ShareChat Reverse Engineered

What this article covers

This is a static, artifact-backed reconstruction of the supplied ShareChat Android package. The observations come from the APK itself: its decoded manifest, archive inventory, signing metadata, resource table, DEX string pool, and package-level tooling. The package was not launched, logged into, attached to a device, or modified. Accordingly, this is a design-document view of the shipped surface and declared integrations—not a claim that every declared path was exercised at runtime.

Artifact identity

The analyzed file is in.mohalla.sharechat-264104.apk.

Property	Observed value
Package ID	`in.mohalla.sharechat`
Application label	ShareChat
Version name	`2026.41.4`
Version code	`264104`
APK size	97,961,667 bytes
APK SHA-256	`f606756d85229edf80af3f40c15a59784cce7566036b845b1076bf48edd65fcb`
Minimum SDK	24
Target SDK	35
DEX files	9 (`classes.dex` through `classes8.dex`)
Flutter AOT payload	Not detected
Native library entries	0 in the APK archive

The version code is the decimal representation of the manifest’s hexadecimal value 0x407a8. The version name and SDK declarations come from the binary manifest as decoded by Android tooling.

Signing and provenance metadata

The APK contains Android Signature Scheme v2 and v3 blocks. The installed apksigner independently reports v2 and v3 verification as true, v1, v3.1, and v4 as false, and Source Stamp verification as true.

The declared application signer is an RSA certificate with this SHA-256 fingerprint:

7057f0c211efdafad1c9ddcf94151cd4b7645118032540c24cdc2f76b5d4927a

Its declared subject is CN=Bhanu Singh, O=Mohalla Inc, L=Kanpur, ST=Uttar Pradesh, C=91. The certificate validity dates declared in the APK are 17 September 2014 through 9 September 2044. The APK’s Source Stamp certificate has fingerprint 3257d599a49d2c961a471ca9843f59d341a405884583fc087df4237b733bbd6d and is declared as an Android/Google certificate.

These are identity and integrity observations, not a statement about the commercial authenticity of the publisher. Static certificate inspection does not establish trust, revocation status, or runtime behavior.

Product shape visible in the package

The manifest and package namespaces describe a broad social product organized around several connected surfaces:

a home/feed shell and deep-link dispatcher;
language selection and language-change flows;
login and OTP-related handling;
profiles, profile editing, labels, moods, follow requests, and notifications;
posts, comments, image viewing, text posts, templates, drafts, and saved-draft upload;
camera capture, gallery selection, cropping, image editing, video editing, transcoding, music selection, and media playback;
direct messaging, friend-zone features, chat-feed settings, and chat-room experiences;
live/audio chat, room themes, battles, leaderboards, families, referrals, and consultation flows;
creator hub, creator earnings/wallet paths, virtual gifting, subscriptions, premium content, and payments;
in-app browser and WebView surfaces;
advertising, attribution, analytics, crash/performance reporting, notifications, and background work.

The named application class is in.mohalla.sharechat.MyApplication. The package also declares a cold-start initializer, Firebase messaging service, notification action receiver, file provider, download notification service, upload/profile services, media services, MQTT service, and multiple foreground services associated with chat and consultation features.

Navigation and entry points

The manifest exposes sharechat.feature.home.main.DeeplinkHandlerActivity as an exported browser-facing entry point. Declared schemes and hosts include:

sharechat://open;
https://sharechat.onelink.me/3i9Y...;
http and https ShareChat links;
sharechat.com and sharechat.co paths for actions, profiles, tags, posts, creator hub, creator earnings, creator wallet, classified listings, chat rooms, friends, families, livestreams, tournaments, achievements, rewards, and related surfaces;
https://b.sharechat.com links.

The package also declares launcher aliases for seasonal/default entry variants: EvaActivityDefault, EvaActivityDiwali, EvaActivityNavratri, and EvaActivityInactive. This is a manifest-level design: the shipped package supports selecting among launcher aliases rather than proving which alias a particular installation currently enables.

The primary home activity is in.mohalla.sharechat.home.main.HomeActivity. Other notable entry activities include SplashActivityV2, LanguageSelectActivity, LoginActivity, ComposeActivity, DefaultComposeNavActivity, PostActivity, VideoPlayerActivity, VideoPlayerV2Activity, MusicFeedActivity, NotificationActivity, CreatorHubActivity, ChatRoomActivity, DmActivity, and WebViewActivity.

