Potentially Intent Spoofing

Description

The application is vulnerable to intent spoofing which could result in the access and exploitation of unauthorized components.

Recommendation

It is recommended to apply proper input validation and parameter filtering on intent action.

References
Technical details
[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/FirebaseInstanceId;', '<init>', '(Lcom/google/firebase/FirebaseApp; Lcom/google/firebase/iid/zzj;)V'), ('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'zza', '(Landroid/content/Context; Lcom/google/firebase/iid/FirebaseInstanceId;)V'), ('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'zzem', '(Landroid/content/Context;)V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.FirebaseInstanceId.<init>():


    private FirebaseInstanceId(com.google.firebase.FirebaseApp p5, com.google.firebase.iid.zzj p6)
    {
        this.zznfk = p5;
        this.zznfl = p6;
        String v0_2 = this.zznfk.getOptions().getGcmSenderId();
        if (v0_2 == null) {
            v0_2 = this.zznfk.getOptions().getApplicationId();
            if (v0_2.startsWith("1:")) {
                String v0_3 = v0_2.split(":");
                if (v0_3.length >= 2) {
                    v0_2 = v0_3[1];
                    if (v0_2.isEmpty()) {
                        v0_2 = 0;
                    }
                } else {
                    v0_2 = 0;
                }
            }
        }
        this.zznfm = v0_2;
        if (this.zznfm != null) {
            com.google.firebase.iid.FirebaseInstanceIdService.zza(this.zznfk.getApplicationContext(), this);
            return;
        } else {
            throw new IllegalStateException("IID failing to initialize, FirebaseApp is missing project ID");
        }
    }

Method com.google.firebase.iid.FirebaseInstanceIdService.zza():


    static void zza(android.content.Context p2, com.google.firebase.iid.FirebaseInstanceId p3)
    {
        if (!com.google.firebase.iid.FirebaseInstanceIdService.zznfq) {
            String v0_4 = p3.zzcfx();
            if ((v0_4 == null) || ((v0_4.zzrg(com.google.firebase.iid.zzj.zzhtt)) || (com.google.firebase.iid.FirebaseInstanceId.zzcfz().zzcgc() != null))) {
                com.google.firebase.iid.FirebaseInstanceIdService.zzem(p2);
            }
        } else {
        }
        return;
    }

Method com.google.firebase.iid.FirebaseInstanceIdService.zzem():


    static void zzem(android.content.Context p3)
    {
        if (com.google.firebase.iid.zzl.zzdf(p3) != null) {
            try {
                if (!com.google.firebase.iid.FirebaseInstanceIdService.zznfq) {
                    com.google.firebase.iid.zzq.zzcge().zze(p3, com.google.firebase.iid.FirebaseInstanceIdService.zzhk(0));
                    com.google.firebase.iid.FirebaseInstanceIdService.zznfq = 1;
                }
            } catch (int v0_2) {
                throw v0_2;
            }
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/FirebaseInstanceId;', 'getInstance', '()Lcom/google/firebase/iid/FirebaseInstanceId;'), ('Lcom/google/firebase/iid/FirebaseInstanceId;', 'getInstance', '(Lcom/google/firebase/FirebaseApp;)Lcom/google/firebase/iid/FirebaseInstanceId;'), ('Lcom/google/firebase/iid/FirebaseInstanceId;', '<init>', '(Lcom/google/firebase/FirebaseApp; Lcom/google/firebase/iid/zzj;)V'), ('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'zza', '(Landroid/content/Context; Lcom/google/firebase/iid/FirebaseInstanceId;)V'), ('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'zzem', '(Landroid/content/Context;)V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.FirebaseInstanceId.getInstance():


    public static com.google.firebase.iid.FirebaseInstanceId getInstance()
    {
        return com.google.firebase.iid.FirebaseInstanceId.getInstance(com.google.firebase.FirebaseApp.getInstance());
    }

Method com.google.firebase.iid.FirebaseInstanceId.getInstance():


    public static declared_synchronized com.google.firebase.iid.FirebaseInstanceId getInstance(com.google.firebase.FirebaseApp p4)
    {
        try {
            com.google.firebase.iid.FirebaseInstanceId v0_6 = ((com.google.firebase.iid.FirebaseInstanceId) com.google.firebase.iid.FirebaseInstanceId.zzhtn.get(p4.getOptions().getApplicationId()));
        } catch (com.google.firebase.iid.FirebaseInstanceId v0_7) {
            throw v0_7;
        }
        if (v0_6 == null) {
            java.util.Map v2_1 = com.google.firebase.iid.zzj.zza(p4.getApplicationContext(), 0);
            if (com.google.firebase.iid.FirebaseInstanceId.zznfj == null) {
                com.google.firebase.iid.FirebaseInstanceId.zznfj = new com.google.firebase.iid.zzk(com.google.firebase.iid.zzj.zzcga());
            }
            v0_6 = new com.google.firebase.iid.FirebaseInstanceId(p4, v2_1);
            com.google.firebase.iid.FirebaseInstanceId.zzhtn.put(p4.getOptions().getApplicationId(), v0_6);
        }
        return v0_6;
    }

Method com.google.firebase.iid.FirebaseInstanceId.<init>():


    private FirebaseInstanceId(com.google.firebase.FirebaseApp p5, com.google.firebase.iid.zzj p6)
    {
        this.zznfk = p5;
        this.zznfl = p6;
        String v0_2 = this.zznfk.getOptions().getGcmSenderId();
        if (v0_2 == null) {
            v0_2 = this.zznfk.getOptions().getApplicationId();
            if (v0_2.startsWith("1:")) {
                String v0_3 = v0_2.split(":");
                if (v0_3.length >= 2) {
                    v0_2 = v0_3[1];
                    if (v0_2.isEmpty()) {
                        v0_2 = 0;
                    }
                } else {
                    v0_2 = 0;
                }
            }
        }
        this.zznfm = v0_2;
        if (this.zznfm != null) {
            com.google.firebase.iid.FirebaseInstanceIdService.zza(this.zznfk.getApplicationContext(), this);
            return;
        } else {
            throw new IllegalStateException("IID failing to initialize, FirebaseApp is missing project ID");
        }
    }

Method com.google.firebase.iid.FirebaseInstanceIdService.zza():


    static void zza(android.content.Context p2, com.google.firebase.iid.FirebaseInstanceId p3)
    {
        if (!com.google.firebase.iid.FirebaseInstanceIdService.zznfq) {
            String v0_4 = p3.zzcfx();
            if ((v0_4 == null) || ((v0_4.zzrg(com.google.firebase.iid.zzj.zzhtt)) || (com.google.firebase.iid.FirebaseInstanceId.zzcfz().zzcgc() != null))) {
                com.google.firebase.iid.FirebaseInstanceIdService.zzem(p2);
            }
        } else {
        }
        return;
    }

Method com.google.firebase.iid.FirebaseInstanceIdService.zzem():


    static void zzem(android.content.Context p3)
    {
        if (com.google.firebase.iid.zzl.zzdf(p3) != null) {
            try {
                if (!com.google.firebase.iid.FirebaseInstanceIdService.zznfq) {
                    com.google.firebase.iid.zzq.zzcge().zze(p3, com.google.firebase.iid.FirebaseInstanceIdService.zzhk(0));
                    com.google.firebase.iid.FirebaseInstanceIdService.zznfq = 1;
                }
            } catch (int v0_2) {
                throw v0_2;
            }
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/FirebaseInstanceId;', 'getInstance', '(Lcom/google/firebase/FirebaseApp;)Lcom/google/firebase/iid/FirebaseInstanceId;'), ('Lcom/google/firebase/iid/FirebaseInstanceId;', '<init>', '(Lcom/google/firebase/FirebaseApp; Lcom/google/firebase/iid/zzj;)V'), ('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'zza', '(Landroid/content/Context; Lcom/google/firebase/iid/FirebaseInstanceId;)V'), ('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'zzem', '(Landroid/content/Context;)V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.FirebaseInstanceId.getInstance():


    public static declared_synchronized com.google.firebase.iid.FirebaseInstanceId getInstance(com.google.firebase.FirebaseApp p4)
    {
        try {
            com.google.firebase.iid.FirebaseInstanceId v0_6 = ((com.google.firebase.iid.FirebaseInstanceId) com.google.firebase.iid.FirebaseInstanceId.zzhtn.get(p4.getOptions().getApplicationId()));
        } catch (com.google.firebase.iid.FirebaseInstanceId v0_7) {
            throw v0_7;
        }
        if (v0_6 == null) {
            java.util.Map v2_1 = com.google.firebase.iid.zzj.zza(p4.getApplicationContext(), 0);
            if (com.google.firebase.iid.FirebaseInstanceId.zznfj == null) {
                com.google.firebase.iid.FirebaseInstanceId.zznfj = new com.google.firebase.iid.zzk(com.google.firebase.iid.zzj.zzcga());
            }
            v0_6 = new com.google.firebase.iid.FirebaseInstanceId(p4, v2_1);
            com.google.firebase.iid.FirebaseInstanceId.zzhtn.put(p4.getOptions().getApplicationId(), v0_6);
        }
        return v0_6;
    }

Method com.google.firebase.iid.FirebaseInstanceId.<init>():


    private FirebaseInstanceId(com.google.firebase.FirebaseApp p5, com.google.firebase.iid.zzj p6)
    {
        this.zznfk = p5;
        this.zznfl = p6;
        String v0_2 = this.zznfk.getOptions().getGcmSenderId();
        if (v0_2 == null) {
            v0_2 = this.zznfk.getOptions().getApplicationId();
            if (v0_2.startsWith("1:")) {
                String v0_3 = v0_2.split(":");
                if (v0_3.length >= 2) {
                    v0_2 = v0_3[1];
                    if (v0_2.isEmpty()) {
                        v0_2 = 0;
                    }
                } else {
                    v0_2 = 0;
                }
            }
        }
        this.zznfm = v0_2;
        if (this.zznfm != null) {
            com.google.firebase.iid.FirebaseInstanceIdService.zza(this.zznfk.getApplicationContext(), this);
            return;
        } else {
            throw new IllegalStateException("IID failing to initialize, FirebaseApp is missing project ID");
        }
    }

Method com.google.firebase.iid.FirebaseInstanceIdService.zza():


    static void zza(android.content.Context p2, com.google.firebase.iid.FirebaseInstanceId p3)
    {
        if (!com.google.firebase.iid.FirebaseInstanceIdService.zznfq) {
            String v0_4 = p3.zzcfx();
            if ((v0_4 == null) || ((v0_4.zzrg(com.google.firebase.iid.zzj.zzhtt)) || (com.google.firebase.iid.FirebaseInstanceId.zzcfz().zzcgc() != null))) {
                com.google.firebase.iid.FirebaseInstanceIdService.zzem(p2);
            }
        } else {
        }
        return;
    }

Method com.google.firebase.iid.FirebaseInstanceIdService.zzem():


    static void zzem(android.content.Context p3)
    {
        if (com.google.firebase.iid.zzl.zzdf(p3) != null) {
            try {
                if (!com.google.firebase.iid.FirebaseInstanceIdService.zznfq) {
                    com.google.firebase.iid.zzq.zzcge().zze(p3, com.google.firebase.iid.FirebaseInstanceIdService.zzhk(0));
                    com.google.firebase.iid.FirebaseInstanceIdService.zznfq = 1;
                }
            } catch (int v0_2) {
                throw v0_2;
            }
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.example.invalidpackage' ==>>> Sink '['Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/FirebaseInstanceId;', 'deleteInstanceId', '()V'), ('Lcom/google/firebase/iid/zzj;', 'zza', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)V'), ('Lcom/google/firebase/iid/zzj;', 'zzb', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzd', '(Landroid/content/Context; Landroid/content/Intent;)V'), ('Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;')]]

Use of a string value com.google.example.invalidpackage to construct an Intent

Method com.google.firebase.iid.FirebaseInstanceId.deleteInstanceId():


    public void deleteInstanceId()
    {
        this.zznfl.zza("*", "*", 0);
        this.zznfl.zzasr();
        return;
    }

Method com.google.firebase.iid.zzj.zza():


    public final void zza(String p3, String p4, android.os.Bundle p5)
    {
        if (android.os.Looper.getMainLooper() != android.os.Looper.myLooper()) {
            com.google.firebase.iid.zzj.zznft.zzf(this.zzhtr, p3, p4);
            if (p5 == null) {
                p5 = new android.os.Bundle();
            }
            p5.putString("delete", "1");
            this.zzb(p3, p4, p5);
            return;
        } else {
            throw new java.io.IOException("MAIN_THREAD");
        }
    }

Method com.google.firebase.iid.zzj.zzb():


    public final String zzb(String p5, String p6, android.os.Bundle p7)
    {
        if (p6 != null) {
            p7.putString("scope", p6);
        }
        p7.putString("sender", p5);
        if (!"".equals(this.zzhtr)) {
            p5 = this.zzhtr;
        }
        p7.putString("subtype", p5);
        p7.putString("X-subtype", p5);
        String v1_1 = com.google.firebase.iid.zzj.zznfu.zza(p7, this.zzasq());
        if (v1_1 != null) {
            java.io.IOException v0_5 = v1_1.getStringExtra("registration_id");
            if (v0_5 == null) {
                v0_5 = v1_1.getStringExtra("unregistered");
            }
            if (v0_5 != null) {
                return v0_5;
            } else {
                java.io.IOException v0_9 = v1_1.getStringExtra("error");
                if (v0_9 == null) {
                    String v1_3 = String.valueOf(v1_1.getExtras());
                    android.util.Log.w("InstanceID/Rpc", new StringBuilder((String.valueOf(v1_3).length() + 29)).append("Unexpected response from GCM ").append(v1_3).toString(), new Throwable());
                    throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
                } else {
                    throw new java.io.IOException(v0_9);
                }
            }
        } else {
            throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
        }
    }

Method com.google.firebase.iid.zzl.zza():


    final android.content.Intent zza(android.os.Bundle p3, java.security.KeyPair p4)
    {
        int v0 = this.zzb(p3, p4);
        if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
            v0 = this.zzb(p3, p4);
            if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
                v0 = 0;
            }
        }
        return v0;
    }

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzd():


    public static declared_synchronized void zzd(android.content.Context p4, android.content.Intent p5)
    {
        try {
            if (com.google.firebase.iid.zzl.zzhrm == null) {
                String v0_5 = new android.content.Intent();
                v0_5.setPackage("com.google.example.invalidpackage");
                com.google.firebase.iid.zzl.zzhrm = android.app.PendingIntent.getBroadcast(p4, 0, v0_5, 0);
            }
        } catch (String v0_2) {
            throw v0_2;
        }
        p5.putExtra("app", com.google.firebase.iid.zzl.zzhrm);
        return;
    }

Method android.content.Intent.setPackage() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/FirebaseInstanceId;', 'deleteInstanceId', '()V'), ('Lcom/google/firebase/iid/zzj;', 'zza', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)V'), ('Lcom/google/firebase/iid/zzj;', 'zzb', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzast', '()V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.FirebaseInstanceId.deleteInstanceId():


    public void deleteInstanceId()
    {
        this.zznfl.zza("*", "*", 0);
        this.zznfl.zzasr();
        return;
    }

Method com.google.firebase.iid.zzj.zza():


    public final void zza(String p3, String p4, android.os.Bundle p5)
    {
        if (android.os.Looper.getMainLooper() != android.os.Looper.myLooper()) {
            com.google.firebase.iid.zzj.zznft.zzf(this.zzhtr, p3, p4);
            if (p5 == null) {
                p5 = new android.os.Bundle();
            }
            p5.putString("delete", "1");
            this.zzb(p3, p4, p5);
            return;
        } else {
            throw new java.io.IOException("MAIN_THREAD");
        }
    }

Method com.google.firebase.iid.zzj.zzb():


    public final String zzb(String p5, String p6, android.os.Bundle p7)
    {
        if (p6 != null) {
            p7.putString("scope", p6);
        }
        p7.putString("sender", p5);
        if (!"".equals(this.zzhtr)) {
            p5 = this.zzhtr;
        }
        p7.putString("subtype", p5);
        p7.putString("X-subtype", p5);
        String v1_1 = com.google.firebase.iid.zzj.zznfu.zza(p7, this.zzasq());
        if (v1_1 != null) {
            java.io.IOException v0_5 = v1_1.getStringExtra("registration_id");
            if (v0_5 == null) {
                v0_5 = v1_1.getStringExtra("unregistered");
            }
            if (v0_5 != null) {
                return v0_5;
            } else {
                java.io.IOException v0_9 = v1_1.getStringExtra("error");
                if (v0_9 == null) {
                    String v1_3 = String.valueOf(v1_1.getExtras());
                    android.util.Log.w("InstanceID/Rpc", new StringBuilder((String.valueOf(v1_3).length() + 29)).append("Unexpected response from GCM ").append(v1_3).toString(), new Throwable());
                    throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
                } else {
                    throw new java.io.IOException(v0_9);
                }
            }
        } else {
            throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
        }
    }

Method com.google.firebase.iid.zzl.zza():


    final android.content.Intent zza(android.os.Bundle p3, java.security.KeyPair p4)
    {
        int v0 = this.zzb(p3, p4);
        if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
            v0 = this.zzb(p3, p4);
            if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
                v0 = 0;
            }
        }
        return v0;
    }

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzast():


    private final void zzast()
    {
        if (this.zzhrq == null) {
            com.google.firebase.iid.zzl.zzdf(this.zzahz);
            this.zzhrq = new android.os.Messenger(new com.google.firebase.iid.zzm(this, android.os.Looper.getMainLooper()));
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.example.invalidpackage' ==>>> Sink '['Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/FirebaseInstanceId;', 'deleteToken', '(Ljava/lang/String; Ljava/lang/String;)V'), ('Lcom/google/firebase/iid/zzj;', 'zza', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)V'), ('Lcom/google/firebase/iid/zzj;', 'zzb', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzd', '(Landroid/content/Context; Landroid/content/Intent;)V'), ('Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;')]]

Use of a string value com.google.example.invalidpackage to construct an Intent

Method com.google.firebase.iid.FirebaseInstanceId.deleteToken():


    public void deleteToken(String p3, String p4)
    {
        android.os.Bundle v0_1 = new android.os.Bundle();
        this.zzac(v0_1);
        this.zznfl.zza(p3, p4, v0_1);
        return;
    }

Method com.google.firebase.iid.zzj.zza():


    public final void zza(String p3, String p4, android.os.Bundle p5)
    {
        if (android.os.Looper.getMainLooper() != android.os.Looper.myLooper()) {
            com.google.firebase.iid.zzj.zznft.zzf(this.zzhtr, p3, p4);
            if (p5 == null) {
                p5 = new android.os.Bundle();
            }
            p5.putString("delete", "1");
            this.zzb(p3, p4, p5);
            return;
        } else {
            throw new java.io.IOException("MAIN_THREAD");
        }
    }

