Help tracing Samsung Photo Editor Generative Edit call chain

[Pfeckert]

I’m trying to reverse-engineer the normal Generative Edit / object-removal workflow in Samsung Photo Editor for interoperability with another Android/web-based field application.
Package: com.sec.android.mimage.photoretouching
Version: 3.8.24.16
The goal is:
my app → original image + user removal mask → Samsung Generative Edit / AI service → edited image → back to my app
We have already identified:
protobuf image-edit request/response structures
an EditDataRequest
request fields including base_image, mask_image, sample_count, and service_version
response fields for the generated image, patching mask, image number, model alias, and debug data
Samsung SCS Vision / gRPC infrastructure
ScsVisionStream and ScsVisionUnary
vision endpoint family including scs-vision-use2.bixbyllm.com
config/service-discovery traffic involving scs-config-use2.bixbyllm.com
Samsung package/device/auth metadata handling
Imagen-related references including IMAGEN_2 and IMAGEN_3
What is still missing is the exact runtime call chain:
Generative Edit UI action → mask/base-image preparation → EditDataRequest builder → Samsung vision client → gRPC call → response handler
I’m specifically trying to identify which class/function constructs the request, how the mask and image are encoded, where service/model selection happens, and how the final edited image is returned or committed.
I am not trying to bypass Samsung authentication, credentials, billing, or security. If there is an exported Activity, Intent, framework API, or supported handoff mechanism that already allows interoperability, that would be preferable.
If anyone has experience with JADX, smali, protobuf, gRPC, Samsung framework internals, JNI/native tracing, or Frida, I’d appreciate help tracing the remaining call path.

[jpstotz]

There are two approaches I would recommend:

1. Static approach: Decompile the app with apktool and load the decompiled code into a workspace of an AI (Claude Desktop, Copilot, ..) and ask your questions. I wouldn't use Jadx for that as Jadx can fail to decompile some methods and others may not be 100% regarding the decompiled code. AIs don't have problems reading Smali and Smali is 100% accurate.,.

2. Dynamic approach: use a rooted Samsung phone and hook the relevant functions using frida/frida-trace. Live on-demand generated data and structures are always best when trying to understand data structures and what they contain... Jadx-GUI can be used to identify functions to be hooked.