Android Services Black Magic
by Aleksandar (Saša) Gargenta, Marakana Inc.


            Android Builders Summit
              February 14th, 2012
             Redwood Shores, CA

                  Screencast @
              http://mrkn.co/munz7
About
Aleksandar (Saša) Gargenta
 •   Developer and instructor of Android Internals and Security training at Marakana
 •   Founder and co-organizer of San Francisco Android User Group (sfandroid.org)
 •   Founder and co-organizer of San Francisco Java User Group (sfjava.org)
 •   Co-founder and co-organizer of San Francisco HTML5 User Group (sfhtml5.org)
 •   Speaker at AnDevCon, AndroidOpen, Android Builders Summit, etc.
 •   Server-side Java and Linux, since 1997
 •   Android/embedded Java and Linux, since 2009
 •   Worked on SMS, WAP Push, MMS, OTA provisioning in previous life
 •   @agargenta on Twitter
 •   aleksandar.gargenta@gmail.com on Google+




Marakana - Helping people get better at what they do
 •   Training on cutting edge open source software (like Android!)
 •   Rockstar team of experts, on staff
 •   Content is king
 •   http://marakana.com/
Android Stack
                               Applications

                                                                        Content
   Home         Contacts           Phone          Browser
                                                                       Providers


                           Application Framework

  Activity      Window             Vibrator            WiFi               Battery
  Service       Service            Service            Service             Service

 Package       Telephony          Resource            Location         Notification
 Service        Service           Manager             Service           Service


                               Native Layer
Surface        Media                                             Android Runtime
                              SQLite           SSL
Flinger      Framework

                                                                    Core Libs
OpenGL         vold            netd           WebKit

                                                                      Dalvik
 libwifi      libcamera         libgps          libc                    VM




   Display       Camera        Linux Kernel             GPS               Binder
   Driver         Driver                                Driver            Driver

   Keypad         WiFi                                  Audio             Power
    Driver        Driver                                Driver            Mgmt
Vibrator on Android
                                                                                               com.example.app (/data/app/ExampleApp.apk)                                                                                                                          system_server

                                                                                                                DalvikVM                                                                                                                                              DalvikVM

                                                                                                               classes.dex                                                                                                                              /system/framework/framework.jar

                                                                                                    com.example.app.ExampleActivity                                                                                                                      android.os.IVibratorService.Stub




                                                                                                                                                                                                                                                                                                          extends
                                                    calls




                                                                                                     /system/framework/framework.jar                                                                                                                      /system/framework/services.jar




                                                                                                                                                              registers "vibrator" service via ServiceManager
                                                                                                           android.os.Vibrator                                                                                                                           com.android.server.SystemServer




                                                                                                                                                                                                                 creates
                                                                                                                                              calls
                                                                                                  android.os.IVibratorService.Stub.Proxy                                                                                                                com.android.server.VibratorService
                                                          looks up "vibrator" service via SM




                                                                                                                                                                                                                                                                                                          calls/links to
gets a reference to the ServiceManager (handle=0)




                                                                                                                                                                                                                                                         /system/lib/libandroid_servers.so
                                                                                                     /system/lib/libandroid_runtime.so




                                                                                                                                                                                                                references
                                                                                                                                               uses (calls)
                                                                                                                                                                                                                                                    com_android_server_VibratorService.cpp
                                                                                                          /system/lib/libbinder.so




                                                                                                                                                                                                                                                                                                        calls
                                                                                                            /system/lib/lib*.so                                                                                                                         /system/lib/libhardware_legacy.so
                                                                                                                                                                                                                                                                      vibrator.c




                                                                                                                                                                                                                             invokes transaction




                                                                                                                                                                                                                                                                                                       uses (io write)
                                                                                                       /system/bin/servicemanager                                                                                                                        /system/lib/libandroid_runtime.so

                                                                                                            service_manager.c                                                                                                                                  /system/lib/libbinder.so
                                                    references




