2025  Facebook SDK 53.68%
OK   PETS 2025  AdvertiserIDCollection 6.79%
OK   USENIX 2024  DSS coverage 46.8%
OK   USENIX 2024  DSS updated 40%
OK   USENIX 2024  ad/analytics library 42%
FRAG WWW 2021  removals 1,129,615 / 1,033,488
      needle: 1,129,615 app removal records, which correspond to 1,033,488 different mobile apps
OK   WWW 2021  median 28.5 days
OK   WWW 2021  top-1500 5%
FRAG WWW 2019  ad libraries 43.8% -> 68%
      needle: 43.8% of apps in 2014 used at least one ad library, while over 68% of apps in 2017
OK   WWW 2019  no update ~61%
OK   NDSS 2026  chameleon 162 (9.85%), 92.59% precision
OK   NDSS 2026  ads 85.96% / pop-ups 95.56% / distraction 19.21%
OK   CCS 2025  723 families / 14,178 versions
OK   CCS 2025  14,178 versions

38 verbatim, 2 present but fragmented by column reflow, 0 NOT LOCATED, of 40
</file>

===== 8. External sources: verified, corrected, and rejected =====

Training data is stale by construction for tool currency, so **every external claim on the content page was fetched, not recalled**, on 2026-08-27. Verification was by GitHub API or ''releases.atom''/''commits.atom'' feed for repositories, by registry API for packages, and by the vendor's or platform's own documentation for everything else.

<WRAP important>
**Read §11 reviewer 3 before trusting a date in this table.** Nine of the ''releases.atom'' dates in the first version of this table were wrong — an off-by-one regex paired each version with the previous release's date — and the table below has been corrected in place from the re-fetch. The corrected values are marked in bold. "Fetched, not recalled" was true; "parsed correctly" was not, and the two are different claims.
</WRAP>

==== Verified ====

^ Claim on the page ^ How verified ^
| Frida 17.17.0, 2026-08-05, not archived | ''api.github.com/repos/frida/frida{,/releases/latest}'' |
| objection 1.12.5, 2026-06-02 | GitHub API |
| Magisk v30.7, 2026-02-23 | GitHub API |
| Xposed archived (flag flipped 2023-06-01); last release v89 2017-12-17; last push 2020-06-08 | GitHub API, ''"archived": true'' |
| LSPosed latest release v1.9.2, 2023-10-11; **default-branch commit 2024-01-07**; ''pushed_at'' 2026-08-26 counts any branch | GitHub API + ''commits/HEAD.atom'' |
| JustTrustMe last release 2016, last push 2024-09-02 | GitHub API |
| SSL Kill Switch 2 release 0.14 (2019-12-03), last push 2023-07-09, README claims support to iOS 14.2 | GitHub API + README |
| TrustMeAlready archived 2019-09-23 | GitHub API |
| Soot 4.7.1 (**2026-02-23**); SootUp v3.0.1 (**2026-08-07**) | ''releases.atom'', **re-fetched after the off-by-one bug in §11 reviewer 3** |
| FlowDroid 2.15.1, **2026-02-23** | ''releases.atom'', re-fetched |
| Apktool v3.0.3, **2026-07-20** | ''releases.atom'', re-fetched |
| jadx 1.5.6, **2026-07-10** | ''releases.atom'', re-fetched |
| Androguard 4.1.4 on PyPI, 2026-06-01 | PyPI JSON API |
| MobSF v4.5.2, **2026-08-10** | ''releases.atom'', re-fetched |
| **LibRadar last commit 2018-12-21** | ''github.com/pkumza/LibRadar/commits/master.atom'' |
| **LibScout last commit 2019-10-25** | ''github.com/reddr/LibScout/commits/master.atom'' |
| npm ''google-play-scraper'' 10.1.3, 2026-05-31 | ''registry.npmjs.org/google-play-scraper'' |
| the npm README's "I don't use or actively maintain this project anymore" | fetched ''README.md'' raw; quoted verbatim |
| PyPI ''google-play-scraper'' 1.2.7, 2024-06-07 | PyPI JSON API + no GitHub releases |
| ''apkeep'' 1.0.0, 2026-04-30 | GitHub API ''published_at''. Note ''releases.atom'' reports 2026-05-05 for the same release; the API/tag page is authoritative |
| ''PlaystoreDownloader'' archived 2024-07-27 | GitHub API |
| ''ipatool'' v2.3.2, **2026-08-03** | ''releases.atom'', re-fetched |
| ''frida-ios-dump'' last commit 2020-06-01 | ''commits.atom'' |
| palera1n v3.0.0 beta 2 (**2026-08-03**); Dopamine 3.0.9 (2026-08-22); TrollStore 2.1.1 (**2026-04-01**) | ''releases.atom'' / ''commits.atom'', re-fetched |
| Appium 3.7.0, 2026-08-24 | ''registry.npmjs.org/appium'' |
| Monkey still shipped in the Android SDK | ''developer.android.com/studio/test/other-testing-tools/monkey'' returns 200 |
| AndroZoo 27,616,422 APKs; email-with-JSON-template access; institutional email required; **6-month key expiry, 500,000-APK cap**; Play metadata added December 2023 | fetched ''androzoo.uni.lu'' and ''androzoo.uni.lu/access'' and read both; the citation stanzas on the home page gave both AndroZoo papers |
| F-Droid ''index-v1''/''index-v2'' | ''f-droid.org/docs/All_our_APIs/'' |
| Android 7.0 (API 24) dropped default user-CA trust — quoted verbatim from the two default ''base-config'' blocks | ''developer.android.com/privacy-and-security/security-config'' |
| ''debug-overrides'' exempts pinning, quoted verbatim | same page |
| Certificate Transparency enforcement is scoped to "publicly-trusted TLS certificates" | ''developer.android.com/privacy-and-security/certificate-transparency-policy'' |
| SafetyNet "was deprecated in 2022 and fully turned down in January 2025"; Play Integrity is the replacement | ''developer.android.com/privacy-and-security/safetynet/attestation'' |
| Google's general ToS anti-automation clause, quoted verbatim, effective 30 July 2026 | ''policies.google.com/terms'' |
| Play Developer API cannot fetch third-party APKs | ''developers.google.com/android-publisher'' scope documentation |
| EU alternative marketplaces and web distribution for iOS; page updated 2026-08-18; further changes effective 2026-10-01 | ''developer.apple.com/support/dma-and-apps-in-the-eu/'' |
| **AppCensus has no free public app-report database** | fetched ''appcensus.io''; the site is live and describes an enterprise product (Assurance / Visibility / Validation / Support) with a "Contact Us" gate and no searchable report library |
| **Lumen Privacy Monitor is gone from Google Play** | ''play.google.com/store/apps/details?id=edu.berkeley.icsi.haystack'' and ''...id=org.icsi.haystack'' both return HTTP 404 |
| Exodus Privacy is live, platform version 1.32.4 | fetched ''reports.exodus-privacy.eu.org/en/'' |

==== Corrected: claims a research sub-agent returned that were wrong ====

An external-currency sweep was delegated to a sub-agent (''model: sonnet''). Its report was **not** taken at face value; every load-bearing item was re-fetched. Four of its claims were wrong or unverifiable, and all four would have reached the page:

^ Sub-agent claim ^ What the primary source says ^
| "''gplaycli'' — Active, not abandoned. Latest release **3.29, March 10, 2026**" | GitHub API: release 3.29 published **2020-03-10**; repo last pushed 2021-10-02. The agent read the year wrong by six years and inverted the verdict. The page says **abandoned**. |
| "**Android 17 (API 37)**, not 16, is now the current stable release" | ''developer.android.com/about/versions'' lists Android 16 as the most recent released version and "Android Beta (Android 17 QPR1)" as preview; ''.../versions/17'' is a beta/testing page. The page says **Android 16 stable, Android 17 in beta**. |
| "mandatory Android developer identity verification for app installation, rolling out from Sept 30, 2026" | Not verified against any Google primary source. **Not published.** |
| "an arXiv longitudinal study of Android app signing-key protection (arxiv.org/pdf/2606.21487) cross-validated 24/26 compromised apps" | Preprint, not read, not peer-reviewed, and the citation could not be confirmed. **Not published.** |

The sub-agent also over-read the CT-enforcement situation ("Android 17 is set to enable CT enforcement by default") in a way the primary page does not state. The page says only what the CT policy page says: enforcement is scoped to publicly-trusted certificates, so a locally-installed interception root is not covered.

==== Rejected sources, and why ====

Recorded so the next run does not re-add them.

^ Source ^ Why rejected ^
| CloudSEK blog post on modded APKs in third-party stores | Vendor security-marketing blog. The claim (mirrors serve repackaged binaries) is plausible and important, but a vendor blog is not a citable source for a methodology page. The page instead states that **no study of mirror integrity was found in these seven venues** and lists it as an open question. |
| ''arxiv.org/pdf/2606.21487'' | Unverified preprint surfaced by a sub-agent; not read. |
| An X/Twitter post attributed to the AppCensus account stating "AppCensus and Lumen Privacy Monitor by Narseo exist no more" | X returns HTTP 402 to unauthenticated fetch, so the wording could not be confirmed. The //claim// was substantiated independently — appcensus.io's own content and two Play Store 404s — and only the independent evidence is on the page. |
| "SSL Kill Switch 3" | Does not appear to exist. No repository under that name was found; ''nabla-c0d3/ios-ssl-kill-switch'' is archived (2015) and ''ssl-kill-switch2'' is the current-but-stale one. Not mentioned. |
| 9to5mac report on Apple redesigning EU ATT prompts after a Bundeskartellamt ruling | Secondary tech press, and not reflected on Apple's own page when checked. ATT enforcement changes are also peripheral to this page. Not published. |
| Android Police / Firebase App Check for the SafetyNet shutdown date | Superseded: Google's own SafetyNet page states "fully turned down in January 2025" verbatim, so the secondary sources were unnecessary. |
| AppGoblin (''appgoblin.info'') as a reusable app-metadata dataset | The site responds (HTTP 200) and advertises free bulk app-store datasets, but it was **not evaluated** — no read of its collection methodology, no check of its coverage or provenance. Recommending an unevaluated third-party dataset to a PhD student is exactly the failure mode this section exists to prevent. Not on the page. A future run that actually evaluates it should add it. |

===== 9. What could not be established =====

  * **How many papers state their storefront.** No probe with acceptable precision was found (see §6). The page uses the ''vantage.locations'' sentinel rate as the nearest available proxy and says so explicitly.
  * **Whether a mirror-served APK differs from the Play original.** No study of this in the seven venues; the only material found was a vendor blog, rejected. Published as an open question.
  * **The Android/iOS balance, properly.** The schema has no field finer than ''platforms = ['mobile']''. The 369 / 39 / 66 / 55 split is a regex over metadata, published with that caveat and with the regex in the report script. It should not be quoted precisely.
  * **Whether the pinning-bypass success rate has changed since 2022.** {[pradeep2022_comparative]} is the only measurement of it found anywhere in the corpus. Four Frida majors later, nobody has repeated it. Published as the first open question.
  * **Exodus Privacy's current tracker-signature count.** Not on the front page, and the statistics pages were not reachable during this run. The page says the service is live and explicitly tells the reader to check before quoting a count.
  * **Whether the corpus's mobile share is really falling.** ''appAnalysis'' peaked at 18.4% of papers in 2015 and is 6.7% in 2024. That could be a real shift, or it could be the corpus's absolute growth (119 papers in 2010, 690 in 2024) diluting a constant absolute volume — absolute mobile counts are roughly flat at 44–66 per year over 2020–2025, with 2019 at 38 and the provisional 2026 at 24. The report output prints the per-year table; the content page shows only the four era columns and makes no claim about the share trend in either direction.
  * **Apple's privacy-manifest (''PrivacyInfo.xcprivacy'') requirement date.** The fetch of Apple's required-reason-API page returned only a title. Privacy manifests are therefore **not** discussed on the page, even though they are an obviously scrapable artefact. A future run should get this and add it.

===== 10. Bibliography =====

17 entries added to [[literature:bibliography]], appended before the closing ''</bibtex>'' of a **fresh export of the live page** (not a local copy — a stale local copy is a known trap here).

**Duplicate check before appending**, by four independent keys: exact key string, normalised title, DOI, and URL. One collision found and resolved:

  * **''koch2023_enough'' already existed** in the live bibliography, with identical title, URL and correct authors. The duplicate entry was **deleted** from the additions file rather than renamed; the page cites the existing key. Without the title/DOI/URL scan a key-string check alone would still have caught this one, but the same scan confirmed the other 17 are genuinely new.
  * ''bibgen.mjs'' emitted ''author = {Koch, Simon and Altpeter, Benjamin and e.V., Datenanfragen.de and Johns, Martin}'' for that paper from the index — "Datenanfragen.de e.V." is Altpeter's **affiliation**, not an author. The live entry already has the correct three authors, so no fix was needed, but the bug is recorded here because ''bibgen'' will reproduce it.

**PETS and USENIX index records carry no authors** (100% of both venues). Author lists were fetched from the venue landing pages with ''curl'' and a browser User-Agent — ''WebFetch'' gets 403 from usenix.org:

<code bash>
curl -s -A 'Mozilla/5.0 ...' https://www.usenix.org/conference/usenixsecurity21/presentation/oltrogge
curl -s -A 'Mozilla/5.0 ...' https://petsymposium.org/popets/2025/popets-2025-0056.php
</code>

**Every DOI was resolved against the Crossref API** (''api.crossref.org/works/<doi>''); all 11 DOI-bearing entries returned HTTP 200. The six USENIX/NDSS entries have no DOI and are cited by landing-page URL, which is what ''bibgen.mjs'' does for those venues.

**Five of the 17 entries are from outside the seven venues**, added deliberately because the corpus cannot cover them:

^ Key ^ Why it is needed ^
| ''allix2016_androzoo'' (MSR 2016) | AndroZoo's own paper; required by its access conditions |
| ''alecci2024_retrospective'' (MSR 2024) | the AndroZoo metadata paper, also required for citation |
| ''li2017_static'' (IST 2017) | the canonical static-analysis systematic review; nothing in the seven venues plays this role |
| ''kong2019_testing'' (IEEE TR 2019) | the canonical automated-Android-testing review, for the UI-exploration section |
| ''pauck2018_promises'' (ESEC/FSE 2018) | the second independent measurement of taint-analysis tool unsoundness, alongside μSE |

===== 11. Review log =====

Four reviewers, all told explicitly that the author's context may not be exhaustive, and all handed the page text, the report script, its unedited output, the probe and quote-check outputs, and these provenance notes. The three focused reviewers ran in parallel first; the generic reviewer ran afterwards on the corrected page — and **caught that this log's one rejection was itself wrong** (see reviewer 4).

==== Reviewer 1 — figures vs the report script (model: sonnet) ====

Re-ran all three scripts live and confirmed the committed ''scripts/*-output.txt'' files are byte-identical to a fresh run. Checked roughly 400 individual figures and percentages cell by cell.

