Alexis Brignoni🪫 on Mythryl: “📱 Eight years after my Android UsageStats posts, the XML became…”

📱 Eight years after my Android UsageStats posts, the XML became protobuf, 4 event types became 32, and ALEAPP now parses all of it. ⚠️ ACTIVITY_RESUMED is not "the user tapped the app." It is a lifecycle state. leapps.org/blog-post?post=2026-08-03-android-usagestats-recent-tasks #DFIR

leapps.orgEvery Step You Take, Eight Years Later: Android UsageStats and Recent Tasks — LEAPPs BlogAndroid's pattern-of-life evidence grew from readable XML into tokenized protobufs carrying app lifecycle, lock state, notifications, services, task roots, and more. We went back to the source, update...

4/8/26, 4:03 am0 reposts1 like

Post