diff --git a/README.md b/README.md
index 9bdf570..32dbd29 100644
--- a/README.md
+++ b/README.md
@@ -7,12 +7,13 @@ Reverse-engineering notes for the BullTron Android app BLE protocol.
 - App label: BullTron
 - Package: `com.inuker.bluetooth.bulltron`
 - Version analyzed: `1.1.33` / `1133001`
-- APK source: PGYER old-version download
-- APK SHA-256: `f11c49499cf226ccd6dc45e8f1780c11c4d84d785846182781886ab135b9a476`
+- XAPK source: APKPure direct download
+- XAPK SHA-256: `35388e6c2b9afeeb4bafd97df09fcb1e33427802dd98f74a2a4648099dda71ff`
+- Base APK SHA-256: `f1d486b410c1fa2fae78837fcc27a63aa16c6cb1b45f096a17c9968908add363`
 - Signer CN: `smart_daly`
 - Signer cert SHA-256: `996caf450ecdb34d0ba45d2b2c6a2df56243338c7be3b7b497168af4e3d00ae4`
 
-The APK was decompiled with apktool and JADX. JADX reported some failed methods, so a few UI mappings were cross-checked against smali.
+The XAPK was unpacked and the base APK code was verified against the separately mirrored PGYER APK: all three DEX files have identical SHA-256 hashes. The APK was decompiled with apktool and JADX. JADX reported some failed methods, so a few UI mappings were cross-checked against smali.
 
 ## Main Finding
 
diff --git a/evidence/apk-info.md b/evidence/apk-info.md
index 1f7f729..8d5e98f 100644
--- a/evidence/apk-info.md
+++ b/evidence/apk-info.md
@@ -1,14 +1,30 @@
 # APK Evidence
 
-- File analyzed locally: `bulltron-1.1.33-pgyer.apk`
-- Source: PGYER old-version download page
+- File analyzed locally: `Bulltron_1.1.33_APKPure.xapk`
+- Source: APKPure direct XAPK download
 - App package: `com.inuker.bluetooth.bulltron`
 - App label: `BullTron`
 - Version: `1.1.33` / `1133001`
-- SHA-256: `f11c49499cf226ccd6dc45e8f1780c11c4d84d785846182781886ab135b9a476`
+- XAPK SHA-256: `35388e6c2b9afeeb4bafd97df09fcb1e33427802dd98f74a2a4648099dda71ff`
+- Base APK SHA-256: `f1d486b410c1fa2fae78837fcc27a63aa16c6cb1b45f096a17c9968908add363`
 - Signer DN: `CN=smart_daly, OU=smart_daly, O=smart_daly, L=smart_daly, ST=smart_daly`
 - Signer cert SHA-256: `996caf450ecdb34d0ba45d2b2c6a2df56243338c7be3b7b497168af4e3d00ae4`
 
+The XAPK contains:
+
+- `com.inuker.bluetooth.bulltron.apk`
+- `config.arm64_v8a.apk`
+- language splits: `ar`, `de`, `en`, `es`, `fr`, `hi`, `in`, `it`, `ja`, `ko`, `my`, `pt`, `ru`, `th`, `tr`, `vi`, `zh`
+- density split: `config.xhdpi.apk`
+
+Code identity check against the separately mirrored PGYER APK:
+
+| DEX | SHA-256 |
+| --- | --- |
+| `classes.dex` | `5fcc413fbddb0ff7dd55b97da55f1c0f08d0bfb1ad6c90de61043f36c7d9afb2` |
+| `classes2.dex` | `881ef2146bf644ad6b25dca82798891c588b32a6ad096ba2a9d768a774c8ba88` |
+| `classes3.dex` | `130f23081d0c563c791b1ed41d3ceccc22cdfd9da37d004ca711808e1688a1ae` |
+
 Local decompile outputs used during analysis:
 
 - apktool output: `bulltron-ble-work/apktool-out`