Method com.google.firebase.iid.zzj.zzb():


    public final String zzb(String p5, String p6, android.os.Bundle p7)
    {
        if (p6 != null) {
            p7.putString("scope", p6);
        }
        p7.putString("sender", p5);
        if (!"".equals(this.zzhtr)) {
            p5 = this.zzhtr;
        }
        p7.putString("subtype", p5);
        p7.putString("X-subtype", p5);
        String v1_1 = com.google.firebase.iid.zzj.zznfu.zza(p7, this.zzasq());
        if (v1_1 != null) {
            java.io.IOException v0_5 = v1_1.getStringExtra("registration_id");
            if (v0_5 == null) {
                v0_5 = v1_1.getStringExtra("unregistered");
            }
            if (v0_5 != null) {
                return v0_5;
            } else {
                java.io.IOException v0_9 = v1_1.getStringExtra("error");
                if (v0_9 == null) {
                    String v1_3 = String.valueOf(v1_1.getExtras());
                    android.util.Log.w("InstanceID/Rpc", new StringBuilder((String.valueOf(v1_3).length() + 29)).append("Unexpected response from GCM ").append(v1_3).toString(), new Throwable());
                    throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
                } else {
                    throw new java.io.IOException(v0_9);
                }
            }
        } else {
            throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
        }
    }

Method com.google.firebase.iid.zzl.zza():


    final android.content.Intent zza(android.os.Bundle p3, java.security.KeyPair p4)
    {
        int v0 = this.zzb(p3, p4);
        if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
            v0 = this.zzb(p3, p4);
            if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
                v0 = 0;
            }
        }
        return v0;
    }

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzd():


    public static declared_synchronized void zzd(android.content.Context p4, android.content.Intent p5)
    {
        try {
            if (com.google.firebase.iid.zzl.zzhrm == null) {
                String v0_5 = new android.content.Intent();
                v0_5.setPackage("com.google.example.invalidpackage");
                com.google.firebase.iid.zzl.zzhrm = android.app.PendingIntent.getBroadcast(p4, 0, v0_5, 0);
            }
        } catch (String v0_2) {
            throw v0_2;
        }
        p5.putExtra("app", com.google.firebase.iid.zzl.zzhrm);
        return;
    }

Method android.content.Intent.setPackage() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/FirebaseInstanceId;', 'deleteToken', '(Ljava/lang/String; Ljava/lang/String;)V'), ('Lcom/google/firebase/iid/zzj;', 'zza', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)V'), ('Lcom/google/firebase/iid/zzj;', 'zzb', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzast', '()V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.FirebaseInstanceId.deleteToken():


    public void deleteToken(String p3, String p4)
    {
        android.os.Bundle v0_1 = new android.os.Bundle();
        this.zzac(v0_1);
        this.zznfl.zza(p3, p4, v0_1);
        return;
    }

Method com.google.firebase.iid.zzj.zza():


    public final void zza(String p3, String p4, android.os.Bundle p5)
    {
        if (android.os.Looper.getMainLooper() != android.os.Looper.myLooper()) {
            com.google.firebase.iid.zzj.zznft.zzf(this.zzhtr, p3, p4);
            if (p5 == null) {
                p5 = new android.os.Bundle();
            }
            p5.putString("delete", "1");
            this.zzb(p3, p4, p5);
            return;
        } else {
            throw new java.io.IOException("MAIN_THREAD");
        }
    }

Method com.google.firebase.iid.zzj.zzb():


    public final String zzb(String p5, String p6, android.os.Bundle p7)
    {
        if (p6 != null) {
            p7.putString("scope", p6);
        }
        p7.putString("sender", p5);
        if (!"".equals(this.zzhtr)) {
            p5 = this.zzhtr;
        }
        p7.putString("subtype", p5);
        p7.putString("X-subtype", p5);
        String v1_1 = com.google.firebase.iid.zzj.zznfu.zza(p7, this.zzasq());
        if (v1_1 != null) {
            java.io.IOException v0_5 = v1_1.getStringExtra("registration_id");
            if (v0_5 == null) {
                v0_5 = v1_1.getStringExtra("unregistered");
            }
            if (v0_5 != null) {
                return v0_5;
            } else {
                java.io.IOException v0_9 = v1_1.getStringExtra("error");
                if (v0_9 == null) {
                    String v1_3 = String.valueOf(v1_1.getExtras());
                    android.util.Log.w("InstanceID/Rpc", new StringBuilder((String.valueOf(v1_3).length() + 29)).append("Unexpected response from GCM ").append(v1_3).toString(), new Throwable());
                    throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
                } else {
                    throw new java.io.IOException(v0_9);
                }
            }
        } else {
            throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
        }
    }

Method com.google.firebase.iid.zzl.zza():


    final android.content.Intent zza(android.os.Bundle p3, java.security.KeyPair p4)
    {
        int v0 = this.zzb(p3, p4);
        if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
            v0 = this.zzb(p3, p4);
            if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
                v0 = 0;
            }
        }
        return v0;
    }

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzast():


    private final void zzast()
    {
        if (this.zzhrq == null) {
            com.google.firebase.iid.zzl.zzdf(this.zzahz);
            this.zzhrq = new android.os.Messenger(new com.google.firebase.iid.zzm(this, android.os.Looper.getMainLooper()));
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/FirebaseInstanceId;', 'getToken', '()Ljava/lang/String;'), ('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'zzem', '(Landroid/content/Context;)V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.FirebaseInstanceId.getToken():


    public String getToken()
    {
        int v0_0 = this.zzcfx();
        if ((v0_0 == 0) || (v0_0.zzrg(com.google.firebase.iid.zzj.zzhtt))) {
            com.google.firebase.iid.FirebaseInstanceIdService.zzem(this.zznfk.getApplicationContext());
        }
        int v0_1;
        if (v0_0 == 0) {
            v0_1 = 0;
        } else {
            v0_1 = v0_0.zzkoo;
        }
        return v0_1;
    }

Method com.google.firebase.iid.FirebaseInstanceIdService.zzem():


    static void zzem(android.content.Context p3)
    {
        if (com.google.firebase.iid.zzl.zzdf(p3) != null) {
            try {
                if (!com.google.firebase.iid.FirebaseInstanceIdService.zznfq) {
                    com.google.firebase.iid.zzq.zzcge().zze(p3, com.google.firebase.iid.FirebaseInstanceIdService.zzhk(0));
                    com.google.firebase.iid.FirebaseInstanceIdService.zznfq = 1;
                }
            } catch (int v0_2) {
                throw v0_2;
            }
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/FirebaseInstanceId;', 'getToken', '(Ljava/lang/String; Ljava/lang/String;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzj;', 'getToken', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzj;', 'zzb', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzast', '()V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.FirebaseInstanceId.getToken():


    public String getToken(String p3, String p4)
    {
        String v0_1 = new android.os.Bundle();
        this.zzac(v0_1);
        return this.zznfl.getToken(p3, p4, v0_1);
    }

Method com.google.firebase.iid.zzj.getToken():


    public final String getToken(String p7, String p8, android.os.Bundle p9)
    {
        if (android.os.Looper.getMainLooper() != android.os.Looper.myLooper()) {
            String v4;
            com.google.firebase.iid.zzr v0_1 = 1;
            if ((p9.getString("ttl") == null) && (!"jwt".equals(p9.getString("type")))) {
                String v1_3 = com.google.firebase.iid.zzj.zznft.zzo(this.zzhtr, p7, p8);
                if ((v1_3 == null) || (v1_3.zzrg(com.google.firebase.iid.zzj.zzhtt))) {
                    v4 = this.zzb(p7, p8, p9);
                    if ((v4 != null) && (v0_1 != null)) {
                        com.google.firebase.iid.zzj.zznft.zza(this.zzhtr, p7, p8, v4, com.google.firebase.iid.zzj.zzhtt);
                    }
                } else {
                    v4 = v1_3.zzkoo;
                }
            } else {
                v0_1 = 0;
            }
            return v4;
        } else {
            throw new java.io.IOException("MAIN_THREAD");
        }
    }

Method com.google.firebase.iid.zzj.zzb():


    public final String zzb(String p5, String p6, android.os.Bundle p7)
    {
        if (p6 != null) {
            p7.putString("scope", p6);
        }
        p7.putString("sender", p5);
        if (!"".equals(this.zzhtr)) {
            p5 = this.zzhtr;
        }
        p7.putString("subtype", p5);
        p7.putString("X-subtype", p5);
        String v1_1 = com.google.firebase.iid.zzj.zznfu.zza(p7, this.zzasq());
        if (v1_1 != null) {
            java.io.IOException v0_5 = v1_1.getStringExtra("registration_id");
            if (v0_5 == null) {
                v0_5 = v1_1.getStringExtra("unregistered");
            }
            if (v0_5 != null) {
                return v0_5;
            } else {
                java.io.IOException v0_9 = v1_1.getStringExtra("error");
                if (v0_9 == null) {
                    String v1_3 = String.valueOf(v1_1.getExtras());
                    android.util.Log.w("InstanceID/Rpc", new StringBuilder((String.valueOf(v1_3).length() + 29)).append("Unexpected response from GCM ").append(v1_3).toString(), new Throwable());
                    throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
                } else {
                    throw new java.io.IOException(v0_9);
                }
            }
        } else {
            throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
        }
    }

Method com.google.firebase.iid.zzl.zza():


    final android.content.Intent zza(android.os.Bundle p3, java.security.KeyPair p4)
    {
        int v0 = this.zzb(p3, p4);
        if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
            v0 = this.zzb(p3, p4);
            if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
                v0 = 0;
            }
        }
        return v0;
    }

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzast():


    private final void zzast()
    {
        if (this.zzhrq == null) {
            com.google.firebase.iid.zzl.zzdf(this.zzahz);
            this.zzhrq = new android.os.Messenger(new com.google.firebase.iid.zzm(this, android.os.Looper.getMainLooper()));
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.example.invalidpackage' ==>>> Sink '['Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/FirebaseInstanceId;', 'getToken', '(Ljava/lang/String; Ljava/lang/String;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzj;', 'getToken', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzj;', 'zzb', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzd', '(Landroid/content/Context; Landroid/content/Intent;)V'), ('Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;')]]

Use of a string value com.google.example.invalidpackage to construct an Intent

Method com.google.firebase.iid.FirebaseInstanceId.getToken():


    public String getToken(String p3, String p4)
    {
        String v0_1 = new android.os.Bundle();
        this.zzac(v0_1);
        return this.zznfl.getToken(p3, p4, v0_1);
    }

Method com.google.firebase.iid.zzj.getToken():


    public final String getToken(String p7, String p8, android.os.Bundle p9)
    {
        if (android.os.Looper.getMainLooper() != android.os.Looper.myLooper()) {
            String v4;
            com.google.firebase.iid.zzr v0_1 = 1;
            if ((p9.getString("ttl") == null) && (!"jwt".equals(p9.getString("type")))) {
                String v1_3 = com.google.firebase.iid.zzj.zznft.zzo(this.zzhtr, p7, p8);
                if ((v1_3 == null) || (v1_3.zzrg(com.google.firebase.iid.zzj.zzhtt))) {
                    v4 = this.zzb(p7, p8, p9);
                    if ((v4 != null) && (v0_1 != null)) {
                        com.google.firebase.iid.zzj.zznft.zza(this.zzhtr, p7, p8, v4, com.google.firebase.iid.zzj.zzhtt);
                    }
                } else {
                    v4 = v1_3.zzkoo;
                }
            } else {
                v0_1 = 0;
            }
            return v4;
        } else {
            throw new java.io.IOException("MAIN_THREAD");
        }
    }

Method com.google.firebase.iid.zzj.zzb():


    public final String zzb(String p5, String p6, android.os.Bundle p7)
    {
        if (p6 != null) {
            p7.putString("scope", p6);
        }
        p7.putString("sender", p5);
        if (!"".equals(this.zzhtr)) {
            p5 = this.zzhtr;
        }
        p7.putString("subtype", p5);
        p7.putString("X-subtype", p5);
        String v1_1 = com.google.firebase.iid.zzj.zznfu.zza(p7, this.zzasq());
        if (v1_1 != null) {
            java.io.IOException v0_5 = v1_1.getStringExtra("registration_id");
            if (v0_5 == null) {
                v0_5 = v1_1.getStringExtra("unregistered");
            }
            if (v0_5 != null) {
                return v0_5;
            } else {
                java.io.IOException v0_9 = v1_1.getStringExtra("error");
                if (v0_9 == null) {
                    String v1_3 = String.valueOf(v1_1.getExtras());
                    android.util.Log.w("InstanceID/Rpc", new StringBuilder((String.valueOf(v1_3).length() + 29)).append("Unexpected response from GCM ").append(v1_3).toString(), new Throwable());
                    throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
                } else {
                    throw new java.io.IOException(v0_9);
                }
            }
        } else {
            throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
        }
    }

Method com.google.firebase.iid.zzl.zza():


    final android.content.Intent zza(android.os.Bundle p3, java.security.KeyPair p4)
    {
        int v0 = this.zzb(p3, p4);
        if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
            v0 = this.zzb(p3, p4);
            if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
                v0 = 0;
            }
        }
        return v0;
    }

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzd():


    public static declared_synchronized void zzd(android.content.Context p4, android.content.Intent p5)
    {
        try {
            if (com.google.firebase.iid.zzl.zzhrm == null) {
                String v0_5 = new android.content.Intent();
                v0_5.setPackage("com.google.example.invalidpackage");
                com.google.firebase.iid.zzl.zzhrm = android.app.PendingIntent.getBroadcast(p4, 0, v0_5, 0);
            }
        } catch (String v0_2) {
            throw v0_2;
        }
        p5.putExtra("app", com.google.firebase.iid.zzl.zzhrm);
        return;
    }

Method android.content.Intent.setPackage() not found.

[TAINT] String 'com.google.example.invalidpackage' ==>>> Sink '['Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/FirebaseInstanceId;', 'zzcfy', '()Ljava/lang/String;'), ('Lcom/google/firebase/iid/FirebaseInstanceId;', 'getToken', '(Ljava/lang/String; Ljava/lang/String;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzj;', 'getToken', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzj;', 'zzb', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzd', '(Landroid/content/Context; Landroid/content/Intent;)V'), ('Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;')]]

Use of a string value com.google.example.invalidpackage to construct an Intent

Method com.google.firebase.iid.FirebaseInstanceId.zzcfy():


    final String zzcfy()
    {
        return this.getToken(this.zznfm, "*");
    }

Method com.google.firebase.iid.FirebaseInstanceId.getToken():


    public String getToken(String p3, String p4)
    {
        String v0_1 = new android.os.Bundle();
        this.zzac(v0_1);
        return this.zznfl.getToken(p3, p4, v0_1);
    }

Method com.google.firebase.iid.zzj.getToken():


    public final String getToken(String p7, String p8, android.os.Bundle p9)
    {
        if (android.os.Looper.getMainLooper() != android.os.Looper.myLooper()) {
            String v4;
            com.google.firebase.iid.zzr v0_1 = 1;
            if ((p9.getString("ttl") == null) && (!"jwt".equals(p9.getString("type")))) {
                String v1_3 = com.google.firebase.iid.zzj.zznft.zzo(this.zzhtr, p7, p8);
                if ((v1_3 == null) || (v1_3.zzrg(com.google.firebase.iid.zzj.zzhtt))) {
                    v4 = this.zzb(p7, p8, p9);
                    if ((v4 != null) && (v0_1 != null)) {
                        com.google.firebase.iid.zzj.zznft.zza(this.zzhtr, p7, p8, v4, com.google.firebase.iid.zzj.zzhtt);
                    }
                } else {
                    v4 = v1_3.zzkoo;
                }
            } else {
                v0_1 = 0;
            }
            return v4;
        } else {
            throw new java.io.IOException("MAIN_THREAD");
        }
    }

Method com.google.firebase.iid.zzj.zzb():


    public final String zzb(String p5, String p6, android.os.Bundle p7)
    {
        if (p6 != null) {
            p7.putString("scope", p6);
        }
        p7.putString("sender", p5);
        if (!"".equals(this.zzhtr)) {
            p5 = this.zzhtr;
        }
        p7.putString("subtype", p5);
        p7.putString("X-subtype", p5);
        String v1_1 = com.google.firebase.iid.zzj.zznfu.zza(p7, this.zzasq());
        if (v1_1 != null) {
            java.io.IOException v0_5 = v1_1.getStringExtra("registration_id");
            if (v0_5 == null) {
                v0_5 = v1_1.getStringExtra("unregistered");
            }
            if (v0_5 != null) {
                return v0_5;
            } else {
                java.io.IOException v0_9 = v1_1.getStringExtra("error");
                if (v0_9 == null) {
                    String v1_3 = String.valueOf(v1_1.getExtras());
                    android.util.Log.w("InstanceID/Rpc", new StringBuilder((String.valueOf(v1_3).length() + 29)).append("Unexpected response from GCM ").append(v1_3).toString(), new Throwable());
                    throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
                } else {
                    throw new java.io.IOException(v0_9);
                }
            }
        } else {
            throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
        }
    }

Method com.google.firebase.iid.zzl.zza():


    final android.content.Intent zza(android.os.Bundle p3, java.security.KeyPair p4)
    {
        int v0 = this.zzb(p3, p4);
        if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
            v0 = this.zzb(p3, p4);
            if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
                v0 = 0;
            }
        }
        return v0;
    }

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzd():


    public static declared_synchronized void zzd(android.content.Context p4, android.content.Intent p5)
    {
        try {
            if (com.google.firebase.iid.zzl.zzhrm == null) {
                String v0_5 = new android.content.Intent();
                v0_5.setPackage("com.google.example.invalidpackage");
                com.google.firebase.iid.zzl.zzhrm = android.app.PendingIntent.getBroadcast(p4, 0, v0_5, 0);
            }
        } catch (String v0_2) {
            throw v0_2;
        }
        p5.putExtra("app", com.google.firebase.iid.zzl.zzhrm);
        return;
    }

Method android.content.Intent.setPackage() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/FirebaseInstanceId;', 'zzcfy', '()Ljava/lang/String;'), ('Lcom/google/firebase/iid/FirebaseInstanceId;', 'getToken', '(Ljava/lang/String; Ljava/lang/String;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzj;', 'getToken', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzj;', 'zzb', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzast', '()V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.FirebaseInstanceId.zzcfy():


    final String zzcfy()
    {
        return this.getToken(this.zznfm, "*");
    }

Method com.google.firebase.iid.FirebaseInstanceId.getToken():


    public String getToken(String p3, String p4)
    {
        String v0_1 = new android.os.Bundle();
        this.zzac(v0_1);
        return this.zznfl.getToken(p3, p4, v0_1);
    }

Method com.google.firebase.iid.zzj.getToken():


    public final String getToken(String p7, String p8, android.os.Bundle p9)
    {
        if (android.os.Looper.getMainLooper() != android.os.Looper.myLooper()) {
            String v4;
            com.google.firebase.iid.zzr v0_1 = 1;
            if ((p9.getString("ttl") == null) && (!"jwt".equals(p9.getString("type")))) {
                String v1_3 = com.google.firebase.iid.zzj.zznft.zzo(this.zzhtr, p7, p8);
                if ((v1_3 == null) || (v1_3.zzrg(com.google.firebase.iid.zzj.zzhtt))) {
                    v4 = this.zzb(p7, p8, p9);
                    if ((v4 != null) && (v0_1 != null)) {
                        com.google.firebase.iid.zzj.zznft.zza(this.zzhtr, p7, p8, v4, com.google.firebase.iid.zzj.zzhtt);
                    }
                } else {
                    v4 = v1_3.zzkoo;
                }
            } else {
                v0_1 = 0;
            }
            return v4;
        } else {
            throw new java.io.IOException("MAIN_THREAD");
        }
    }

