Pure Clean Master 保活与拉活反编译代码册#

文档日期：2026-10-12
样本：com.pureclean.smartfile.master，APK 1.1.8（19）。
S1=静态事实，I=合理推断，U=未验证。未操作测试机。
下面代码均为对反编译结果的去混淆、去日志、去异常包装后的等价摘录/伪代码，用于开发快速理解；不是原始源码。精确证据必须回查所列文件与行号。密钥、SDK Token 和无关混淆常量已省略。

一、总体调用图#

ContentProvider WpCyBN.onCreate
  └─ tm.a(context)
      ├─ w61.a()                    创建 3 个通知 Channel
      ├─ md.a()                     尝试启动 gXXfik 前台服务
      │   └─ 失败 → Job 3857 / PsaeNNErXb
      ├─ qu3.e()                    每日 10:00 Alarm → BpFZcYhmZ
      ├─ 注册系统事件 Receiver
      ├─ ac3.a()                    Job 3432 / sToBblBqZa，15 分钟自续约
      └─ q41.d()                    WorkManager，15 分钟周期

BOOT/MY_PACKAGE_REPLACED ─┐
Alarm Receiver ───────────┤
JobService / Worker ──────┤→ md.a() + ep3.d()
FCM message ──────────────┘            └─ 1 秒后 AUTO 通知策略

系统事件/文件变化/业务阈值
  └─ x22.a(scene, callback)
      └─ vn 统一门控/频控
          └─ callback 组文案
              └─ t22.e/f → notify(8194)
                  └─ OutOpenActivity → SplashActivity → p71 路由工具页

二、发现范围#

本册覆盖本样本中发现的 App 自有保活/拉活方法：

1. 初始化 Provider 与回调配置；
2. 前台服务及失败 Job；
3. 周期 Job、WorkManager、Alarm；
4. 开机/升级/Alarm/系统事件 Receiver；
5. FCM 入口；
6. 常驻通知；
7. AUTO 召回、统一通知门控、发布、重复和点击回跳。

Google/Firebase/AndroidX/广告 SDK 自带的 Job/Receiver 不列为“App 自有保活代码”；Manifest 中能看到它们，但不能外推为 App 主动保活策略。（S1）

三、初始化层#

3.1 KeepCallbackImp：参数与 Channel 常量#

源码：jadx/sources/com/ai/smart/notify/KeepCallbackImp.java:11-25

final class KeepCallbackImp extends KeepCallbackBase {
    static final Pair RESIDENT = ("channel_id_resident", "resident");
    static final Pair REMIND = ("channel_id_remind", "remind");
    static final Pair REMIND_SILENT = ("channel_id_remind_silence", "remind_silence");
    static final int RESIDENT_NOTIFICATION_ID = 1;

    KeepCallbackImp() {
        dailyAlarmTime = "10:00";   // 解码值
        jobIntervalMinutes = 15;
        workIntervalMinutes = 15;
    }
}

状态：S1。10:00 为解码后的静态值。

3.2 WpCyBN.onCreate()：进程级自动初始化#

源码：jadx-targeted/WpCyBN.java:76-179。标准模式在 jadx/sources/com/ai/smart/WpCyBN.java:47-52 失败，因此使用 simple 定点恢复。

boolean onCreate() {
    Context context = getContext();
    if (context == null) return true;

    staticContext = context.getApplicationContext();
    if (!packageDigestMatchesAllowedValue(context.getPackageName())) return false;

    readDebugFlagFromSharedPreferences();
    KeepCallbackBase callback = reflectCallbackFromManifestMetadata("jpobwy");
    if (callback == null) return false;
    Global.keepCallback = callback;

    if (staticContext instanceof Application app) {
        app.registerActivityLifecycleCallbacks(ProcessActivityCounter.INSTANCE);
    }
    Adjust.getAttribution(...);
    Adjust.getAdid(...);
    launchAsyncInit(...);
    tm.a(context);
    return true;
}

