Required checklist
Feature category
API or data
Use case
Title: [Feature Request/Cleanup]: Purging residual telemetry strings and dead framework packages in v5.1.6
Hi,
I am writing to provide constructive feedback regarding the static codebase and resource footprint of GameHub Lite version 5.1.6. As part of a standard pre-installation audit, I processed this build through an automated behavioral sandbox environment. While live on-device testing confirms that the application operates safely and cleanly without actively prompting the user for invasive runtime permissions, the underlying binary continues to trigger severe high-risk alerts on threat intelligence platforms.
Because the explicit goal of the GameHub Lite project is to provide a privacy-conscious, streamlined alternative to the heavily monitored original XiaoJi base app, these persistent framework leftovers create significant friction for users attempting to verify the integrity of your releases. The automated scanner flagged numerous "Suspicious Indicators" that are clearly dead code artifacts and residual string packages inherited from the unpatched original application structure.
Specifically, the sandbox logs flagged compiled, inactive class paths referencing the android.location.LocationManager API framework—including explicit commands for getLatitude and getLongitude. Additionally, static analysis detected compiled telephony subsystems (READ_PHONE_STATE) designed to harvest unique physical hardware identifiers like the IMEI and ESN, alongside dormant media configuration strings capable of executing background audio capture (RECORD_AUDIO).
Beyond these high-privilege hooks, the binary maintains an incredibly broad compiled network footprint, containing references to 461 unique URLs and 55 distinct remote IP destinations. While the application does not execute outbound telemetry floods during a live gaming session, the presence of these dead tracker domains (likely lingering analytics modules like Umeng, JPush, or original corporate check-in nodes) triggers immediate classification as aggressive grayware by multi-engine scanners. Automated platforms also flagged structural capabilities for background process manipulation and Wi-Fi parameter modification, which look like environment exploitation tactics to an AI scanner despite being inactive.
To maintain technical accuracy, the report also generated standard development noise—such as Java Reflection warnings (Method.invoke) within the official androidx layout libraries and a malware delivery alert targeting a raw GitHub asset domain. While these specific elements are easily dismissed as benign false positives stemming from standard Google UI dependencies and the open-source FastAdapter library, the actual telemetry frameworks and hardware tracking hooks represent a distinct structural issue.
Therefore, I would like to officially request a dedicated cleanup pass in upcoming development cycles to completely purge, stub out, or refactor these dead Smali and Java classes rather than simply disabling them. Deleting these leftover tracking signatures and removing the hundreds of un-utilized URL strings from the asset files will dramatically lower the application's perceived threat profile. Ensuring that the binary is completely clean of residual framework code will provide total transparency to the community, reassure privacy-conscious users, and allow the project to cleanly pass automated security audits without triggering false alarms.
Thank you for your hard work, dedication, and continued maintenance of this project for the community.
Proposed change
I want a clean apk with no code malicous or suspicous code left.
Alternatives tried
Turning off wifi but it still sends some data.
Affected devices or SoCs
All devices are affected
Additional context
If you Can :
Remove bigseyes tracker . ( It still shows).
If you havent done it :replace gamehubs emulation tools with safe ones.
And finaly: check for injections , i am suspicous of it injecting .
Required checklist
Feature category
API or data
Use case
Title: [Feature Request/Cleanup]: Purging residual telemetry strings and dead framework packages in v5.1.6
Hi,
I am writing to provide constructive feedback regarding the static codebase and resource footprint of GameHub Lite version 5.1.6. As part of a standard pre-installation audit, I processed this build through an automated behavioral sandbox environment. While live on-device testing confirms that the application operates safely and cleanly without actively prompting the user for invasive runtime permissions, the underlying binary continues to trigger severe high-risk alerts on threat intelligence platforms.
Because the explicit goal of the GameHub Lite project is to provide a privacy-conscious, streamlined alternative to the heavily monitored original XiaoJi base app, these persistent framework leftovers create significant friction for users attempting to verify the integrity of your releases. The automated scanner flagged numerous "Suspicious Indicators" that are clearly dead code artifacts and residual string packages inherited from the unpatched original application structure.
Specifically, the sandbox logs flagged compiled, inactive class paths referencing the
android.location.LocationManagerAPI framework—including explicit commands forgetLatitudeandgetLongitude. Additionally, static analysis detected compiled telephony subsystems (READ_PHONE_STATE) designed to harvest unique physical hardware identifiers like the IMEI and ESN, alongside dormant media configuration strings capable of executing background audio capture (RECORD_AUDIO).Beyond these high-privilege hooks, the binary maintains an incredibly broad compiled network footprint, containing references to 461 unique URLs and 55 distinct remote IP destinations. While the application does not execute outbound telemetry floods during a live gaming session, the presence of these dead tracker domains (likely lingering analytics modules like Umeng, JPush, or original corporate check-in nodes) triggers immediate classification as aggressive grayware by multi-engine scanners. Automated platforms also flagged structural capabilities for background process manipulation and Wi-Fi parameter modification, which look like environment exploitation tactics to an AI scanner despite being inactive.
To maintain technical accuracy, the report also generated standard development noise—such as Java Reflection warnings (
Method.invoke) within the officialandroidxlayout libraries and a malware delivery alert targeting a raw GitHub asset domain. While these specific elements are easily dismissed as benign false positives stemming from standard Google UI dependencies and the open-sourceFastAdapterlibrary, the actual telemetry frameworks and hardware tracking hooks represent a distinct structural issue.Therefore, I would like to officially request a dedicated cleanup pass in upcoming development cycles to completely purge, stub out, or refactor these dead Smali and Java classes rather than simply disabling them. Deleting these leftover tracking signatures and removing the hundreds of un-utilized URL strings from the asset files will dramatically lower the application's perceived threat profile. Ensuring that the binary is completely clean of residual framework code will provide total transparency to the community, reassure privacy-conscious users, and allow the project to cleanly pass automated security audits without triggering false alarms.
Thank you for your hard work, dedication, and continued maintenance of this project for the community.
Proposed change
I want a clean apk with no code malicous or suspicous code left.
Alternatives tried
Turning off wifi but it still sends some data.
Affected devices or SoCs
All devices are affected
Additional context
If you Can :
Remove bigseyes tracker . ( It still shows).
If you havent done it :replace gamehubs emulation tools with safe ones.
And finaly: check for injections , i am suspicous of it injecting .