How Qingting FM Tricks DAU Metrics: Inside Its Hidden Android Processes

Qingting FM teaches how to boost DAU and cheat analytics platforms

Summary

After examining Qingting FM’s source code, the overall working principle can be summarized:

The app silently starts several background processes, pushing the device’s battery usage to the limit so the app stays alive in the background.

A persistent component periodically executes a “Prometheus logic” that opens a transparent, invisible UI, even when the screen is off, to inflate daily active user (DAU) counts.

This logic sends a notification to third‑party analytics services claiming the user opened the app, thereby increasing reported DAU.

The inflated DAU numbers are reported to investors, creating the illusion of massive user growth.

Investors are consequently misled into funding a fraudulent operation.

As Android developers, we should avoid such practices and warn analytics providers and investors.

Specific steps

First, observe the number of processes the app runs after launch:

The app runs five inter‑guarded processes that cannot be fully killed. Decompiling the APK reveals a key service named NotificationService :

Its manifest entry:

<service android:name=".NotificationService" android:process=":notification">
    <intent-filter>
        <action android:name="fm.qingting.qtradio.NotificationService" />
        <category android:name="android.intent.category.DEFAULT" />
    </intent-filter>
</service>

In onCreate, NotificationService calls MessageManager.restartThread, which starts a MessageThread:

The thread runs execPrometheus, which eventually invokes doPrometheus. This method launches a transparent ShieldActivity that self‑destructs after two seconds:

The invisible activity triggers API calls to third‑party analytics (Umeng, TalkingData, iResearch), making them count the app as active.

How Qingting FM inflates ad metrics

The app also contains a Zeus class that manipulates ad impressions:

Zeus creates a hidden WebView (not attached to any UI) and loads advertiser URLs in the background. Two key methods, setZeusUrl() and startZeus(), drive this behavior:

After loading the page, the app programmatically simulates user clicks, causing ad impression and click counts to skyrocket.

The ThirdTracker class sends the fabricated data to various ad‑monitoring platforms (e.g., 秒针, AdMaster, DoubleClick):

The trigger chain originates from RootNode.onClockTime, propagates through ClockManager.dispatchClockEvent, and finally reaches the hidden WebView.

Qingting FM APK decompilation tutorial (v5.0.1)

Step 1: Extract classes.dex from the APK (APK is essentially a zip file).

Step 2

Download dex2jar and run d2j-dex2jar.bat classes.dex <output‑jar> to convert the dex file to a jar.

The resulting classes-dex2jar.jar contains the decompiled bytecode.

Step 3

Download JD‑GUI, open the jar, and browse Qingting FM’s source code.

The analysis demonstrates how the app manipulates DAU and ad metrics, highlighting serious ethical and security concerns for developers, analysts, and investors.