状态：S1 主干；simple 恢复可能丢失异常边（U）。

3.3 tm.a(Context)：总编排#

源码：jadx/sources/defpackage/tm.java:29-103

static void initKeepAlive(Context context) {
    w61.a(context);                         // 创建通知 Channels
    if (!hasNotificationPermission(context)) return;

    if (!keepInitDone) {
        keepInitDone = true;
        md.a();                             // 前台服务
        qu3.e(context);                     // 每日 Alarm
        registerSystemEventReceivers(context);
        registerBootAndPackageReplaceReceivers(context);
        ac3.a(context);                     // Job 3432
    }

    if (!workInitDone) {
        q41.d(context);                     // 周期 WorkManager
        workInitDone = true;
    }
}

状态：S1。这里的门槛可由 k82.a() 还原为通知能力：API 33+ 检查 POST_NOTIFICATIONS，更低版本检查 NotificationManager.areNotificationsEnabled()（jadx/sources/defpackage/k82.java:23-27）。因此 Service/Alarm/Job/Work 主链只有在通知可用时才初始化。

四、前台服务与失败兜底#

4.1 md.a()：启动前台服务，失败则排 Job 3857#

源码：jadx/sources/defpackage/md.java:173-243

static void ensureForegroundService() {
    Context context = WpCyBN.staticContext;
    if (context == null || !hasNotificationPermission(context)) return;

    try {
        if (!gXXfik.running) {
            Intent i = new Intent(context, gXXfik.class).setPackage(context.getPackageName());
            context.startForegroundService(i);
        }
    } catch (Throwable startFailure) {
        if (PsaeNNErXb.jobScheduled) return;
        JobInfo job = new JobInfo.Builder(3857, component(PsaeNNErXb.class))
            .setRequiredNetworkType(JobInfo.NETWORK_TYPE_NONE)
            .setRequiresCharging(false)
            .setRequiresDeviceIdle(false)
            .setPersisted(true)
            .setMinimumLatency(5_000L)
            .setOverrideDeadline(7_000L)
            .setPriorityIfApi33(400)
            .build();
        jobScheduler.cancel(3857);
        jobScheduler.schedule(job);
        PsaeNNErXb.jobScheduled = true;
    }
}

状态：S1。

4.2 gXXfik：常驻前台服务#

源码：jadx/sources/com/ai/smart/gXXfik.java:36-125

private void enterForeground() {
    Notification n = w61.c(this);
    if (SDK_INT >= 29) {
        startForeground(1, n, 0x40000000 /* specialUse */);
    } else {
        startForeground(1, n);
    }
    running = true;
}

void onCreate() {
    super.onCreate();
    enterForeground();
}

int onStartCommand(Intent intent, int flags, int startId) {
    enterForeground();
    return SDK_INT >= 34 ? START_NOT_STICKY : START_STICKY;
}

void onDestroy() {
    super.onDestroy();
    stopForeground(STOP_FOREGROUND_REMOVE);
    running = false;
    md.a();
}

void onTaskRemoved(Intent rootIntent) {
    super.onTaskRemoved(rootIntent);
    md.a();
}

状态：S1。0x40000000 与 Manifest 的 foregroundServiceType="specialUse" 对应。系统是否允许重启为 U。

4.3 PsaeNNErXb：Job 3857 兜底#

源码：jadx/sources/com/ai/smart/PsaeNNErXb.java:46-139

void onCreate() {
    super.onCreate();
    startForeground(1, w61.c(this), SDK_INT >= 29 ? 0x40000000 : /* old overload */ 0);
    if (!gXXfik.running) {
        try { startForegroundService(new Intent(this, gXXfik.class)); }
        catch (Throwable ignored) { /* logged */ }
    }
}

boolean onStartJob(JobParameters params) {
    launchCoroutine(/* vn case 12: background keep work */);
    return true;
}

boolean onStopJob(JobParameters params) { return false; }

void onDestroy() {
    super.onDestroy();
    jobScheduled = false;
}

状态：S1。协程 case 12 的全部副作用受混淆影响，未完整命名（U）。

五、周期 Job、Work 与 Alarm#

5.1 ac3.a(Context)：Job 3432#

源码：jadx/sources/defpackage/ac3.java:80-127

static void schedulePeriodicJob(Context context) {
    long minutes = KeepCallback.jobIntervalMinutes; // 15
    if (minutes == 0) {
        jobScheduler.cancel(3432);
        return;
    }

    long delay = minutesToMillis(minutes);
    JobInfo job = new JobInfo.Builder(3432, component(sToBblBqZa.class))
        .setRequiredNetworkType(JobInfo.NETWORK_TYPE_NONE)
        .setRequiresCharging(false)
        .setRequiresDeviceIdle(false)
        .setPersisted(true)
        .setMinimumLatency(delay)
        .setOverrideDeadline(delay + 5_000L)
        .setPriorityIfApi33(400)
        .build();
    jobScheduler.schedule(job);
}