                                                                                                             /system/lib/lib*.so                                                                                                                                  /system/lib/lib*.so



                                                                                                                   /dev/binder                                                                                                                        /sys/class/timed_output/vibrator/enable
                                                                                                                                                              Kernel
                                                    registers as binder context manager
                                                                                                                                                                                                                                                   gets a reference to the ServiceManager (handle=0)
Power on Android
                                                                                            com.example.app (/data/app/ExampleApp.apk)                                                                                                                 system_server

                                                                                                             DalvikVM                                                                                                                                     DalvikVM
                                                                                                                                                                                                                                             /system/framework/framework.jar
                                                                                                            classes.dex
                                                                                                                                                                                                                                              android.os.IPowerManager.Stub
                                                                                                 com.example.app.ExampleActivity
                                                                                                                                                                                                                                                      android.os.Power
                                                    calls




                                                                                                                                                                                                                                                                                                                  calls
                                                                                                  /system/framework/framework.jar                                                                                                             /system/framework/services.jar




                                                                                                                                                                                                                                                                                     extends
                                                                                                                                              creates

                                                                                                                                                           registers "power" service via ServiceManager
                                                                                                    android.os.PowerManager                                                                                                                  com.android.server.SystemServer




                                                                                                                                                                                                           creates
                                                                                                android.os.PowerManager.WakeLock                                                                                                            com.android.server.PowerManagerService
                                                          looks up "power" service via SM




                                                                                                                                                                                                                                                                                               calls/links to
gets a reference to the ServiceManager (handle=0)




                                                                                               android.os.IPowerManager.Stub.Proxy        calls

                                                                                                                                                                                                                                             /system/lib/libandroid_runtime.so
                                                                                                  /system/lib/libandroid_runtime.so




                                                                                                                                                                                                          references
                                                                                                                                                                                                                                                  android_os_Power.cpp
                                                                                                       /system/lib/libbinder.so




                                                                                                                                                                                                                                                                                                 calls
                                                                                                         /system/lib/lib*.so                                                                                                                /system/lib/libhardware_legacy.so


                                                                                                                                            uses (calls)
                                                                                                                                                                                                                                                           power.c




                                                                                                                                                                                                                                                                                                uses (io write)
                                                                                                    /system/bin/servicemanager                                                                                                               /system/lib/libandroid_runtime.so

                                                                                                        service_manager.c                                                                                                                          /system/lib/libbinder.so
                                                                                                                                                                                                                       invokes
                                                    references




                                                                                                          /system/lib/lib*.so                                                                                                                         /system/lib/lib*.so



                                                                                                                /dev/binder                                                                                                                         /sys/power/wake_lock
                                                                                                                                                           Kernel
                                                    registers as binder context manager
                                                                                                                                                                                                                                 gets a reference to the ServiceManager (handle=0)
Alarm on Android
                                                                                                            com.android.deskclock                                                                                                                         system_server
                                                                                                        (/system/app/DeskClock.apk)
                                                                                                                                                                                                                                                             DalvikVM
                                                                                                                   DalvikVM
                                                                                                                                                                                                                                                /system/framework/framework.jar
                                                                                                                  classes.dex
                                                                                                                                                                                                                                                android.app.IAlarmManager.Stub
                                                                                      calls




                                                                                                     com.android.deskclock.AlarmClock

                                                                                                       com.android.deskclock.Alarms




                                                                                                                                                                                                                                                                                        extends
                                                                                                                                                                                                                                                 /system/framework/services.jar
                                                                                      uses




                                                                                                                                               calls
                                                                                                      /system/framework/framework.jar




                                                                                                                                                              registers "alarm" service via ServiceManager
                                                                                                                                                                                                                                                com.android.server.SystemServer




                                                                                                                                                                                                              creates
                                                                                                          android.app.ContextImpl