Content creation pipeline

The declared creation surface is more than a single composer. The package contains separate activities and services for:

1. camera capture and preview; 2. gallery browsing and image selection; 3. crop and image preview; 4. text-post creation and text-post templates; 5. music selection; 6. image editing; 7. video editing and video drafts; 8. transcoding; 9. saved-draft upload; 10. post upload in a dedicated PostUploadService.

This supports a practical state model: select or capture media, optionally transform it, add text/music/template content, preserve a draft, transcode where necessary, then upload asynchronously. The existence of these states is evidenced by the declared components; exact validation rules, progress UI, retry policy, and server response schemas require runtime or decompiled method evidence and are not asserted here.

Social and communication surfaces

The package names expose direct messaging (DmActivity, DMActivityV2, recipient and share-post activities), chat-feed browsing, archive/settings screens, and friend-zone flows. Chat rooms have their own activity family for listing, creation, audio playback, themes, battles, family management, levels, invitations, leaderboards, referrals, and user listings.

The manifest also declares org.eclipse.paho.android.service.MqttService and the DEX string pool contains ssl://chatbrokers.sharechat.com:443. That is strong static evidence that an MQTT/TLS broker integration is packaged. It does not prove that every installation connects to that broker or establish the exact topic protocol.

Consultation-specific declarations include available astrologers, consultation creation/listing, birth details, host details, private consultation calling, notification actions, and foreground/notification services. These names document a distinct consultation workflow embedded in the broader chat/live system.

Media and playback

The APK declares two video-player activities, a media-player activity, video caching, file download services, and a PDF viewer. It also carries media-related permissions and feature declarations for camera and microphone use. The manifest-level design therefore covers playback, caching/download, document viewing, camera capture, and audio/video creation.

No native .so files were present under lib/< ABI >/ in the APK archive, and Flutter identification found no lib/*/libapp.so AOT payload. The package is consequently not identified here as a Flutter build. Its Kotlin metadata, AndroidX Compose markers, application namespaces, and Java/Kotlin component names indicate a predominantly Android/Kotlin-oriented package with Compose-related dependencies; the exact proportion of Views, Compose, and any embedded cross-platform modules cannot be established from filenames alone.

Permissions and Android integrations

The manifest requests or declares permissions associated with:

network and connectivity state;
camera, microphone, media, and storage access;
fine/coarse location;
Bluetooth, including BLUETOOTH_CONNECT;
notifications and full-screen intent;
wake locks, vibration, audio settings, and foreground services;
phone state, phone numbers, answering calls, and calling;
system alert windows and write-settings access;
Google Play Billing and advertising ID;
boot completion and Firebase Cloud Messaging;
Android advertising services and attribution;
package visibility and external-app integrations.

The manifest specifically includes media-specific foreground-service permissions for data sync, microphone, media playback, camera, and media projection. It also advertises camera, autofocus, front-camera, and microphone hardware features.

Permission declaration is not permission grant. Whether a permission is requested, denied, limited, or used on a particular screen is runtime-dependent.

External applications and sharing

The manifest includes package-visibility declarations for a wide set of external applications, including WhatsApp, WhatsApp Business, Telegram, LINE, Discord, Slack, Viber, Signal, Truecaller, Instagram, Facebook, multiple UPI/payment applications, and other financial or communication apps. It also declares share and view intents, camera capture, SMS/tel handling, Custom Tabs, market links, and YouTube-related flows.

This supports a sharing and external-integration design in which ShareChat can hand content or actions to installed partner applications. The manifest does not by itself prove that every listed partner is shown to users or that every integration succeeds.

Payments and creator economy

The package contains payment activities for card input, bank/wallet selection, and payment lists. The DEX string pool includes Razorpay endpoints such as https://api.razorpay.com/v1/checkout and https://api.razorpay.com/v1/payments/, as well as ShareChat wallet/coin paths and Amazon Pay assets.

Creator-facing declarations include creator hub, creator earnings program deep links, creator wallet, virtual-gifting paths, premium content gates, autopay, episodic autopay, subscription/payment listing, and AI-sharing purchase flows. These observations establish the packaged product surface. They do not establish prices, entitlements, transaction states, or server-side fulfilment rules.