^ # ^ Finding ^ Verdict ^ Action ^
| 1 | The per-era tool table in the report script filtered to families with **≥8 papers**, which silently omitted TaintDroid (7 papers) — a family the content page quotes per-era to argue it is superseded. A reader told to verify the page against this output could not find the row. | **Accepted.** Real reproducibility gap, and exactly the defect the provenance convention exists to prevent. | Threshold removed; the era table now prints **every** mapped family with no minimum, and the code carries a comment saying why. The TaintDroid figures on the page (6.8% / 0.6% / 0% / 0%) were correct and are unchanged; they are now findable in the output. |
| 2 | "objection … 8 of its 10 uses in this corpus are pinning bypass" — reviewer counted **9** used tuples, not 10, and proposed "7 of its 9". | **First rejected, then ACCEPTED after reviewer 4 showed the rejection was wrong.** My rejection re-enumerated ''/objection/i'' **corpus-wide** and got 10 tuples / 8 pinning, and concluded the reviewer had miscounted. Reviewer 4 pointed out that one of the ten — ''CCS/2019/watching-you-watch-the-tracking-ecosystem…'', an OTT-streaming-device paper — **is not in ''appAnalysis''**, the population every other figure in that table is on. Within the page's own population it is **9 tuples, 7 with a pinning purpose** — exactly what reviewer 1 proposed. Rejecting a finding by silently switching denominators, on a page whose first methodology bullet is "every table names its own denominator", is the worst kind of error this log can contain, and it is recorded here rather than quietly corrected. | Page changed to "**7 of its 9 uses among the 529**"; the fold comment in ''mobile_fold.mjs'' updated; the enumeration below now carries the ''appAnalysis'' flag per row and is **computed by ''report_mobile.mjs''** rather than by an ad-hoc command, so the denominator cannot drift again. |
| 3 | "8,606 of 1,098,479 apps targeting Android 7+ (8.67%)" is internally inconsistent — 8,606/1,098,479 = 0.78%; 8.67% is 8,606/99,212. | **Accepted**, and it is a good catch: the inconsistency is in {[oltrogge2021_mallory]}'s own sentence, and republishing it unexamined would have passed the ambiguity on. | Rewritten to give 8,606 as an absolute, state that the paper's 8.67% is of the 99,212 custom-NSC apps, and give 0.78% as the share of the 1,098,479. |
| 4 | Provenance page said "**Four** entries are from outside the seven venues" above a table listing **five**. | **Accepted.** | Corrected to "Five of the 17 entries". |
| 5 | The ''ethics.reviewOutcome'' and ''artifacts.availability'' rows were computed as ''529 − sentinelOnlyPapers'', which counts papers whose object is entirely absent as if they had stated something. | **Accepted** — and already fixed before the review landed (see §12); the reviewer derived 149/28.2% and 323/61.1% independently, which is a useful confirmation. | None outstanding. |
| 6 | Provenance said absolute mobile counts are "roughly flat at 44–66 per year since 2019", but 2019 is **38**. | **Accepted.** | Corrected to 2020–2025, with 2019 = 38 and provisional 2026 = 24 named. |
| 7 | Content page said "flat at 41–44% across every **four-year** window since 2010", but the eras span 6, 5, 4 and 2 years. | **Accepted.** | Reworded to "across all four era windows", with the four spans listed. |

The enumeration is now printed by the report script (§13, "objection, enumerated"), with the ''appAnalysis'' membership of each row visible:

<code>
objection tuples in appAnalysis: 9 (7 with a pinning purpose); corpus-wide papers: 10
  PIN  used   USENIX/2021/share-first-ask-later-...          Detect and disable SSL pinning
  PIN  used   CCS/2022/freely-given-consent-...              Disabled SSL pinning in instrumented apps.
  oth  used   USENIX/2022/breaking-bridgefy-again-...        Hooked functions and observed or modified app behavior.
  PIN  used   USENIX/2023/the-ok-is-not-enough-...           Automated Android apps and disabled SSL checking.
  PIN  used   PETS/2024/a-black-box-privacy-analysis-...     Disabled mobile-app SSL certificate checks.
  PIN  used   USENIX/2024/abandon-all-hope-ye-who-enter-...  Detected and disabled SSL pinning.
  oth  used   USENIX/2025/autovr-automated-ui-exploration    Repackage APKs containing the injected Frida server.
  PIN  used   PETS/2025/the-impact-of-default-mobile-sdk-... Bypass SSL pinning on rooted Android.
  PIN  used   PETS/2026/the-tcf-doesn-t-really-a-a-id-...    Disabled SSL pinning during traffic collection.
</code>

The tenth, corpus-wide, is ''CCS/2019/watching-you-watch-the-tracking-ecosystem…'' — ''appAnalysis = false''.

==== Reviewer 2 — citations and quotes (model: sonnet) ====

Independently re-derived every quoted figure from ''paper.cols.txt'' rather than trusting ''quotecheck_mobile-output.txt''; resolved all 11 DOIs against Crossref; re-fetched all six USENIX/NDSS author lists and the PoPETs one from the venue landing pages; duplicate-scanned the 17 new entries against the 488 live ones on four axes (key string, DOI, URL, and normalised title with a fuzzy threshold).

^ Finding ^ Verdict ^ Action ^
| 22 citekeys all resolve; no duplicate or colliding keys beyond the ''koch2023_enough'' one already removed; best fuzzy title match among the new entries topped out at 0.55. | Confirmation. | None. |
| All 17 new entries' authors, titles, years, venues and DOIs match Crossref / the venue pages exactly. | Confirmation. | None. |
| ~43 quoted figures across 13 papers re-derived independently; all correct and correctly attributed, including the three denominators most likely to be got wrong: the Popular/Random n=1,000 in {[pradeep2022_comparative]} being **per platform**, the 9,889-app IoT-VER set in {[schmidt2023_iotflow]} (not its 947-app comparison set), and the 42% in {[khandelwal2024_unpacking]} — which the reviewer notes is one of **three different 42% figures in that paper**, and the page picked the right one (the 15K most popular apps reporting no third-party sharing). | Confirmation, and the most valuable part of this review. | None. |
| All seven footnoted external verbatim quotes match their source URLs exactly. | Confirmation. | None. |
| **"40% changed it at least once across ten monthly snapshots"** — the paper's ten snapshots are 8 weekly plus 3 spread over later months, not monthly. | **Accepted.** A wording error, not a numeric one. | Changed to "across ten snapshots between June 2022 and May 2023". |
| The ''pradeep2022_comparative'' weak-cipher result holds only for the **Common Android** dataset; the paper's general finding is that pinning apps have //better// cipher security. | **Confirmation of a deliberate choice.** The figure was in an early draft, was cut before publication precisely because it needed this scoping, and survives only on this provenance page (§7 exemplars) where it is correctly labelled "Common Android". The content page makes no cipher claim. | None. |

==== Reviewer 3 — external currency (model: sonnet) ====

43 items re-fetched independently, plus a dead-link sweep of every URL on the page. **This reviewer earned its slot: it found a systematic bug that had put nine wrong dates on the page, and it found the root cause pattern before I did.**

**The bug.** The first currency pass read GitHub's ''releases.atom'' with

<code>
/<entry>.*?<title>(.*?)<\/title>.*?<updated>(.*?)<\/updated>/s
</code>

In that feed ''<updated>'' comes **before** ''<title>'' inside each ''<entry>'', so the regex paired entry //N//'s title with entry //N+1//'s date — every version number was printed alongside the **previous** release's date. Nine claims were wrong in exactly that way. Re-verified by splitting on ''</entry>'' and parsing each entry alone, now committed as ''scripts/mobile_tool_currency.sh'' with the bug documented in its header so it cannot recur:

^ Claim ^ Was ^ Is ^
| Soot 4.7.1 | 2026-02-13 | **2026-02-23** (2026-02-13 is 4.7.0) |
| SootUp v3.0.1 | 2026-07-16 | **2026-08-07** (2026-07-16 is v3.0.0) |
| FlowDroid 2.15.1 | 2026-02-19 | **2026-02-23** (2026-02-19 is 2.15.0) |
| Apktool v3.0.3 | 2026-04-19 | **2026-07-20** (2026-04-19 is v3.0.2) |
| jadx 1.5.6 | 2026-02-25 | **2026-07-10** (2026-02-25 is 1.5.5) |
| MobSF v4.5.2 | 2026-07-06 | **2026-08-10** (2026-07-06 is v4.5.1) |
| ipatool v2.3.2 | 2026-07-05 | **2026-08-03** (2026-07-05 is v2.3.1) |
| palera1n v3.0.0 beta 2 | 2026-07-27 | **2026-08-03** (2026-07-27 is v2.4, a different track) |
| **TrollStore 2.1.1** | 2024-09-02 | **2026-04-01** (2024-09-02 is 2.1) |

TrollStore is the damaging one and the reviewer ranked it first correctly: the page had it looking like a tool coasting on old commits since 2024, when its current release shipped in April 2026. Verdict changed to "Actively released."

^ Other finding ^ Verdict ^ Action ^
| ''.../safetynet/attestation'' 301-redirects to ''.../safetynet/deprecation-timeline'', which carries the same sentence. | **Accepted.** | Footnote now cites the new canonical path and notes the redirect. |
| ''.../support/dma-and-apps-in-the-eu/'' 301-redirects to ''.../support/apps-in-the-eu''. | **Accepted.** | Same. |
| "page updated 18 August 2026" for the Apple DMA page is **unverifiable** — the page is a JS shell with no static date exposed to any automated fetch. | **Accepted.** The date came from a sub-agent's WebFetch summary, not from anything I could see myself. | Claim **deleted**. This is the second sub-agent claim on that page that did not survive re-fetching. |
| ''reddr/LibRadar'' returns 404; ''pkumza/LibRadar'' is the sole canonical repo. | Confirmation — the page already cites ''pkumza''. | None. |
| The Certificate Transparency conclusion ("a locally-installed interception root is not publicly trusted, so CT is not an additional barrier") is the page's **inference**, not a sentence Google states; Google's page never mentions user or local CAs at all. The reviewer judged the existing hedge ("on the documentation's own wording") to be doing the right job and recommended no change. | **Accepted as an inference, kept with the hedge.** Recorded here so a future reader knows it is a reading and not a quote — this remains the single weakest external claim on the page. | None. |
| No maintained successor to LibRadar/LibScout exists; nothing has displaced Frida/objection for pinning bypass. | Confirmation of the page's own Open Question. | None. |
| Every URL returns 200 or a benign redirect; no 404s. ''npmjs.com'' returns 403 to automation, so those two footnotes were confirmed via ''registry.npmjs.org'' instead. | Confirmation. | None. |
| Xposed: the reviewer noted the //archive flag// was flipped 2023-06-01, while 2020-06-08 is ''pushed_at''. | **Accepted as imprecise.** The page said "archived 2020-06-08", conflating the two. | Rewritten as "archived; last release v89 (2017-12-17), last push 2020-06-08". |

**One thing I found while re-verifying, which the reviewer did not raise:** LSPosed's ''pushed_at'' of 2026-08-26 — the basis for the page's original "Repository still active" — counts **any branch**. Its **default branch has not moved since 2024-01-07**. That is a materially stronger version of the reviewer's point, so the verdict was changed from "Repository still active, no release cut in nearly three years" to "**Stalled.** No release in nearly three years and no default-branch commit in over two", with the discrepancy explained in the footnote. The currency script now prints the default-branch date and carries a note about the two definitions.

Also caught in the same pass: ''apkeep'' reads **2026-05-05** from ''releases.atom'' but **2026-04-30** from the API's ''published_at''. The tag page is authoritative, so the page keeps 2026-04-30 and the script prints a note about the divergence.

==== Reviewer 4 — generic, no checklist (model: fable) ====

Ran last, on the page as corrected by the other three. It re-derived contested figures itself and **computed two intersections the page had only inferred**, which is how it found the two worst remaining defects. Every finding was accepted; none was rejected.

^ # ^ Finding ^ Action ^
| 1 | **This log's one rejection was wrong.** The ''objection'' count was rejected using a corpus-wide denominator instead of ''appAnalysis''. | Reviewer 1's finding reinstated as **Accepted**; page now says 7 of 9; the enumeration is computed by the report script with the ''appAnalysis'' flag shown. See finding 2 above. |
| 2 | **§8's "Verified" table still carried the nine pre-fix dates** that reviewer 3 had proved wrong, under a heading claiming verification — so this page contradicted the page it backs. Reviewer 4 named this as my own recorded failure mode ("a fix survives in the provenance log"). | All nine rows corrected in place with the new values in bold, plus a ''%%<WRAP important>%%'' at the head of §8 saying "'fetched, not recalled' was true; 'parsed correctly' was not". |
| 3 | **§11's preamble said the generic reviewer "ran afterwards", three subsections above a "Not run."** | Preamble corrected; this subsection replaced. |
| 4 | "every large Android study in the corpus uses AndroZoo, an unofficial scraper, or a mirror" is a **false universal** — of the 96 papers with a ≥100,000-app population, sources include vendor telemetry (NortonLifeLock, Palo Alto Networks), volunteer capture (Lumen) and inherited datasets (Drebin, Andrubis, the Gamba preinstalled-app set). | Rewritten with the five routes and the 96-paper computation, which ''report_mobile.mjs'' now prints with the full list of non-store sources. |
| 5 | "most papers that intercepted traffic never wrote down what they could not intercept" was derived from **three unintersected probe counts** (110 / 71 / 33 / 13) that cannot support a claim about the 110. Reviewer 4 computed the intersection: of the 110, **44 mention pinning, 65 (59.1%) mention none of pinning, a bypass, or the NSC**. The claim survives, by 9 points, on evidence that was invalid as written. | The intersection is now computed by ''report_mobile.mjs'' over full text and the page publishes the four real numbers instead of the inference. **This is the single best catch of the four reviews**: the conclusion was right and the reasoning was not, which no number-checking pass would have found. |
| 6 | §4's prose restated the guard's own accounting ("305 of 366 … 61 allowed") after the output had moved to 367 / 62. | Prose no longer restates it; it points at the output block and says why restating it is how it goes stale. |
| 7 | Three small false statements: §9 claimed the content page "reports the per-year table" (it does not); §7 said "Two findings" above three bullets; §15 said "the one citekey" where there are four. | All three corrected. |
| 8 | **No "What to Read First" section**, though ''design:longitudinal'' — the stated model — has one and "which papers to read first" is in the page's remit. The recommendations existed but were buried in mid-prose. | Section added near the top, five papers with the methodological reason for each, plus the two systematic reviews. |
| 9 | **The page never says how to see iOS traffic**, and does not admit the gap: step 1 of the pinning section is entirely Android, the pipeline tip is Android-only without saying so, and the only iOS bypass tool named is marked unmaintained with no alternative. | A ''%%<WRAP info>%%'' now scopes steps 1–3 as Android and gives the iOS route (CA profile with full trust, then code injection on a jailbroken device), pointing at {[pradeep2022_comparative]} as the worked example. |
| 10 | Three practitioner staples missing: **on-device VPN capture** (the no-root route, present in the fold residue and only mentioned on the page as a dead data source), **per-app traffic attribution** (a proxy sees the OS and Play Services too), and **QUIC** (bypasses a TCP proxy; 14 of 529 papers mention it). | New subsection "Three things that will bite you that no paper warns you about", with three new probes behind it. |
| 11 | "the one the corpus's recent traffic-measurement papers converge on" overstates: of 191 papers since 2023, **16** use Frida+mitmproxy and **3** the full named stack. | Reworded to "built from the components recent papers most often combine", with both figures given and the convergence claim withdrawn. The report script now computes them. |
| 12 | "PETS and NDSS are where a mobile privacy measurement most often lands" over-reads a two-point spread, ignores that USENIX (143) and CCS (106) dominate by volume, and calls ''appAnalysis'' "privacy measurement" when it includes malware and vulnerability work. | Both views now given, with the population caveat. |
| 13 | The classification-target table's top row was ''other'' at 44.2% — a finding about the extraction schema, not the field. | Row cut. |
| 14 | The page reported ''pre-existing-dataset'' at 17.8% but **named no dataset except AndroZoo**, failing its own "so they do not rebuild one" purpose. | New paragraph naming Drebin, Andrubis, the Gamba preinstalled-app set, Firmware Scanner, Koodous, VirusShare, AMD, PrivacyGrade and the Lumen captures, with a warning that a malware set is not a sample of apps users have and that a 2014 dataset is a claim about 2014. |
| 15 | Two undocumented universals ("the only paper in the corpus", "Nobody has re-measured") and one overstatement ("needed an LLM … at all"). | All three scoped to "we found" / "in these seven venues" / "used". |
| 16 | "Every percentage in that paper is over 3,654" is almost certainly false of a whole paper. | Changed to "Its app-level results are all over 3,654". |

**Taste items accepted:** none changed. Reviewer 4 flagged the Android 16/17 footnote as dateable trivia, the acquisition-tool repeats in "Which Methods Are Current", and the venue paragraph's placement. The Android-version footnote stays because it is what dates the user-CA and CT claims around it; the repeats stay because the site convention (''design:longitudinal'') is that "Which Methods Are Current" is a self-contained dated summary; the venue paragraph stays where a newcomer will read it. All three are judgement calls a reasonable person would make differently.

