Free Case Study · APK Reverse Engineering
Duolingo APK Analysis
How we decompiled Duolingo (com.duolingo) to map its
IronSource-centered ad mediation, Kotlin + Compose + Unity hybrid stack,
and full API surface - the same depth you get for any Google Play competitor via AppXray.
Key findings at a glance
- IronSource mediation hub with 3,952+ class references - routing Unity Ads, Vungle, Moloco, AdMob, Meta AN, and Pangle through a single mediation stack.
- Facebook Audience Network as hidden DEX -
audience_network.dex(~5 MB) lazy-loaded fromassets/for cold-start optimization. - 7+ ad networks for free-tier monetization, plus Google Play Billing for Super / Plus subscriptions (no RevenueCat).
- Staging APIs in production -
android-api-stage,goals-api-stage,goals-api-stage-2/3,infra-edge-gateway-stage-cf. - Kotlin + Jetpack Compose primary UI (4,000+ Compose refs); Unity runtime for chess and select game modules.
- Adjust attribution; Sentry with a dedicated
duolingo-sentry.sentry.iotenant and session-replay URLs. - China split -
android-api.duolingo.cnalongside globalandroid-api.duolingo.com. - First-party ad surfaces -
CustomNativeAdActivity,FullscreenNetworkNativeAdActivity,PlusPromoVideoActivity(session-end upsell).
Architecture overview
Duolingo is a large native Android app built primarily with Kotlin + Jetpack Compose. Select experiences (chess, certain interactive modules) run inside an embedded Unity runtime. Multi-DEX (11 files), ProGuard enabled, R8-style obfuscation, XAPK split delivery.
| Module | Technology |
|---|---|
| Lessons, profile, leagues, onboarding, Plus flows | Kotlin + Jetpack Compose |
| Networking | OkHttp + Retrofit, Cronet for streaming |
| Local persistence | Room, DataStore |
| Audio / video | ExoPlayer (lessons, promos, TTS) |
| Animations | Lottie + Rive (modular_rive_lily.json, CDN Lottie) |
| Game / interactive modules | Embedded Unity (UnityActivity, UnityPlayerGameActivity) |
| Monetization | Google Play Billing + IronSource mediation |
| Component counts | 242 Activities, 17 Services, 11 DEX |
Ad networks & mediation
This is what detect IronSource mediation in APK and Android ad waterfall analysis look like in practice - all networks plus how they wire into a single mediation hub.
| Network | Role |
|---|---|
| IronSource (LevelPlay) | Mediation hub - 3,952+ class references in bytecode |
| Unity Ads | Rewarded + interstitial via Unity / IronSource |
| Vungle | Video; mediation adapter |
| Moloco | Performance / programmatic |
| Google AdMob | Banner, interstitial, rewarded, native |
| Meta Audience Network | Runtime-loaded audience_network.dex (~5 MB) |
| Pangle (ByteDance) | High fill for Asian traffic |
First-party ad surfaces include CustomNativeAdActivity, FullscreenNetworkNativeAdActivity, and a
dedicated PlusPromoVideoActivity for session-end Super/Plus upsell - ad UX is partly first-party, partly mediation-driven.
API endpoints extracted from APK
Example of extract API endpoints from an Android app - first-party gateway, regional split (global vs China), dedicated subsystems (goals, sessions, Sentry), and multiple staging hosts left in the production build.
| Endpoint | Purpose |
|---|---|
android-api.duolingo.com | Primary global API gateway |
android-api.duolingo.cn | China region API |
goals-api.duolingo.com | Daily goals / streak service |
sessions.duolingo.com | Lesson session state |
infra-edge-gateway.duolingo.com | Edge gateway (Cloudflare-fronted) |
duolingo-sentry.sentry.io | Dedicated Sentry tenant (incl. session replay) |
android-api-stage.duolingo.com | Staging API - exposed in production |
goals-api-stage-2.duolingo.com | Staging goals service - exposed in production |
Full report lists all extracted endpoints plus third-party ad/analytics domains.
SDK list (sample)
Third-party SDKs categorized in the full report - ads, analytics, auth, attribution, runtimes. Highlights:
Same depth for your competitor
Get a Duolingo-level report for any app
Send a Google Play link. Full APK decompilation, SDK detection, ad mediation analysis, and API extraction - PDF + Markdown in 2 hours. From $29 per app.