# APK Competitor Analysis Methodology

Used in session 2026-05-20 to reverse-engineer three streaming apps (Cinema HD v3.0.6, Debrid Stream v3.2.3, Flix Vision v3.6.2) and extract implementable patterns.

## Tooling

```bash
# Install jadx (one-time)
curl -sL "https://github.com/skylot/jadx/releases/download/v1.5.1/jadx-1.5.1.zip" -o jadx.zip
unzip jadx.zip -d jadx-1.5.1

# Decompile APK
/tmp/jadx-1.5.1/bin/jadx --show-bad-code -d output-dir input.apk

# Quick AndroidManifest check without full decompile
unzip -p input.apk AndroidManifest.xml | strings | grep -E "version|package=|activity"
```

## 19-Point Audit Framework

For each APK, answer these questions systematically:

1. **App startup flow** — What Activity launches first? What does Application.onCreate() do? Splash screen → main activity path.
2. **Onboarding flow** — Is auth required? Can you skip? What's the first-time experience?
3. **Login/account flow** — OAuth? WebView? API key entry? Google Sign-In? Where are tokens stored?
4. **Home screen structure** — Tabs? Rows? Hero carousel? What sections exist?
5. **Movie/show detail page** — Backdrop, synopsis, cast, seasons, source list, play button logic.
6. **Search/filter behavior** — Voice search? Onscreen keyboard? Filters? Trending/recommendation pills?
7. **Android TV / remote focus navigation** — Leanback library? Compose for TV? D-pad handling? Focus restoration?
8. **Player screen UX** — Which player engine (ExoPlayer v2/v3, Media3, custom)? Gestures? Subtitle rendering? Audio tracks?
9. **Loading, empty, and error states** — Per-row? Full-screen? Retry patterns?
10. **Settings page structure** — What sections? What's configurable?
11. **Profile/account page structure** — Multi-user? Kids mode? Avatar selection? PIN protection?
12. **Provider/addon/resolver architecture** — Hardcoded scrapers? Server-driven config? Plugin system? How does content get resolved?
13. **Network layer patterns** — OkHttp? Volley? Retrofit? How many clients? Rate limiting? Sanitization?
14. **Caching/offline strategy** — Image cache (Picasso/Glide/Coil)? HTTP cache? DB cache? TTL?
15. **Database/local storage usage** — Room? SQLite? SharedPreferences? What's persisted?
16. **Diagnostics/logging/debug patterns** — Crashlytics? Custom logging? Stats overlay?
17. **Security practices and risks** — Token storage? HTTPS? Obfuscation? Cleartext? Backup policy?
18. **Performance/responsiveness patterns** — Hardware acceleration? Buffer tuning? Device detection?
19. **UI/UX polish ideas** — Animations? Screen savers? Countdown timers? Smart subtitle positioning?

## Pattern Extraction

After answering all 19, synthesize across apps:

1. **What's the SAME?** — Debrid OAuth flow, player engine choice, content metadata fields, settings structure. These are industry standards dictated by the APIs/services.
2. **What's DIFFERENT?** — How they source content (scraping vs addons vs server config). This is the competitive differentiator.
3. **What's BETTER?** — Flix Vision's countdown card beats Debrid Stream's basic overlay. Flix Vision's remote config beats Cinema HD's hardcoded scrapers.
4. **What's FREE TO IMPLEMENT?** — Anything dictated by public API specs (debrid OAuth, OpenSubtitles REST API, TMDB, Trakt). Architecture patterns (MVVM + StateFlow, sheet overlays, countdown timers). Standard library configs (cache sizes, buffer durations).
5. **What's OFF-LIMITS?** — Their specific source code files, SVG/PNG assets, API keys, Firebase project configs, server URLs, copyrighted UI designs.

## Deliverables Template

Always produce these 6 documents when doing APK analysis:

| # | Document | Purpose |
|---|----------|---------|
| 1 | APK_REFERENCE_AUDIT.md | Raw data — version, tech stack, manifest, architecture, storage, monetization |
| 2 | IMPLEMENTATION_IDEAS_FOR_OUR_APP.md | What we SHOULD build — patterns to adopt, prioritized feature list |
| 3 | DO_NOT_COPY_OR_USE.md | Legal firewall — what's their IP, anti-patterns, leaked API keys |
| 4 | UI_UX_PATTERN_NOTES.md | Screen layouts, navigation patterns, TV focus, color/font choices |
| 5 | PLAYER_AND_PLAYBACK_PATTERN_NOTES.md | Player engine, controls, gestures, subtitles, auto-play, resume |
| 6 | SETTINGS_PROFILE_ADDON_PAGE_RECOMMENDATIONS.md | Full settings trees, profile systems, addon management, cloud browsing |

## Key Finding: Three Content-Sourcing Architectures

After analyzing 3 apps, we identified three distinct approaches:

| App | Architecture | Pro | Con |
|-----|-------------|-----|-----|
| Cinema HD | 140+ hardcoded HTML scrapers (Jsoup) | Maximum coverage | Unmaintainable, breaks constantly |
| Debrid Stream | Stremio addon protocol (community-powered APIs) | No scraping maintenance, legally cleaner | Depends on addon availability |
| Flix Vision | **Server-driven JSON config + 11 extractors** | Remote-controllable, lean client | Requires backend server |

For NexStream: keep the Stremio addon protocol as primary, add remote config for feature toggles and provider overrides (Flix Vision pattern).

## MediaFire APK Download Pattern

When downloading APKs from MediaFire, the direct link is in the HTML page:
```bash
# First download fetches the HTML page
curl -sL "[mediafire-url]" -o page.html
# Extract the actual download URL
grep -o 'https://download[^"]*' page.html | head -1
# Then download the real APK
curl -sL "[extracted-url]" -o real.apk
```