**One inherited discrepancy it found:** the header comment in ''mobile_fold.mjs'' said adb appears in 29 papers under its largest spelling while the generated table in section 5 says 28. The table is the authority; the comment had been written from an early ad-hoc query. Fixed at source rather than explained away.

**Two things reviewer 4 checked and passed**, worth recording because they were the things most likely to be wrong: the denominator discipline held everywhere it traced, and the ''[[:Artifacts]]'' red links are a site-wide promised-but-missing page linked from 14 other pages, not a defect of this one.


===== 12. The run itself =====

^ Item ^ Value ^
| Date | 2026-08-27 |
| Corpus at the time | ''data/extract/run1'', 5,859 papers, 7 venues (CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P), 2010–2026 |
| Main agent | Claude (Opus 5) — all queries, the report script, the fold, the probes, the quote check, the page text, and independent re-verification of every external claim |
| Sub-agents | one ''sonnet'' external-currency sweep (which itself fanned out to seven sub-agents, and whose four wrong claims are in §8); three ''sonnet'' reviewers spawned, **all three returned**; the ''fable'' generic pass was not run (§11) |
| Write path | ''node scripts/dw.mjs put'' over JSON-RPC, with ''%%--if-rev%%'' on every save |
| Stability figures | the ~20% free-text agreement and 0.9% unlocatable-quote figures quoted from ''data/extract/README.md'' were measured on the **older, smaller corpus** and have not been re-measured. Treated as the right order of magnitude. |
| Mistakes caught in review of my own work | (1) the item brief's figures were stale and were re-derived rather than reused; (2) the first probe pass was case-insensitive and over-counted Xposed 6.4×; (3) the first draft published "218 (46.2%) report no validation of the classifier at all", which conflated //papers with at least one unvalidated classifier// with //papers with no validation at all// — the correct figures are 79 (16.7%) with none, 178 (37.7%) with all validated, and 393 (83.3%) with at least one validated, and the report script now computes all three; (4) the first draft obtained "199 (37.6%)" for ''ethics.reviewOutcome'' and "341 (64.5%)" for ''artifacts.availability'' by **subtracting the sentinel count from 529**, which overstates both — ''ethics'' is ''null'' on 50 of the 529 papers and ''artifacts'' on 18, so //stated + sentinel-only ≠ 529//. The correct figures are **149 (28.2%)** and **323 (61.1%)**; the report script now prints all three components so nobody has to subtract, and the number guard (§4) was written after this. (5) the ''frida-ios-dump'' fold landed in the wrong family until a smoke test caught it. |
| Accidental exposure | none. No credential was printed; ''.env'' was never read into output. |

===== 13. Full report output =====

Unedited output of ''node scripts/report_mobile.mjs''. §8 is the complete fold residue.

<file - report_mobile-output.txt>

==============================================================================
1. POPULATIONS
==============================================================================
corpus                                              5859
appAnalysis  studyTypes has 'mobile-app-analysis'    529   9.0% of corpus
mobilePlat   platforms has 'mobile'                  1075   18.3%
either                                              1079
both                                                525
tools category 'mobile-instrumentation' (any)        364
  of those, outside 'either'                        32
population unit 'mobile-apps'                       502
  of those, outside 'either'                        24

--- appAnalysis per venue
Venue    appAnalysis  all   share of venue
-------  -----------  ----  --------------
USENIX   143          1410  10.1%
CCS      106          990   10.7%
NDSS     82           701   11.7%
PETS     66           510   12.9%
IEEE-SP  63           767   8.2%
WWW      37           843   4.4%
IMC      32           638   5.0%

--- appAnalysis per year (2026 is provisional: CCS/IMC 2026 not held, IEEE S&P/WWW 2026 under-selected)
Year  papers  appAnalysis  share  mobilePlat  share
----  ------  -----------  -----  ----------  -----
2010  119     1            0.8%   6           5.0%
2011  116     3            2.6%   11          9.5%
2012  151     13           8.6%   25          16.6%
2013  125     13           10.4%  27          21.6%
2014  166     23           13.9%  40          24.1%
2015  190     35           18.4%  51          26.8%
2016  182     23           12.6%  45          24.7%
2017  231     32           13.9%  61          26.4%
2018  254     20           7.9%   53          20.9%
2019  402     38           9.5%   82          20.4%
2020  404     44           10.9%  86          21.3%
2021  379     44           11.6%  84          22.2%
2022  546     49           9.0%   106         19.4%
2023  719     55           7.6%   113         15.7%
2024  690     46           6.7%   110         15.9%
2025  770     66           8.6%   127         16.5%
2026  415     24           5.8%   48          11.6%

==============================================================================
2. TOOLING, folded (population: appAnalysis, N=529, tuples with usedOrMentioned="used")
==============================================================================

--- folded tool families (only families the fold defines; unmapped names are residue, printed in section 8)
Family                  papers  share of 529
----------------------  ------  ------------
Frida                   74      14.0%
adb                     71      13.4%
Soot                    65      12.3%
apktool                 57      10.8%
mitmproxy               52      9.8%
FlowDroid               49      9.3%
Androguard              37      7.0%
smali/baksmali          34      6.4%
Monkey                  34      6.4%
jadx                    32      6.0%
Xposed                  31      5.9%
Play store scraper      30      5.7%
tcpdump                 27      5.1%
Wireshark               25      4.7%
LibRadar                23      4.3%
Android emulator        21      4.0%
IDA Pro                 18      3.4%
Appium                  17      3.2%
UI Automator            15      2.8%
pinning-bypass helper   15      2.8%
DroidBot                14      2.6%
Magisk                  14      2.6%
PScout                  12      2.3%
iOS app acquisition     12      2.3%
Ghidra                  12      2.3%
Burp Suite              11      2.1%
third-party APK mirror  10      1.9%
LibScout                10      1.9%
libimobiledevice        9       1.7%
Fiddler                 8       1.5%
WALA                    7       1.3%
TaintDroid              7       1.3%
AndroZoo                7       1.3%
MobSF                   7       1.3%
AndroidViewClient       6       1.1%
jailbreak tool          5       0.9%
monkeyrunner            3       0.6%
Accessibility Service   3       0.6%
RERAN                   3       0.6%
Charles Proxy           2       0.4%

--- the same families per era — this is the currency evidence
era sizes: 2010-2015=88  2016-2020=157  2021-2024=194  2025-2026*=90
Family                  total  2010-2015   2016-2020   2021-2024   2025-2026*
----------------------  -----  ----------  ----------  ----------  ----------
Frida                   74     0 (0.0%)    6 (3.8%)    38 (19.6%)  30 (33.3%)
adb                     71     5 (5.7%)    13 (8.3%)   34 (17.5%)  19 (21.1%)
Soot                    65     8 (9.1%)    24 (15.3%)  24 (12.4%)  9 (10.0%)
apktool                 57     10 (11.4%)  21 (13.4%)  15 (7.7%)   11 (12.2%)
mitmproxy               52     1 (1.1%)    11 (7.0%)   27 (13.9%)  13 (14.4%)
FlowDroid               49     4 (4.5%)    16 (10.2%)  22 (11.3%)  7 (7.8%)
Androguard              37     7 (8.0%)    7 (4.5%)    18 (9.3%)   5 (5.6%)
smali/baksmali          34     15 (17.0%)  11 (7.0%)   5 (2.6%)    3 (3.3%)
Monkey                  34     2 (2.3%)    14 (8.9%)   12 (6.2%)   6 (6.7%)
jadx                    32     0 (0.0%)    2 (1.3%)    18 (9.3%)   12 (13.3%)
Xposed                  31     0 (0.0%)    16 (10.2%)  13 (6.7%)   2 (2.2%)
Play store scraper      30     0 (0.0%)    6 (3.8%)    14 (7.2%)   10 (11.1%)
tcpdump                 27     2 (2.3%)    5 (3.2%)    14 (7.2%)   6 (6.7%)
Wireshark               25     2 (2.3%)    6 (3.8%)    8 (4.1%)    9 (10.0%)
LibRadar                23     0 (0.0%)    10 (6.4%)   11 (5.7%)   2 (2.2%)
Android emulator        21     7 (8.0%)    7 (4.5%)    6 (3.1%)    1 (1.1%)
IDA Pro                 18     1 (1.1%)    6 (3.8%)    7 (3.6%)    4 (4.4%)
Appium                  17     0 (0.0%)    2 (1.3%)    7 (3.6%)    8 (8.9%)
UI Automator            15     0 (0.0%)    3 (1.9%)    7 (3.6%)    5 (5.6%)
pinning-bypass helper   15     0 (0.0%)    3 (1.9%)    8 (4.1%)    4 (4.4%)
DroidBot                14     0 (0.0%)    2 (1.3%)    8 (4.1%)    4 (4.4%)
Magisk                  14     0 (0.0%)    1 (0.6%)    5 (2.6%)    8 (8.9%)
PScout                  12     2 (2.3%)    7 (4.5%)    0 (0.0%)    3 (3.3%)
iOS app acquisition     12     2 (2.3%)    4 (2.5%)    3 (1.5%)    3 (3.3%)
Ghidra                  12     0 (0.0%)    2 (1.3%)    4 (2.1%)    6 (6.7%)
Burp Suite              11     1 (1.1%)    2 (1.3%)    4 (2.1%)    4 (4.4%)
third-party APK mirror  10     2 (2.3%)    5 (3.2%)    3 (1.5%)    0 (0.0%)
LibScout                10     0 (0.0%)    6 (3.8%)    3 (1.5%)    1 (1.1%)
libimobiledevice        9      0 (0.0%)    2 (1.3%)    5 (2.6%)    2 (2.2%)
Fiddler                 8      1 (1.1%)    2 (1.3%)    5 (2.6%)    0 (0.0%)
WALA                    7      3 (3.4%)    2 (1.3%)    2 (1.0%)    0 (0.0%)
TaintDroid              7      6 (6.8%)    1 (0.6%)    0 (0.0%)    0 (0.0%)
AndroZoo                7      0 (0.0%)    2 (1.3%)    1 (0.5%)    4 (4.4%)
MobSF                   7      0 (0.0%)    1 (0.6%)    4 (2.1%)    2 (2.2%)
AndroidViewClient       6      0 (0.0%)    3 (1.9%)    2 (1.0%)    1 (1.1%)
jailbreak tool          5      0 (0.0%)    0 (0.0%)    2 (1.0%)    3 (3.3%)
monkeyrunner            3      2 (2.3%)    1 (0.6%)    0 (0.0%)    0 (0.0%)
Accessibility Service   3      0 (0.0%)    1 (0.6%)    1 (0.5%)    1 (1.1%)
RERAN                   3      0 (0.0%)    0 (0.0%)    3 (1.5%)    0 (0.0%)
Charles Proxy           2      0 (0.0%)    0 (0.0%)    1 (0.5%)    1 (1.1%)

--- unfolded top names, for comparison with the folded table above
name (skeleton-folded only)  papers
---------------------------  ------
Frida                        72
Soot                         65
VirusTotal                   58
apktool                      56
mitmproxy                    52
FlowDroid                    49
Android Debug Bridge (adb)   41
Androguard                   37
JADX                         32
tcpdump                      28
LibRadar                     22
Python                       22
Xposed                       22
Selenium                     21
Wireshark                    20
adb                          19
Chrome                       19
scikit-learn                 19
IDA Pro                      18
Appium                       17
google-play-scraper          15
DroidBot                     14
Monkey                       14
random forest                13
Android emulator             12
distinct skeleton-folded names: 1755

--- how much the alias fold changes the answer
adb                  folded= 71  largest single spelling="Android Debug Bridge (ADB)"=28  spellings=11
Frida                folded= 74  largest single spelling="Frida"=69  spellings=10
Xposed               folded= 31  largest single spelling="Xposed"=22  spellings=5
Monkey               folded= 34  largest single spelling="Monkey"=13  spellings=12
UI Automator         folded= 15  largest single spelling="Android UI Automator"=4  spellings=8
Play store scraper   folded= 30  largest single spelling="google-play-scraper"=12  spellings=12

--- tool GROUPS — the four things a mobile study can instrument, and whether it combines them
tool group            papers  share of 529  2010-2015   2016-2020   2021-2024   2025-2026*
--------------------  ------  ------------  ----------  ----------  ----------  ----------
static analysis / RE  225     42.5%         37 (42.0%)  69 (43.9%)  82 (42.3%)  37 (41.1%)
runtime hooking       155     29.3%         10 (11.4%)  32 (20.4%)  73 (37.6%)  40 (44.4%)
traffic interception  110     20.8%         7 (8.0%)    24 (15.3%)  52 (26.8%)  27 (30.0%)
UI exploration        89      16.8%         4 (4.5%)    26 (16.6%)  36 (18.6%)  23 (25.6%)

static AND traffic: 55 (10.4% of 529)
  static only 170
  traffic only 55
  neither (no tool in either group named) 249
Era         N    static AND traffic
----------  ---  ------------------
2010-2015   88   4 (4.5%)
2016-2020   157  12 (7.6%)
2021-2024   194  25 (12.9%)
2025-2026*  90   14 (15.6%)

UI exploration AND traffic interception: 30 (5.7% of 529) — the "drive it and watch the wire" pipeline

--- of the papers that intercepted traffic, how many mention pinning at all
(placeholder — see the traffic-group block below; 'both' here is static AND traffic, not the traffic group)
traffic-interception papers: 110 (full text read for 110)
  mention pinning:                44 (40.0%)
  describe bypassing pinning:     22 (20.0%)
  mention the NSC:                6 (5.5%)
  mention NONE of the three:      65 (59.1%)  <-- the page's claim rests on this

--- the large-population sources, and the modern-pipeline co-occurrence — both quoted on the page
appAnalysis papers with a >=100,000-app population: 96
  distinct sourceList values among them: 52; of those, 30 are neither a store nor AndroZoo:
    AndroidRank
    AndroidZoo
    Andrubis dataset
    Antiy AVL
    App installation logs
    Baidu market
    Drebin dataset
    Firmware Scanner
    Gamba et al. preinstalled-app dataset / Firmware Scanner
    Janus Dataset
    Koodous
    Lumen users
    NortonLifeLock's mobile security product
    Palo Alto Networks
    Palo Alto Networks newer APK testing sample
    PrivacyGrade
    SamMobile
    VirusShare, VirusTotal, and the AMD dataset
    VirusTotal
    Wandoujia marketplace
    Wang et al. [116]
    WeChat third-party miniapps
    anti-virus vendor telemetry program
    custom app-market collection over 30 markets
    custom instrumented SDK deployment
    custom mini-app collection across six super-app platforms
    mobile app activity data collected by the security company's product
    not-stated
    publicly available stock Android firmware images
    same initial dataset from AndroidRank

appAnalysis papers since 2023: 191
  Frida AND mitmproxy:            16 (8.4%)
  Frida AND mitmproxy AND Magisk: 3 (1.6%)  <-- the page does NOT claim the field converged on this

--- objection, enumerated — the page quotes this ratio, so it is computed here
objection tuples in appAnalysis: 9 (7 with a pinning purpose); corpus-wide papers: 10
  PIN  used   USENIX/2021/share-first-ask-later-or-never-studying-violations-of-gdprs-explicit-consent-in  Detect and disable SSL pinning
  PIN  used   CCS/2022/freely-given-consent-studying-consent-notice-of-third-party-tracking-and-its-vio  Disabled SSL pinning in instrumented apps.
  oth  used   USENIX/2022/breaking-bridgefy-again-adopting-libsignal-is-not-enough  Hooked functions and observed or modified app behavior.
  PIN  used   USENIX/2023/the-ok-is-not-enough-a-large-scale-study-of-consent-dialogs-in-smartphone-applic  Automated Android apps and disabled SSL checking.
  PIN  used   PETS/2024/a-black-box-privacy-analysis-of-messaging-service-providers-chat-message-process  Disabled mobile-app SSL certificate checks.
  PIN  used   USENIX/2024/abandon-all-hope-ye-who-enter-here-a-dynamic-longitudinal-investigation-of-andro  Detected and disabled SSL pinning.
  oth  used   USENIX/2025/autovr-automated-ui-exploration-for-detecting-sensitive-data-flow-exposures-in-v  Repackage APKs containing the injected Frida server.
  PIN  used   PETS/2025/the-impact-of-default-mobile-sdk-usage-on-privacy-and-data-protection  Bypass SSL pinning on rooted Android.
  PIN  used   PETS/2026/the-tcf-doesn-t-really-a-a-id-automatic-privacy-analysis-and-legal-compliance-of  Disabled SSL pinning during traffic collection.

