# Cinema HD & Debrid Stream APK Analysis Reference

Produced from decompiling Cinema HD v3.0.6 and Debrid Stream v3.2.3 via jadx. Use as a comparison cheat sheet when analyzing streaming APKs.

## Quick Comparison

| Aspect | Cinema HD | Debrid Stream |
|--------|-----------|---------------|
| Package | com.yoku.cinemahd.v3 | com.debridstream.tv |
| Version | 3.0.6 (116) | 3.2.3 (135) |
| Compiled SDK | 31 (Android 12) | 35 (Android 15) |
| Min SDK | 21 | 24 |
| Architecture | Multi-activity, Dagger+RxJava | Single-activity, Compose+Coroutines |
| UI | XML layouts | Jetpack Compose |
| Navigation | Bottom nav, explicit intents | Tab-based Compose navigation |
| Player | ExoPlayer v2 | Media3 (ExoPlayer v3) |
| Images | Glide + Fresco | Coil |
| Database | Room (SQLite) | Room + Firestore |
| DI | Dagger 2 | Custom/obfuscated Hilt-like |
| Auth | OAuth WebViews | Firebase Auth + Google Sign-In |
| Monetization | 6 ad SDKs + Bitcoin/codes | RevenueCat subscriptions |
| Scraping | 140+ embedded website scrapers (Jsoup) | Unknown (obfuscated) |

## Architecture Signals to Extract

### From AndroidManifest.xml Every Time
```xml
<!-- Key attributes on <application>: -->
android:name              <!-- Application class -->
android:hardwareAccelerated  <!-- TRUE for video apps -->
android:largeHeap        <!-- Memory-intensive app -->
android:usesCleartextTraffic  <!-- Security risk if true -->
android:networkSecurityConfig  <!-- Points to @xml/... -->
android:appComponentFactory   <!-- Often androidx default -->
```

### Provider/Resolver Pattern (Cinema HD)
The core of scraping-based streaming apps:
- `BaseProvider` → abstract scraper (140+ implementations)
- `BaseResolver` → abstract video extractor (120+ implementations)
- `MediaSource` → unified stream result (Parcelable, size, quality, debrid flags)
- Static array of ALL providers instantiated at class load time — anti-pattern
- Premium resolvers wrap RealDebrid/AllDebrid/Premiumize APIs
- Interceptor layer for Cloudflare challenge bypass

### Debrid Token Storage Pattern (Cinema HD)
```java
// Tokens stored in SharedPreferences (unencrypted - BAD)
edit.putString("real_debrid_access_token", value);
edit.putString("real_debrid_refresh_token", value);
edit.putString("real_debrid_client_secret", value);
edit.putString("real_debrid_last_clientID", value);
```
Our app should use EncryptedSharedPreferences instead.

### Debrid Stream State Management Pattern
```kotlin
// MVVM with sealed state per screen:
class HomeViewModel : AndroidViewModel() {
    private val _uiState: MutableStateFlow<HomeUiState>
    val uiState: StateFlow<HomeUiState>  // public read-only
    
    // Per-category loading trackers prevent re-fetches:
    private val loadedMain: MutableSet<String>
    private val loadingMain: MutableSet<String>
    private val loadedMovies: MutableSet<String>
    // ... one set per tab category
}
```

### Compose for TV Setup (Debrid Stream)
```kotlin
class MainActivity : ComponentActivity() {
    override fun onCreate(savedInstanceState: Bundle?) {
        enableEdgeToEdge()  // Modern TV OS 10+
        setContent {
            // Compose UI tree starting with AuthViewModel state
            AuthScreen(authViewModel)
        }
    }
}
```

### Image Cache Configuration (Debrid Stream — Coil)
```kotlin
// Memory: 10% of heap with weak references
// Disk: 100MB in <cache>/coil_cache/
new ImageLoader.Builder(context)
    .memoryCache {
        MemoryCache.Builder(context)
            .maxSizePercent(0.1)
            .weakReferencesEnabled(true)
            .build()
    }
    .diskCache {
        DiskCache.Builder()
            .directory(File(context.cacheDir, "coil_cache"))
            .maxSizeBytes(100 * 1024 * 1024)
            .build()
    }
```

### OkHttp Configuration (Debrid Stream)
```kotlin
OkHttpClient.Builder()
    .cache(Cache(File(cacheDir, "okhttp_http_cache"), /* ~4MB */))
    .dispatcher(Dispatcher().apply {
        maxRequests = 8
        maxRequestsPerHost = 4
    })
    .build()
```

## Key Anti-Patterns to Flag

1. **Static array of all providers** — Cinema HD instantiates 140+ providers in one static init. Our app: dynamic plugin registry.
2. **Cleartext HTTP** — `usesCleartextTraffic="true"` in Cinema HD. Always use HTTPS.
3. **Plaintext token storage** — SharedPreferences for debrid tokens. Use EncryptedSharedPreferences.
4. **Hardware acceleration off** — `hardwareAccelerated="false"` in Cinema HD. Bad for video and animations.
5. **Legacy storage** — `requestLegacyExternalStorage=true`. Target SDK 35+ avoids this.
6. **6+ ad SDKs** — Cinema HD bundles 7 different ad SDKs. Privacy/performance nightmare.
7. **React Native overhead** — Cinema HD initializes React Native engine despite being a native app.

## Manifest Entry Analysis Template

When examining a new streaming APK's manifest, check for these specific tells:

- `LEANBACK_LAUNCHER` → Android TV support
- `android.software.leanback` → Leanback library used
- `touchscreen required="false"` → TV-only or phone+TV
- `BILLING` permission → Google Play subscriptions
- `RECORD_AUDIO` → Voice search on TV
- `INSTALL_PACKAGES` → In-app APK updater
- `FOREGROUND_SERVICE` + `WAKE_LOCK` → Background playback
- `largeHeap` → Heavy image loading expected
- `allowBackup` → true = cloud backup, false = local-only
- Multiple WebView auth activities → OAuth-driven integrations (RD/AD/Trakt)