<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Analyzing Mobile Push Notification Security

## FCM API
```bash
# Send notification via FCM (requires server key)
curl -X POST https://fcm.googleapis.com/fcm/send \
  -H "Authorization: key=SERVER_KEY" \
  -H "Content-Type: application/json" \
  -d '{"to": "DEVICE_TOKEN", "notification": {"title": "T", "body": "B"}}'

# Send to topic
curl -X POST https://fcm.googleapis.com/fcm/send \
  -H "Authorization: key=SERVER_KEY" \
  -H "Content-Type: application/json" \
  -d '{"to": "/topics/TOPIC", "data": {"key": "value"}}'

# FCM v1 API (OAuth2)
curl -X POST https://fcm.googleapis.com/v1/projects/PROJECT/messages:send \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"message": {"token": "DEVICE_TOKEN", "notification": {"title": "T"}}}'
```

## Frida Notification Hooks
```javascript
// Hook FirebaseMessagingService.onMessageReceived
Java.perform(function() {
    var FMS = Java.use("com.google.firebase.messaging.FirebaseMessagingService");
    FMS.onMessageReceived.implementation = function(msg) {
        console.log("[FCM] From: " + msg.getFrom());
        console.log("[FCM] Data: " + msg.getData().toString());
        var notif = msg.getNotification();
        if (notif) {
            console.log("[FCM] Title: " + notif.getTitle());
            console.log("[FCM] Body: " + notif.getBody());
        }
        this.onMessageReceived(msg);
    };
});

// Hook token retrieval
Java.perform(function() {
    var FI = Java.use("com.google.firebase.messaging.FirebaseMessaging");
    FI.getToken.implementation = function() {
        var task = this.getToken();
        console.log("[FCM] getToken called");
        return task;
    };
});
```

## ADB Notification Commands
```bash
adb shell settings get secure lock_screen_show_notifications  # Lock screen
adb shell dumpsys notification                                 # Active notifications
adb shell cmd notification list                                # List channels
adb shell dumpsys notification --noredact                      # Full content
```

## FCM Server Key Pattern
```
# Legacy server key format: AAAA followed by ~152 chars
AAAA[A-Za-z0-9:_-]{100,}

# Found in:
# - google-services.json (api_key)
# - res/values/strings.xml
# - Hardcoded in Java/Kotlin source
```