Method com.google.firebase.iid.zzj.zzb():


    public final String zzb(String p5, String p6, android.os.Bundle p7)
    {
        if (p6 != null) {
            p7.putString("scope", p6);
        }
        p7.putString("sender", p5);
        if (!"".equals(this.zzhtr)) {
            p5 = this.zzhtr;
        }
        p7.putString("subtype", p5);
        p7.putString("X-subtype", p5);
        String v1_1 = com.google.firebase.iid.zzj.zznfu.zza(p7, this.zzasq());
        if (v1_1 != null) {
            java.io.IOException v0_5 = v1_1.getStringExtra("registration_id");
            if (v0_5 == null) {
                v0_5 = v1_1.getStringExtra("unregistered");
            }
            if (v0_5 != null) {
                return v0_5;
            } else {
                java.io.IOException v0_9 = v1_1.getStringExtra("error");
                if (v0_9 == null) {
                    String v1_3 = String.valueOf(v1_1.getExtras());
                    android.util.Log.w("InstanceID/Rpc", new StringBuilder((String.valueOf(v1_3).length() + 29)).append("Unexpected response from GCM ").append(v1_3).toString(), new Throwable());
                    throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
                } else {
                    throw new java.io.IOException(v0_9);
                }
            }
        } else {
            throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
        }
    }

Method com.google.firebase.iid.zzl.zza():


    final android.content.Intent zza(android.os.Bundle p3, java.security.KeyPair p4)
    {
        int v0 = this.zzb(p3, p4);
        if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
            v0 = this.zzb(p3, p4);
            if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
                v0 = 0;
            }
        }
        return v0;
    }

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzast():


    private final void zzast()
    {
        if (this.zzhrq == null) {
            com.google.firebase.iid.zzl.zzdf(this.zzahz);
            this.zzhrq = new android.os.Messenger(new com.google.firebase.iid.zzm(this, android.os.Looper.getMainLooper()));
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/FirebaseInstanceId;', 'zzqw', '(Ljava/lang/String;)V'), ('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'zzem', '(Landroid/content/Context;)V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.FirebaseInstanceId.zzqw():


    public final void zzqw(String p2)
    {
        com.google.firebase.iid.FirebaseInstanceId.zznfj.zzqw(p2);
        com.google.firebase.iid.FirebaseInstanceIdService.zzem(this.zznfk.getApplicationContext());
        return;
    }

Method com.google.firebase.iid.FirebaseInstanceIdService.zzem():


    static void zzem(android.content.Context p3)
    {
        if (com.google.firebase.iid.zzl.zzdf(p3) != null) {
            try {
                if (!com.google.firebase.iid.FirebaseInstanceIdService.zznfq) {
                    com.google.firebase.iid.zzq.zzcge().zze(p3, com.google.firebase.iid.FirebaseInstanceIdService.zzhk(0));
                    com.google.firebase.iid.FirebaseInstanceIdService.zznfq = 1;
                }
            } catch (int v0_2) {
                throw v0_2;
            }
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.example.invalidpackage' ==>>> Sink '['Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/FirebaseInstanceId;', 'zzqx', '(Ljava/lang/String;)V'), ('Lcom/google/firebase/iid/zzj;', 'zzb', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzd', '(Landroid/content/Context; Landroid/content/Intent;)V'), ('Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;')]]

Use of a string value com.google.example.invalidpackage to construct an Intent

Method com.google.firebase.iid.FirebaseInstanceId.zzqx():


    final void zzqx(String p7)
    {
        String v1_0 = this.zzcfx();
        if ((v1_0 != null) && (!v1_0.zzrg(com.google.firebase.iid.zzj.zzhtt))) {
            String v0_3;
            android.os.Bundle v2_1 = new android.os.Bundle();
            int v4_0 = String.valueOf("/topics/");
            String v0_1 = String.valueOf(p7);
            if (v0_1.length() == 0) {
                v0_3 = new String(v4_0);
            } else {
                v0_3 = v4_0.concat(v0_1);
            }
            String v0_8;
            v2_1.putString("gcm.topic", v0_3);
            String v1_1 = v1_0.zzkoo;
            com.google.firebase.iid.zzj v3_0 = String.valueOf("/topics/");
            String v0_5 = String.valueOf(p7);
            if (v0_5.length() == 0) {
                v0_8 = new String(v3_0);
            } else {
                v0_8 = v3_0.concat(v0_5);
            }
            this.zzac(v2_1);
            this.zznfl.zzb(v1_1, v0_8, v2_1);
            return;
        } else {
            throw new java.io.IOException("token not available");
        }
    }

Method com.google.firebase.iid.zzj.zzb():


    public final String zzb(String p5, String p6, android.os.Bundle p7)
    {
        if (p6 != null) {
            p7.putString("scope", p6);
        }
        p7.putString("sender", p5);
        if (!"".equals(this.zzhtr)) {
            p5 = this.zzhtr;
        }
        p7.putString("subtype", p5);
        p7.putString("X-subtype", p5);
        String v1_1 = com.google.firebase.iid.zzj.zznfu.zza(p7, this.zzasq());
        if (v1_1 != null) {
            java.io.IOException v0_5 = v1_1.getStringExtra("registration_id");
            if (v0_5 == null) {
                v0_5 = v1_1.getStringExtra("unregistered");
            }
            if (v0_5 != null) {
                return v0_5;
            } else {
                java.io.IOException v0_9 = v1_1.getStringExtra("error");
                if (v0_9 == null) {
                    String v1_3 = String.valueOf(v1_1.getExtras());
                    android.util.Log.w("InstanceID/Rpc", new StringBuilder((String.valueOf(v1_3).length() + 29)).append("Unexpected response from GCM ").append(v1_3).toString(), new Throwable());
                    throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
                } else {
                    throw new java.io.IOException(v0_9);
                }
            }
        } else {
            throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
        }
    }

Method com.google.firebase.iid.zzl.zza():


    final android.content.Intent zza(android.os.Bundle p3, java.security.KeyPair p4)
    {
        int v0 = this.zzb(p3, p4);
        if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
            v0 = this.zzb(p3, p4);
            if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
                v0 = 0;
            }
        }
        return v0;
    }

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzd():


    public static declared_synchronized void zzd(android.content.Context p4, android.content.Intent p5)
    {
        try {
            if (com.google.firebase.iid.zzl.zzhrm == null) {
                String v0_5 = new android.content.Intent();
                v0_5.setPackage("com.google.example.invalidpackage");
                com.google.firebase.iid.zzl.zzhrm = android.app.PendingIntent.getBroadcast(p4, 0, v0_5, 0);
            }
        } catch (String v0_2) {
            throw v0_2;
        }
        p5.putExtra("app", com.google.firebase.iid.zzl.zzhrm);
        return;
    }

Method android.content.Intent.setPackage() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/FirebaseInstanceId;', 'zzqx', '(Ljava/lang/String;)V'), ('Lcom/google/firebase/iid/zzj;', 'zzb', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzast', '()V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.FirebaseInstanceId.zzqx():


    final void zzqx(String p7)
    {
        String v1_0 = this.zzcfx();
        if ((v1_0 != null) && (!v1_0.zzrg(com.google.firebase.iid.zzj.zzhtt))) {
            String v0_3;
            android.os.Bundle v2_1 = new android.os.Bundle();
            int v4_0 = String.valueOf("/topics/");
            String v0_1 = String.valueOf(p7);
            if (v0_1.length() == 0) {
                v0_3 = new String(v4_0);
            } else {
                v0_3 = v4_0.concat(v0_1);
            }
            String v0_8;
            v2_1.putString("gcm.topic", v0_3);
            String v1_1 = v1_0.zzkoo;
            com.google.firebase.iid.zzj v3_0 = String.valueOf("/topics/");
            String v0_5 = String.valueOf(p7);
            if (v0_5.length() == 0) {
                v0_8 = new String(v3_0);
            } else {
                v0_8 = v3_0.concat(v0_5);
            }
            this.zzac(v2_1);
            this.zznfl.zzb(v1_1, v0_8, v2_1);
            return;
        } else {
            throw new java.io.IOException("token not available");
        }
    }

Method com.google.firebase.iid.zzj.zzb():


    public final String zzb(String p5, String p6, android.os.Bundle p7)
    {
        if (p6 != null) {
            p7.putString("scope", p6);
        }
        p7.putString("sender", p5);
        if (!"".equals(this.zzhtr)) {
            p5 = this.zzhtr;
        }
        p7.putString("subtype", p5);
        p7.putString("X-subtype", p5);
        String v1_1 = com.google.firebase.iid.zzj.zznfu.zza(p7, this.zzasq());
        if (v1_1 != null) {
            java.io.IOException v0_5 = v1_1.getStringExtra("registration_id");
            if (v0_5 == null) {
                v0_5 = v1_1.getStringExtra("unregistered");
            }
            if (v0_5 != null) {
                return v0_5;
            } else {
                java.io.IOException v0_9 = v1_1.getStringExtra("error");
                if (v0_9 == null) {
                    String v1_3 = String.valueOf(v1_1.getExtras());
                    android.util.Log.w("InstanceID/Rpc", new StringBuilder((String.valueOf(v1_3).length() + 29)).append("Unexpected response from GCM ").append(v1_3).toString(), new Throwable());
                    throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
                } else {
                    throw new java.io.IOException(v0_9);
                }
            }
        } else {
            throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
        }
    }

Method com.google.firebase.iid.zzl.zza():


    final android.content.Intent zza(android.os.Bundle p3, java.security.KeyPair p4)
    {
        int v0 = this.zzb(p3, p4);
        if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
            v0 = this.zzb(p3, p4);
            if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
                v0 = 0;
            }
        }
        return v0;
    }

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzast():


    private final void zzast()
    {
        if (this.zzhrq == null) {
            com.google.firebase.iid.zzl.zzdf(this.zzahz);
            this.zzhrq = new android.os.Messenger(new com.google.firebase.iid.zzm(this, android.os.Looper.getMainLooper()));
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/FirebaseInstanceId;', 'zzqy', '(Ljava/lang/String;)V'), ('Lcom/google/firebase/iid/zzj;', 'zza', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)V'), ('Lcom/google/firebase/iid/zzj;', 'zzb', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzast', '()V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.FirebaseInstanceId.zzqy():


    final void zzqy(String p7)
    {
        String v1_0 = this.zzcfx();
        if ((v1_0 != null) && (!v1_0.zzrg(com.google.firebase.iid.zzj.zzhtt))) {
            String v0_3;
            android.os.Bundle v2_1 = new android.os.Bundle();
            String v4_0 = String.valueOf("/topics/");
            String v0_1 = String.valueOf(p7);
            if (v0_1.length() == 0) {
                v0_3 = new String(v4_0);
            } else {
                v0_3 = v4_0.concat(v0_1);
            }
            String v0_8;
            v2_1.putString("gcm.topic", v0_3);
            com.google.firebase.iid.zzj v3_0 = this.zznfl;
            String v1_1 = v1_0.zzkoo;
            String v4_1 = String.valueOf("/topics/");
            String v0_5 = String.valueOf(p7);
            if (v0_5.length() == 0) {
                v0_8 = new String(v4_1);
            } else {
                v0_8 = v4_1.concat(v0_5);
            }
            v3_0.zza(v1_1, v0_8, v2_1);
            return;
        } else {
            throw new java.io.IOException("token not available");
        }
    }

Method com.google.firebase.iid.zzj.zza():


    public final void zza(String p3, String p4, android.os.Bundle p5)
    {
        if (android.os.Looper.getMainLooper() != android.os.Looper.myLooper()) {
            com.google.firebase.iid.zzj.zznft.zzf(this.zzhtr, p3, p4);
            if (p5 == null) {
                p5 = new android.os.Bundle();
            }
            p5.putString("delete", "1");
            this.zzb(p3, p4, p5);
            return;
        } else {
            throw new java.io.IOException("MAIN_THREAD");
        }
    }

Method com.google.firebase.iid.zzj.zzb():


    public final String zzb(String p5, String p6, android.os.Bundle p7)
    {
        if (p6 != null) {
            p7.putString("scope", p6);
        }
        p7.putString("sender", p5);
        if (!"".equals(this.zzhtr)) {
            p5 = this.zzhtr;
        }
        p7.putString("subtype", p5);
        p7.putString("X-subtype", p5);
        String v1_1 = com.google.firebase.iid.zzj.zznfu.zza(p7, this.zzasq());
        if (v1_1 != null) {
            java.io.IOException v0_5 = v1_1.getStringExtra("registration_id");
            if (v0_5 == null) {
                v0_5 = v1_1.getStringExtra("unregistered");
            }
            if (v0_5 != null) {
                return v0_5;
            } else {
                java.io.IOException v0_9 = v1_1.getStringExtra("error");
                if (v0_9 == null) {
                    String v1_3 = String.valueOf(v1_1.getExtras());
                    android.util.Log.w("InstanceID/Rpc", new StringBuilder((String.valueOf(v1_3).length() + 29)).append("Unexpected response from GCM ").append(v1_3).toString(), new Throwable());
                    throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
                } else {
                    throw new java.io.IOException(v0_9);
                }
            }
        } else {
            throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
        }
    }

Method com.google.firebase.iid.zzl.zza():


    final android.content.Intent zza(android.os.Bundle p3, java.security.KeyPair p4)
    {
        int v0 = this.zzb(p3, p4);
        if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
            v0 = this.zzb(p3, p4);
            if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
                v0 = 0;
            }
        }
        return v0;
    }

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzast():


    private final void zzast()
    {
        if (this.zzhrq == null) {
            com.google.firebase.iid.zzl.zzdf(this.zzahz);
            this.zzhrq = new android.os.Messenger(new com.google.firebase.iid.zzm(this, android.os.Looper.getMainLooper()));
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.example.invalidpackage' ==>>> Sink '['Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/FirebaseInstanceId;', 'zzqy', '(Ljava/lang/String;)V'), ('Lcom/google/firebase/iid/zzj;', 'zza', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)V'), ('Lcom/google/firebase/iid/zzj;', 'zzb', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzd', '(Landroid/content/Context; Landroid/content/Intent;)V'), ('Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;')]]

Use of a string value com.google.example.invalidpackage to construct an Intent

Method com.google.firebase.iid.FirebaseInstanceId.zzqy():


    final void zzqy(String p7)
    {
        String v1_0 = this.zzcfx();
        if ((v1_0 != null) && (!v1_0.zzrg(com.google.firebase.iid.zzj.zzhtt))) {
            String v0_3;
            android.os.Bundle v2_1 = new android.os.Bundle();
            String v4_0 = String.valueOf("/topics/");
            String v0_1 = String.valueOf(p7);
            if (v0_1.length() == 0) {
                v0_3 = new String(v4_0);
            } else {
                v0_3 = v4_0.concat(v0_1);
            }
            String v0_8;
            v2_1.putString("gcm.topic", v0_3);
            com.google.firebase.iid.zzj v3_0 = this.zznfl;
            String v1_1 = v1_0.zzkoo;
            String v4_1 = String.valueOf("/topics/");
            String v0_5 = String.valueOf(p7);
            if (v0_5.length() == 0) {
                v0_8 = new String(v4_1);
            } else {
                v0_8 = v4_1.concat(v0_5);
            }
            v3_0.zza(v1_1, v0_8, v2_1);
            return;
        } else {
            throw new java.io.IOException("token not available");
        }
    }

Method com.google.firebase.iid.zzj.zza():


    public final void zza(String p3, String p4, android.os.Bundle p5)
    {
        if (android.os.Looper.getMainLooper() != android.os.Looper.myLooper()) {
            com.google.firebase.iid.zzj.zznft.zzf(this.zzhtr, p3, p4);
            if (p5 == null) {
                p5 = new android.os.Bundle();
            }
            p5.putString("delete", "1");
            this.zzb(p3, p4, p5);
            return;
        } else {
            throw new java.io.IOException("MAIN_THREAD");
        }
    }

Method com.google.firebase.iid.zzj.zzb():


    public final String zzb(String p5, String p6, android.os.Bundle p7)
    {
        if (p6 != null) {
            p7.putString("scope", p6);
        }
        p7.putString("sender", p5);
        if (!"".equals(this.zzhtr)) {
            p5 = this.zzhtr;
        }
        p7.putString("subtype", p5);
        p7.putString("X-subtype", p5);
        String v1_1 = com.google.firebase.iid.zzj.zznfu.zza(p7, this.zzasq());
        if (v1_1 != null) {
            java.io.IOException v0_5 = v1_1.getStringExtra("registration_id");
            if (v0_5 == null) {
                v0_5 = v1_1.getStringExtra("unregistered");
            }
            if (v0_5 != null) {
                return v0_5;
            } else {
                java.io.IOException v0_9 = v1_1.getStringExtra("error");
                if (v0_9 == null) {
                    String v1_3 = String.valueOf(v1_1.getExtras());
                    android.util.Log.w("InstanceID/Rpc", new StringBuilder((String.valueOf(v1_3).length() + 29)).append("Unexpected response from GCM ").append(v1_3).toString(), new Throwable());
                    throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
                } else {
                    throw new java.io.IOException(v0_9);
                }
            }
        } else {
            throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
        }
    }

Method com.google.firebase.iid.zzl.zza():


    final android.content.Intent zza(android.os.Bundle p3, java.security.KeyPair p4)
    {
        int v0 = this.zzb(p3, p4);
        if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
            v0 = this.zzb(p3, p4);
            if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
                v0 = 0;
            }
        }
        return v0;
    }

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzd():


    public static declared_synchronized void zzd(android.content.Context p4, android.content.Intent p5)
    {
        try {
            if (com.google.firebase.iid.zzl.zzhrm == null) {
                String v0_5 = new android.content.Intent();
                v0_5.setPackage("com.google.example.invalidpackage");
                com.google.firebase.iid.zzl.zzhrm = android.app.PendingIntent.getBroadcast(p4, 0, v0_5, 0);
            }
        } catch (String v0_2) {
            throw v0_2;
        }
        p5.putExtra("app", com.google.firebase.iid.zzl.zzhrm);
        return;
    }

Method android.content.Intent.setPackage() not found.