==============================================================================
3. STATIC VS DYNAMIC (population: appAnalysis papers that classified something)
==============================================================================
appAnalysis papers with >=1 classification tuple: 472 / 529
classification.method  papers  share of 529  share of classifiers
---------------------  ------  ------------  --------------------
heuristic-rules        257     48.6%         54.4%
manual-labelling       192     36.3%         40.7%
static-analysis        149     28.2%         31.6%
supervised-ml          103     19.5%         21.8%
third-party-service    87      16.4%         18.4%
curated-database       75      14.2%         15.9%
dynamic-analysis       48      9.1%          10.2%
regex-or-signature     46      8.7%          9.7%
other                  32      6.0%          6.8%
unsupervised-ml        23      4.3%          4.9%
blocklist              20      3.8%          4.2%
graph-analysis         16      3.0%          3.4%
llm                    15      2.8%          3.2%

--- static-analysis and dynamic-analysis methods per era
Era         N    static-analysis  dynamic-analysis  both       llm
----------  ---  ---------------  ----------------  ---------  ----------
2010-2015   88   32 (36.4%)       11 (12.5%)        8 (9.1%)   0 (0.0%)
2016-2020   157  41 (26.1%)       9 (5.7%)          6 (3.8%)   0 (0.0%)
2021-2024   194  58 (29.9%)       20 (10.3%)        12 (6.2%)  1 (0.5%)
2025-2026*  90   18 (20.0%)       8 (8.9%)          5 (5.6%)   14 (15.6%)

--- classification.validation (population: appAnalysis papers that classified something)
validation                  papers  share of classifiers
--------------------------  ------  --------------------
manual-validation           321     68.0%
none-reported               218     46.2%
comparison-to-other-method  79      16.7%
held-out-test-set           60      12.7%
cross-validation            35      7.4%
papers reporting >=1 real validation: 393 (83.3% of 472 classifiers)
papers reporting NO validation on any classifier: 79 (16.7%)
(for comparison, papers with >=1 'none-reported' tuple: 218 — these overlap)
papers where EVERY classifier has a real validation value: 178 (37.7%)

--- Android vs iOS, by regex over title + tool names + population sources + detection phenomena
Android-matching only 369 (69.8%) | iOS-matching only 39 (7.4%) | both 66 (12.5%) | neither 55 (10.4%)

--- classification.target
target               papers  share of 529
-------------------  ------  ------------
other                234     44.2%
mobile-app           198     37.4%
vulnerability        113     21.4%
sdk-or-library       66      12.5%
domain               51      9.6%
network-traffic      44      8.3%
privacy-policy       39      7.4%
web-request          28      5.3%
malware              26      4.9%
website-category     26      4.9%
ip-address           18      3.4%
user-generated-text  17      3.2%

==============================================================================
4. THE APP SAMPLE (population: appAnalysis)
==============================================================================
sourceList: stated in 513/529, sentinel-only 13, no population tuple 3
sourceList (skeleton-folded)    papers  share of 529
------------------------------  ------  ------------
Google Play                     134     25.3%
Google Play store               75      14.2%
custom seed list                58      11.0%
AndroZoo                        46      8.7%
Apple App Store                 11      2.1%
VirusTotal                      11      2.1%
F-Droid                         7       1.3%
Tranco                          7       1.3%
Amazon Mechanical Turk          6       1.1%
AppBrain                        6       1.1%
custom device set               6       1.1%
DroidBench                      6       1.1%
AndroidRank                     5       0.9%
App Store                       5       0.9%
Android Malware Genome project  4       0.8%
Android Market                  4       0.8%
custom experimental setup       4       0.8%
GitHub                          4       0.8%
Google Play market              4       0.8%
Baidu Market                    3       0.6%

--- the same, after merging Google Play spellings by hand
Google Play family: 250 papers (47.3% of 529) across 62 spellings
  spellings: Android Market | Google Play | Google Play Market | Google Play Store | Google Play Store (US site) | Google Play Store (popular apps) | Google Play Store Top Free in Android Apps | Google Play Store and Apple App Store | Google Play Store and featured/recommended apps | Google Play Store and six online sources: Androidapps, Apkhere, Apkmirror, Apkpure, Uptodown, and Aptoide | Google Play Store and third-party websites | Google Play Store charts | Google Play Store dataset from related work [79] | Google Play Store developer contact information | Google Play Store historical most-installed list | Google Play Store in the US | Google Play Store privacy-policy links | Google Play Store reviews | Google Play Store top app charts | Google Play Store's Designed for Families program | Google Play Store's Top 500 list | Google Play Store, Apple App store, and App Annie | Google Play Store, Crawl 1 | Google Play Store, Crawl 2 | Google Play Store, Crawl 3 | Google Play Store, apps described as app-lockers | Google Play Store, “top free” category | Google Play Top Free charts | Google Play and 360 App Assistant top download lists | Google Play and Apkmonk | Google Play and Apple App Store | Google Play and Baidu market | Google Play and Tencent Myapp | Google Play and WanDouJia | Google Play and development documentation | Google Play and iTunes stores | Google Play and other 12 popular third-party app markets worldwide | Google Play and third-party Android markets | Google Play and third-party Android markets plus VirusTotal | Google Play apps using com.umlaut.crowd SDK | Google Play categories | Google Play dynamically analyzed apps | Google Play filtered app set | Google Play lists of popular apps in 49 app categories | Google Play market | Google Play marketplace dataset provided by Norton | Google Play search engine | Google Play store | Google Play store based on the rank of APKPure | Google Play store top app lists | Google Play store, Ubuntu Software Center and Chrome Extensions | Google Play store; AOL Query Log dataset | Google Play top paid app list | Google Play top-ranked apps | Google Play's “top 200 free apps” list | Google Play, Germany | Google Play, MyApp, and Apple App Store | Google Play, apkpure.com, and apktada.com | Google Play, third-party websites (APKPure and 360 Store) | Google Play; AppBrain and AndroidRank | Official Android Market | official Android Market

--- app-set sizes (population: mobile-apps population tuples inside appAnalysis)
papers with a mobile-apps population tuple: 400; of those, 397 state an n
n over 916 tuples: min 1  p10 17  median 1300  p90 329272  max 65000000
app-set size band  papers with >=1 such tuple  share of 397
-----------------  --------------------------  ------------
1-10               52                          13.1%
11-100             139                         35.0%
101-1,000          127                         32.0%
1,001-10,000       130                         32.7%
10,001-100,000     112                         28.2%
>100,000           92                          23.2%

--- sampling method for mobile-apps population tuples
samplingMethod        papers  share of 400
--------------------  ------  ------------
purposive             196     49.0%
top-n                 140     35.0%
random                91      22.8%
pre-existing-dataset  71      17.8%
exhaustive            51      12.8%
seed-and-crawl        38      9.5%
convenience           35      8.8%
stratified            28      7.0%
snowball              2       0.5%

--- listVersion: does the paper pin WHEN the apps were fetched?
mobile-apps population tuples: 930; with a listVersion: 393 (42.3%)
papers: 400; with >=1 listVersion: 222 (55.5%)

--- temporal.mode
temporal.mode       papers  share of 529
------------------  ------  ------------
active-probing      192     36.3%
live-crawl          188     35.5%
existing-dataset    166     31.4%
passive-collection  93      17.6%
web-archive         4       0.8%

==============================================================================
5. VANTAGE AND STOREFRONT (population: appAnalysis papers with >=1 vantage tuple)
==============================================================================
appAnalysis papers with >=1 vantage tuple: 430 / 529
locations: stated in 117/430 (27.2%); sentinel-only 313 (72.8%)
location (skeleton-folded, NOT geo-folded)  papers
------------------------------------------  ------
United States                               23
Germany                                     17
China                                       12
India                                       10
U.S.                                        9
Europe                                      8
Asia                                        6
Canada                                      6
North America                               6
USA                                         6
Austria                                     5
EU                                          5
infrastructure      papers  share of 430
------------------  ------  ------------
research-testbed    156     36.3%
volunteer-devices   44      10.2%
university-network  29      6.7%
cloud-provider      19      4.4%
commercial-vpn      11      2.6%
mobile-network      11      2.6%
proxy-service       3       0.7%
residential         2       0.5%
tor                 1       0.2%

==============================================================================
6. WHAT THE WEB-SHAPED SCHEMA FIELDS SAY (population: appAnalysis)
==============================================================================
appAnalysis papers with a crawlConfig object: 115 / 529 (21.7%)
  for comparison, corpus-wide 'crawled' population: 1120
  statefulness      stated  10/115  stateful=5 stateless=5
  headless          stated  12/115  headless=8 headful=4
  consentAction (schema field populated; not a paper claim) stated  31/115  no-interaction=29 accept-all=2
  interactionDepth  stated  74/115  single-target-page=40 landing-page-only=17 deep-crawl=14 landing-plus-subpages=3
  authentication    stated  71/115  none=60 account-registration=5 manual-login=4 automated-login=1 sso=1

--- artifacts.availability
availability                papers  share of 529
--------------------------  ------  ------------
public                      267     50.5%
promised-not-yet-available  31      5.9%
restricted                  12      2.3%
on-request                  7       1.3%
explicitly-withheld         6       1.1%
sentinel-only (none-mentioned/not-stated): 188 (35.5%)

--- ethics.reviewOutcome
reviewOutcome                   papers  share of 529
------------------------------  ------  ------------
approved                        87      16.4%
explicitly-discussed-no-review  25      4.7%
not-required                    22      4.2%
exempt                          11      2.1%
sought-outcome-unstated         4       0.8%
sentinel-only: 330 (62.4%)

--- "states a value" side of each field, for the page table
ethics.reviewOutcome    stated 149 (28.2% of 529)  sentinel-only 330  no ethics object 50
artifacts.availability  stated 323 (61.1% of 529)  sentinel-only 188  no artifacts object 18  of which stated: public 267 (50.5%)
vantage.locations       stated 117 (27.2% of 430)  sentinel-only 313 (72.8%)
population.listVersion  stated 222 (55.5% of 400)

==============================================================================
7. EXEMPLAR FIGURES QUOTED ON THE PAGE (detection tuples, verbatim prevalence)
==============================================================================

IMC 2022 — A comparative analysis of certificate pinning in Android & iOS.
  population: AlternativeTo n=575 mobile-apps top-n | Google Play Store n=1000 mobile-apps random | iTunes Search API n=1000 mobile-apps top-n | Android app-ID list compiled by prior work n=1000 mobile-apps random | Apple App Store listings n=1000 mobile-apps random
  * static certificate-pinning indicators | share of apps with one instance | up to 27% of Android apps and 33% of iOS apps
      quote: "Static analysis reveals even more potential pinning (up to 27% on Android and 33% on iOS)." [introduction]
  * runtime certificate pinning | share of apps using pinning at runtime | 11.4% of popular iOS apps and 6.7% of popular Android apps
      quote: "We find a wide range of prevalence for potential and actual pinning, with 11.4% of popular iOS apps and 6.7% of popular Android apps using pinning in our dynamic tests." [introduction]
  * runtime certificate pinning | share of apps using pinning at runtime | 0.9% of random Android apps and 2.5% of random iOS apps
      quote: "Pinning is much less prevalent in randomly selected (i.e., less popular) apps (0.9% of Android and 2.5% of iOS apps)." [introduction]
  * pinning circumvention | share of unique pinned destinations circumvented | ≈51.51% on Android and ≈66.15% on iOS
      quote: "we were able to successfully circumvent pinning for ≈51.51% unique destinations on Android, and ≈66.15% unique destinations on iOS." [methodology]
  * weak TLS ciphers | percentage of apps with at least one bad-cipher connection | Common Android: 23.4% of pinning apps versus 8.35% overall
      quote: "For the Common Android dataset, we see that pinning apps reduce connection security as the percentage of bad ciphers in pinning apps is higher (23.4%) than that of the overall dataset (8.35%)." [results]
  * PII in pinned traffic | PII prevalence in pinned versus non-pinned traffic | iOS advertisement IDs: 25.85% pinned versus 18.06% non-pinned
      quote: "Ad. ID* 25.85 % 18.06 %" [results]

USENIX 2021 — Why Eve and Mallory Still Love Android: Revisiting TLS (In)Security in Android Applications
  population: Google Play n=1335322 mobile-apps seed-and-crawl | Google Play n=15000 mobile-apps random | Google Play n=40 mobile-apps purposive
  * NSC adoption | share of Google Play apps | 99,212 of 1,335,322 apps implemented custom NSC settings
      quote: "Of the 1,335,322 free Android apps we analyzed, 99,212 implemented custom NSC settings." [results]
  * NSC security downgrades | share of apps with custom NSC files | 88.87% downgraded security compared to default settings
      quote: "Out of the 99,212 apps with custom NSC files that we were able to identify in our body of Android applications, 88,174 (88.87%) apps included configurations that downgrade security compared to default settings." [results]
  * Certificate pinning | share of apps with custom NSC settings | 663 apps, or 0.67%, used NSC certificate pinning
      quote: "Overall, we found 663 apps that implement certificate pinning using NSC." [results]
  * Trust in user-installed CAs | share of apps targeting Android 7 or higher | 8,606 apps (8.67%) re-enabled trust for user-installed certificates
      quote: "Out of 1,098,479 apps targeting Android 7 or higher, we found 8,606 apps that re-enable trust for user-installed certificates (8.67%)." [results]
  * Vulnerable certificate-validation code | share of analyzed apps | 5,511 of 15,000 apps (36.7%) were vulnerable
      quote: "Overall, we found 2,232 (14.8%) apps with vulnerable HostnameVerifier and 5,202 (34.7%) apps with vulnerable TrustManager implementations." [results]
  * Google Play safeguard bypasses | acceptance or blocking of experiments | Most vulnerable TrustManager and HostnameVerifier implementations were accepted
      quote: "After submitting each experiment to Google Play, the app went through the Google Play app review procedure. Once the verification process concluded, we checked for security alerts in the Google Play Console." [methodology]
  * Sensitive data over HTTP | share of manually analyzed apps | More than half of both 20-app sets used HTTP for sensitive user data
      quote: "In conclusion we find that in both sets more than half of the apps we tested manually used HTTP to transfer sensitive user data including login credentials." [results]