状态：S1。

5.2 sToBblBqZa：Job 自续约#

源码：jadx/sources/com/ai/smart/sToBblBqZa.java:21-47

void onCreate() {
    super.onCreate();
    md.a();
    ep3.d("job-create/live-point");
}

boolean onStartJob(JobParameters params) {
    ac3.a(this);       // 再排下一次 Job 3432
    return false;
}

boolean onStopJob(JobParameters params) { return false; }

状态：S1；传给 ep3.d 的混淆字符串仅做语义占位，不应当作原文。

5.3 q41.d(Context) 与 kcTBvDgL.doWork()：15 分钟 WorkManager#

源码：jadx/sources/defpackage/q41.java:145-181、jadx/sources/com/ai/smart/kcTBvDgL.java:26-35

static void schedulePeriodicWork(Context context) {
    long minutes = KeepCallback.workIntervalMinutes; // 15
    if (minutes == 0) {
        WorkManager.cancelUniqueWork("MiGS");
        return;
    }
    PeriodicWorkRequest request =
        new PeriodicWorkRequest.Builder(kcTBvDgL.class, minutes, MINUTES)
            .setFlexInterval(5, MINUTES)
            .build();
    WorkManager.enqueueUniquePeriodicWork("MiGS", /* existing policy */, request);
}

Result kcTBvDgL.doWork() {
    md.a();
    ep3.d("worker/live-point");
    return Result.success();
}

状态：S1。WorkManager 实际到达时间受系统调度影响（U）。

5.4 qu3.e(Context)：每日 10:00 唤醒型 Alarm#

源码：jadx/sources/defpackage/qu3.java:79-130

static void scheduleDailyAlarm(Context context) {
    PendingIntent pi = PendingIntent.getBroadcast(
        context, 74655,
        new Intent(context, BpFZcYhmZ.class),
        pendingIntentFlags()
    );
    alarmManager.cancel(pi);

    Calendar next = nextLocalTime("10:00");
    long delay = next.getTimeInMillis() - System.currentTimeMillis();
    alarmManager.set(
        AlarmManager.ELAPSED_REALTIME_WAKEUP, // type 2，可唤醒；set() 非 exact
        SystemClock.elapsedRealtime() + delay,
        pi
    );
}

状态：S1。它具备 wakeup（唤醒）能力，但 set() 仍可被系统批处理和延迟，不是准点保证。

5.5 BpFZcYhmZ.onReceive()：Alarm 回调#

源码：jadx/sources/com/ai/smart/BpFZcYhmZ.java:20-29

void onReceive(Context context, Intent intent) {
    md.a();
    ep3.d("alarm/live-point");
    qu3.e(context);        // 安排下一次
}

状态：S1。

六、开机、升级与系统事件#

6.1 ZPHDnIht.onReceive()：BOOT/包升级#

源码：jadx/sources/com/ai/smart/ZPHDnIht.java:21-39；Manifest：jadx/resources/AndroidManifest.xml:339-348

void onReceive(Context context, Intent intent) {
    if (intent == null) return;
    String action = intent.getAction();
    if (BOOT_COMPLETED.equals(action) || MY_PACKAGE_REPLACED.equals(action)) {
        md.a();
        ep3.d("boot-or-replace/live-point");
    }
}

状态：S1。

6.2 s7.onReceive()：保活系统事件接收器#

源码：jadx/sources/defpackage/s7.java:19-90；注册入口：tm.java:40-71

void onReceive(Context context, Intent intent) {
    String action = intent != null ? intent.getAction() : null;
    if (!isOneOfRegisteredDeviceOrPackageActions(action)) return;

    long now = System.currentTimeMillis();
    if (now - lastHandledByAction.getOrDefault(action, 0L) < 500L) return;
    lastHandledByAction.put(action, now);

    md.a();
    ep3.d("system-receiver/live-point");
}

静态注册集经 hash 与同一工作区明文 Receiver 对照，包括解锁、充/断电、屏幕开关、包增删改、最近任务键/系统对话框和配置变化等；每个 action 做 500ms 去抖。（S1/I；混淆字符串的逐项明文应以运行日志复核）