[TAINT] String 'gcm.n.link' ==>>> Sink '['Landroid/content/Intent;', 'setData', '(Landroid/net/Uri;)Landroid/content/Intent;', '0', 'IPC_SINK']' [[('Lcom/google/firebase/messaging/zza;', 'zzt', '(Landroid/os/Bundle;)Landroid/app/PendingIntent;'), ('Landroid/content/Intent;', 'setData', '(Landroid/net/Uri;)Landroid/content/Intent;')]]

Use of a string value gcm.n.link to construct an Intent

Method com.google.firebase.messaging.zza.zzt():


    private final android.app.PendingIntent zzt(android.os.Bundle p5)
    {
        java.util.Set v1_4;
        java.util.Set v1_3 = com.google.firebase.messaging.zza.zze(p5, "gcm.n.click_action");
        if (android.text.TextUtils.isEmpty(v1_3)) {
            java.util.Set v1_8 = com.google.firebase.messaging.zza.zzae(p5);
            if (v1_8 == null) {
                android.app.PendingIntent v0_2 = this.mContext.getPackageManager().getLaunchIntentForPackage(this.mContext.getPackageName());
                if (v0_2 == null) {
                    android.util.Log.w("FirebaseMessaging", "No activity found to launch app");
                }
                v1_4 = v0_2;
            } else {
                android.app.PendingIntent v0_4 = new android.content.Intent("android.intent.action.VIEW");
                v0_4.setPackage(this.mContext.getPackageName());
                v0_4.setData(v1_8);
                v1_4 = v0_4;
            }
        } else {
            android.app.PendingIntent v0_6 = new android.content.Intent(v1_3);
            v0_6.setPackage(this.mContext.getPackageName());
            v0_6.setFlags(268435456);
            v1_4 = v0_6;
        }
        android.app.PendingIntent v0_14;
        if (v1_4 != null) {
            v1_4.addFlags(67108864);
            android.app.PendingIntent v0_10 = new android.os.Bundle(p5);
            com.google.firebase.messaging.FirebaseMessagingService.zzq(v0_10);
            v1_4.putExtras(v0_10);
            int v2_4 = v0_10.keySet().iterator();
            while (v2_4.hasNext()) {
                android.app.PendingIntent v0_16 = ((String) v2_4.next());
                if ((v0_16.startsWith("gcm.n.")) || (v0_16.startsWith("gcm.notification."))) {
                    v1_4.removeExtra(v0_16);
                }
            }
            v0_14 = android.app.PendingIntent.getActivity(this.mContext, this.zzngh.incrementAndGet(), v1_4, 1073741824);
        } else {
            v0_14 = 0;
        }
        return v0_14;
    }

Method android.content.Intent.setData() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'zza', '(Landroid/content/Context; Lcom/google/firebase/iid/FirebaseInstanceId;)V'), ('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'zzem', '(Landroid/content/Context;)V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.FirebaseInstanceIdService.zza():


    static void zza(android.content.Context p2, com.google.firebase.iid.FirebaseInstanceId p3)
    {
        if (!com.google.firebase.iid.FirebaseInstanceIdService.zznfq) {
            String v0_4 = p3.zzcfx();
            if ((v0_4 == null) || ((v0_4.zzrg(com.google.firebase.iid.zzj.zzhtt)) || (com.google.firebase.iid.FirebaseInstanceId.zzcfz().zzcgc() != null))) {
                com.google.firebase.iid.FirebaseInstanceIdService.zzem(p2);
            }
        } else {
        }
        return;
    }

Method com.google.firebase.iid.FirebaseInstanceIdService.zzem():


    static void zzem(android.content.Context p3)
    {
        if (com.google.firebase.iid.zzl.zzdf(p3) != null) {
            try {
                if (!com.google.firebase.iid.FirebaseInstanceIdService.zznfq) {
                    com.google.firebase.iid.zzq.zzcge().zze(p3, com.google.firebase.iid.FirebaseInstanceIdService.zzhk(0));
                    com.google.firebase.iid.FirebaseInstanceIdService.zznfq = 1;
                }
            } catch (int v0_2) {
                throw v0_2;
            }
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.example.invalidpackage' ==>>> Sink '['Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'zza', '(Landroid/content/Intent; Z Z)V'), ('Lcom/google/firebase/iid/FirebaseInstanceId;', 'zzcfy', '()Ljava/lang/String;'), ('Lcom/google/firebase/iid/FirebaseInstanceId;', 'getToken', '(Ljava/lang/String; Ljava/lang/String;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzj;', 'getToken', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzj;', 'zzb', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzd', '(Landroid/content/Context; Landroid/content/Intent;)V'), ('Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;')]]

Use of a string value com.google.example.invalidpackage to construct an Intent

Method com.google.firebase.iid.FirebaseInstanceIdService.zza():


    private final void zza(android.content.Intent p9, boolean p10, boolean p11)
    {
        com.google.firebase.iid.FirebaseInstanceIdService.zznfq = 0;
        if (com.google.firebase.iid.zzl.zzdf(this) != null) {
            String v0_0 = com.google.firebase.iid.FirebaseInstanceId.getInstance();
            String v3_0 = v0_0.zzcfx();
            if ((v3_0 != null) && (!v3_0.zzrg(com.google.firebase.iid.zzj.zzhtt))) {
                String v4_2 = com.google.firebase.iid.FirebaseInstanceId.zzcfz();
                String v3_1 = v4_2.zzcgc();
                while (v3_1 != null) {
                    String v0_5 = v3_1.split("!");
                    if (v0_5.length == 2) {
                        String v5_1 = v0_5[0];
                        String v6_1 = v0_5[1];
                        String v0_6 = -1;
                        try {
                            switch (v5_1.hashCode()) {
                                case 83:
                                    if (v5_1.equals("S")) {
                                        v0_6 = 0;
                                    } else {
                                        switch (v0_6) {
                                            case 0:
                                                com.google.firebase.iid.FirebaseInstanceId.getInstance().zzqx(v6_1);
                                                if (this.zznfr) {
                                                    android.util.Log.d("FirebaseInstanceId", "subscribe operation succeeded");
                                                }
                                            case 1:
                                                com.google.firebase.iid.FirebaseInstanceId.getInstance().zzqy(v6_1);
                                                if (this.zznfr) {
                                                    android.util.Log.d("FirebaseInstanceId", "unsubscribe operation succeeded");
                                                }
                                                break;
                                        }
                                    }
                                    break;
                                case 85:
                                    if (!v5_1.equals("U")) {
                                    } else {
                                        v0_6 = 1;
                                    }
                                    break;
                                default:
                            }
                        } catch (String v0_13) {
                        }
                        this.zza(p9, v0_13.getMessage());
                        return;
                    }
                    v4_2.zzra(v3_1);
                    v3_1 = v4_2.zzcgc();
                }
                android.util.Log.d("FirebaseInstanceId", "topic sync succeeded");
            } else {
                try {
                    String v1_2 = v0_0.zzcfy();
                } catch (String v0_22) {
                    this.zza(p9, v0_22.getMessage());
                } catch (String v0_21) {
                    android.util.Log.e("FirebaseInstanceId", "Unable to get master token", v0_21);
                }
                if (v1_2 == null) {
                    this.zza(p9, "returned token is null");
                } else {
                    if (this.zznfr) {
                        android.util.Log.d("FirebaseInstanceId", "get master token succeeded");
                    }
                    com.google.firebase.iid.FirebaseInstanceIdService.zza(this, v0_0);
                    if ((p11) || ((v3_0 == null) || ((v3_0 != null) && (!v1_2.equals(v3_0.zzkoo))))) {
                        this.onTokenRefresh();
                    }
                }
            }
        }
        return;
    }

Method com.google.firebase.iid.FirebaseInstanceId.zzcfy():


    final String zzcfy()
    {
        return this.getToken(this.zznfm, "*");
    }

Method com.google.firebase.iid.FirebaseInstanceId.getToken():


    public String getToken(String p3, String p4)
    {
        String v0_1 = new android.os.Bundle();
        this.zzac(v0_1);
        return this.zznfl.getToken(p3, p4, v0_1);
    }

Method com.google.firebase.iid.zzj.getToken():


    public final String getToken(String p7, String p8, android.os.Bundle p9)
    {
        if (android.os.Looper.getMainLooper() != android.os.Looper.myLooper()) {
            String v4;
            com.google.firebase.iid.zzr v0_1 = 1;
            if ((p9.getString("ttl") == null) && (!"jwt".equals(p9.getString("type")))) {
                String v1_3 = com.google.firebase.iid.zzj.zznft.zzo(this.zzhtr, p7, p8);
                if ((v1_3 == null) || (v1_3.zzrg(com.google.firebase.iid.zzj.zzhtt))) {
                    v4 = this.zzb(p7, p8, p9);
                    if ((v4 != null) && (v0_1 != null)) {
                        com.google.firebase.iid.zzj.zznft.zza(this.zzhtr, p7, p8, v4, com.google.firebase.iid.zzj.zzhtt);
                    }
                } else {
                    v4 = v1_3.zzkoo;
                }
            } else {
                v0_1 = 0;
            }
            return v4;
        } else {
            throw new java.io.IOException("MAIN_THREAD");
        }
    }

Method com.google.firebase.iid.zzj.zzb():


    public final String zzb(String p5, String p6, android.os.Bundle p7)
    {
        if (p6 != null) {
            p7.putString("scope", p6);
        }
        p7.putString("sender", p5);
        if (!"".equals(this.zzhtr)) {
            p5 = this.zzhtr;
        }
        p7.putString("subtype", p5);
        p7.putString("X-subtype", p5);
        String v1_1 = com.google.firebase.iid.zzj.zznfu.zza(p7, this.zzasq());
        if (v1_1 != null) {
            java.io.IOException v0_5 = v1_1.getStringExtra("registration_id");
            if (v0_5 == null) {
                v0_5 = v1_1.getStringExtra("unregistered");
            }
            if (v0_5 != null) {
                return v0_5;
            } else {
                java.io.IOException v0_9 = v1_1.getStringExtra("error");
                if (v0_9 == null) {
                    String v1_3 = String.valueOf(v1_1.getExtras());
                    android.util.Log.w("InstanceID/Rpc", new StringBuilder((String.valueOf(v1_3).length() + 29)).append("Unexpected response from GCM ").append(v1_3).toString(), new Throwable());
                    throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
                } else {
                    throw new java.io.IOException(v0_9);
                }
            }
        } else {
            throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
        }
    }

Method com.google.firebase.iid.zzl.zza():


    final android.content.Intent zza(android.os.Bundle p3, java.security.KeyPair p4)
    {
        int v0 = this.zzb(p3, p4);
        if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
            v0 = this.zzb(p3, p4);
            if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
                v0 = 0;
            }
        }
        return v0;
    }

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzd():


    public static declared_synchronized void zzd(android.content.Context p4, android.content.Intent p5)
    {
        try {
            if (com.google.firebase.iid.zzl.zzhrm == null) {
                String v0_5 = new android.content.Intent();
                v0_5.setPackage("com.google.example.invalidpackage");
                com.google.firebase.iid.zzl.zzhrm = android.app.PendingIntent.getBroadcast(p4, 0, v0_5, 0);
            }
        } catch (String v0_2) {
            throw v0_2;
        }
        p5.putExtra("app", com.google.firebase.iid.zzl.zzhrm);
        return;
    }

Method android.content.Intent.setPackage() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'zza', '(Landroid/content/Intent; Z Z)V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.FirebaseInstanceIdService.zza():


    private final void zza(android.content.Intent p9, boolean p10, boolean p11)
    {
        com.google.firebase.iid.FirebaseInstanceIdService.zznfq = 0;
        if (com.google.firebase.iid.zzl.zzdf(this) != null) {
            String v0_0 = com.google.firebase.iid.FirebaseInstanceId.getInstance();
            String v3_0 = v0_0.zzcfx();
            if ((v3_0 != null) && (!v3_0.zzrg(com.google.firebase.iid.zzj.zzhtt))) {
                String v4_2 = com.google.firebase.iid.FirebaseInstanceId.zzcfz();
                String v3_1 = v4_2.zzcgc();
                while (v3_1 != null) {
                    String v0_5 = v3_1.split("!");
                    if (v0_5.length == 2) {
                        String v5_1 = v0_5[0];
                        String v6_1 = v0_5[1];
                        String v0_6 = -1;
                        try {
                            switch (v5_1.hashCode()) {
                                case 83:
                                    if (v5_1.equals("S")) {
                                        v0_6 = 0;
                                    } else {
                                        switch (v0_6) {
                                            case 0:
                                                com.google.firebase.iid.FirebaseInstanceId.getInstance().zzqx(v6_1);
                                                if (this.zznfr) {
                                                    android.util.Log.d("FirebaseInstanceId", "subscribe operation succeeded");
                                                }
                                            case 1:
                                                com.google.firebase.iid.FirebaseInstanceId.getInstance().zzqy(v6_1);
                                                if (this.zznfr) {
                                                    android.util.Log.d("FirebaseInstanceId", "unsubscribe operation succeeded");
                                                }
                                                break;
                                        }
                                    }
                                    break;
                                case 85:
                                    if (!v5_1.equals("U")) {
                                    } else {
                                        v0_6 = 1;
                                    }
                                    break;
                                default:
                            }
                        } catch (String v0_13) {
                        }
                        this.zza(p9, v0_13.getMessage());
                        return;
                    }
                    v4_2.zzra(v3_1);
                    v3_1 = v4_2.zzcgc();
                }
                android.util.Log.d("FirebaseInstanceId", "topic sync succeeded");
            } else {
                try {
                    String v1_2 = v0_0.zzcfy();
                } catch (String v0_22) {
                    this.zza(p9, v0_22.getMessage());
                } catch (String v0_21) {
                    android.util.Log.e("FirebaseInstanceId", "Unable to get master token", v0_21);
                }
                if (v1_2 == null) {
                    this.zza(p9, "returned token is null");
                } else {
                    if (this.zznfr) {
                        android.util.Log.d("FirebaseInstanceId", "get master token succeeded");
                    }
                    com.google.firebase.iid.FirebaseInstanceIdService.zza(this, v0_0);
                    if ((p11) || ((v3_0 == null) || ((v3_0 != null) && (!v1_2.equals(v3_0.zzkoo))))) {
                        this.onTokenRefresh();
                    }
                }
            }
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'zzem', '(Landroid/content/Context;)V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.FirebaseInstanceIdService.zzem():


    static void zzem(android.content.Context p3)
    {
        if (com.google.firebase.iid.zzl.zzdf(p3) != null) {
            try {
                if (!com.google.firebase.iid.FirebaseInstanceIdService.zznfq) {
                    com.google.firebase.iid.zzq.zzcge().zze(p3, com.google.firebase.iid.FirebaseInstanceIdService.zzhk(0));
                    com.google.firebase.iid.FirebaseInstanceIdService.zznfq = 1;
                }
            } catch (int v0_2) {
                throw v0_2;
            }
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.example.invalidpackage' ==>>> Sink '['Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'handleIntent', '(Landroid/content/Intent;)V'), ('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'zza', '(Landroid/content/Intent; Z Z)V'), ('Lcom/google/firebase/iid/FirebaseInstanceId;', 'zzcfy', '()Ljava/lang/String;'), ('Lcom/google/firebase/iid/FirebaseInstanceId;', 'getToken', '(Ljava/lang/String; Ljava/lang/String;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzj;', 'getToken', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzj;', 'zzb', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzd', '(Landroid/content/Context; Landroid/content/Intent;)V'), ('Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;')]]

Use of a string value com.google.example.invalidpackage to construct an Intent

Method com.google.firebase.iid.FirebaseInstanceIdService.handleIntent():


    public void handleIntent(android.content.Intent p10)
    {
        String v0_11 = p10.getAction();
        if (v0_11 == null) {
            v0_11 = "";
        }
        String v0_8;
        switch (v0_11.hashCode()) {
            case -1737547627:
                if (!v0_11.equals("ACTION_TOKEN_REFRESH_RETRY")) {
                    v0_8 = -1;
                } else {
                    v0_8 = 0;
                }
                break;
            default:
        }
        switch (v0_8) {
            case 0:
                this.zza(p10, 0, 0);
                break;
            default:
                String v0_9 = com.google.firebase.iid.FirebaseInstanceIdService.zzp(p10);
                android.content.Intent v2_3 = this.zzqz(v0_9);
                String v3_3 = p10.getStringExtra("CMD");
                if (this.zznfr) {
                    String v5_1 = String.valueOf(p10.getExtras());
                    android.util.Log.d("FirebaseInstanceId", new StringBuilder((((String.valueOf(v0_9).length() + 18) + String.valueOf(v3_3).length()) + String.valueOf(v5_1).length())).append("Service command ").append(v0_9).append(" ").append(v3_3).append(" ").append(v5_1).toString());
                }
                if (p10.getStringExtra("unregistered") == null) {
                    if (!"gcm.googleapis.com/refresh".equals(p10.getStringExtra("from"))) {
                        if (!"RST".equals(v3_3)) {
                            if (!"RST_FULL".equals(v3_3)) {
                                if (!"SYNC".equals(v3_3)) {
                                    if (!"PING".equals(v3_3)) {
                                    } else {
                                        String v0_14 = p10.getExtras();
                                        String v1_5 = com.google.firebase.iid.zzl.zzdf(this);
                                        if (v1_5 != null) {
                                            android.content.Intent v2_0 = new android.content.Intent("com.google.android.gcm.intent.SEND");
                                            v2_0.setPackage(v1_5);
                                            v2_0.putExtras(v0_14);
                                            com.google.firebase.iid.zzl.zzd(this, v2_0);
                                            v2_0.putExtra("google.to", "google.com/iid");
                                            v2_0.putExtra("google.message_id", com.google.firebase.iid.zzl.zzasu());
                                            this.sendOrderedBroadcast(v2_0, "com.google.android.gtalkservice.permission.GTALK_SERVICE");
                                        } else {
                                            android.util.Log.w("FirebaseInstanceId", "Unable to respond to ping due to missing target package");
                                        }
                                    }
                                } else {
                                    com.google.firebase.iid.zzj.zzcga().zzhu(v0_9);
                                    this.zza(p10, 0, 1);
                                }
                            } else {
                                if (com.google.firebase.iid.zzj.zzcga().isEmpty()) {
                                } else {
                                    v2_3.zzasr();
                                    com.google.firebase.iid.zzj.zzcga().zzasv();
                                    this.zza(p10, 1, 1);
                                }
                            }
                        } else {
                            v2_3.zzasr();
                            this.zza(p10, 1, 1);
                        }
                    } else {
                        com.google.firebase.iid.zzj.zzcga().zzhu(v0_9);
                        this.zza(p10, 0, 1);
                    }
                } else {
                    String v1_4 = com.google.firebase.iid.zzj.zzcga();
                    if (v0_9 == null) {
                        v0_9 = "";
                    }
                    v1_4.zzhu(v0_9);
                    com.google.firebase.iid.zzj.zzcgb().zzi(p10);
                }
        }
        return;
    }