USENIX 2024 — Racing for TLS Certificate Validation: A Hijacker's Guide to the Android TLS Galaxy
  population: 360 Mobile Assistant (Qihoo 360 Appstore) n=4121 mobile-apps top-n | Google Play store based on the rank of APKPure n=5452 mobile-apps top-n | 360 Mobile Assistant (Qihoo 360 Appstore) n=2765 mobile-apps top-n | Google Play store based on the rank of APKPure n=5061 mobile-apps top-n
  * TLS certificate validation failures | share of apps | 55.3% of Chinese apps and 6.4% of Google Play apps
      quote: "We found that 1529/2765 (55.3%) of Chinese apps were identified to have at least one of the four certificate validation issues; in contrast ... 322/5061 (6.4%)" [results]
  * Validation hijacking | share of insecure apps | 34.3% of insecure Chinese apps and 21.1% of insecure Google Play apps
      quote: "524/1529 (34.3%) of the Chinese apps, and 68/322 (21.1%) of the Google Play apps with TLS validation issues suffer from validation hijacking." [introduction]
  * Unverified certificate signatures | share of apps | 47.3% Chinese and 4.8% Google Play apps
      quote: "1307/2765 (47.3%) were identified with unverified certificate signatures ... For Google Play apps, 244/5061 (4.8%)" [results]
  * Self-signed certificate acceptance | share of apps | 49.7% Chinese and 4.8% Google Play apps
      quote: "1375/2765 (49.7%) trusted self-signed certificates ... For Google Play apps, 243/5061 (4.8%)" [results]
  * Expired certificate acceptance | share of apps | 47.4% Chinese and 4.6% Google Play apps
      quote: "1310/2765 (47.4%) accepted expired certificates ... For Google Play apps, 231/5061 (4.6%)" [results]
  * Domain mismatch acceptance | share of apps | 38.3% Chinese and 4.7% Google Play apps
      quote: "1059/2765 (38.3%) ignored mismatched domain ... For Google Play apps, 236/5061 (4.7%)" [results]
  * Sensitive information leakage | share of insecure apps | 88.8% of Chinese apps with validation issues; 86.3% of Google Play apps used plain insecure TLS
      quote: "In the Chinese app dataset, we found that 1358/1529 (88.8%) of the apps transmit sensitive information using insecure TLS connections." [results]
  * Static certificate override presence | share of collected apps | 47.0% Chinese and 21.3% Google Play apps used override functions
      quote: "Through a combination of dynamic and static analyses, we observed 1937/4121 (47.0%) Chinese apps and 1162/5452 (21.3%) Google Play apps utilizing these override functions." [results]

CCS 2023 — IoTFlow: Inferring IoT Device Behavior at Scale through Static Mobile Companion App Analysis.
  population: three prior datasets: Neupane et al., IoTSpotter, and IoTProfiler n=9889 mobile-apps pre-existing-dataset | Google Play Store n=947 mobile-apps top-n | custom device set n=13 iot-devices purposive
  * IoT endpoint and protocol reconstruction | number of apps with reconstructed endpoints or schemes | Schemes reconstructed in 7,113 remote-endpoint apps and 871 local-endpoint apps
      quote: "For IoT-VER, we reconstructed schemes in 7,113 unique apps for remote endpoints and in 871 apps for local communication." [results]
  * Direct device communication | share of apps | 6,355 apps (64.26%) declared Bluetooth permissions; 1,483 (14.99%) had local IP addresses
      quote: "6,355 (64.26%) apps declare at least one Bluetooth permission. We find a local IP address in 1,483 (14.99%) apps" [results]
  * MQTT endpoint reachability | reachable endpoints | 74 of 138 remote MQTT endpoints (53.62%) accepted a connection
      quote: "We connected successfully (return code 0) to 74 MQTT endpoints (53.62%)." [results]
  * Certificate pinning and expiry | share of apps or certificates | 385 apps (3.89%) used pinning; 9,129 certificates (29.18%) were expired in May 2023
      quote: "We use the approach by Pradeep et al. [76] to identify pinning and the corresponding certificates by analyzing the Network Security Configuration (NSC)" [results]
  * Abandoned domains | domains available for registration | 67 domains from 73 apps were verified available for registration
      quote: "we verified that 67 domains from 73 apps are indeed available for registration." [results]
  * Inter-component data flows | number of flows | 497 of 579 Bluetooth flows (85.84%) involved ICC
      quote: "Overall, we found 579 flows from Bluetooth sources in 90 apps. Remarkably, 497 (85.84%) of these flows involve ICC" [results]
  * Hard-coded encryption keys | share of apps using encryption | 2,321 IoT apps (57.04%) contained reconstructed hard-coded keys
      quote: "Overall, we reconstructed hard-coded keys in 2,321 (57.04%) IoT apps and 408 (50.24%) general-purpose apps." [results]
  * Static versus dynamic behavior coverage | matching domains and paths across 13 apps | IoTFlow extracted 54 domains and 281 paths versus 40 domains and 160 paths dynamically
      quote: "IoTFlow performs better than dynamic analysis and extracts more IoT-related behavior statically from companion apps than dynamic analysis (54 domains and 281 paths vs. 40 domains and 160 paths)" [evaluation]

USENIX 2018 — Discovering Flaws in Security-Focused Static Analysis Tools for Android using Systematic Mutation
  population: F-droid n=7 mobile-apps convenience | Google Play n=8664 mobile-apps top-n
  * Undocumented flaws in Android leak detectors | number of unique flaws | 13 unique flaws in FlowDroid
      quote: "Our in-depth analysis of the output of µSE for FlowDroid discovers 13 unique flaws that are not documented in either the paper or the source code repository" [evaluation]
  * Undetected executable data leaks | share of executable mutants undetected | FlowDroid 48.7%; Argus 73.1%; DroidSafe 4.1%
      quote: "FlowDroid cannot detect over 48% of the leaks, while Argus cannot detect over 73%. Further, DroidSafe does not detect a non-negligible percentage of leaks (i.e., over 4%)" [results]
  * Android fragment use | share of apps containing fragments | 91% of 8,664 apps contained fragment code
      quote: "the fact that 7,860 out of 8,664 top apps, or 91% of popular apps contain fragment code" [appendix]
  * Executable injected mutants | number and percentage of executable mutants | 2,026 of 7,584 mutants were verified executable; over 73% filtered
      quote: "µSE injects 7, 584 leaks into the Android apps, of which, 5, 558 potentially non-executable leaks are filtered out using our EE, leaving only 2, 026 leaks confirmed as executable" [results]

USENIX 2023 — The OK Is Not Enough: A Large Scale Study of Consent Dialogs in Smartphone Applications
  population: Google Play Store charts n=3006 mobile-apps top-n | iOS App Store category rankings n=1773 mobile-apps top-n
  * privacy consent dialogs | share of successfully analyzed apps | 814 (22.3%) apps displayed a privacy consent dialog on start; 434 (11.9%) displayed a proper dialog.
      quote: "Overall, we detected 814 (22.3%) apps displaying a privacy consent dialog on start. 232 (6.3%) displayed a link, 165 (4.5%) displayed a notice, and 434 (11.9%) displayed a proper dialog." [results]
  * dark patterns | share of proper dialogs with at least one violation | 429 (98.8%) proper dialogs violated at least one design requirement.
      quote: "We detected at least one violation of our design requirements in 429 apps (98.8%). On Android ... 98.4% ... and on iOS ... 99.5%." [results]
  * pre-consent tracker traffic | apps contacting monitored tracking endpoints before interaction | 3013 (82.5%) analyzed apps contacted a covered tracking endpoint before interaction.
      quote: "Mapping the requests back to apps, leads to 3013 (82.5%) of apps contacted one of our covered tracking endpoints before any interaction took place." [results]
  * pseudonymous data transmission | apps sending a unique identifier before consent | 1285 (35.2%) apps sent at least one request containing a unique identifier.
      quote: "1285 (35.2%) apps sent at least one request containing a unique identifier rendering the contained information at least pseudonymous and thus covered by the GDPR." [results]
  * post-rejection data transmission | apps transmitting pseudonymous data after rejection | 5 apps transmitted pseudonymous data after interacting with an unambiguous reject button.
      quote: "We observed 5 transmitting pseudonymous data after interacting with an unambiguous reject button out of which all 5 were new." [results]
  * TCF usage | apps setting TCF-related strings | 146 (4.0%) apps set TCF-related settings during execution.
      quote: "We detected only TCF-related settings in 146 (4.0%) apps. This highly limits any analysis approach based on frameworks." [results]

PETS 2022 — Are iPhones Really Better for Privacy? A Comparative Study of iOS and Android Apps
  population: Google Play n=283065 mobile-apps seed-and-crawl | Apple App Store n=285680 mobile-apps seed-and-crawl | Google Play n=12000 mobile-apps random | Apple App Store n=12000 mobile-apps random
  * tracking-library presence | share of apps containing a library | 88.73% of Android apps and 79.35% of iOS apps contained at least one tracking library.
      quote: "88.73% contained at least one on Android, 79.35% on iOS." [results]
  * potential AdId access | share of apps with matching code | 86.1% of Android apps and 42.7% of iOS apps could access the AdId.
      quote: "We detected potential access to the AdId by checking for the presence of the AdSupport class and the system interface IAdvertisingIdService" [methodology]
  * tracking before consent | share of apps contacting tracking domains at startup | 81.44% of Android apps and 68.46% of iOS apps potentially shared data before consent.
      quote: "This suggests potentially widespread violations of applicable data protection law (in 81.44% of Android apps, and 68.46% of iOS apps)." [results]
  * PII exposure in network traffic | share of apps transmitting identifiers | 55.4% of Android apps and 31.0% of iOS apps shared the AdId over the Internet.
      quote: "We found that more Android apps shared the AdId over the Internet (55.4% on Android, and 31.0% on iOS)." [results]
  * permission requests | share of apps requesting permissions | Camera was requested by 56.3% of iOS apps and 21.2% of Android apps.
      quote: "Both were included by about 50% of iOS apps (Camera 56.3%, Location 49.2%), and less than a third of Android apps (Camera 21.2%, Location 28.0%)." [results]
  * cross-platform app identity | share classified as cross-platform | 13.7% of downloaded Android apps and 12.8% of iOS apps met the 95% similarity threshold.
      quote: "Among the 24k downloaded apps, we considered only those apps as cross-platform that had a cosine similarity of at least 95%. This amounted to 13.7% of downloaded Android apps, and 12.8% of iOS apps." [methodology]

USENIX 2024 — Unpacking Privacy Labels: A Measurement and Developer Perspective on Google's Data Safety Section
  population: AndroZoo n=2720000 mobile-apps pre-existing-dataset | Google Play Store n=1100000 mobile-apps exhaustive | Google Play Store n=15000 mobile-apps purposive | custom trend-based developer list n=30000 mobile-apps purposive
  * DSS adoption | share of apps | 46.8% of apps had privacy labels as of May 2023.
      quote: "Privacy labels are present only for 46.8% of the apps on the Google play store (as of May 31 2023)." [dataset]
  * DSS longitudinal changes | share of apps updating DSS | 40% updated their DSS at least once; 4% updated it at least twice.
      quote: "We find that 40% (n=283K) of the apps updated their DSS at least once, while 4% (n=27K) updated it at least twice." [results]
  * Third-party library underreporting | share of analyzed apps | 42% used at least one advertising or analytics library.
      quote: "Analyzing the apks, we find that 42% of the analyzed subset of apps used at least one third-party library for advertisement or analytics." [results]
  * DSS and permission inconsistency | share of apps | 11.5% reported precise location without location permissions; 23.7% reported files without corresponding permissions.
      quote: "11.5% of the apps report collecting or sharing precise location data without obtaining location permissions." [results]
  * Encryption inconsistency | share of apps | 40% claimed no collection or sharing but encryption; 59% lacked INTERNET permission while claiming encryption.
      quote: "59% of apps do not request network permissions, yet state that they encrypt data in transit." [results]
  * Developer-label disagreement | share of developers | 41% disagreed for collection and 42% disagreed for sharing.
      quote: "41% of developers who stated in their emails not to engage in data collection were nonetheless reported as collecting data in their DSS. A similar inconsistency (42%) was observed for data sharing." [results]
  * Developer response themes | coded responses | 225 responses were coded after filtering 889 voluntary responses.
      quote: "Using the refined codebook, the two authors continued to code independently until they stopped observing new codes by the 175th response... reaching 225 responses." [methodology]
  * Overreported purposes | number of apps | More than 3,500 apps listed six or more purposes for every collected data type.
      quote: "out of the 7 possible purposes for collecting data, more than 3.5K apps list 6 or more purposes for every data type they collect" [results]

WWW 2021 — A Longitudinal Study of Removed Apps in iOS App Store.
  population: iOS app store n=1033488 mobile-apps exhaustive | iOS app store n=854 mobile-apps purposive | iOS app store n=759 mobile-apps purposive
  * iOS app removals | number of removal records and distinct apps | 1,129,615 records corresponding to 1,033,488 different apps
      quote: "Overall, there are 1,129,615 app removal records, which correspond to 1,033,488 different mobile apps." [dataset]
  * Cyclical app removal | median interval between adjacent peaks | 28.5 days
      quote: "The median of time interval between the adjacent peaks is 28.5 days." [results]
  * Removed popular apps | share of removed apps ever ranked top-1500 | 51,704 removed apps (5%)
      quote: "Overall, 51,704 of the removed apps (5%) has been ranked in top-1500 across categories." [results]
  * Removal reasons | share of manually labeled apps by reason | Ranking Fraud 67.6%; Fake Description 56.1%; Content Issue 55.4%
      quote: "Most apps are removed mainly due to the reasons including Ranking Fraud (67.6%), Fake Description (56.1%), and Content Issue (55.4%)." [results]
  * App-removal prediction | F1 score | GBDT achieved F1=0.8326; six-days-ahead prediction achieved F1=79.3%
      quote: "The best performances for AUC score, precision, recall, F1 score, accuracy and false positive rate are 0.9116, 0.8909, 0.8214, 0.8326, 0.8397, and 0.0844, respectively." [results]

NDSS 2026 — CHAMELEOSCAN: Demystifying and Detecting iOS Chameleon Apps via LLM-Powered UI Exploration
  population: WeChat Accounts (4), Appraven Groups (2), Illicit Websites (17) n=500 mobile-apps seed-and-crawl | App Store n=300 mobile-apps random | App Store n=23416 mobile-apps pre-existing-dataset | App Store n=1644 mobile-apps purposive | KNOWN dataset n=467 mobile-apps pre-existing-dataset
  * iOS Chameleon apps | detection rate and precision | 162 of 1,644 apps (9.85%) identified; 92.59% precision
      quote: "C HAMELEO S CAN identified 162 (9.85%) as Chameleon apps, with manual verification confirming a precision of 92.59%." [results]
  * Transformation methods | share of Chameleon apps | 10 categories; specific-string submission 69.60% and designated-area tapping 9.80%
      quote: "the two most prevalent formats ... account for 69.60% (348 cases) and 9.80% (49 cases), respectively." [results]
  * Review-disclosed transformation methods | share of apps | 244 of 500 apps (48.8%) contained disclosed transformation methods
      quote: "48.8% (244) of analyzed apps contained review-disclosed transformation methods" [results]
  * Functional transformation discrepancies | qualitative prevalence | 234 accessible-IPAs transitioned to illicit operational states after transformation
      quote: "Following successful transformation, these apps invariably transition to illicit operational states" [results]
  * Chameleon detection on known apps | recall and precision | 71.76% recall and 100% precision
      quote: "C HAMELEO S CAN achieves a recall of 71.76% and a precision of 100%." [results]
  * Hybrid UI frameworks | share of analyzed apps | 104 of 223 analyzed apps (46.64%) used Flutter or WebView
      quote: "Collectively, 104 apps (46.64%) relied on hybrid frameworks (Flutter or WebView)" [results]
  * UI interference elements | precision, recall, and resolution rate | 19.21% of observed pages contained distracting elements; ads resolved in 85.96% and pop-ups in 95.56%
      quote: "manual analysis identifying distracting elements in 19.21% of cases (848 pages) ... resolved 85.96% of intrusive ads ... and 95.56% of pop-up instances" [results]