6.3 MyApplication.onCreate()：业务通知系统 Receiver#

源码：jadx/sources/com/ai/smart/MyApplication.java:99-126

void registerBusinessReceiver() {
    IntentFilter device = new IntentFilter();
    device.addAction(USER_PRESENT);
    device.addAction(ACTION_POWER_CONNECTED);
    device.addAction(ACTION_POWER_DISCONNECTED);
    device.addAction(BATTERY_CHANGED);
    device.addAction(SCREEN_ON);
    device.addAction(SCREEN_OFF);
    device.setPriority(1000);
    register(s13, device);

    IntentFilter packages = new IntentFilter();
    packages.addAction(PACKAGE_ADDED);
    packages.addAction(PACKAGE_REMOVED);
    packages.addAction(PACKAGE_REPLACED);
    packages.addDataScheme("package");
    register(s13, packages);

    register(s13, new IntentFilter(CLOSE_SYSTEM_DIALOGS));
    register(s13, new IntentFilter(CONFIGURATION_CHANGED));
}

状态：S1。这些 Receiver 的通知触发分支详见 拉活通知规则与文案全量报告.md。

6.4 q93 / ye：Activity 可见性与前后台闸门#

源码：jadx/sources/defpackage/q93.java:32-57,350-416、jadx/sources/defpackage/ye.java:70-113

// WpCyBN 注册的进程级计数器
onActivityStarted(Activity a) {
    tm.a(a.getApplicationContext());
    handleResidentNotificationEntryIfPresent(a);
    visibleActivityCount++;
    if (visibleActivityCount == 1) {
        reportForegroundLivePointIfDue();
        ep3.d("foreground/live-point");
        restartIpAndAdIdBlacklistChecks();
    }
}
onActivityStopped(Activity a) { visibleActivityCount--; }

// MyApplication 注册的业务生命周期回调
onAppForegrounded() { MyApplication.appInBackground = false; }
onAppBackgrounded() {
    MyApplication.appInBackground = true;
    if (leftBecauseOfAd) requestNotification(AD_GO_BACK, adRetrieveTemplate);
}

状态：S1。NaKMPne 使用 q93.f17531c，普通通知策略使用 MyApplication.f4790c。

七、FCM 远程入口#

7.1 NaKMPne.c(RemoteMessage)#

源码：jadx-targeted/NaKMPne.java:35-108。标准模式主方法失败，使用 simple 定点恢复。

void onMessageReceived(RemoteMessage message) {
    md.a();
    ep3.d("fcm/live-point");

    int priority = parseOriginalPriority(message);
    if (priority == HIGH
        && hasNotificationPermission(this)
        && visibleActivityCount <= 0
        && deviceStateChecksPass()
        && orientation != LANDSCAPE
        && minutesSinceLastPoint >= 5
        && hour >= 7 && hour < 23) {
        // simple 反编译未恢复出清晰的可见通知发布调用
    }

    inspectDeliveredPriorityAndPriorityReduction(message);
    updateLivePoint(...);
}

void onNewToken(String token) {
    yd1.a(this, token);
}

状态：收到 FCM 后调用 md.a()/ep3.d() 为 S1；“直接展示通知”没有代码证据，属于 U。

八、AUTO 拉活入口#

8.1 ep3.d(String) → j case 8#

源码：jadx/sources/defpackage/ep3.java:150-175、jadx-targeted/j.java:200-204

static void onLivePoint(String source) {
    rememberFirstSourceIfEmpty(source);
    delay(1_000L, () -> x22.a(AUTO, new r12(AUTO_TEMPLATE)));
    refreshFcmTokenIfNeeded(source);
    reportLivePoint(source);
}