Method com.google.firebase.iid.FirebaseInstanceIdService.zza():


    private final void zza(android.content.Intent p9, boolean p10, boolean p11)
    {
        com.google.firebase.iid.FirebaseInstanceIdService.zznfq = 0;
        if (com.google.firebase.iid.zzl.zzdf(this) != null) {
            String v0_0 = com.google.firebase.iid.FirebaseInstanceId.getInstance();
            String v3_0 = v0_0.zzcfx();
            if ((v3_0 != null) && (!v3_0.zzrg(com.google.firebase.iid.zzj.zzhtt))) {
                String v4_2 = com.google.firebase.iid.FirebaseInstanceId.zzcfz();
                String v3_1 = v4_2.zzcgc();
                while (v3_1 != null) {
                    String v0_5 = v3_1.split("!");
                    if (v0_5.length == 2) {
                        String v5_1 = v0_5[0];
                        String v6_1 = v0_5[1];
                        String v0_6 = -1;
                        try {
                            switch (v5_1.hashCode()) {
                                case 83:
                                    if (v5_1.equals("S")) {
                                        v0_6 = 0;
                                    } else {
                                        switch (v0_6) {
                                            case 0:
                                                com.google.firebase.iid.FirebaseInstanceId.getInstance().zzqx(v6_1);
                                                if (this.zznfr) {
                                                    android.util.Log.d("FirebaseInstanceId", "subscribe operation succeeded");
                                                }
                                            case 1:
                                                com.google.firebase.iid.FirebaseInstanceId.getInstance().zzqy(v6_1);
                                                if (this.zznfr) {
                                                    android.util.Log.d("FirebaseInstanceId", "unsubscribe operation succeeded");
                                                }
                                                break;
                                        }
                                    }
                                    break;
                                case 85:
                                    if (!v5_1.equals("U")) {
                                    } else {
                                        v0_6 = 1;
                                    }
                                    break;
                                default:
                            }
                        } catch (String v0_13) {
                        }
                        this.zza(p9, v0_13.getMessage());
                        return;
                    }
                    v4_2.zzra(v3_1);
                    v3_1 = v4_2.zzcgc();
                }
                android.util.Log.d("FirebaseInstanceId", "topic sync succeeded");
            } else {
                try {
                    String v1_2 = v0_0.zzcfy();
                } catch (String v0_22) {
                    this.zza(p9, v0_22.getMessage());
                } catch (String v0_21) {
                    android.util.Log.e("FirebaseInstanceId", "Unable to get master token", v0_21);
                }
                if (v1_2 == null) {
                    this.zza(p9, "returned token is null");
                } else {
                    if (this.zznfr) {
                        android.util.Log.d("FirebaseInstanceId", "get master token succeeded");
                    }
                    com.google.firebase.iid.FirebaseInstanceIdService.zza(this, v0_0);
                    if ((p11) || ((v3_0 == null) || ((v3_0 != null) && (!v1_2.equals(v3_0.zzkoo))))) {
                        this.onTokenRefresh();
                    }
                }
            }
        }
        return;
    }

Method com.google.firebase.iid.FirebaseInstanceId.zzcfy():


    final String zzcfy()
    {
        return this.getToken(this.zznfm, "*");
    }

Method com.google.firebase.iid.FirebaseInstanceId.getToken():


    public String getToken(String p3, String p4)
    {
        String v0_1 = new android.os.Bundle();
        this.zzac(v0_1);
        return this.zznfl.getToken(p3, p4, v0_1);
    }

Method com.google.firebase.iid.zzj.getToken():


    public final String getToken(String p7, String p8, android.os.Bundle p9)
    {
        if (android.os.Looper.getMainLooper() != android.os.Looper.myLooper()) {
            String v4;
            com.google.firebase.iid.zzr v0_1 = 1;
            if ((p9.getString("ttl") == null) && (!"jwt".equals(p9.getString("type")))) {
                String v1_3 = com.google.firebase.iid.zzj.zznft.zzo(this.zzhtr, p7, p8);
                if ((v1_3 == null) || (v1_3.zzrg(com.google.firebase.iid.zzj.zzhtt))) {
                    v4 = this.zzb(p7, p8, p9);
                    if ((v4 != null) && (v0_1 != null)) {
                        com.google.firebase.iid.zzj.zznft.zza(this.zzhtr, p7, p8, v4, com.google.firebase.iid.zzj.zzhtt);
                    }
                } else {
                    v4 = v1_3.zzkoo;
                }
            } else {
                v0_1 = 0;
            }
            return v4;
        } else {
            throw new java.io.IOException("MAIN_THREAD");
        }
    }

Method com.google.firebase.iid.zzj.zzb():


    public final String zzb(String p5, String p6, android.os.Bundle p7)
    {
        if (p6 != null) {
            p7.putString("scope", p6);
        }
        p7.putString("sender", p5);
        if (!"".equals(this.zzhtr)) {
            p5 = this.zzhtr;
        }
        p7.putString("subtype", p5);
        p7.putString("X-subtype", p5);
        String v1_1 = com.google.firebase.iid.zzj.zznfu.zza(p7, this.zzasq());
        if (v1_1 != null) {
            java.io.IOException v0_5 = v1_1.getStringExtra("registration_id");
            if (v0_5 == null) {
                v0_5 = v1_1.getStringExtra("unregistered");
            }
            if (v0_5 != null) {
                return v0_5;
            } else {
                java.io.IOException v0_9 = v1_1.getStringExtra("error");
                if (v0_9 == null) {
                    String v1_3 = String.valueOf(v1_1.getExtras());
                    android.util.Log.w("InstanceID/Rpc", new StringBuilder((String.valueOf(v1_3).length() + 29)).append("Unexpected response from GCM ").append(v1_3).toString(), new Throwable());
                    throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
                } else {
                    throw new java.io.IOException(v0_9);
                }
            }
        } else {
            throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
        }
    }

Method com.google.firebase.iid.zzl.zza():


    final android.content.Intent zza(android.os.Bundle p3, java.security.KeyPair p4)
    {
        int v0 = this.zzb(p3, p4);
        if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
            v0 = this.zzb(p3, p4);
            if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
                v0 = 0;
            }
        }
        return v0;
    }

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzd():


    public static declared_synchronized void zzd(android.content.Context p4, android.content.Intent p5)
    {
        try {
            if (com.google.firebase.iid.zzl.zzhrm == null) {
                String v0_5 = new android.content.Intent();
                v0_5.setPackage("com.google.example.invalidpackage");
                com.google.firebase.iid.zzl.zzhrm = android.app.PendingIntent.getBroadcast(p4, 0, v0_5, 0);
            }
        } catch (String v0_2) {
            throw v0_2;
        }
        p5.putExtra("app", com.google.firebase.iid.zzl.zzhrm);
        return;
    }

Method android.content.Intent.setPackage() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'handleIntent', '(Landroid/content/Intent;)V'), ('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'zza', '(Landroid/content/Intent; Z Z)V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.FirebaseInstanceIdService.handleIntent():


    public void handleIntent(android.content.Intent p10)
    {
        String v0_11 = p10.getAction();
        if (v0_11 == null) {
            v0_11 = "";
        }
        String v0_8;
        switch (v0_11.hashCode()) {
            case -1737547627:
                if (!v0_11.equals("ACTION_TOKEN_REFRESH_RETRY")) {
                    v0_8 = -1;
                } else {
                    v0_8 = 0;
                }
                break;
            default:
        }
        switch (v0_8) {
            case 0:
                this.zza(p10, 0, 0);
                break;
            default:
                String v0_9 = com.google.firebase.iid.FirebaseInstanceIdService.zzp(p10);
                android.content.Intent v2_3 = this.zzqz(v0_9);
                String v3_3 = p10.getStringExtra("CMD");
                if (this.zznfr) {
                    String v5_1 = String.valueOf(p10.getExtras());
                    android.util.Log.d("FirebaseInstanceId", new StringBuilder((((String.valueOf(v0_9).length() + 18) + String.valueOf(v3_3).length()) + String.valueOf(v5_1).length())).append("Service command ").append(v0_9).append(" ").append(v3_3).append(" ").append(v5_1).toString());
                }
                if (p10.getStringExtra("unregistered") == null) {
                    if (!"gcm.googleapis.com/refresh".equals(p10.getStringExtra("from"))) {
                        if (!"RST".equals(v3_3)) {
                            if (!"RST_FULL".equals(v3_3)) {
                                if (!"SYNC".equals(v3_3)) {
                                    if (!"PING".equals(v3_3)) {
                                    } else {
                                        String v0_14 = p10.getExtras();
                                        String v1_5 = com.google.firebase.iid.zzl.zzdf(this);
                                        if (v1_5 != null) {
                                            android.content.Intent v2_0 = new android.content.Intent("com.google.android.gcm.intent.SEND");
                                            v2_0.setPackage(v1_5);
                                            v2_0.putExtras(v0_14);
                                            com.google.firebase.iid.zzl.zzd(this, v2_0);
                                            v2_0.putExtra("google.to", "google.com/iid");
                                            v2_0.putExtra("google.message_id", com.google.firebase.iid.zzl.zzasu());
                                            this.sendOrderedBroadcast(v2_0, "com.google.android.gtalkservice.permission.GTALK_SERVICE");
                                        } else {
                                            android.util.Log.w("FirebaseInstanceId", "Unable to respond to ping due to missing target package");
                                        }
                                    }
                                } else {
                                    com.google.firebase.iid.zzj.zzcga().zzhu(v0_9);
                                    this.zza(p10, 0, 1);
                                }
                            } else {
                                if (com.google.firebase.iid.zzj.zzcga().isEmpty()) {
                                } else {
                                    v2_3.zzasr();
                                    com.google.firebase.iid.zzj.zzcga().zzasv();
                                    this.zza(p10, 1, 1);
                                }
                            }
                        } else {
                            v2_3.zzasr();
                            this.zza(p10, 1, 1);
                        }
                    } else {
                        com.google.firebase.iid.zzj.zzcga().zzhu(v0_9);
                        this.zza(p10, 0, 1);
                    }
                } else {
                    String v1_4 = com.google.firebase.iid.zzj.zzcga();
                    if (v0_9 == null) {
                        v0_9 = "";
                    }
                    v1_4.zzhu(v0_9);
                    com.google.firebase.iid.zzj.zzcgb().zzi(p10);
                }
        }
        return;
    }

Method com.google.firebase.iid.FirebaseInstanceIdService.zza():


    private final void zza(android.content.Intent p9, boolean p10, boolean p11)
    {
        com.google.firebase.iid.FirebaseInstanceIdService.zznfq = 0;
        if (com.google.firebase.iid.zzl.zzdf(this) != null) {
            String v0_0 = com.google.firebase.iid.FirebaseInstanceId.getInstance();
            String v3_0 = v0_0.zzcfx();
            if ((v3_0 != null) && (!v3_0.zzrg(com.google.firebase.iid.zzj.zzhtt))) {
                String v4_2 = com.google.firebase.iid.FirebaseInstanceId.zzcfz();
                String v3_1 = v4_2.zzcgc();
                while (v3_1 != null) {
                    String v0_5 = v3_1.split("!");
                    if (v0_5.length == 2) {
                        String v5_1 = v0_5[0];
                        String v6_1 = v0_5[1];
                        String v0_6 = -1;
                        try {
                            switch (v5_1.hashCode()) {
                                case 83:
                                    if (v5_1.equals("S")) {
                                        v0_6 = 0;
                                    } else {
                                        switch (v0_6) {
                                            case 0:
                                                com.google.firebase.iid.FirebaseInstanceId.getInstance().zzqx(v6_1);
                                                if (this.zznfr) {
                                                    android.util.Log.d("FirebaseInstanceId", "subscribe operation succeeded");
                                                }
                                            case 1:
                                                com.google.firebase.iid.FirebaseInstanceId.getInstance().zzqy(v6_1);
                                                if (this.zznfr) {
                                                    android.util.Log.d("FirebaseInstanceId", "unsubscribe operation succeeded");
                                                }
                                                break;
                                        }
                                    }
                                    break;
                                case 85:
                                    if (!v5_1.equals("U")) {
                                    } else {
                                        v0_6 = 1;
                                    }
                                    break;
                                default:
                            }
                        } catch (String v0_13) {
                        }
                        this.zza(p9, v0_13.getMessage());
                        return;
                    }
                    v4_2.zzra(v3_1);
                    v3_1 = v4_2.zzcgc();
                }
                android.util.Log.d("FirebaseInstanceId", "topic sync succeeded");
            } else {
                try {
                    String v1_2 = v0_0.zzcfy();
                } catch (String v0_22) {
                    this.zza(p9, v0_22.getMessage());
                } catch (String v0_21) {
                    android.util.Log.e("FirebaseInstanceId", "Unable to get master token", v0_21);
                }
                if (v1_2 == null) {
                    this.zza(p9, "returned token is null");
                } else {
                    if (this.zznfr) {
                        android.util.Log.d("FirebaseInstanceId", "get master token succeeded");
                    }
                    com.google.firebase.iid.FirebaseInstanceIdService.zza(this, v0_0);
                    if ((p11) || ((v3_0 == null) || ((v3_0 != null) && (!v1_2.equals(v3_0.zzkoo))))) {
                        this.onTokenRefresh();
                    }
                }
            }
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/zzi;', 'zzcfw', '()Lcom/google/firebase/iid/zzi;'), ('Lcom/google/firebase/iid/FirebaseInstanceId;', 'getInstance', '()Lcom/google/firebase/iid/FirebaseInstanceId;'), ('Lcom/google/firebase/iid/FirebaseInstanceId;', 'getInstance', '(Lcom/google/firebase/FirebaseApp;)Lcom/google/firebase/iid/FirebaseInstanceId;'), ('Lcom/google/firebase/iid/FirebaseInstanceId;', '<init>', '(Lcom/google/firebase/FirebaseApp; Lcom/google/firebase/iid/zzj;)V'), ('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'zza', '(Landroid/content/Context; Lcom/google/firebase/iid/FirebaseInstanceId;)V'), ('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'zzem', '(Landroid/content/Context;)V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.zzi.zzcfw():


    public static com.google.firebase.iid.zzi zzcfw()
    {
        return new com.google.firebase.iid.zzi(com.google.firebase.iid.FirebaseInstanceId.getInstance());
    }

Method com.google.firebase.iid.FirebaseInstanceId.getInstance():


    public static com.google.firebase.iid.FirebaseInstanceId getInstance()
    {
        return com.google.firebase.iid.FirebaseInstanceId.getInstance(com.google.firebase.FirebaseApp.getInstance());
    }

Method com.google.firebase.iid.FirebaseInstanceId.getInstance():


    public static declared_synchronized com.google.firebase.iid.FirebaseInstanceId getInstance(com.google.firebase.FirebaseApp p4)
    {
        try {
            com.google.firebase.iid.FirebaseInstanceId v0_6 = ((com.google.firebase.iid.FirebaseInstanceId) com.google.firebase.iid.FirebaseInstanceId.zzhtn.get(p4.getOptions().getApplicationId()));
        } catch (com.google.firebase.iid.FirebaseInstanceId v0_7) {
            throw v0_7;
        }
        if (v0_6 == null) {
            java.util.Map v2_1 = com.google.firebase.iid.zzj.zza(p4.getApplicationContext(), 0);
            if (com.google.firebase.iid.FirebaseInstanceId.zznfj == null) {
                com.google.firebase.iid.FirebaseInstanceId.zznfj = new com.google.firebase.iid.zzk(com.google.firebase.iid.zzj.zzcga());
            }
            v0_6 = new com.google.firebase.iid.FirebaseInstanceId(p4, v2_1);
            com.google.firebase.iid.FirebaseInstanceId.zzhtn.put(p4.getOptions().getApplicationId(), v0_6);
        }
        return v0_6;
    }

Method com.google.firebase.iid.FirebaseInstanceId.<init>():


    private FirebaseInstanceId(com.google.firebase.FirebaseApp p5, com.google.firebase.iid.zzj p6)
    {
        this.zznfk = p5;
        this.zznfl = p6;
        String v0_2 = this.zznfk.getOptions().getGcmSenderId();
        if (v0_2 == null) {
            v0_2 = this.zznfk.getOptions().getApplicationId();
            if (v0_2.startsWith("1:")) {
                String v0_3 = v0_2.split(":");
                if (v0_3.length >= 2) {
                    v0_2 = v0_3[1];
                    if (v0_2.isEmpty()) {
                        v0_2 = 0;
                    }
                } else {
                    v0_2 = 0;
                }
            }
        }
        this.zznfm = v0_2;
        if (this.zznfm != null) {
            com.google.firebase.iid.FirebaseInstanceIdService.zza(this.zznfk.getApplicationContext(), this);
            return;
        } else {
            throw new IllegalStateException("IID failing to initialize, FirebaseApp is missing project ID");
        }
    }

Method com.google.firebase.iid.FirebaseInstanceIdService.zza():


    static void zza(android.content.Context p2, com.google.firebase.iid.FirebaseInstanceId p3)
    {
        if (!com.google.firebase.iid.FirebaseInstanceIdService.zznfq) {
            String v0_4 = p3.zzcfx();
            if ((v0_4 == null) || ((v0_4.zzrg(com.google.firebase.iid.zzj.zzhtt)) || (com.google.firebase.iid.FirebaseInstanceId.zzcfz().zzcgc() != null))) {
                com.google.firebase.iid.FirebaseInstanceIdService.zzem(p2);
            }
        } else {
        }
        return;
    }

Method com.google.firebase.iid.FirebaseInstanceIdService.zzem():


    static void zzem(android.content.Context p3)
    {
        if (com.google.firebase.iid.zzl.zzdf(p3) != null) {
            try {
                if (!com.google.firebase.iid.FirebaseInstanceIdService.zznfq) {
                    com.google.firebase.iid.zzq.zzcge().zze(p3, com.google.firebase.iid.FirebaseInstanceIdService.zzhk(0));
                    com.google.firebase.iid.FirebaseInstanceIdService.zznfq = 1;
                }
            } catch (int v0_2) {
                throw v0_2;
            }
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/zzi;', 'getToken', '()Ljava/lang/String;'), ('Lcom/google/firebase/iid/FirebaseInstanceId;', 'getToken', '()Ljava/lang/String;'), ('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'zzem', '(Landroid/content/Context;)V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.zzi.getToken():


    public final String getToken()
    {
        return this.zznfi.getToken();
    }

Method com.google.firebase.iid.FirebaseInstanceId.getToken():


    public String getToken()
    {
        int v0_0 = this.zzcfx();
        if ((v0_0 == 0) || (v0_0.zzrg(com.google.firebase.iid.zzj.zzhtt))) {
            com.google.firebase.iid.FirebaseInstanceIdService.zzem(this.zznfk.getApplicationContext());
        }
        int v0_1;
        if (v0_0 == 0) {
            v0_1 = 0;
        } else {
            v0_1 = v0_0.zzkoo;
        }
        return v0_1;
    }

Method com.google.firebase.iid.FirebaseInstanceIdService.zzem():


    static void zzem(android.content.Context p3)
    {
        if (com.google.firebase.iid.zzl.zzdf(p3) != null) {
            try {
                if (!com.google.firebase.iid.FirebaseInstanceIdService.zznfq) {
                    com.google.firebase.iid.zzq.zzcge().zze(p3, com.google.firebase.iid.FirebaseInstanceIdService.zzhk(0));
                    com.google.firebase.iid.FirebaseInstanceIdService.zznfq = 1;
                }
            } catch (int v0_2) {
                throw v0_2;
            }
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.example.invalidpackage' ==>>> Sink '['Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/zzj;', 'getToken', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzj;', 'zzb', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzd', '(Landroid/content/Context; Landroid/content/Intent;)V'), ('Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;')]]

Use of a string value com.google.example.invalidpackage to construct an Intent

Method com.google.firebase.iid.zzj.getToken():


    public final String getToken(String p7, String p8, android.os.Bundle p9)
    {
        if (android.os.Looper.getMainLooper() != android.os.Looper.myLooper()) {
            String v4;
            com.google.firebase.iid.zzr v0_1 = 1;
            if ((p9.getString("ttl") == null) && (!"jwt".equals(p9.getString("type")))) {
                String v1_3 = com.google.firebase.iid.zzj.zznft.zzo(this.zzhtr, p7, p8);
                if ((v1_3 == null) || (v1_3.zzrg(com.google.firebase.iid.zzj.zzhtt))) {
                    v4 = this.zzb(p7, p8, p9);
                    if ((v4 != null) && (v0_1 != null)) {
                        com.google.firebase.iid.zzj.zznft.zza(this.zzhtr, p7, p8, v4, com.google.firebase.iid.zzj.zzhtt);
                    }
                } else {
                    v4 = v1_3.zzkoo;
                }
            } else {
                v0_1 = 0;
            }
            return v4;
        } else {
            throw new java.io.IOException("MAIN_THREAD");
        }
    }