PETS 2025 — Privacy Settings of Third-Party Libraries in Android Apps: A Study of Facebook SDKs
  population: AndroZoo n=8848 mobile-apps top-n | AndroZoo n=6203 mobile-apps top-n
  * Facebook SDK integration | share of analyzed apps | 53.68% integrate at least one Facebook SDK
      quote: "3,245 apps (53.68%) integrate at least one of these SDKs." [results]
  * Privacy-setting modifications | privacy-enhanced configuration rate | AutoLogAppEvents: 17.90%; AutoInit: 11.46%; AdvertiserIDCollection: 6.79%
      quote: "The percentage of apps opting for privacy-enhanced configurations remains low across most settings, such as AdvertiserIDCollection, where only 6.79% of apps disabled the default data collection setting." [results]
  * Personal-data transmission | unique connections and transmitting apps | 80,449 unique connections from 4,959 apps; 3,589 apps transmitted user data
      quote: "we successfully intercepted 80,449 unique connections from 4,959 apps, with 3,589 of these apps transmitting a range of user data." [results]
  * Facebook SDK data transmission | connections containing personal data | 917 connections across 518 apps
      quote: "Facebook SDKs were identified as one of the top sources of off-device personal data transmission, with 917 connections containing personal data across 518 apps" [results]
  * AdID transmission | share of Facebook SDK data transfers | AdID was 54.03% of data types transferred by Facebook SDKs
      quote: "Among all data types transferred by Facebook's SDKs, AdID was the most prevalent (54.03%)" [results]
  * Privacy-label discrepancies | potential non-disclosure rate | 399 of 1,388 apps (28.75%) enabled AdID collection but failed to disclose it
      quote: "399 out of 1,388 apps (28.75%) have AdvertiserIDCollection enabled-whether explicitly set or left as the default-but fail to disclose this in their privacy labels." [results]
  * Privacy-policy discrepancies | non-disclosure rate | 58 of 1,037 analyzed policies (5.59%) failed to disclose AdID collection
      quote: "Across all 1,388 apps with AdID collection enabled-either by default or explicitly-we analyzed 1,037 privacy policies and identified 58 apps (5.59%) that did not disclose AdID collection." [results]
  * Child-directed app compliance issues | apps evaluated | 73 apps met all three restrictive criteria; 779 declared Play Families adherence
      quote: "Our evaluation of 73 apps that met these criteria did not uncover issues related to the integration of Facebook SDKs" [results]

==============================================================================
8. FOLD RESIDUE — every "used" tool name in appAnalysis that mobile_fold.mjs does NOT map
==============================================================================
"used" tool tuples in appAnalysis: 3306; mapped to a family: 921 (27.9%); residue: 2385 tuples in 1732 distinct names

The residue is dominated by general-purpose tooling (Python, PyTorch, Chrome) that the
fold deliberately does not name, plus one-off custom tools. Printed in full, >=2 tuples:
unmapped name                          tuples
-------------------------------------  ------
VirusTotal                             58
Python                                 22
Selenium                               21
Chrome                                 19
scikit-learn                           15
Amazon Mechanical Turk                 10
EasyList                               10
Random Forest                          10
OpenSSL                                9
Prolific                               9
Scrapy                                 8
Firefox                                8
spaCy                                  8
Android                                7
iptables                               7
Google Play                            7
Google Search                          7
Docker                                 7
Tranco                                 7
PyTorch                                7
NLTK                                   6
WordNet                                6
Google Translate                       6
Support Vector Machine                 6
TensorFlow                             6
Android Studio                         6
AVClass                                6
t-SNE                                  6
EasyPrivacy                            6
PolicyLint                             6
Qualtrics                              6
Amazon EC2                             5
Android SDK                            5
Android NDK                            5
netstat                                5
Keras                                  5
word2vec                               5
BERT                                   5
GPT-4o                                 5
Android Open Source Project (AOSP)     4
Amandroid                              4
MaxMind                                4
Safari                                 4
R                                      4
Google Chrome                          4
logistic regression                    4
IccTA                                  4
Chromium                               4
Tesseract                              4
MobileInsight                          4
aapt                                   4
SMOTE                                  4
USRP B210                              4
CogniCrypt                             4
BeautifulSoup                          4
Google Play Store                      4
Google Safe Browsing                   4
langdetect                             4
JEB                                    4
DBSCAN                                 4
IPinfo                                 4
CryptoGuard                            4
TF-IDF                                 4
Adam                                   4
Exodus                                 4
Wenjuanxing                            4
PoliCheck                              4
Polisis                                4
ChatGPT                                4
Heros                                  3
strace                                 3
class-dump                             3
SEAndroid                              3
Google Play Unofficial Python API      3
SQLite                                 3
Monsoon Power Monitor                  3
MalloDroid                             3
Dynamic Time Warping                   3
grep                                   3
curl                                   3
AWS EC2                                3
SuSi                                   3
OpenWPM                                3
k-means                                3
Tor Browser                            3
Flask                                  3
EdgeMiner                              3
Z3                                     3
ping                                   3
OCR                                    3
RabbitMQ                               3
Scikit-learn                           3
strings                                3
Binwalk                                3
Logistic Regression                    3
Python Requests                        3
RootBeer                               3
Crunchbase                             3
Puppeteer                              3
Lumen Privacy Monitor                  3
UIHarvester                            3
ProVerif                               3
CocoaPods                              3
MiniCrawler                            3
crt.sh                                 3
ipinfo.io                              3
nmap                                   3
WhatsApp                               3
AirGuard                               3
SpaCy                                  3
AFL++                                  3
APKEditor                              3
Android Asset Packaging Tool           2
Dedexer                                2
AOSP                                   2
jsoup                                  2
Web of Trust (WOT)                     2
k-nearest neighbors (k-NN)             2
AppBrain.com                           2
Carat                                  2
Norton Mobile Security                 2
Hopper                                 2
otool                                  2
GDB                                    2
Dalysis                                2
Robotium                               2
NetworkX                               2
Stanford parser                        2
support vector machine (SVM)           2
Dexpler                                2
noVNC                                  2
PhoneLab                               2
tc                                     2
GSM Arena                              2
MaxMind GeoIP                          2
PlanetLab                              2
Meddle                                 2
ReCon                                  2
Hindsight                              2
AdGuard                                2
Celery                                 2
Redis                                  2
enjarify                               2
Support Vector Machine (SVM)           2
logcat                                 2
Compatibility Test Suite (CTS)         2
SVM                                    2
Android Asset Packaging Tool (aapt)    2
Z3-Str                                 2
APK Downloader                         2
DroidSafe                              2
XGBoost                                2
Node.js                                2
Gradient Boosting                      2
Word2Vec                               2
Google Text-to-Speech                  2
Scapy                                  2
hostapd                                2
srsLTE                                 2
OpenStreetMap                          2
BLESSED                                2
Gensim                                 2
ssdeep                                 2
Shodan                                 2
Nessus                                 2
Capstone                               2
Latent Dirichlet Allocation            2
Random Forest Classifier               2
NIST SP 800-22                         2
Google Cloud Natural Language API      2
imagehash                              2
Euphony                                2
FirmXRay                               2
Baidu                                  2
Public Suffix List                     2
Apache Spark                           2
AWS                                    2
RIPE Atlas                             2
Luminati                               2
agglomerative hierarchical clustering  2
PhishTank                              2
Pandas                                 2
Farsight DNSDB                         2
Beautiful Soup                         2
AppCensus                              2
DeviceCheck                            2
Google App Engine                      2
GNU Parallel                           2
OpenVPN                                2
Google Vision API                      2
YOLOv3                                 2
Koodous                                2
URLCrazy                               2
K-means                                2
Festvox                                2
ACVTool                                2
TensorFlow Lite                        2
TDLib                                  2
DYNAMO                                 2
Cuttlefish                             2
SCAT                                   2
Apptopia                               2
SimilarWeb                             2
googleplay-api                         2
AllenNLP                               2
LightGBM                               2
Doccano                                2
Prodigy                                2
apksigner                              2
Firmware Scanner                       2
Androwarn                              2
Twitter Academic API                   2
BeautifulSoup4                         2
tc-netem                               2
WHOIS                                  2
Termux                                 2
Random forest                          2
Google Play query completion API       2
Google Translate API                   2
Android Studio Emulator                2
AntMonitor                             2
tldextract                             2
MNN                                    2
VirusTotal API                         2
Hidden Markov Model                    2
Viterbi algorithm                      2
k-nearest neighbors                    2
ImageNet                               2
Google Maps                            2
nDPI                                   2
Open5GS                                2
BrowserStack                           2
Edge                                   2
Brave                                  2
Sentence-BERT                          2
HtmlToPlaintext                        2
Apple Find My                          2
OpenHaystack                           2
RoBERTa                                2
Chrome DevTools                        2
Playwright                             2
Symantec Sitereview                    2
cosine similarity                      2
SciPy                                  2
ZXTouch                                2
Logcat                                 2
AVClass2                               2
eBPF                                   2
ThirdEye                               2
Google search engine                   2
Apache                                 2
TalkBack                               2
Raspberry Pi 4                         2
ss                                     2
GraphSAGE                              2
GPT-4                                  2
Theos                                  2
Unity                                  2
regular expressions                    2
google_play_scraper                    2
DuckDuckGo Tracker Radar               2
ESP32                                  2
PostgreSQL                             2
plistlib                               2
Google Play Protect                    2
requests                               2