Advertising, analytics, and support services

The archive contains dependency markers and package names for AndroidX, Kotlin, Kotlin coroutines, Compose, Hilt/Dagger, Room, Paging, WorkManager, Wire/gRPC runtime, Firebase, Intercom, AppsFlyer, InMobi, Vungle, Moloco, PubNative, and other advertising or telemetry-related SDKs. These markers are evidence that corresponding libraries or modules are bundled or referenced; they are not a claim that every SDK is initialized on every launch.

Observed host candidates include:

ShareChat APIs and services: apis.sharechat.com, sc-c2s-apis.sharechat.com, sc-events-apis.sharechat.com, sc-realtime-communication.sharechat.com;
ShareChat media/CDN hosts: cdn.sharechat.com, cdn4.sharechat.com, and cdn-sc-g.sharechat.com;
support and policy hosts: help.sharechat.com, privacy.sharechat.com, and mojapp.in grievance links;
payment hosts: api.razorpay.com and cdn.razorpay.com;
communication/identity hosts: Truecaller and Intercom endpoints;
advertising/mediation hosts associated with InMobi, Vungle, Moloco, PubNative, and related services;
Firebase and Google service hosts.

The APK also packages ShareChat CDN URLs for images, WebP/SVG/GIF assets, audio, and content JSON. Static URL strings do not constitute a complete API inventory: URLs may be templates, examples, SDK defaults, or feature-specific routes, and dynamic construction may hide additional endpoints.

Data and storage indicators

Room, DataStore, preferences, WorkManager, file download, video caching, draft, and upload-related markers appear in the archive and manifest/component names. The package therefore has declared building blocks for local preferences, database-backed state, queued/background work, media caching, drafts, downloads, and upload continuation.

The supplied static pass did not recover a verified local database schema, secure-storage key layout, cache schema, migration history, or conflict-resolution algorithm. Those remain unresolved until a runtime snapshot, decompiled database classes, or an app-owned test account/device trace is available.

Security observations and limits

The APK uses HTTPS URLs for the ShareChat service candidates and contains an MQTT-over-TLS broker string. The manifest and static strings alone do not establish certificate pinning, custom trust anchors, payload encryption, request signing, token refresh rules, emulator detection, or anti-tampering behavior. Those questions require focused decompilation and, where authorized, runtime/network observation.

The static inspection also did not execute the app. It therefore cannot verify screen dimensions, typography, colors, animations, accessibility behavior, loading/error states, pagination, keyboard handling, lifecycle recovery, or account-role differences. Component names provide a useful navigation and feature map, but they are not screenshots or behavioral traces.

Reproduction-oriented feature map

For an implementation that follows the shipped structure without inventing unverified details, use these bounded modules:

1. Application shell: startup initializer, splash, home, language selection, login, and deep-link dispatch. 2. Feed and content: post viewing, comments, reactions, profiles, tags, search, notifications, and status viewing. 3. Composer: camera/gallery, crop/edit, text/template posts, music, video editing, drafts, transcoding, and upload. 4. Communication: direct messages, sharing into chats, friend zone, chat feeds, rooms, audio playback, and live/consultation flows. 5. Creator and commerce: creator hub, wallet/coins, virtual gifting, premium content, subscriptions, payments, and UPI/external payment handoff. 6. Platform services: notifications, downloads, caching, Firebase messaging, background services, WebView/browser, analytics, attribution, advertising, and support.

Each module should be treated as an observed product boundary. Exact API contracts, authentication mechanics, screen-level styling, and success/failure transitions should be added only after separate evidence is collected.

Verification record

The analysis workspace contains the raw and derived evidence used for this article under sharechat-analysis/, including:

aapt-badging.txt and aapt-summary.txt;
manifest-xmltree.txt and manifest-names.txt;
apk-signature.json;
flutter-build.json;
archive-members.txt;
extracted DEX strings and filtered URL candidates;
article-evidence-summary.json.

The APK identity used throughout is SHA-256 f606756d85229edf80af3f40c15a59784cce7566036b845b1076bf48edd65fcb. Claims above are limited to those static observations and explicitly marked boundaries.

Abbie Cracks