Method com.google.firebase.iid.zzj.zzb():


    public final String zzb(String p5, String p6, android.os.Bundle p7)
    {
        if (p6 != null) {
            p7.putString("scope", p6);
        }
        p7.putString("sender", p5);
        if (!"".equals(this.zzhtr)) {
            p5 = this.zzhtr;
        }
        p7.putString("subtype", p5);
        p7.putString("X-subtype", p5);
        String v1_1 = com.google.firebase.iid.zzj.zznfu.zza(p7, this.zzasq());
        if (v1_1 != null) {
            java.io.IOException v0_5 = v1_1.getStringExtra("registration_id");
            if (v0_5 == null) {
                v0_5 = v1_1.getStringExtra("unregistered");
            }
            if (v0_5 != null) {
                return v0_5;
            } else {
                java.io.IOException v0_9 = v1_1.getStringExtra("error");
                if (v0_9 == null) {
                    String v1_3 = String.valueOf(v1_1.getExtras());
                    android.util.Log.w("InstanceID/Rpc", new StringBuilder((String.valueOf(v1_3).length() + 29)).append("Unexpected response from GCM ").append(v1_3).toString(), new Throwable());
                    throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
                } else {
                    throw new java.io.IOException(v0_9);
                }
            }
        } else {
            throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
        }
    }

Method com.google.firebase.iid.zzl.zza():


    final android.content.Intent zza(android.os.Bundle p3, java.security.KeyPair p4)
    {
        int v0 = this.zzb(p3, p4);
        if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
            v0 = this.zzb(p3, p4);
            if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
                v0 = 0;
            }
        }
        return v0;
    }

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzd():


    public static declared_synchronized void zzd(android.content.Context p4, android.content.Intent p5)
    {
        try {
            if (com.google.firebase.iid.zzl.zzhrm == null) {
                String v0_5 = new android.content.Intent();
                v0_5.setPackage("com.google.example.invalidpackage");
                com.google.firebase.iid.zzl.zzhrm = android.app.PendingIntent.getBroadcast(p4, 0, v0_5, 0);
            }
        } catch (String v0_2) {
            throw v0_2;
        }
        p5.putExtra("app", com.google.firebase.iid.zzl.zzhrm);
        return;
    }

Method android.content.Intent.setPackage() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/zzj;', 'getToken', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzj;', 'zzb', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzast', '()V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.zzj.getToken():


    public final String getToken(String p7, String p8, android.os.Bundle p9)
    {
        if (android.os.Looper.getMainLooper() != android.os.Looper.myLooper()) {
            String v4;
            com.google.firebase.iid.zzr v0_1 = 1;
            if ((p9.getString("ttl") == null) && (!"jwt".equals(p9.getString("type")))) {
                String v1_3 = com.google.firebase.iid.zzj.zznft.zzo(this.zzhtr, p7, p8);
                if ((v1_3 == null) || (v1_3.zzrg(com.google.firebase.iid.zzj.zzhtt))) {
                    v4 = this.zzb(p7, p8, p9);
                    if ((v4 != null) && (v0_1 != null)) {
                        com.google.firebase.iid.zzj.zznft.zza(this.zzhtr, p7, p8, v4, com.google.firebase.iid.zzj.zzhtt);
                    }
                } else {
                    v4 = v1_3.zzkoo;
                }
            } else {
                v0_1 = 0;
            }
            return v4;
        } else {
            throw new java.io.IOException("MAIN_THREAD");
        }
    }

Method com.google.firebase.iid.zzj.zzb():


    public final String zzb(String p5, String p6, android.os.Bundle p7)
    {
        if (p6 != null) {
            p7.putString("scope", p6);
        }
        p7.putString("sender", p5);
        if (!"".equals(this.zzhtr)) {
            p5 = this.zzhtr;
        }
        p7.putString("subtype", p5);
        p7.putString("X-subtype", p5);
        String v1_1 = com.google.firebase.iid.zzj.zznfu.zza(p7, this.zzasq());
        if (v1_1 != null) {
            java.io.IOException v0_5 = v1_1.getStringExtra("registration_id");
            if (v0_5 == null) {
                v0_5 = v1_1.getStringExtra("unregistered");
            }
            if (v0_5 != null) {
                return v0_5;
            } else {
                java.io.IOException v0_9 = v1_1.getStringExtra("error");
                if (v0_9 == null) {
                    String v1_3 = String.valueOf(v1_1.getExtras());
                    android.util.Log.w("InstanceID/Rpc", new StringBuilder((String.valueOf(v1_3).length() + 29)).append("Unexpected response from GCM ").append(v1_3).toString(), new Throwable());
                    throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
                } else {
                    throw new java.io.IOException(v0_9);
                }
            }
        } else {
            throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
        }
    }

Method com.google.firebase.iid.zzl.zza():


    final android.content.Intent zza(android.os.Bundle p3, java.security.KeyPair p4)
    {
        int v0 = this.zzb(p3, p4);
        if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
            v0 = this.zzb(p3, p4);
            if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
                v0 = 0;
            }
        }
        return v0;
    }

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzast():


    private final void zzast()
    {
        if (this.zzhrq == null) {
            com.google.firebase.iid.zzl.zzdf(this.zzahz);
            this.zzhrq = new android.os.Messenger(new com.google.firebase.iid.zzm(this, android.os.Looper.getMainLooper()));
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.example.invalidpackage' ==>>> Sink '['Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/zzj;', 'zza', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)V'), ('Lcom/google/firebase/iid/zzj;', 'zzb', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzd', '(Landroid/content/Context; Landroid/content/Intent;)V'), ('Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;')]]

Use of a string value com.google.example.invalidpackage to construct an Intent

Method com.google.firebase.iid.zzj.zza():


    public final void zza(String p3, String p4, android.os.Bundle p5)
    {
        if (android.os.Looper.getMainLooper() != android.os.Looper.myLooper()) {
            com.google.firebase.iid.zzj.zznft.zzf(this.zzhtr, p3, p4);
            if (p5 == null) {
                p5 = new android.os.Bundle();
            }
            p5.putString("delete", "1");
            this.zzb(p3, p4, p5);
            return;
        } else {
            throw new java.io.IOException("MAIN_THREAD");
        }
    }

Method com.google.firebase.iid.zzj.zzb():


    public final String zzb(String p5, String p6, android.os.Bundle p7)
    {
        if (p6 != null) {
            p7.putString("scope", p6);
        }
        p7.putString("sender", p5);
        if (!"".equals(this.zzhtr)) {
            p5 = this.zzhtr;
        }
        p7.putString("subtype", p5);
        p7.putString("X-subtype", p5);
        String v1_1 = com.google.firebase.iid.zzj.zznfu.zza(p7, this.zzasq());
        if (v1_1 != null) {
            java.io.IOException v0_5 = v1_1.getStringExtra("registration_id");
            if (v0_5 == null) {
                v0_5 = v1_1.getStringExtra("unregistered");
            }
            if (v0_5 != null) {
                return v0_5;
            } else {
                java.io.IOException v0_9 = v1_1.getStringExtra("error");
                if (v0_9 == null) {
                    String v1_3 = String.valueOf(v1_1.getExtras());
                    android.util.Log.w("InstanceID/Rpc", new StringBuilder((String.valueOf(v1_3).length() + 29)).append("Unexpected response from GCM ").append(v1_3).toString(), new Throwable());
                    throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
                } else {
                    throw new java.io.IOException(v0_9);
                }
            }
        } else {
            throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
        }
    }

Method com.google.firebase.iid.zzl.zza():


    final android.content.Intent zza(android.os.Bundle p3, java.security.KeyPair p4)
    {
        int v0 = this.zzb(p3, p4);
        if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
            v0 = this.zzb(p3, p4);
            if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
                v0 = 0;
            }
        }
        return v0;
    }

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzd():


    public static declared_synchronized void zzd(android.content.Context p4, android.content.Intent p5)
    {
        try {
            if (com.google.firebase.iid.zzl.zzhrm == null) {
                String v0_5 = new android.content.Intent();
                v0_5.setPackage("com.google.example.invalidpackage");
                com.google.firebase.iid.zzl.zzhrm = android.app.PendingIntent.getBroadcast(p4, 0, v0_5, 0);
            }
        } catch (String v0_2) {
            throw v0_2;
        }
        p5.putExtra("app", com.google.firebase.iid.zzl.zzhrm);
        return;
    }

Method android.content.Intent.setPackage() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/zzj;', 'zza', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)V'), ('Lcom/google/firebase/iid/zzj;', 'zzb', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzast', '()V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.zzj.zza():


    public final void zza(String p3, String p4, android.os.Bundle p5)
    {
        if (android.os.Looper.getMainLooper() != android.os.Looper.myLooper()) {
            com.google.firebase.iid.zzj.zznft.zzf(this.zzhtr, p3, p4);
            if (p5 == null) {
                p5 = new android.os.Bundle();
            }
            p5.putString("delete", "1");
            this.zzb(p3, p4, p5);
            return;
        } else {
            throw new java.io.IOException("MAIN_THREAD");
        }
    }

Method com.google.firebase.iid.zzj.zzb():


    public final String zzb(String p5, String p6, android.os.Bundle p7)
    {
        if (p6 != null) {
            p7.putString("scope", p6);
        }
        p7.putString("sender", p5);
        if (!"".equals(this.zzhtr)) {
            p5 = this.zzhtr;
        }
        p7.putString("subtype", p5);
        p7.putString("X-subtype", p5);
        String v1_1 = com.google.firebase.iid.zzj.zznfu.zza(p7, this.zzasq());
        if (v1_1 != null) {
            java.io.IOException v0_5 = v1_1.getStringExtra("registration_id");
            if (v0_5 == null) {
                v0_5 = v1_1.getStringExtra("unregistered");
            }
            if (v0_5 != null) {
                return v0_5;
            } else {
                java.io.IOException v0_9 = v1_1.getStringExtra("error");
                if (v0_9 == null) {
                    String v1_3 = String.valueOf(v1_1.getExtras());
                    android.util.Log.w("InstanceID/Rpc", new StringBuilder((String.valueOf(v1_3).length() + 29)).append("Unexpected response from GCM ").append(v1_3).toString(), new Throwable());
                    throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
                } else {
                    throw new java.io.IOException(v0_9);
                }
            }
        } else {
            throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
        }
    }

Method com.google.firebase.iid.zzl.zza():


    final android.content.Intent zza(android.os.Bundle p3, java.security.KeyPair p4)
    {
        int v0 = this.zzb(p3, p4);
        if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
            v0 = this.zzb(p3, p4);
            if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
                v0 = 0;
            }
        }
        return v0;
    }

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzast():


    private final void zzast()
    {
        if (this.zzhrq == null) {
            com.google.firebase.iid.zzl.zzdf(this.zzahz);
            this.zzhrq = new android.os.Messenger(new com.google.firebase.iid.zzm(this, android.os.Looper.getMainLooper()));
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.example.invalidpackage' ==>>> Sink '['Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/zzj;', 'zzb', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzd', '(Landroid/content/Context; Landroid/content/Intent;)V'), ('Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;')]]

Use of a string value com.google.example.invalidpackage to construct an Intent

Method com.google.firebase.iid.zzj.zzb():


    public final String zzb(String p5, String p6, android.os.Bundle p7)
    {
        if (p6 != null) {
            p7.putString("scope", p6);
        }
        p7.putString("sender", p5);
        if (!"".equals(this.zzhtr)) {
            p5 = this.zzhtr;
        }
        p7.putString("subtype", p5);
        p7.putString("X-subtype", p5);
        String v1_1 = com.google.firebase.iid.zzj.zznfu.zza(p7, this.zzasq());
        if (v1_1 != null) {
            java.io.IOException v0_5 = v1_1.getStringExtra("registration_id");
            if (v0_5 == null) {
                v0_5 = v1_1.getStringExtra("unregistered");
            }
            if (v0_5 != null) {
                return v0_5;
            } else {
                java.io.IOException v0_9 = v1_1.getStringExtra("error");
                if (v0_9 == null) {
                    String v1_3 = String.valueOf(v1_1.getExtras());
                    android.util.Log.w("InstanceID/Rpc", new StringBuilder((String.valueOf(v1_3).length() + 29)).append("Unexpected response from GCM ").append(v1_3).toString(), new Throwable());
                    throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
                } else {
                    throw new java.io.IOException(v0_9);
                }
            }
        } else {
            throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
        }
    }

Method com.google.firebase.iid.zzl.zza():


    final android.content.Intent zza(android.os.Bundle p3, java.security.KeyPair p4)
    {
        int v0 = this.zzb(p3, p4);
        if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
            v0 = this.zzb(p3, p4);
            if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
                v0 = 0;
            }
        }
        return v0;
    }

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzd():


    public static declared_synchronized void zzd(android.content.Context p4, android.content.Intent p5)
    {
        try {
            if (com.google.firebase.iid.zzl.zzhrm == null) {
                String v0_5 = new android.content.Intent();
                v0_5.setPackage("com.google.example.invalidpackage");
                com.google.firebase.iid.zzl.zzhrm = android.app.PendingIntent.getBroadcast(p4, 0, v0_5, 0);
            }
        } catch (String v0_2) {
            throw v0_2;
        }
        p5.putExtra("app", com.google.firebase.iid.zzl.zzhrm);
        return;
    }

Method android.content.Intent.setPackage() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/zzj;', 'zzb', '(Ljava/lang/String; Ljava/lang/String; Landroid/os/Bundle;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzast', '()V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.zzj.zzb():


    public final String zzb(String p5, String p6, android.os.Bundle p7)
    {
        if (p6 != null) {
            p7.putString("scope", p6);
        }
        p7.putString("sender", p5);
        if (!"".equals(this.zzhtr)) {
            p5 = this.zzhtr;
        }
        p7.putString("subtype", p5);
        p7.putString("X-subtype", p5);
        String v1_1 = com.google.firebase.iid.zzj.zznfu.zza(p7, this.zzasq());
        if (v1_1 != null) {
            java.io.IOException v0_5 = v1_1.getStringExtra("registration_id");
            if (v0_5 == null) {
                v0_5 = v1_1.getStringExtra("unregistered");
            }
            if (v0_5 != null) {
                return v0_5;
            } else {
                java.io.IOException v0_9 = v1_1.getStringExtra("error");
                if (v0_9 == null) {
                    String v1_3 = String.valueOf(v1_1.getExtras());
                    android.util.Log.w("InstanceID/Rpc", new StringBuilder((String.valueOf(v1_3).length() + 29)).append("Unexpected response from GCM ").append(v1_3).toString(), new Throwable());
                    throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
                } else {
                    throw new java.io.IOException(v0_9);
                }
            }
        } else {
            throw new java.io.IOException("SERVICE_NOT_AVAILABLE");
        }
    }

Method com.google.firebase.iid.zzl.zza():


    final android.content.Intent zza(android.os.Bundle p3, java.security.KeyPair p4)
    {
        int v0 = this.zzb(p3, p4);
        if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
            v0 = this.zzb(p3, p4);
            if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
                v0 = 0;
            }
        }
        return v0;
    }

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzast():


    private final void zzast()
    {
        if (this.zzhrq == null) {
            com.google.firebase.iid.zzl.zzdf(this.zzahz);
            this.zzhrq = new android.os.Messenger(new com.google.firebase.iid.zzm(this, android.os.Looper.getMainLooper()));
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/zzl;', 'zzast', '()V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.zzl.zzast():


    private final void zzast()
    {
        if (this.zzhrq == null) {
            com.google.firebase.iid.zzl.zzdf(this.zzahz);
            this.zzhrq = new android.os.Messenger(new com.google.firebase.iid.zzm(this, android.os.Looper.getMainLooper()));
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.example.invalidpackage' ==>>> Sink '['Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzd', '(Landroid/content/Context; Landroid/content/Intent;)V'), ('Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;')]]

Use of a string value com.google.example.invalidpackage to construct an Intent

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzd():


    public static declared_synchronized void zzd(android.content.Context p4, android.content.Intent p5)
    {
        try {
            if (com.google.firebase.iid.zzl.zzhrm == null) {
                String v0_5 = new android.content.Intent();
                v0_5.setPackage("com.google.example.invalidpackage");
                com.google.firebase.iid.zzl.zzhrm = android.app.PendingIntent.getBroadcast(p4, 0, v0_5, 0);
            }
        } catch (String v0_2) {
            throw v0_2;
        }
        p5.putExtra("app", com.google.firebase.iid.zzl.zzhrm);
        return;
    }

Method android.content.Intent.setPackage() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzast', '()V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzast():


    private final void zzast()
    {
        if (this.zzhrq == null) {
            com.google.firebase.iid.zzl.zzdf(this.zzahz);
            this.zzhrq = new android.os.Messenger(new com.google.firebase.iid.zzm(this, android.os.Looper.getMainLooper()));
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.example.invalidpackage' ==>>> Sink '['Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/zzl;', 'zzd', '(Landroid/content/Context; Landroid/content/Intent;)V'), ('Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;')]]

Use of a string value com.google.example.invalidpackage to construct an Intent

Method com.google.firebase.iid.zzl.zzd():


    public static declared_synchronized void zzd(android.content.Context p4, android.content.Intent p5)
    {
        try {
            if (com.google.firebase.iid.zzl.zzhrm == null) {
                String v0_5 = new android.content.Intent();
                v0_5.setPackage("com.google.example.invalidpackage");
                com.google.firebase.iid.zzl.zzhrm = android.app.PendingIntent.getBroadcast(p4, 0, v0_5, 0);
            }
        } catch (String v0_2) {
            throw v0_2;
        }
        p5.putExtra("app", com.google.firebase.iid.zzl.zzhrm);
        return;
    }

Method android.content.Intent.setPackage() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzast', '()V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.iid.zzl.zza():


    final android.content.Intent zza(android.os.Bundle p3, java.security.KeyPair p4)
    {
        int v0 = this.zzb(p3, p4);
        if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
            v0 = this.zzb(p3, p4);
            if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
                v0 = 0;
            }
        }
        return v0;
    }

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzast():


    private final void zzast()
    {
        if (this.zzhrq == null) {
            com.google.firebase.iid.zzl.zzdf(this.zzahz);
            this.zzhrq = new android.os.Messenger(new com.google.firebase.iid.zzm(this, android.os.Looper.getMainLooper()));
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.example.invalidpackage' ==>>> Sink '['Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;', '0', 'IPC_SINK']' [[('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzb', '(Landroid/os/Bundle; Ljava/security/KeyPair;)Landroid/content/Intent;'), ('Lcom/google/firebase/iid/zzl;', 'zzd', '(Landroid/content/Context; Landroid/content/Intent;)V'), ('Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;')]]