names appearing exactly once: 1466 — listed alphabetically:
  114DNS passive DNS | 3-layer neural network | 360 Mobile Guard | 360 Passive DNS Project
  3u | 7-Zip | 89z Google Play crawler | A-priori algorithm
  AAPT | ABBYY FineReader | ABY | ACR122u
  ADAM | ADB Log-Cat | ADB Logcat | ADT Eclipse plug-ins
  AES | AKAZE | ANTLR | AOSP 4.4.2 r12
  APER | APISENSE | APKLab.io | APKParser
  ARM NEON | ARPABET | ATLAS.ti | AV-Class
  AVG | AVG AntiVirus Free | AVG Antivirus Free v2.9 | AWS Device Farm
  AWS IoT | AZ Screen Recorder | Abuse.ch's malware sources blacklist | Accelerometer Meter v1.32
  AccessibilityService | Acra 4.2.3 | ActivityInstrumentationTestCase | Acunetix
  AdAway | AdAway Hosts | AdBlockPlus | AdaBoost
  Adafruit Bluefruit LE Sniffer | Adafruit PN532 | Adaptive Boost | Adaptive Misinformation
  AdblockPlus Library for Android | AdvBox | Affinity Propagation | Affinity propagation
  Aho-Corasick automaton | Aircrack-ng | AlarmManager | Alexa
  Alexa ranking | AliPay-dev | Aliyun Cloud | Aliyun Cloud Servers
  Amarisoft Callbox | Amazon | Amazon AWS EC2 | Amazon Alexa
  Amazon Device Farm | Amazon Rekognition | Amazon Text-to-Speech | Amazon Web Service EC2
  Amazon Web Services (AWS) EC2 m4.4xlarge | AmiGo | AmiGo testbed | AnTuTu
  AndHook | AndroBomb | AndroChef Java Decompiler | AndroTotal
  AndroZoo app crawler | Android 10 | Android 2.2 | Android 2.3.3
  Android 4.1.1 (Jellybean) | Android 4.3 emulator | Android API | Android ART DoCall()
  Android Asset Packaging Tool (AAPT) | Android Auto Clicker | Android Bluetooth HCI snoop log | Android CPU governors
  Android DDMS | Android Developers documentation | Android InstrumentationTestRunner | Android Open Source Project
  Android Open Source Project (AOSP) 8.1 | Android OpenSSL | Android PackageManager APIs | Android Profiler
  Android Sensor Framework | Android SpeechRecognizer API | Android Studio IDE | Android Studio Profiler
  Android TextToSpeech API | Android ViewServer | Android WebView | Android adb
  Android dumpsys | Android proc filesystem | AndroidStudio | Anguli
  AntMonitor Library | Antiy AVL Mobile Security | Antutu Benchmark | AoAv2 protocol
  Apache Cordova | Apache Groovy | ApkSigner | Apkmonk
  App Annie | App Store Scraper | App instrumentation framework by Koch et al. | AppBrain API
  AppCensus custom Android instrumentation | Appetize.io | Apple App Store | Apple App Store API
  Apple Catalog API | Apple Geolocation API | Apple Maps | Apple iCloud API
  Apple-provided web API | AppleScript | AppsPlayground | Appscope
  Aquatone | Archive.org | Arduino | Arduino Micro
  Argus | Arjun | AssetStudio | Attack-VC
  Audacity | AudioFlinger | AutoCog | AutoGluon
  AutoHotkey | AutoVC | Autofill Framework | Avast
  Axolotl | Aya | BCM4387 network adapter | BERT Cased
  BERT-Base uncased | BERT-base-uncased | BIND 9 | BLE 4.2 adapter
  BLE GAP API | BTLEmap | Baidu OCR | Baidu PhoneGuard
  Bash | Basic Naive Bayes (BNB) | Battery Historian | BatteryLab
  Beautiful-Soup | Bee | Better tracker blocker | BiLSTM
  BinDiff | Binary Ninja | BinaryNinja | BladeRF
  BlueDroid | BlueSeal | BlueStacks | Bluetooth
  Bluetooth Explorer | Bluetooth HCI snoop | Bluetooth Packet Logger | BluetoothGatt
  BluetoothGattServer | Boot-Image-tools | Bosch GLR825 laser distance measurer | BouncyCastle
  Brave Software | Brave for Android | Bro | Broadcom BCM4360
  Bui et al. purpose-extraction tool | Bundler toolkit | BusyBox | Butterworth filter
  BypassRootCheck-Pro | C&W | C4.5 Decision Tree | C4.5 decision tree
  CADO-NFS | CAIDA's Archipelago (Ark) | CANDID | CBOW (Continuous Bag-of-Words)
  CETA resources | CETD algorithm | CFR | CHIP Tool
  CLD3 | CLIP | CLTK | CMU pronunciation dictionary
  CMUDict | CNN & RNN | CNN and RNN | CSRF Scanner
  CTIA Stolen Phone Checker | CVC4 | CVE | CVE Details
  CYREN | CaffeineMark | Camera Timestamp Free | Canny Edge Detection
  CardEmulator | Cardpliance | Carthage | Cartographer
  Cartopy | CellularPrivacy | Centroid | Centroid Prediction
  Centroids | Cephei | ChatGPT (OpenAI's TextCompletion API) | ChatGPT 3.5 and 4
  CheckHost | Checker Framework | Choco data constraint solver | Chrome DevTools Protocol
  Chrome DevTools Protocol (CDP) | Chrome Developer Tools | Chrome Extension Source Viewer | Chrome User Experience Report (CrUX)
  Chrome WebDriver | Chrome WebRTC Debugging Console | Chrome remote debugging protocol | ChromeCacheView
  Chromium Code Search | Chromium source code | Clang-based fuzzy parser | Cloud Datastore
  Cloud Research | Cloudflare website categorization | ClueFinder | CmrfScanner
  CodeQL | CogniCryptSAST | ComDroid | Common Library classification
  Compatibility Testing Suite (CTS) | ConceptNet | Console | Convolutional Neural Network
  Convolutional neural network (CNN) | Cookie-Editor | CoreML | CrashScope
  Criminal IP | Cruiser app crawler | Crunchbase API | CrySL
  Crylogger | CryptoREX | Customized Mitm Proxy | CyanogenMod
  Cyanogenmod 11 | Cycript | Cydia Substrate | D8
  DAGGER | DBIP | DED | DIAG
  DIALDroid-Bench | DOTHOME | DSFD | Daikon
  Dalvik VM | Dalvik virtual machine | Damerau-Levenshtein edit distance | Dare
  Decision Tree | Decision Tree (DT) | Decision Trees | DeepFool
  DeepSec | DeepSniffer | DeepSteal | DeltaWalker
  DenseNet 201 | Depot | Detect Language | Dialogflow
  DidFail | Difuzer | Digital Asset Links | DigitalOcean
  Disconnect | Disconnect Me | Dnsmasq | Doc2Vec
  Docker Swarm | DomainTools WHOIS | DontKillMyApp | Dopamine
  DoubleX | Dovecot | Draco | Dragnet
  DroidBench | DroidBench 2.0 | DroidChameleon | DroidPlugin
  DroidRA | DroidSIFT | Droidlysis | Drozer
  EAST | ELM327 command set | EMP-toolkit | EOEDroid
  ESP32 WROOM | Easy List | Easy Privacy | EasyList, EasyPrivacy, Disconnect, and AdGuard mobile list
  Eclipse | Eclipse ADT | Edgeminer | EfficientNet-B0
  Elasticsearch | Elbow method | ElevenLabs | Ella
  Empath | Epicc | Esprima | Etherscan
  Etherscan List Token Transfer Events API | Ettercap | Ettus USRP B210 | ExifRead
  ExoPlayer | Exodus Privacy tracker list | Exodus-Privacy | ExodusPrivacy
  Explicit Semantic Analysis | ExpressVPN | Extreme Gradient Boosting (XGB) | F-Secure
  FAISS | FFmpeg | FP-GROWTH | FPMON
  FSEvents | FSGANR | FSGANS | FSquaDRA
  FSquaDRA2 | FaceNet512 | FaceShifter | Facebook Graph API
  FairFace | Fakeium | Faker | Fanboy
  Fast Gradient Sign Method (FGSM) | FastAI | FastDTW | FastRPC
  Fastbot | Fastly | Fax | Fernflower
  Filebench | FindSecBugs | FingerprintJS | FingerprintJS2
  Fingerprintjs2 | FireBase Scanner | Firebase scanner | Firefox mobile browser
  FirmXray | First Order Method Model (FOMM) | Fisher Score | Fleiss's κ
  Flesch Kincaid Calculator | Flightradar24 | FlowPrint | Flutter
  Foolbox | ForceAtlas2 | ForcePoint | Fortify SCA
  Fossology | FoulWrapper | Function ID | G*Power
  GATOR | GCC | GCC/G++ | GDA
  GPT-4-Turbo | GPT-J 6B | GPT4o | GPy
  GSDMM | Gadgets360 | Gaussian Mixture Model | Gaussian Naive Bayes
  Gaussian Naive Bayes (GNB) | Gaussian mixture models (GMMs) | Gaussian model | Gemini
  Generative Adversarial Network (GAN) | Genymotion Emulator | GeoIP | Geocodio
  Gitleaks | Go | Go-based crawler | GoDaddy
  Google | Google AdWords | Google Ads | Google App Engine AutoML
  Google Best Guess | Google Chrome 63.0.3239.111 | Google Chrome's browser developer tools | Google Cloud Natural Language APIs
  Google Cloud Speech-to-Text | Google Cloud Vision API | Google Compute Engine | Google Custom Search API
  Google Custom Search JSON API | Google Dataset Search | Google Direction API | Google Firebase Test Lab
  Google Form | Google Forms | Google Image | Google Image Search
  Google Images | Google Keyword Planner | Google Map API | Google Maps API
  Google Maps Directions API | Google Maps Javascript API | Google Natural Language API | Google Pixel 3a
  Google Play Console | Google Play Downloader | Google Play SDK Index | Google Play Store developer console
  Google Play recommendation system | Google SSO | Google Safe Browsing Update API | Google SafeBrowsing
  Google Scholar | Google Search APIs | Google SentencePiece Tokenizer | Google Takeout
  Google Tesseract OCR | Google Translate API for Python | Google Translation | Google Translator
  Google Vision Text Documentation Detection API | Google libphonenumber | Google migration API | Google play unofficial Python API
  Google related query API | Google text-to-speech (TTS) engine | Google's Activity Recognition API | Google's Gemini LLM
  Google's Protobuf compiler | Google's Tesseract | Google's Vision API | Google's language detection
  Google-Protobuf | GooglePlay | Gradient Boosting Decision Tree | Gradle
  Grammarly | GraphQL Security Auditor | Greynoise | Grid Search
  Griffin-Lim | Grounded Theory | Guibat icon classification model | Gyrophone code
  H3 | HCI snoop log | HERE Map | HIVE-COTE
  HLR lookup | HLRLOOKUPS | HMAC-SHA256 | HTTP Archive
  HTTP Toolkit | HTTPS Everywhere | Hadoop File System | Hakrawler
  HanLP | Haversine formula | Heroku | Hertz
  Hierarchical Mixture of Naive Bayes (HMNB) | Hill Climbing | History Export | HornDroid
  HostingChecker | Hurricane Electric's Tunnel Broker | Hushed | Hybrid Analysis
  IBM WALA | IC3 | ICSI Certificate Notary | ICSI Netalyzr for Android
  ICface | IDA Freeware | IDA-Pro | IDA-pro
  IGNN | IMEI.info | INA219 High Side DC Current Sensor | IP2Location
  IPA-tool | IPInfo | IPaddressAPI.com | IPerf
  IRTT | Inception | Inception-ResNet-v1 | InceptionTime
  Intel PCM | IntelliDroid | Internet Archive | Internet Information Services (IIS)
  Internet Routing Registries (IRRs) | JA3 | JA3S | JAW
  JD-GUI | JEB Android decompiler | JEB Decompiler | JEB Pro
  JEB decompiler | JExifViewer | JSA String Analyzer (JSA) | JSketch
  JSoup | JSoup 1.11.1 | JTOOL | Jaccard index
  Jaccard similarity coefficient | Janus | Java API nanoTime | Java Cryptography Architecture (JCA)
  Java Cryptography Extension (JCE) | Java Reflection | Java reflection | Java-ML
  JavaBaker | JavaParser | JavaPathfinder | JavaSMT
  JavaScript | JetBrains dotPeek | Jieba | Jitsi
  Joker | Jupyter Notebooks | K Nearest Neighbors | K-Nearest Neighbor
  K-Nearest Neighbor (kNN) | K-Nearest Neighbors | K-Nearest Neighbors (KNN) | K-nearest neighbor algorithm (KNN)
  KVM | Kamailio | KiwiTalk | Knockoff Nets
  Kolmogorov-Smirnov test | Kplaysearch | Krakatau | Krippendorff's alpha
  Kruskal-Wallis test | Kryptowire's internal Android static analysis engine | LATCH | LDA
  LDPlayer | LIBLINEAR | LIBSVM | LIEF
  LIME | LLDB | LLVM | LLaMA 3.1 8B Instruct
  LME4 | LOWESS | LSPlant | LSTM encoder-decoder
  Lalaine | Langdetect | Language Technology Platform (LTP) | Lasso regularized linear regression
  Latent Semantic Analysis | LatinIME | Leader Algorithm | LeakScope
  LearnLib | Learning Vector Quantization (LVQ) | Legend | Lemur
  Levenberg-Marquardt algorithm | LexisNexis | LibAFL | LibFuzzer
  LibPecker | LibSVM | LightCNN | Lightbeam
  LineageOS | LineageOS 19 | Linux Virtual Machine | Linux namespaces
  LiteRadar | LiveLab | Llama 3 | Local Extreme Value Detection (LEVD)
  Local Outlier Factor | Logistic Regression (LR) | Long Short-Term Memory | Lookout Security & Antivirus
  Lookout Security & Antivirus v6.9 | Lookout Security and Antivirus | Louvain algorithm | Lumen
  Lumos | Lxml | M'layer Perceptron (Deep) | MANOVA
  MATLAB | MATLAB 5G Toolbox | MATLAB Curve Fitting Toolbox | MAXQDA
  MD5 | MD5 and SHA-1 cryptanalytic toolbox (hashclash) | MDROID+ | MIRToolbox
  MIRtollbox | MITM SSL proxy | MKNetworkKit | ML-Doctor
  MLP | MPlayer | Mace | Mallodroid
  Mallory | MalwareBytes | ManyCam | Marvel App
  Marvel app | Matlab | Matlab LTE Toolbox | Matplotlib
  Matter.js | Maven Repository | MaxMind GeoIP2 Precision Web Service | MaxMind GeoLite2
  MaxMind Geolocation | MaxMind commercial database | Maximum Likelihood Estimation | Maxmind
  McAfee | McNemar's test | Mechanical Turk | Media Projection
  MediaExtract | MeshLab | Metasploit | Microsoft Azure
  Microsoft Azure Speaker Recognition | Microworkers | Mini-Crawler | Mixture of Naive Bayes (MNB)
  Mixture of Naive Bayes with Categories (MNBC) | MoaAB | Mobibench | Mobile Verification Toolkit (MVT)
  MobileNetV2 | MobileNetV3 | Mobileinsight | ModelXray
  ModelXtractor | ModemManager | Modularity | MongoDB
  Monsoon High Voltage Power Monitor | Monsoon Meter | Monsoon high-resolution Power Monitor | Monsoon power monitor
  Monte Carlo simulations | Mother of All Adblocking | Mozilla Rhino | Mozilla's funfuzz
  Mullvad | Multi-Hop | Multinomial Naïve Bayes | Munkres algorithm
  NIST statistical test suites | NLTK CoreNLP Parser | NLTK English stopwords list | NLTK Sentence Tokenizer
  NLTK stop words | NMAP | NPA/NXX database | NTP
  Naive Bayes | Naive Bayes classifier | Naive Bayes with Informative Priors (PNB) | National Vulnerability Database
  Navizon app | Nearest Neighbor | Needleman-Wunsch algorithm | Netify
  Netlab | Netron | Netstat | Network Analyzer
  Network Signal Guru | NetworkManager | NetworkProfiler | Neural Networks
  NextDNS | Nmap | NoFrak | NoTracking
  NomadLAB | Nordic nrf52840 board | Norton | Norton Mobile Security Lite v2.5.0.379
  NortonLifeLock mobile security product | NoxPlayer | NuSMV | NumPy
  O-LLVM obfuscator | OBFUSCAN | OCR SPACE | OOPSpam
  OPAL framework | OPTis-S4 | OS Monitor | OVR Metrics Tool
  OWASP Zed Attack Proxy (ZAP) | Oat2dex | OkHttp3 | Oltrogge et al.'s Android app crawler
  OmniParser | Omnipeek | OneTrust | Online Protobuf Decoder
  Ookla Speedtest | Open | Open GPX Tracker | OpenAI Vision API
  OpenAirInterface (OAI) | OpenCV | OpenCV cv2.absdiff | OpenCellID
  OpenMP | OpenPhish | OpenWrt | OpenYOLO
  Opera | Optunity | Orbot | Osquery
  PACER | PJSIP | PLY (Python Lex-Yacc) | POWDER
  PRAW | Packet Capture | PacketDotNet.Ieee80211 | PacketLogger
  PaddleOCR | PageRank | Paho | Paho MQTT client
  Palo Alto Firewall | Palo Alto Networks proprietary detection system | Papers With Code | Paragraph Vectors Model
  Parani-UD100 | Partial Program Analysis (PPA) | Pastebin | Patch Antenna RP-SMA-R/A
  Patch-based Multiview Stereo (PMVS) | Perceptual Hashing (pHash) | Permission Checker (PerChecker) | Perspective
  Perspective API | PhoneGap | PhotoDNA | Phraser
  Pi-hole's Default List | Pillow | Ping Traceroute | PingTools
  Piper | PlayDrone | Plino | Polar Proxy
  PoliGraph | Policy Highlights | PolicyLint preprocessing script | Porter Stemmer
  Postfix | Postman | Power Profiler | PowerTool
  PowerTutor | Prediction-Poison | Principal Component Analysis | Principal Component Analysis (PCA)
  Priv-Accept | PrivBERT | Privacify | PrivacyGrade
  ProbLog | ProcHarvester | Procyon | Projected Gradient Descent (PGD)
  Prolific Academic | Protocol Informatics (PI) | Proton VPN | Proxmark RDV4
  ProxyDroid | Proxyman | PubNub | PublicWWW
  PurPliance NER model | PyBLE | PyBluez | PyCrypto
  PyDictionary | PyOD | PyPy | PyQt5
  PySMT | PyTorchMobile | PyVirtualDisplay | Pytesseract
  Python 3.8 | Python Cryptography Toolkit (pycrypto) | Python Flask | Python NLTK
  Python SSL library | Python crawler | Python cryptography module | Python enchant
  Python pdfminer | Python script | Python socket library | Python string similarity matching
  Python timeit | Python validators library | Python-based implementation | Qianxin sandbox
  Qihoo 360 | Qihoo 360 passive DNS | Qualcomm Hexagon SDK | Qualys SSL Labs
  Qualys SSL Server Test | Qwen2.5-14B | Qwen2.5-7B | Qwen2.5-Coder-32B-Instruct
  Qwen2.5-VL | R-Droid | R8 | R8 retrace
  RAM disks | RAW SOCKET | ROP | RSPAN
  Raccoon APK Downloader | Raccoon app downloader | Radare | RainbowCrack
  Random Forest (RF) | Random Forests | Random Lists | Randoop
  Rapid7's passive DNS | Raspberry Pi | Raspberry Pi 4 Model B | Raspberry-PI
  ReadabiliPy | Readability | Realistic Vision V4.0 noVAE | Reaper
  Reddit API | Redexer | Regex Generator++ | RenderTexture
  ReproDroid | ResNet101 | ResNet152 | Resemblyzer
  Resnet | RetinaFace | Rev | Ridler-Calvard method
  Robokiller | Robolectric | Root Zone Database | Rust
  SAAF | SAPIC+ | SBERT all-MiniLM-L6-v2 | SHA-256
  SHA-512 | SHAP | SIFT | SIM7000A
  SIMtrace2 | SLOCCount | SMT solver | SNPE
  SQLCipher | SQLMap | SSIM | SSL Labs
  SSL proxy | SSLsniff | STAC | SURF
  SV2TTS | SVC | SVM classifier (custom) | SVM with RBF kernel
  SWI-Prolog | Safari Privacy Report | Safari Web Inspector | SafetyNet
  Samsung Internet Browser | Savitzky-Golay smoothing filter | SceneDroid | Scikit-Learn
  Screaming Frog | Sdat2img | Seaborn | SearchBug
  Selendroid | Selenium WebDriver | Selenium web driver | Self-Organizing Map (SOM)
  Semgrep | SensorDisabler | SensorLog | SensorTower
  SentencePiece | Seq2Seq | SerpAPI | ServiceOS browser runtime
  ShadowNet | Shamiko | Shark | Shark for Root
  Shodan Search Engine | ShowAPI | Showcaller | Siamese neural network
  Signal | Signal for android backup decryption tool | Sikuli | SimCSE
  Simg2img | SimiDroid | Simple Transformers | SimpleNLG
  Skyfield | Slither | Smali/BakSmali | Smart Contract Sanctuary
  SmartDroid | SmartThings Simulator IDE | SnoopDog | Snorkel
  SourceDNA | Spamhaus | Spamhaus Policy Block List | Spamhaus passive DNS API
  Spamhaus' SBL and DBL | Spark | Speedtest CLI | Sphinx
  Sphinx-4 | Spicy | Splituapp | Spongy Castle
  SpongyCastle | SpoofTooph | Spoon | SpyOnWeb
  Squid | Stanford NER | Stanford Named Entity Recognizer | Stanford POSTagger
  Stanford Parser | Stanford Parser Wrapper | Stanford Topic Modeling Toolbox | Stanford typed dependency parser
  Stanza | Statcounter | Stats-Models OLS | Statsmodels
  Steven Black host list | Storm | Strava | Support Vector Machine (SVM) Linear kernel
  Support Vector Machine (SVM) with RBF Kernel | Support Vector Machines (SVM) | Swift | System WebView Shell App
  T5-11B | TC Slim | TC voice synthesis API | TCP-Dump
  TF-IDF cosine similarity | TFLite | TI CC2540 | TLS-Attacker
  TWRP | Tacyt | Tailscale | Tamarin
  Tamarin prover | Team Cymru IP-to-ASN | Team Cymru's Botnet Analysis and Reporting Service | Temperature calibration
  Tencent Map Geocoding API | TensorFlowLite | TerminalEmulator | Tesseract OCR
  Tesseract OCR Engine | Tesseract-OCR | Texas Instruments (TI) CC2640 | Texas Instruments INA219
  TextExerciser | Threema | Tile hidden API | Time Machine
  TinyCheck | Tinyproxy | Titanium Framework | TollFreeNumbers.com
  Tor | Toybox | Trace.js | Trace32
  Tracker Detect | Tracker Radar Collector (TRC) | TrafficStats.getUidRxBytes() | TransE
  Transformer-Based Universal Sentence Encoder | Transformer-based model | Trend Micro Mobile Security | TrendMicro Mobile Security Personal Edition v2.0.0.1294
  Trepn Profiler | TriggerScope | TrollStore | TruffleHog
  Tsung | TurkPrime | Twilio Lookup API | Twitter Search API
  U-Net | UBC | UIPicker | UPX
  URLExtract | URLScan | UTSFuzzer | Uber API
  Uber Client app | UberTooth One | Ubertooth One | Ubertooth-One
  UiRef | UpSet | User Agent Switcher | User Interviews
  VF2 | VFDecrypt | VGG | VGGNet
  VMMap | VMware ESXi | VMware Workstation | Valgrind
  Variational AutoEncoders | VeriFast | Very sparse random projection | ViT
  VirusTotal public API | VisibleV8 | Void | WHOIS database
  WICG webpackage | WProf | Wandoujia management app | Watir
  Wayback Machine | WeChat | WeChat Windows client | WeChat metadata API
  Web Audio API | Web of Trust (WoT) | WebAgentDriver | WebAssembly
  WebProxyTool | WebUI | WebUSB API | Webshrinker
  Weka | WhatsApp Crypt14-Crypt15 Decrypter | WhatsApp Google Drive extractor | WhoTracks.Me
  Whois IP Address Database | WhoisXMLAPI WHOIS API | WiFi Direct | Widevine Integration Platform
  Wine | WireShark/tshark | Word Mover's Distance | Word2vec
  WordNet::similarity | Wowza Stream Engine | WuKong | Wukong
  X-Ray 2020 | X-Ray Tracker List | X2Face | XCUITest
  XCode | XLM-Roberta | XPMChecker | XPOChecker
  XPrivacy | XSEDE TACC Jetstream | XSStrike | Xception
  Xcode UI tests | Xray | YAHFA | YCSB
  YOLO_Label | Yellow Pages | Yet Another Mail Merge (YAMM) | YouTube Player APIs
  Z3-str | Z3StrSolver | ZRTP4PJ | Zeek
  ZeroMQ | ZoKrates | Zoom | aapt2
  adb dumpsys | adblockparser | airbase-ng | allmpnet-base-v2
  android-async-http 1.4.9 | android.os.FileObserver | angr | anisotropy-based quality method
  annotation tool [5] | api.trongrid.io | apk-mitm | app-downloader
  autocorrect | axmlparserpy | bert-base-uncased | bidirectional LSTM
  bidirectional LSTM sentence embedding model | binwalk | bluetooth Python module | bpftool
  chrome-remoteinterface | clang | cloud_enum | commercial URL filtering service
  commercial VPN subscriptions | commercial pDNS tool | conditional random field | conditional random field (CRF)
  continuous speedtest | create ap | curve25519-dalek | custom Android app
  custom EME JavaScript script | custom app-market crawler | custom automated crawler | custom browser extension
  custom crawler | custom retrieval tool | custom scraper | custom static analysis
  custom web scraper | customized Needleman-Wunsch algorithm | cve-search | danglingcname
  data collection tools developed by Garimella and Tyson | database | decision tree classifier | decision trees
  devmodectl | dex-method-list | dexter | diff
  dmg2img | dnsmasq | doc2vec PV-DM | domain Whois
  dpkt | dumpdecrypted | dumpsys | dynamic execution monitor
  dynamic time warping (DTW) | e2tools | eadb | emoji
  emoji Python package | emulator | en_core_web_lg | ens-normalize
  esalib | eth-ens-namehash | ethers.js | exclusive sparse coding
  exit survey software | fast.com | fastText | fastboot
  fastcluster | filemon | firebase-messaging | foundation LLMs
  friTap | gSpan | genetic programming | gensim
  getapk custom shell script | getrusage | google-play-scrape | googler
  googletrans | gplaycrawler | gplaydl | gpsoauth
  gpt-4o | gradient decision boosted trees (GDBT) | graph-based label propagation | graph-tool
  handleopenurl.com | hashcat | hcidump | headless Chrome Browser
  headless browser | hex editor | hierarchical clustering | hpHosts
  hping3 | iOS SDK | iOracle | iPerf
  iPerf3 | iVerify | ibtool | idna-uts46-hx
  instrumented Android 9.0 (Pie) | ip xfrm state | ipcat | ipcc-downloader
  iperf3 | ipinfo | iptoasn.com | ipvigilante.com
  jarsigner | javalang | javap | javascript-hooker
  javax.crypto | jeb | jieba | jitsi-srtp
  jtool | k-Means | k-means clustering | kernel module
  keytool | knee-point method | ksvm | lattice-based key recovery algorithm
  libav | libclang | libqmi | libselinux
  libtins | linux-router | lldb | log
  logic analyzer | lxml | mDNSResponder | macOS Console
  macOS Console app | macOS system logging facility | machine learning classifier from Chatterjee et al. | massdns
  maximum-relevancy minimum-redundancy (mRMR) | miniTracing | minidom | mitm-proxy
  mobile security product's analysis infrastructure | mock location provider | modAL | mtr
  mtranslate | multi-class k-nearest neighbors classifier | multi-layer perception (MLP) | multi-layer perceptron (MLP)
  multimeter tester | multipass | nRF52832 Dongle | ncnn
  nearest neighbor algorithm | netsniff-ng | network sniffer | network tap
  networkx | nosmoke | nsenter | oat2dex
  objdump | one-class Support Vector Machine | openssl | our crawler
  ovrgpuprofiler | p0f | paraphrase-multilingual-MiniLM-L12-v2 | parse-play
  pcap-parser | pcap4j | petlib | pfctl
  pix2pix | pkuseg | playsound | plutil
  pm3 client | power-meter | procstats | professional transcription service
  proprietary instrumented AOSP build | protobufs library | protoscope | proxy
  proxy server | proxychains4 | publicly available GitHub script | publicsuffixlist
  publicwww.com | pyOpenSSL | pySim | pyasn1
  pyautogui | pyelftools | pygtrans | pymobiledevice3
  pysoot | pytesseract | python-magic | python-whois
  pytorch.nn | pywinauto | r0capture | r4nd0m
  radiff2 | random forest | random forest (custom) | random sampling
  recurrent neural network with LSTM units | redroid | regex package | regular expressions (regex)
  reservoir sampling | ripgrep | roberta-large-nli-stsb-mean-tokens | rootAVD
  rvictl | scikit-learn DecisionTreeRegressor | scrcpy | screening application
  script written by the aforementioned hobbyist | semantic similarity | sentence-transformers/all-MiniLM-L6-v2 | sesearch
  simg2img | simulated annealing | smali/dexpler | smp_call_function_single
  spaCy en_core_web_lg | sparse SVM | speedtest.net | sqldiff
  sqlmap | srec_cat | srsENB | srsRAN
  srsRAN v21.10 | srsUE | sslscan | startSSL
  stochastic gradient descent (SGD) | stress-ng | strongSwan | supervised linear classifier (custom adaptation)
  sysctl | sysfs | syslog -w | sysmoEUICC1
  tPacketCapture | tf-idf vectorizer | tld | tool developed by Garimella et al.
  traceroute | transformer-based encoder | transparent proxy | tree edit distance
  tvbus.exe | two-coin model | uBlock Origin | unbound
  urllib | vDexExtractor | vmihailenco/msgpack | web crawler
  web3.js | web3.py | whitelist-chrome | www.iplocation.net
  wxappUnpacker | wxml-transformer | xcodebuild | z3
  zImageTool | zxcvbn
</file>

