Ok, I looked through old files and found the details. First, you need to get the file Uber_v3.86.5_apkpure.com.apk (Uber app) and decompile it. You can decompil

Ok, I looked through old files and found the details. First, you need to get the file Uber_v3.86.5_apkpure.com.apk (Uber app) and decompile it. You can decompile a later version but I cannot guarantee that all the files are still there. In case you don't have decompiling tools around, I found that someone has uploaded files from the directory 'classes/com/baidu/' here: http://rgho.st/8WlHPJC8g http://rgho.st/8WlHPJC8g To find the code that scans WiFi networks, grep the files for getScanResults which is the method name from Android API. You will find a file classes/com/baidu/android/pushservice/util/l.java (and several other files). Someone posted this file here: https://pastebin.com/6cXv2itK https://pastebin.com/6cXv2itK If you look at the method public static String a(Context paramContext, String paramString) at line 114 you'll see that it gets WiFi scan results and then does something that looks like composing a POST request to https://cp01-rdqa-dev404.cp01.baidu.com:8443/rest/2.0/zwifi/getzidwifiinfo https://cp01-rdqa-dev404.cp01.baidu.com:8443/rest/2.0/zwifi/... (which doesn't resolve currently). I didn't have time to examine the code thoroughly. By the way, the code in a paper [1] mentions a shared property named "pst": SharedPreferences localSharedPreferences = paramContext.getSharedPreferences("pst", 0); If you search Uber sources for "pst", you'll find a file classes/com/baidu/frontia/a/d/b$b.java (here: https://pastebin.com/4zDp8dSz https://pastebin.com/4zDp8dSz ) that also uses this property: localObject1 = "pst"; ... localObject1 = paramContext.getSharedPreferences((String)localObject1, 0); You can also search for "push_sync", which was mentioned in the paper, and you'll find that several files contain this string: classes/com/baidu/android/pushservice/c/b.java classes/com/baidu/android/pushservice/PushLightapp.java classes/com/baidu/android/pushservice/PushManager.java classes/com/baidu/android/pushservice/util/i.java You can also search for other keywords, for example 'http' and you'll find interesting URLs like 'http://127.0.0.1:7777/native' http://127.0.0.1:7777/native'. Finally, you can search for getSubscriberId which is an Android API method that returns an IMSI and you'll also find several matches: classes/com/baidu/location/h/b.java classes/com/baidu/platform/comapi/util/f.java classes/com/baidu/vi/VDeviceAPI.java classes/com/baidu/android/pushservice/message/f.java [1] https://www.virusbulletin.com/virusbulletin/2018/03/vb2016-paper-wild-android-collusions/ https://www.virusbulletin.com/virusbulletin/2018/03/vb2016-p...