状态：S1 主链。AUTO 回调在两套模板中随机选择：缓存告警或存储占用告警。（S1）

九、统一通知策略#

9.1 x22.a(scene, callback)#

源码：jadx/sources/defpackage/x22.java:43-51

static void requestNotification(Scene scene, Supplier<Unit> buildAndPost) {
    Job previous = activeSceneJobs.remove(scene);
    if (previous != null) previous.cancel();
    activeSceneJobs.put(scene, launch(new vn(scene, buildAndPost)));
}

状态：S1。

9.2 vn：门控/频控去噪等价代码#

源码：jadx-targeted/vn.java:650-847；关键跳转交叉证据：jadx-targeted/vn-fallback.java:1115-1495

suspend Unit evaluateAndSend(Scene scene, Supplier<Unit> callback) {
    delay(1_000L);
    activeSceneJobs.remove(scene);

    if (!notificationsEnabled()) return;
    if (scene.tier != HIGH && firstOpenAgeMs() < 300_000L) return;
    if (!isInteractiveAndUnlocked()) return;
    if (isLandscape()) return;
    if (appIsForeground()) return;
    if (hour < 7 || hour >= 23) return;

    if (scene == RECENT_TASK
        && remoteRecentNoClickSwitch == 1
        && sameDayRecentNoClickCount >= 2) return;
    if (scene == NOTIFY_CLEAN && alreadyShownToday()) return;

    if (isOrganic()) {
        if (now - lastAnyNotification < 2 * HOUR) return;
    } else {
        long interval = intervalFor(scene.tier, totalShowCount, remoteConfig);
        if (now - lastTierNotification(scene.tier) < interval) return;
    }

    if (now - lastTierDecision < 10_000L
        && previousTier != null
        && scene.tier.isLowerThan(previousTier)) return;

    callback.get();
    saveLastAnyTime(now);
    saveTierTime(scene.tier, now);
    saveLastTier(scene.tier);
    incrementTotalCount();
    updateSceneCounters(scene);
}

状态：关键 return 均由 fallback 指令输出交叉确认，属于 S1；伪代码仍不是逐字原始源码。HIGH 冷却的实际分支为 highShowCount == 1 ? sendFirstIntervalHigh : sendRepeatIntervalHigh，字段名与轮次呈反常关系，疑似实现缺陷。

十、通知发布与重复#

10.1 t22.e/f(...)：发布 ID 8194#

源码：jadx-targeted/t22.java:101-271

static void postReminder(
    Context context, String title, String body,
    String compactCta, String expandedCta,
    Intent clickIntent, Bitmap image,
    boolean isRepeat
) {
    clickIntent.setData(uniqueUri());
    if (!isRepeat) report("pushNotify", clickIntent.getStringExtra("action"));

    RemoteViews big = buildBig(title, body, expandedCta, image);
    RemoteViews small = buildSmall(title, compactCta, image);
    RemoteViews middle = buildMiddle(title, expandedCta, image);

    PendingIntent deleteIntent = broadcast("com.action.CANCEL_REPEAT");
    String channel = isRepeat ? "channel_id_remind_silence" : "channel_id_remind";
    Notification n = new NotificationBuilder(context, channel)
        .setSmallIcon(...)
        .setCustomViews(small, middle, big)
        .setContentIntent(activity(clickIntent))
        .setDeleteIntent(deleteIntent)
        .setTitleAndText(title, body)
        .build();

    notificationManager.notify(8194, n);

    if (!isRepeat) {
        int repeatCount = isSamsungDevice() ? 1 : 3;
        launch(new y22(repeatCount, sameNotificationArgs));
    }
}

状态：S1。

10.2 y22：4 秒重复#

源码：jadx/sources/defpackage/y22.java:65-119（标准输出主体失败但保留反编译伪代码）

for (int i = 0; i < repeatCount; i++) {
    delay(4_000L);
    if (!notificationsEnabled()) continue;
    if (!isInteractiveAndUnlocked()) continue;
    if (isLandscape()) continue;
    if (appIsForeground()) continue;
    postSameReminder(isRepeat = true); // 静默 Channel
}

状态：S1 主干；源码末尾仍有 UnsupportedOperationException，应以伪代码区与 t22 调用共同复核。

十一、点击回跳#

11.1 OutOpenActivity#

源码：jadx/sources/a/ac/view/splash/OutOpenActivity.java:55-84

void onCreate(Bundle state) {
    super.onCreate(state);
    cancelRepeatNotificationJob();