===== 14. External tool currency, unedited =====

Output of ''sh scripts/mobile_tool_currency.sh''. Every version and date in the page's four tool-currency tables comes from here.

<file - mobile_tool_currency-output.txt>
repo                                           latest release                     last commit
----                                           --------------                     -----------
frida/frida                                    Frida 17.17.0 @ 2026-08-05         2026-08-18
sensepost/objection                            1.12.5 @ 2026-06-02                2026-07-23
rovo89/Xposed                                  v89 @ 2017-12-17                   2017-12-17
LSPosed/LSPosed                                1.9.2 @ 2023-10-11                 2024-01-07
topjohnwu/Magisk                               Magisk v30.7 @ 2026-02-23          2026-08-27
Fuzion24/JustTrustMe                           v.2 @ 2016-01-26                   2024-09-02
nabla-c0d3/ssl-kill-switch2                    0.14 @ 2019-12-03                  2021-03-28
ViRb3/TrustMeAlready                           Release v1.11 @ 2019-03-11         2019-09-23
soot-oss/soot                                  4.7.1 @ 2026-02-23                 2026-08-17
soot-oss/SootUp                                v3.0.1 @ 2026-08-07                2026-08-24
secure-software-engineering/FlowDroid          FlowDroid 2.15.1 @ 2026-02-23      2026-08-18
iBotPeaches/Apktool                            v3.0.3 @ 2026-07-20                2026-08-24
skylot/jadx                                    1.5.6 @ 2026-07-10                 2026-08-19
MobSF/Mobile-Security-Framework-MobSF          v4.5.2 @ 2026-08-10                2026-08-21
rednaga/APKiD                                  v3.1.0 - "AbhiTheModder" edition @ 2026-04-09 2026-07-27
pkumza/LibRadar                                1.5.0 @ 2017-06-15                 2018-12-21
reddr/LibScout                                 Cleanup of local deps @ 2019-01-30 2019-10-25
EFForg/apkeep                                  apkeep v1.0.0 @ 2026-05-05         2026-05-04
matlink/gplaycli                               3.29 @ 2020-03-10                  2021-10-02
ClaudiuGeorgiu/PlaystoreDownloader             PlaystoreDownloader 2.0 alpha @ 2022-01-08 2024-07-27
facundoolano/google-play-scraper               v10.1.2 @ 2025-11-10               2026-07-18
JoMingyu/google-play-scraper                   no releases                        2024-06-07
majd/ipatool                                   v2.3.2 @ 2026-08-03                2026-08-03
AloneMonkey/frida-ios-dump                     no releases                        2020-06-01
opa334/TrollStore                              2.1.1 @ 2026-04-01                 2026-04-01
palera1n/palera1n                              v3.0.0 beta 2 @ 2026-08-03         2026-07-27
opa334/Dopamine                                3.0.9 @ 2026-08-22                 2026-08-22

--- package registries
npm  google-play-scraper          10.1.3 @ 2026-05-31
npm  appium                       3.7.0 @ 2026-08-24
PyPI google-play-scraper          1.2.7 @ 2024-06-07
PyPI androguard                   4.1.4 @ 2026-06-01

--- NOTE: releases.atom <updated> is not always the release publication date.
    apkeep reads 2026-05-05 here but the GitHub API published_at is 2026-04-30;
    the API/tag page is authoritative and the page uses 2026-04-30.
--- NOTE: the commits column is the DEFAULT BRANCH only. The GitHub API pushed_at
    counts any branch, which is why LSPosed reads 2024-01-07 here and 2026-08-26
    from the API. The page cites the default-branch date, which is the stricter one.
</file>

===== 15. Conventions followed on this page =====

^ Item ^ Value ^
| Discussion block | **None**, following the convention set by the other ''provenance:'' pages — comments belong on the content page. |
| Reference list | **None.** There is no %%<bibtex bibliography>%% block, so the four citekeys here render as markers without a reference list; that is the existing convention on ''provenance:'' pages, not an omission. This page adds no bibliography entries of its own. |
| Naming | mirrors the content page id under ''provenance:'', unchanged, so the mapping needs no lookup and ''sitemap.mjs'' groups it with the other provenance pages. |
| Reachability | linked from the content page's //Methodology and limitations of these figures// section; links back below. |
| Publication order | [[literature:bibliography]] (17 entries) → [[design:mobile_and_app_measurement]] → this page → [[:start]]. |

[[design:mobile_and_app_measurement|← back to the content page]] · [[literature:corpus|corpus-level provenance]]

===== Markup sweep, 2026-09-17 =====

Mechanical rendering repair only: a fresh live raw/XHTML export of 188 pages was checked with ''check_wrap.mjs'' and ''check_typography.mjs''. Affected plugin tags, CLI flags and heading markup were repaired; no figures or substantive prose were changed. The resulting source and rendered DOM were re-checked after saving.

===== Link-hygiene sweep, 2026-09-17 =====

The fresh rendered-DOM sweep found this page's two bare ''start'' links resolved to ''provenance:design:start''. They are now root-anchored; the post-save DOM was re-checked for red links. No figures or citations changed.

===== ConsentAction audit propagation, 2026-09-17 =====

**What was wrong.** The mobile/app report's appAnalysis diagnostic said ''consentAction stated 31/115'' without the schema-vs-paper-claim qualification. The 31/115 figure is a field-population diagnostic for the app subset, not an audited claim count.

**Command and real output.** ''node scripts/report_mobile.mjs'' → ''consentAction (schema field populated; not a paper claim) stated 31/115; no-interaction=29 accept-all=2''. ''node scripts/consent_action_noninteraction_audit.mjs'' → corpus-wide **55/1,120 = 4.9%** audited paper claims and **279/313 = 89.1%** unsupported ''no-interaction'' labels.

**What changed.** The embedded report output now labels the 31/115 diagnostic as schema field population; the corpus-wide audit result is not substituted into this appAnalysis subset.

**Review.** One **model: 'sonnet'** figures-vs-script pass re-ran ''report_mobile.mjs'' and checked the edited diagnostic and the adjacent statefulness/headless/interactionDepth/authentication diagnostics. No mismatch was found. No citation pass was needed: no citekey or quoted claim changed.

**Rejected finding.** The 31/115 appAnalysis diagnostic was not replaced by the corpus-wide 55/1,120 result because those are different populations.