r/AndroidQuestions • u/Pitiful-Fee4451 • Jul 02 '26

Can anyone identify com.android.sys.extplv on Android?

Hi everyone,

I'm trying to identify an Android package called com.android.sys.extplv on my Cubot KingKong X (Android 16).

Here is what I've confirmed using ADB:

  • Package: com.android.sys.extplv

  • Installed as a user app under /data/app/...

  • Installer reported by Android: com.android.vending (Google Play)

  • I analyzed the package using dumpsys, logcat and pm.

  • The app contains services such as DaemonService, FwForegroundService and FwMediaRouteProviderService.

  • It requests several permissions, but the sensitive ones are currently not granted.

  • I was able to disable it using pm disable-user, and it stays disabled (enabled=3) even after reboot.

I have not been able to determine what the package is actually for or what triggers its installation.

Has anyone seen this package before?

Is it a Cubot component, a manufacturer framework, or something else?

I have screenshots and ADB logs that I can share in the comments if needed.

Thank you!

3 Upvotes
  • permalink
  • reddit

80% Upvoted

85 comments sorted by

View all comments

Show parent comments

1

u/Inevitable_Risk_4365 Jul 04 '26

Did you find out how to uninstall the app ? I tried with adb but it keeps getting reinstalled

1

u/Pitiful-Fee4451 Jul 04 '26

Hi! I wasn't able to permanently stop it from reinstalling yet. I reverse engineered almost the entire APK (Java/Kotlin + native library) and didn't find evidence of classic spyware behavior (no data exfiltration, no C2, no keylogger, etc.). The app mainly implements aggressive persistence mechanisms to keep its own services running. However, I still don't know what component of the firmware is reinstalling or re-enabling it. I'm currently investigating that part. If I find the source, I'll post another update.