Extract API keys from all 26 APKs

[kndhjk]

Task

Scan all 26 APKs in apks/ to find hardcoded API keys, tokens, and secrets.

Steps

1. Run python3 scripts/batch_scan.py for initial automated scan
2. For APKs with native libraries, extract strings from .so files
3. For obfuscated strings, write decoders (XOR, Base64, custom)
4. Document findings in analysis/batch_report.md

Priority APKs (most likely to have keys)

• 404-new-era — has XOR obfuscation, known API endpoints
• mcdonald-manager — React Native, 97MB, likely has embedded keys
• code-blooded — 59MB, large app
• gg-bond — 55MB, large app
• study-hard — 18MB, has native lib

Deliverables

• analysis/batch_scan_results.json — automated scan output
• analysis/batch_report.md — human-readable summary
• Per-APK analysis in analysis/<apk_name>/