    String action = getIntent().getStringExtra("action");
    if ("notify_recentTask".equals(action)) resetRecentNoClickCount();
    reportClickNotify(action);
    dismissFullscreenAdsIfPresent();

    Intent next = new Intent(this, SplashActivity.class);
    next.putExtra("action", action);
    startActivity(next);
    finish();
}

状态：S1。

11.2 SplashActivity.j() 与 p71.d(action)#

源码：jadx/sources/a/ac/view/splash/SplashActivity.java:188-215、jadx/sources/defpackage/p71.java:203-341

void routeNotificationEntry() {
    String action = intentActionOr("none");
    if ("notify_ad_retrieve".equals(action) && mainTaskAlreadyExists()) {
        restoreExistingTask();
    } else {
        startMainActivityWith(action);
    }
}

void homeRouter(String action) {
    switch (action) {
        case "notify_screenshot", "resident_photo" -> open(ScreenShot);
        case "notify_new_fileA", "notify_auto_2", "notify_unlock_bigFile",
             "notify_uncharge", "resident_clean" -> open(LargeFile);
        case "notify_auto_1", "notify_unlockScreen_junk", "notify_unlock_unclean",
             "resident_cache" -> open(CacheClean);
        case "notify_appInstallA", "notify_appInstallB", "notify_appUnInstall",
             "notify_recentTask", "notify_charge", "resident_app" -> open(AppManage);
        case "notify_use_network_over_50", "notify_use_network_over_100",
             "notify_change_network", "resident_speed" -> open(NetworkTraffic);
        case "notify_lowpower20", "notify_unlockScreen_ram" -> open(RAM);
        case "notify_notifyClean" -> open(NotifyClean);
    }
}

状态：S1。notify_charge → AppManage 是代码真实映射，但产品语义可疑（I）。

十二、常驻通知构建#

12.1 w61.a/c(Context)#

源码：jadx/sources/defpackage/w61.java:38-74,98-230

static void createChannels(Context c) {
    create("channel_id_resident", "resident", IMPORTANCE_DEFAULT, sound=null);
    create("channel_id_remind", "remind", IMPORTANCE_HIGH,
           sound=null, lights=true, vibration=true);
    create("channel_id_remind_silence", "remind_silence", IMPORTANCE_HIGH,
           sound=null, lights=false, vibration=false);
}

static Notification buildResident(Context c) {
    PendingIntent clean = action(8197, "resident_clean");
    PendingIntent cache = action(8198, "resident_cache");
    PendingIntent app = action(8199, "resident_app");
    PendingIntent photo = action(8200, "resident_photo");
    PendingIntent speed = action(8201, "resident_speed");

    RemoteViews compactAndBig = bindLabelsAndDynamicSpeed(...);
    Notification n = builder(c, "channel_id_resident")
        .setOngoing(true)
        .setCustomViews(compactAndBig)
        .setContentIntent(openSplash("action_resident"))
        .build();

    n.deleteIntent = servicePendingIntent(gXXfik.class); // 删除后再次请求服务
    n.when = now + 365 * DAY;
    return n;
}

状态：S1。

十三、方法索引（给开发定位）#

十四、未验证与开发注意#

1. JADX 完整任务有 579 个错误；六个关键类已用 simple 模式恢复，但不能当原始源代码。（U）
2. vn 的 simple 输出曾缺失三处跳转；本轮已用 fallback 指令输出确认首次打开 300 秒、最近任务两次未点击、通知清理每日一次的 return，但实际计时/计数仍应真机日志验证。（S1/U）
3. NaKMPne 没有明确的可见通知发布调用；不要把 FCM 收消息直接等同“展示通知”。（U）
4. 系统强停会进入 stopped state，通常不是这些 Job/Receiver 可自行绕过的；本报告不声称可对抗强停。（U）
5. Android 14+ 前台服务限制、Android 15/16 通知与任务配额、各 OEM 自启动策略均需真机矩阵验证。（U）
6. 所有定时均是“请求调度”，不是 SLA：Work/Job/非 exact Alarm 都可能延迟。（S1/U）