Use of a string value com.google.example.invalidpackage to construct an Intent

Method com.google.firebase.iid.zzl.zza():


    final android.content.Intent zza(android.os.Bundle p3, java.security.KeyPair p4)
    {
        int v0 = this.zzb(p3, p4);
        if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
            v0 = this.zzb(p3, p4);
            if ((v0 != 0) && (v0.hasExtra("google.messenger"))) {
                v0 = 0;
            }
        }
        return v0;
    }

Method com.google.firebase.iid.zzl.zzb():


    private final android.content.Intent zzb(android.os.Bundle p12, java.security.KeyPair p13)
    {
        String v1_5 = com.google.firebase.iid.zzl.zzasu();
        android.support.v4.util.SimpleArrayMap v2_5 = new com.google.firebase.iid.zzo(0);
        this.zznfw.put(v1_5, v2_5);
        String v4_0 = android.os.SystemClock.elapsedRealtime();
        if ((this.zzhuj == 0) || (v4_0 > this.zzhuj)) {
            this.zzast();
            if (com.google.firebase.iid.zzl.zzhtw != null) {
                Throwable v0_38;
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                if (!com.google.firebase.iid.zzl.zzhtx) {
                    v0_38 = "com.google.android.c2dm.intent.REGISTER";
                } else {
                    v0_38 = "com.google.iid.TOKEN_REQUEST";
                }
                android.support.v4.util.SimpleArrayMap v3_4 = new android.content.Intent(v0_38);
                v3_4.setPackage(com.google.firebase.iid.zzl.zzhtw);
                p12.putString("gmsv", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzao(this.zzahz, com.google.firebase.iid.zzl.zzdf(this.zzahz))));
                p12.putString("osv", Integer.toString(android.os.Build$VERSION.SDK_INT));
                p12.putString("app_ver", Integer.toString(com.google.firebase.iid.FirebaseInstanceId.zzej(this.zzahz)));
                p12.putString("app_ver_name", com.google.firebase.iid.FirebaseInstanceId.zzdd(this.zzahz));
                p12.putString("cliv", "fiid-11400000");
                p12.putString("appid", com.google.firebase.iid.FirebaseInstanceId.zza(p13));
                Throwable v0_49 = com.google.firebase.iid.FirebaseInstanceId.zzn(p13.getPublic().getEncoded());
                p12.putString("pub2", v0_49);
                android.content.BroadcastReceiver v5_16 = new String[2];
                v5_16[0] = this.zzahz.getPackageName();
                v5_16[1] = v0_49;
                p12.putString("sig", com.google.firebase.iid.zzl.zza(p13, v5_16));
                v3_4.putExtras(p12);
                com.google.firebase.iid.zzl.zzd(this.zzahz, v3_4);
                this.zzhuf = android.os.SystemClock.elapsedRealtime();
                v3_4.putExtra("kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                v3_4.putExtra("X-kid", new StringBuilder((String.valueOf(v1_5).length() + 5)).append("|ID|").append(v1_5).append("|").toString());
                Throwable v0_4 = "com.google.android.gsf".equals(com.google.firebase.iid.zzl.zzhtw);
                if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                    android.content.BroadcastReceiver v5_7 = String.valueOf(v3_4.getExtras());
                    android.util.Log.d("InstanceID/Rpc", new StringBuilder((String.valueOf(v5_7).length() + 8)).append("Sending ").append(v5_7).toString());
                }
                if (v0_4 == null) {
                    v3_4.putExtra("google.messenger", this.zzhrq);
                    if ((this.zzhud != null) || (this.zzhue != null)) {
                        Throwable v0_9 = android.os.Message.obtain();
                        v0_9.obj = v3_4;
                        try {
                            if (this.zzhud == null) {
                                this.zzhue.send(v0_9);
                                try {
                                    Throwable v0_28 = v2_5.zzcgd();
                                } catch (Throwable v0_29) {
                                    this.zznfw.remove(v1_5);
                                    throw v0_29;
                                }
                                this.zznfw.remove(v1_5);
                                return v0_28;
                            } else {
                                this.zzhud.send(v0_9);
                            }
                        } catch (Throwable v0) {
                            if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                                android.util.Log.d("InstanceID/Rpc", "Messenger failed, fallback to startService");
                            }
                        }
                    }
                    if (!com.google.firebase.iid.zzl.zzhtx) {
                        this.zzahz.startService(v3_4);
                    } else {
                        this.zzahz.sendBroadcast(v3_4);
                    }
                } else {
                    if (com.google.firebase.iid.zzl.zzhub == null) {
                        com.google.firebase.iid.zzl.zzhub = new com.google.firebase.iid.zzn(this);
                        if (android.util.Log.isLoggable("InstanceID/Rpc", 3)) {
                            android.util.Log.d("InstanceID/Rpc", "Registered GSF callback receiver");
                        }
                        Throwable v0_24 = new android.content.IntentFilter("com.google.android.c2dm.intent.REGISTRATION");
                        v0_24.addCategory(this.zzahz.getPackageName());
                        this.zzahz.registerReceiver(com.google.firebase.iid.zzl.zzhub, v0_24, "com.google.android.c2dm.permission.SEND", 0);
                    }
                    this.zzahz.startService(v3_4);
                }
            } else {
                throw new java.io.IOException("MISSING_INSTANCEID_SERVICE");
            }
        } else {
            android.util.Log.w("InstanceID/Rpc", new StringBuilder(78).append("Backoff mode, next request attempt: ").append((this.zzhuj - v4_0)).append(" interval: ").append(this.zzhui).toString());
            throw new java.io.IOException("RETRY_LATER");
        }
    }

Method com.google.firebase.iid.zzl.zzd():


    public static declared_synchronized void zzd(android.content.Context p4, android.content.Intent p5)
    {
        try {
            if (com.google.firebase.iid.zzl.zzhrm == null) {
                String v0_5 = new android.content.Intent();
                v0_5.setPackage("com.google.example.invalidpackage");
                com.google.firebase.iid.zzl.zzhrm = android.app.PendingIntent.getBroadcast(p4, 0, v0_5, 0);
            }
        } catch (String v0_2) {
            throw v0_2;
        }
        p5.putExtra("app", com.google.firebase.iid.zzl.zzhrm);
        return;
    }

Method android.content.Intent.setPackage() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/messaging/FirebaseMessaging;', 'getInstance', '()Lcom/google/firebase/messaging/FirebaseMessaging;'), ('Lcom/google/firebase/iid/FirebaseInstanceId;', 'getInstance', '()Lcom/google/firebase/iid/FirebaseInstanceId;'), ('Lcom/google/firebase/iid/FirebaseInstanceId;', 'getInstance', '(Lcom/google/firebase/FirebaseApp;)Lcom/google/firebase/iid/FirebaseInstanceId;'), ('Lcom/google/firebase/iid/FirebaseInstanceId;', '<init>', '(Lcom/google/firebase/FirebaseApp; Lcom/google/firebase/iid/zzj;)V'), ('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'zza', '(Landroid/content/Context; Lcom/google/firebase/iid/FirebaseInstanceId;)V'), ('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'zzem', '(Landroid/content/Context;)V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.messaging.FirebaseMessaging.getInstance():


    public static declared_synchronized com.google.firebase.messaging.FirebaseMessaging getInstance()
    {
        try {
            if (com.google.firebase.messaging.FirebaseMessaging.zzngj == null) {
                com.google.firebase.messaging.FirebaseMessaging.zzngj = new com.google.firebase.messaging.FirebaseMessaging(com.google.firebase.iid.FirebaseInstanceId.getInstance());
            }
        } catch (com.google.firebase.messaging.FirebaseMessaging v0_4) {
            throw v0_4;
        }
        return com.google.firebase.messaging.FirebaseMessaging.zzngj;
    }

Method com.google.firebase.iid.FirebaseInstanceId.getInstance():


    public static com.google.firebase.iid.FirebaseInstanceId getInstance()
    {
        return com.google.firebase.iid.FirebaseInstanceId.getInstance(com.google.firebase.FirebaseApp.getInstance());
    }

Method com.google.firebase.iid.FirebaseInstanceId.getInstance():


    public static declared_synchronized com.google.firebase.iid.FirebaseInstanceId getInstance(com.google.firebase.FirebaseApp p4)
    {
        try {
            com.google.firebase.iid.FirebaseInstanceId v0_6 = ((com.google.firebase.iid.FirebaseInstanceId) com.google.firebase.iid.FirebaseInstanceId.zzhtn.get(p4.getOptions().getApplicationId()));
        } catch (com.google.firebase.iid.FirebaseInstanceId v0_7) {
            throw v0_7;
        }
        if (v0_6 == null) {
            java.util.Map v2_1 = com.google.firebase.iid.zzj.zza(p4.getApplicationContext(), 0);
            if (com.google.firebase.iid.FirebaseInstanceId.zznfj == null) {
                com.google.firebase.iid.FirebaseInstanceId.zznfj = new com.google.firebase.iid.zzk(com.google.firebase.iid.zzj.zzcga());
            }
            v0_6 = new com.google.firebase.iid.FirebaseInstanceId(p4, v2_1);
            com.google.firebase.iid.FirebaseInstanceId.zzhtn.put(p4.getOptions().getApplicationId(), v0_6);
        }
        return v0_6;
    }

Method com.google.firebase.iid.FirebaseInstanceId.<init>():


    private FirebaseInstanceId(com.google.firebase.FirebaseApp p5, com.google.firebase.iid.zzj p6)
    {
        this.zznfk = p5;
        this.zznfl = p6;
        String v0_2 = this.zznfk.getOptions().getGcmSenderId();
        if (v0_2 == null) {
            v0_2 = this.zznfk.getOptions().getApplicationId();
            if (v0_2.startsWith("1:")) {
                String v0_3 = v0_2.split(":");
                if (v0_3.length >= 2) {
                    v0_2 = v0_3[1];
                    if (v0_2.isEmpty()) {
                        v0_2 = 0;
                    }
                } else {
                    v0_2 = 0;
                }
            }
        }
        this.zznfm = v0_2;
        if (this.zznfm != null) {
            com.google.firebase.iid.FirebaseInstanceIdService.zza(this.zznfk.getApplicationContext(), this);
            return;
        } else {
            throw new IllegalStateException("IID failing to initialize, FirebaseApp is missing project ID");
        }
    }

Method com.google.firebase.iid.FirebaseInstanceIdService.zza():


    static void zza(android.content.Context p2, com.google.firebase.iid.FirebaseInstanceId p3)
    {
        if (!com.google.firebase.iid.FirebaseInstanceIdService.zznfq) {
            String v0_4 = p3.zzcfx();
            if ((v0_4 == null) || ((v0_4.zzrg(com.google.firebase.iid.zzj.zzhtt)) || (com.google.firebase.iid.FirebaseInstanceId.zzcfz().zzcgc() != null))) {
                com.google.firebase.iid.FirebaseInstanceIdService.zzem(p2);
            }
        } else {
        }
        return;
    }

Method com.google.firebase.iid.FirebaseInstanceIdService.zzem():


    static void zzem(android.content.Context p3)
    {
        if (com.google.firebase.iid.zzl.zzdf(p3) != null) {
            try {
                if (!com.google.firebase.iid.FirebaseInstanceIdService.zznfq) {
                    com.google.firebase.iid.zzq.zzcge().zze(p3, com.google.firebase.iid.FirebaseInstanceIdService.zzhk(0));
                    com.google.firebase.iid.FirebaseInstanceIdService.zznfq = 1;
                }
            } catch (int v0_2) {
                throw v0_2;
            }
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/messaging/FirebaseMessaging;', 'send', '(Lcom/google/firebase/messaging/RemoteMessage;)V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.messaging.FirebaseMessaging.send():


    public void send(com.google.firebase.messaging.RemoteMessage p5)
    {
        if (!android.text.TextUtils.isEmpty(p5.getTo())) {
            String v0_6 = com.google.firebase.FirebaseApp.getInstance().getApplicationContext();
            String v1_0 = com.google.firebase.iid.zzl.zzdf(v0_6);
            if (v1_0 != null) {
                android.content.Intent v2_1 = new android.content.Intent("com.google.android.gcm.intent.SEND");
                com.google.firebase.iid.zzl.zzd(v0_6, v2_1);
                v2_1.setPackage(v1_0);
                v2_1.putExtras(p5.mBundle);
                v0_6.sendOrderedBroadcast(v2_1, "com.google.android.gtalkservice.permission.GTALK_SERVICE");
            } else {
                android.util.Log.e("FirebaseMessaging", "Google Play services package is missing. Impossible to send message");
            }
            return;
        } else {
            throw new IllegalArgumentException("Missing \'to\'");
        }
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'com.google.example.invalidpackage' ==>>> Sink '['Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;', '0', 'IPC_SINK']' [[('Lcom/google/firebase/messaging/FirebaseMessaging;', 'send', '(Lcom/google/firebase/messaging/RemoteMessage;)V'), ('Lcom/google/firebase/iid/zzl;', 'zzd', '(Landroid/content/Context; Landroid/content/Intent;)V'), ('Landroid/content/Intent;', 'setPackage', '(Ljava/lang/String;)Landroid/content/Intent;')]]

Use of a string value com.google.example.invalidpackage to construct an Intent

Method com.google.firebase.messaging.FirebaseMessaging.send():


    public void send(com.google.firebase.messaging.RemoteMessage p5)
    {
        if (!android.text.TextUtils.isEmpty(p5.getTo())) {
            String v0_6 = com.google.firebase.FirebaseApp.getInstance().getApplicationContext();
            String v1_0 = com.google.firebase.iid.zzl.zzdf(v0_6);
            if (v1_0 != null) {
                android.content.Intent v2_1 = new android.content.Intent("com.google.android.gcm.intent.SEND");
                com.google.firebase.iid.zzl.zzd(v0_6, v2_1);
                v2_1.setPackage(v1_0);
                v2_1.putExtras(p5.mBundle);
                v0_6.sendOrderedBroadcast(v2_1, "com.google.android.gtalkservice.permission.GTALK_SERVICE");
            } else {
                android.util.Log.e("FirebaseMessaging", "Google Play services package is missing. Impossible to send message");
            }
            return;
        } else {
            throw new IllegalArgumentException("Missing \'to\'");
        }
    }

Method com.google.firebase.iid.zzl.zzd():


    public static declared_synchronized void zzd(android.content.Context p4, android.content.Intent p5)
    {
        try {
            if (com.google.firebase.iid.zzl.zzhrm == null) {
                String v0_5 = new android.content.Intent();
                v0_5.setPackage("com.google.example.invalidpackage");
                com.google.firebase.iid.zzl.zzhrm = android.app.PendingIntent.getBroadcast(p4, 0, v0_5, 0);
            }
        } catch (String v0_2) {
            throw v0_2;
        }
        p5.putExtra("app", com.google.firebase.iid.zzl.zzhrm);
        return;
    }

Method android.content.Intent.setPackage() not found.

[TAINT] String 'com.google.iid.TOKEN_REQUEST' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/messaging/RemoteMessage$Builder;', 'build', '()Lcom/google/firebase/messaging/RemoteMessage;'), ('Lcom/google/firebase/iid/FirebaseInstanceId;', 'getInstance', '()Lcom/google/firebase/iid/FirebaseInstanceId;'), ('Lcom/google/firebase/iid/FirebaseInstanceId;', 'getInstance', '(Lcom/google/firebase/FirebaseApp;)Lcom/google/firebase/iid/FirebaseInstanceId;'), ('Lcom/google/firebase/iid/FirebaseInstanceId;', '<init>', '(Lcom/google/firebase/FirebaseApp; Lcom/google/firebase/iid/zzj;)V'), ('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'zza', '(Landroid/content/Context; Lcom/google/firebase/iid/FirebaseInstanceId;)V'), ('Lcom/google/firebase/iid/FirebaseInstanceIdService;', 'zzem', '(Landroid/content/Context;)V'), ('Lcom/google/firebase/iid/zzl;', 'zzdf', '(Landroid/content/Context;)Ljava/lang/String;'), ('Lcom/google/firebase/iid/zzl;', 'zza', '(Landroid/content/pm/PackageManager;)Z'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value com.google.iid.TOKEN_REQUEST to construct an Intent

Method com.google.firebase.messaging.RemoteMessage$Builder.build():


    public com.google.firebase.messaging.RemoteMessage build()
    {
        android.os.Bundle v2_1 = new android.os.Bundle();
        String v3_1 = this.zzdks.entrySet().iterator();
        while (v3_1.hasNext()) {
            com.google.firebase.messaging.RemoteMessage v0_8 = ((java.util.Map$Entry) v3_1.next());
            v2_1.putString(((String) v0_8.getKey()), ((String) v0_8.getValue()));
        }
        v2_1.putAll(this.mBundle);
        com.google.firebase.messaging.RemoteMessage v0_2 = com.google.firebase.iid.FirebaseInstanceId.getInstance().getToken();
        if (v0_2 == null) {
            this.mBundle.remove("from");
        } else {
            this.mBundle.putString("from", v0_2);
        }
        return new com.google.firebase.messaging.RemoteMessage(v2_1);
    }

Method com.google.firebase.iid.FirebaseInstanceId.getInstance():


    public static com.google.firebase.iid.FirebaseInstanceId getInstance()
    {
        return com.google.firebase.iid.FirebaseInstanceId.getInstance(com.google.firebase.FirebaseApp.getInstance());
    }

Method com.google.firebase.iid.FirebaseInstanceId.getInstance():


    public static declared_synchronized com.google.firebase.iid.FirebaseInstanceId getInstance(com.google.firebase.FirebaseApp p4)
    {
        try {
            com.google.firebase.iid.FirebaseInstanceId v0_6 = ((com.google.firebase.iid.FirebaseInstanceId) com.google.firebase.iid.FirebaseInstanceId.zzhtn.get(p4.getOptions().getApplicationId()));
        } catch (com.google.firebase.iid.FirebaseInstanceId v0_7) {
            throw v0_7;
        }
        if (v0_6 == null) {
            java.util.Map v2_1 = com.google.firebase.iid.zzj.zza(p4.getApplicationContext(), 0);
            if (com.google.firebase.iid.FirebaseInstanceId.zznfj == null) {
                com.google.firebase.iid.FirebaseInstanceId.zznfj = new com.google.firebase.iid.zzk(com.google.firebase.iid.zzj.zzcga());
            }
            v0_6 = new com.google.firebase.iid.FirebaseInstanceId(p4, v2_1);
            com.google.firebase.iid.FirebaseInstanceId.zzhtn.put(p4.getOptions().getApplicationId(), v0_6);
        }
        return v0_6;
    }

Method com.google.firebase.iid.FirebaseInstanceId.<init>():


    private FirebaseInstanceId(com.google.firebase.FirebaseApp p5, com.google.firebase.iid.zzj p6)
    {
        this.zznfk = p5;
        this.zznfl = p6;
        String v0_2 = this.zznfk.getOptions().getGcmSenderId();
        if (v0_2 == null) {
            v0_2 = this.zznfk.getOptions().getApplicationId();
            if (v0_2.startsWith("1:")) {
                String v0_3 = v0_2.split(":");
                if (v0_3.length >= 2) {
                    v0_2 = v0_3[1];
                    if (v0_2.isEmpty()) {
                        v0_2 = 0;
                    }
                } else {
                    v0_2 = 0;
                }
            }
        }
        this.zznfm = v0_2;
        if (this.zznfm != null) {
            com.google.firebase.iid.FirebaseInstanceIdService.zza(this.zznfk.getApplicationContext(), this);
            return;
        } else {
            throw new IllegalStateException("IID failing to initialize, FirebaseApp is missing project ID");
        }
    }

Method com.google.firebase.iid.FirebaseInstanceIdService.zza():


    static void zza(android.content.Context p2, com.google.firebase.iid.FirebaseInstanceId p3)
    {
        if (!com.google.firebase.iid.FirebaseInstanceIdService.zznfq) {
            String v0_4 = p3.zzcfx();
            if ((v0_4 == null) || ((v0_4.zzrg(com.google.firebase.iid.zzj.zzhtt)) || (com.google.firebase.iid.FirebaseInstanceId.zzcfz().zzcgc() != null))) {
                com.google.firebase.iid.FirebaseInstanceIdService.zzem(p2);
            }
        } else {
        }
        return;
    }

Method com.google.firebase.iid.FirebaseInstanceIdService.zzem():


    static void zzem(android.content.Context p3)
    {
        if (com.google.firebase.iid.zzl.zzdf(p3) != null) {
            try {
                if (!com.google.firebase.iid.FirebaseInstanceIdService.zznfq) {
                    com.google.firebase.iid.zzq.zzcge().zze(p3, com.google.firebase.iid.FirebaseInstanceIdService.zzhk(0));
                    com.google.firebase.iid.FirebaseInstanceIdService.zznfq = 1;
                }
            } catch (int v0_2) {
                throw v0_2;
            }
        }
        return;
    }

Method com.google.firebase.iid.zzl.zzdf():


    public static String zzdf(android.content.Context p5)
    {
        String v0_20;
        if (com.google.firebase.iid.zzl.zzhtw == null) {
            com.google.firebase.iid.zzl.zzhty = android.os.Process.myUid();
            android.content.pm.PackageManager v2 = p5.getPackageManager();
            if (!com.google.android.gms.common.util.zzq.isAtLeastO()) {
                String v3_1 = v2.queryIntentServices(new android.content.Intent("com.google.android.c2dm.intent.REGISTER"), 0).iterator();
                while (v3_1.hasNext()) {
                    if (com.google.firebase.iid.zzl.zza(v2, ((android.content.pm.ResolveInfo) v3_1.next()).serviceInfo.packageName, "com.google.android.c2dm.intent.REGISTER")) {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        String v0_5 = 1;
                    }
                    if (v0_5 != null) {
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                        return v0_20;
                    }
                }
                v0_5 = 0;
            }
            if (!com.google.firebase.iid.zzl.zza(v2)) {
                android.util.Log.w("InstanceID/Rpc", "Failed to resolve IID implementation package, falling back");
                if (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gms")) {
                    if ((com.google.android.gms.common.util.zzq.zzalj()) || (!com.google.firebase.iid.zzl.zzb(v2, "com.google.android.gsf"))) {
                        android.util.Log.w("InstanceID/Rpc", "Google Play services is missing, unable to get tokens");
                        v0_20 = 0;
                    } else {
                        com.google.firebase.iid.zzl.zzhtx = 0;
                        v0_20 = com.google.firebase.iid.zzl.zzhtw;
                    }
                } else {
                    com.google.firebase.iid.zzl.zzhtx = com.google.android.gms.common.util.zzq.isAtLeastO();
                    v0_20 = com.google.firebase.iid.zzl.zzhtw;
                }
            } else {
                v0_20 = com.google.firebase.iid.zzl.zzhtw;
            }
        } else {
            v0_20 = com.google.firebase.iid.zzl.zzhtw;
        }
        return v0_20;
    }

Method com.google.firebase.iid.zzl.zza():


    private static boolean zza(android.content.pm.PackageManager p5)
    {
        java.util.Iterator v3_1 = p5.queryBroadcastReceivers(new android.content.Intent("com.google.iid.TOKEN_REQUEST"), 0).iterator();
        while (v3_1.hasNext()) {
            if (com.google.firebase.iid.zzl.zza(p5, ((android.content.pm.ResolveInfo) v3_1.next()).activityInfo.packageName, "com.google.iid.TOKEN_REQUEST")) {
                com.google.firebase.iid.zzl.zzhtx = 1;
                int v0_1 = 1;
            }
            return v0_1;
        }
        v0_1 = 0;
        return v0_1;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'gcm.n.click_action' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/messaging/zza;', 'zzt', '(Landroid/os/Bundle;)Landroid/app/PendingIntent;'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value gcm.n.click_action to construct an Intent

Method com.google.firebase.messaging.zza.zzt():


    private final android.app.PendingIntent zzt(android.os.Bundle p5)
    {
        java.util.Set v1_4;
        java.util.Set v1_3 = com.google.firebase.messaging.zza.zze(p5, "gcm.n.click_action");
        if (android.text.TextUtils.isEmpty(v1_3)) {
            java.util.Set v1_8 = com.google.firebase.messaging.zza.zzae(p5);
            if (v1_8 == null) {
                android.app.PendingIntent v0_2 = this.mContext.getPackageManager().getLaunchIntentForPackage(this.mContext.getPackageName());
                if (v0_2 == null) {
                    android.util.Log.w("FirebaseMessaging", "No activity found to launch app");
                }
                v1_4 = v0_2;
            } else {
                android.app.PendingIntent v0_4 = new android.content.Intent("android.intent.action.VIEW");
                v0_4.setPackage(this.mContext.getPackageName());
                v0_4.setData(v1_8);
                v1_4 = v0_4;
            }
        } else {
            android.app.PendingIntent v0_6 = new android.content.Intent(v1_3);
            v0_6.setPackage(this.mContext.getPackageName());
            v0_6.setFlags(268435456);
            v1_4 = v0_6;
        }
        android.app.PendingIntent v0_14;
        if (v1_4 != null) {
            v1_4.addFlags(67108864);
            android.app.PendingIntent v0_10 = new android.os.Bundle(p5);
            com.google.firebase.messaging.FirebaseMessagingService.zzq(v0_10);
            v1_4.putExtras(v0_10);
            int v2_4 = v0_10.keySet().iterator();
            while (v2_4.hasNext()) {
                android.app.PendingIntent v0_16 = ((String) v2_4.next());
                if ((v0_16.startsWith("gcm.n.")) || (v0_16.startsWith("gcm.notification."))) {
                    v1_4.removeExtra(v0_16);
                }
            }
            v0_14 = android.app.PendingIntent.getActivity(this.mContext, this.zzngh.incrementAndGet(), v1_4, 1073741824);
        } else {
            v0_14 = 0;
        }
        return v0_14;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'gcm.notification.' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/messaging/zza;', 'zzt', '(Landroid/os/Bundle;)Landroid/app/PendingIntent;'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value gcm.notification. to construct an Intent

Method com.google.firebase.messaging.zza.zzt():


    private final android.app.PendingIntent zzt(android.os.Bundle p5)
    {
        java.util.Set v1_4;
        java.util.Set v1_3 = com.google.firebase.messaging.zza.zze(p5, "gcm.n.click_action");
        if (android.text.TextUtils.isEmpty(v1_3)) {
            java.util.Set v1_8 = com.google.firebase.messaging.zza.zzae(p5);
            if (v1_8 == null) {
                android.app.PendingIntent v0_2 = this.mContext.getPackageManager().getLaunchIntentForPackage(this.mContext.getPackageName());
                if (v0_2 == null) {
                    android.util.Log.w("FirebaseMessaging", "No activity found to launch app");
                }
                v1_4 = v0_2;
            } else {
                android.app.PendingIntent v0_4 = new android.content.Intent("android.intent.action.VIEW");
                v0_4.setPackage(this.mContext.getPackageName());
                v0_4.setData(v1_8);
                v1_4 = v0_4;
            }
        } else {
            android.app.PendingIntent v0_6 = new android.content.Intent(v1_3);
            v0_6.setPackage(this.mContext.getPackageName());
            v0_6.setFlags(268435456);
            v1_4 = v0_6;
        }
        android.app.PendingIntent v0_14;
        if (v1_4 != null) {
            v1_4.addFlags(67108864);
            android.app.PendingIntent v0_10 = new android.os.Bundle(p5);
            com.google.firebase.messaging.FirebaseMessagingService.zzq(v0_10);
            v1_4.putExtras(v0_10);
            int v2_4 = v0_10.keySet().iterator();
            while (v2_4.hasNext()) {
                android.app.PendingIntent v0_16 = ((String) v2_4.next());
                if ((v0_16.startsWith("gcm.n.")) || (v0_16.startsWith("gcm.notification."))) {
                    v1_4.removeExtra(v0_16);
                }
            }
            v0_14 = android.app.PendingIntent.getActivity(this.mContext, this.zzngh.incrementAndGet(), v1_4, 1073741824);
        } else {
            v0_14 = 0;
        }
        return v0_14;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'gcm.n.link_android' ==>>> Sink '['Landroid/content/Intent;', 'setData', '(Landroid/net/Uri;)Landroid/content/Intent;', '0', 'IPC_SINK']' [[('Lcom/google/firebase/messaging/zza;', 'zzt', '(Landroid/os/Bundle;)Landroid/app/PendingIntent;'), ('Landroid/content/Intent;', 'setData', '(Landroid/net/Uri;)Landroid/content/Intent;')]]

Use of a string value gcm.n.link_android to construct an Intent

Method com.google.firebase.messaging.zza.zzt():


    private final android.app.PendingIntent zzt(android.os.Bundle p5)
    {
        java.util.Set v1_4;
        java.util.Set v1_3 = com.google.firebase.messaging.zza.zze(p5, "gcm.n.click_action");
        if (android.text.TextUtils.isEmpty(v1_3)) {
            java.util.Set v1_8 = com.google.firebase.messaging.zza.zzae(p5);
            if (v1_8 == null) {
                android.app.PendingIntent v0_2 = this.mContext.getPackageManager().getLaunchIntentForPackage(this.mContext.getPackageName());
                if (v0_2 == null) {
                    android.util.Log.w("FirebaseMessaging", "No activity found to launch app");
                }
                v1_4 = v0_2;
            } else {
                android.app.PendingIntent v0_4 = new android.content.Intent("android.intent.action.VIEW");
                v0_4.setPackage(this.mContext.getPackageName());
                v0_4.setData(v1_8);
                v1_4 = v0_4;
            }
        } else {
            android.app.PendingIntent v0_6 = new android.content.Intent(v1_3);
            v0_6.setPackage(this.mContext.getPackageName());
            v0_6.setFlags(268435456);
            v1_4 = v0_6;
        }
        android.app.PendingIntent v0_14;
        if (v1_4 != null) {
            v1_4.addFlags(67108864);
            android.app.PendingIntent v0_10 = new android.os.Bundle(p5);
            com.google.firebase.messaging.FirebaseMessagingService.zzq(v0_10);
            v1_4.putExtras(v0_10);
            int v2_4 = v0_10.keySet().iterator();
            while (v2_4.hasNext()) {
                android.app.PendingIntent v0_16 = ((String) v2_4.next());
                if ((v0_16.startsWith("gcm.n.")) || (v0_16.startsWith("gcm.notification."))) {
                    v1_4.removeExtra(v0_16);
                }
            }
            v0_14 = android.app.PendingIntent.getActivity(this.mContext, this.zzngh.incrementAndGet(), v1_4, 1073741824);
        } else {
            v0_14 = 0;
        }
        return v0_14;
    }

Method android.content.Intent.setData() not found.

[TAINT] String 'gcm.n.' ==>>> Sink '['Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V', '0', 'IPC_SINK']' [[('Lcom/google/firebase/messaging/zza;', 'zzt', '(Landroid/os/Bundle;)Landroid/app/PendingIntent;'), ('Landroid/content/Intent;', '<init>', '(Ljava/lang/String;)V')]]

Use of a string value gcm.n. to construct an Intent

Method com.google.firebase.messaging.zza.zzt():


    private final android.app.PendingIntent zzt(android.os.Bundle p5)
    {
        java.util.Set v1_4;
        java.util.Set v1_3 = com.google.firebase.messaging.zza.zze(p5, "gcm.n.click_action");
        if (android.text.TextUtils.isEmpty(v1_3)) {
            java.util.Set v1_8 = com.google.firebase.messaging.zza.zzae(p5);
            if (v1_8 == null) {
                android.app.PendingIntent v0_2 = this.mContext.getPackageManager().getLaunchIntentForPackage(this.mContext.getPackageName());
                if (v0_2 == null) {
                    android.util.Log.w("FirebaseMessaging", "No activity found to launch app");
                }
                v1_4 = v0_2;
            } else {
                android.app.PendingIntent v0_4 = new android.content.Intent("android.intent.action.VIEW");
                v0_4.setPackage(this.mContext.getPackageName());
                v0_4.setData(v1_8);
                v1_4 = v0_4;
            }
        } else {
            android.app.PendingIntent v0_6 = new android.content.Intent(v1_3);
            v0_6.setPackage(this.mContext.getPackageName());
            v0_6.setFlags(268435456);
            v1_4 = v0_6;
        }
        android.app.PendingIntent v0_14;
        if (v1_4 != null) {
            v1_4.addFlags(67108864);
            android.app.PendingIntent v0_10 = new android.os.Bundle(p5);
            com.google.firebase.messaging.FirebaseMessagingService.zzq(v0_10);
            v1_4.putExtras(v0_10);
            int v2_4 = v0_10.keySet().iterator();
            while (v2_4.hasNext()) {
                android.app.PendingIntent v0_16 = ((String) v2_4.next());
                if ((v0_16.startsWith("gcm.n.")) || (v0_16.startsWith("gcm.notification."))) {
                    v1_4.removeExtra(v0_16);
                }
            }
            v0_14 = android.app.PendingIntent.getActivity(this.mContext, this.zzngh.incrementAndGet(), v1_4, 1073741824);
        } else {
            v0_14 = 0;
        }
        return v0_14;
    }

Method android.content.Intent.<init>() not found.

[TAINT] String 'gcm.notification.' ==>>> Sink '['Landroid/content/Intent;', 'setData', '(Landroid/net/Uri;)Landroid/content/Intent;', '0', 'IPC_SINK']' [[('Lcom/google/firebase/messaging/zza;', 'zzt', '(Landroid/os/Bundle;)Landroid/app/PendingIntent;'), ('Landroid/content/Intent;', 'setData', '(Landroid/net/Uri;)Landroid/content/Intent;')]]

Use of a string value gcm.notification. to construct an Intent

Method com.google.firebase.messaging.zza.zzt():


    private final android.app.PendingIntent zzt(android.os.Bundle p5)
    {
        java.util.Set v1_4;
        java.util.Set v1_3 = com.google.firebase.messaging.zza.zze(p5, "gcm.n.click_action");
        if (android.text.TextUtils.isEmpty(v1_3)) {
            java.util.Set v1_8 = com.google.firebase.messaging.zza.zzae(p5);
            if (v1_8 == null) {
                android.app.PendingIntent v0_2 = this.mContext.getPackageManager().getLaunchIntentForPackage(this.mContext.getPackageName());
                if (v0_2 == null) {
                    android.util.Log.w("FirebaseMessaging", "No activity found to launch app");
                }
                v1_4 = v0_2;
            } else {
                android.app.PendingIntent v0_4 = new android.content.Intent("android.intent.action.VIEW");
                v0_4.setPackage(this.mContext.getPackageName());
                v0_4.setData(v1_8);
                v1_4 = v0_4;
            }
        } else {
            android.app.PendingIntent v0_6 = new android.content.Intent(v1_3);
            v0_6.setPackage(this.mContext.getPackageName());
            v0_6.setFlags(268435456);
            v1_4 = v0_6;
        }
        android.app.PendingIntent v0_14;
        if (v1_4 != null) {
            v1_4.addFlags(67108864);
            android.app.PendingIntent v0_10 = new android.os.Bundle(p5);
            com.google.firebase.messaging.FirebaseMessagingService.zzq(v0_10);
            v1_4.putExtras(v0_10);
            int v2_4 = v0_10.keySet().iterator();
            while (v2_4.hasNext()) {
                android.app.PendingIntent v0_16 = ((String) v2_4.next());
                if ((v0_16.startsWith("gcm.n.")) || (v0_16.startsWith("gcm.notification."))) {
                    v1_4.removeExtra(v0_16);
                }
            }
            v0_14 = android.app.PendingIntent.getActivity(this.mContext, this.zzngh.incrementAndGet(), v1_4, 1073741824);
        } else {
            v0_14 = 0;
        }
        return v0_14;
    }

Method android.content.Intent.setData() not found.

[TAINT] String 'gcm.n.' ==>>> Sink '['Landroid/content/Intent;', 'setData', '(Landroid/net/Uri;)Landroid/content/Intent;', '0', 'IPC_SINK']' [[('Lcom/google/firebase/messaging/zza;', 'zzt', '(Landroid/os/Bundle;)Landroid/app/PendingIntent;'), ('Landroid/content/Intent;', 'setData', '(Landroid/net/Uri;)Landroid/content/Intent;')]]

Use of a string value gcm.n. to construct an Intent

Method com.google.firebase.messaging.zza.zzt():


    private final android.app.PendingIntent zzt(android.os.Bundle p5)
    {
        java.util.Set v1_4;
        java.util.Set v1_3 = com.google.firebase.messaging.zza.zze(p5, "gcm.n.click_action");
        if (android.text.TextUtils.isEmpty(v1_3)) {
            java.util.Set v1_8 = com.google.firebase.messaging.zza.zzae(p5);
            if (v1_8 == null) {
                android.app.PendingIntent v0_2 = this.mContext.getPackageManager().getLaunchIntentForPackage(this.mContext.getPackageName());
                if (v0_2 == null) {
                    android.util.Log.w("FirebaseMessaging", "No activity found to launch app");
                }
                v1_4 = v0_2;
            } else {
                android.app.PendingIntent v0_4 = new android.content.Intent("android.intent.action.VIEW");
                v0_4.setPackage(this.mContext.getPackageName());
                v0_4.setData(v1_8);
                v1_4 = v0_4;
            }
        } else {
            android.app.PendingIntent v0_6 = new android.content.Intent(v1_3);
            v0_6.setPackage(this.mContext.getPackageName());
            v0_6.setFlags(268435456);
            v1_4 = v0_6;
        }
        android.app.PendingIntent v0_14;
        if (v1_4 != null) {
            v1_4.addFlags(67108864);
            android.app.PendingIntent v0_10 = new android.os.Bundle(p5);
            com.google.firebase.messaging.FirebaseMessagingService.zzq(v0_10);
            v1_4.putExtras(v0_10);
            int v2_4 = v0_10.keySet().iterator();
            while (v2_4.hasNext()) {
                android.app.PendingIntent v0_16 = ((String) v2_4.next());
                if ((v0_16.startsWith("gcm.n.")) || (v0_16.startsWith("gcm.notification."))) {
                    v1_4.removeExtra(v0_16);
                }
            }
            v0_14 = android.app.PendingIntent.getActivity(this.mContext, this.zzngh.incrementAndGet(), v1_4, 1073741824);
        } else {
            v0_14 = 0;
        }
        return v0_14;
    }

Method android.content.Intent.setData() not found.