                                                                                                        android.app.AlarmManager                                                                                                                      .AlarmManagerService
                                                    looks up "alarm" service via SM




                                                                                                                                                 calls




                                                                                                                                                                                                                                                                                        calls/links to
gets a reference to the ServiceManager (handle=0)




                                                                                                   android.app.IAlarmManager.Stub.Proxy

                                                                                                      /system/lib/libandroid_runtime.so




                                                                                                                                                                                                             references
                                                                                                                                                                                                                                                /system/lib/libandroid_servers.so
                                                                                                            /system/lib/libbinder.so



                                                                                                                                               uses (calls)
                                                                                                                                                                                                                                           com_android_server_AlarmManagerService.cpp

                                                                                                               /system/lib/lib*.so


                                                                                                        /system/bin/servicemanager                                                                                                              /system/lib/libandroid_runtime.so




                                                                                                                                                                                                                                                                                         uses (ioctl)
                                                                                                              service_manager.c                                                                                                                       /system/lib/libbinder.so
                                                                                                                                                                                                                          invokes
                                                                                      references




                                                                                                               /system/lib/lib*.so                                                                                                                       /system/lib/lib*.so



                                                                                                                      /dev/binder                                                                                                                            /dev/alarm
                                                                                                                                                              Kernel
                                                                                      registers as binder context manager
                                                                                                                                                                                                                                    gets a reference to the ServiceManager (handle=0)
Package Manager on Android
                                                                                                 com.android.packageinstaller                                                                                                     system_server
                                                                                              (/system/app/PackageInstaller.apk)
                                                                                                                                                                                                                                     DalvikVM
                                                                                                             DalvikVM
                                                                                                            classes.dex                                                                                                /system/framework/framework.jar
                                                                                                    .PackageInstallerActivity                                                                                         android.content.pm.IPackageManager.Stub
                                                     calls




                                                                                                        .InstallAppProgress




                                                                                                                                                                                                                                                                            extends
                                                                                                                                                    extends
                                                                                                                                                                                                                         /system/framework/services.jar
                                                                                               /system/framework/framework.jar
                                                    calls




                                                                                                                                                                                     creates
                                                                                             android.content.pm.PackageManager                                                                                          com.android.server.SystemServer

                                                                                             android.app.ApplicationPackageManager                                                                                    com.android.server.pm.PackageManagerService




                                                                                                                                                    calls




                                                                                                                                                                                                                                                                         calls
                                                         looks up "package" service via SM




                                                                                                                                                                             registers "package" service via SM
gets a reference to the ServiceManager (handle=0)




                                                                                             android.content.pm.IPackageManager.Stub.Proxy
                                                                                                                                                                                                                         com.android.server.pm.Installer

                                                                                                /system/lib/libandroid_runtime.so
                                                                                                                                                                                                                        /system/lib/libandroid_runtime.so




                                                                                                                                                                                       references
                                                                                                      /system/lib/libbinder.so



                                                                                                                                             uses (calls)
                                                                                                                                                                                                                              /system/lib/libbinder.so
                                                                                                         /system/lib/lib*.so




                                                                                                                                                                                                                                                                         send messages
                                                                                                                                                                                                                                 /system/lib/lib*.so




                                                                                                                                                               invokes transaction
                                                                                                   /system/bin/servicemanager

                                                                                                        service_manager.c                                                                                                              installd
                                                                                                                                                                                                                                      installd.c
                                                      references




                                                                                                         /system/lib/lib*.so
                                                                                                                                                                                                                                                          get messages


                                                                                                                 /dev/binder                                                                                                    /dev/socket/installd
                                                                                                                                                              Kernel
                                                     registers as binder context manager
                                                                                                                                                                                                                  gets a reference to the ServiceManager (handle=0)
WiFi Management on Android
                                                                                          com.example.app (/data/app/ExampleApp.apk)                                                                                                     system_server
                                                                                                                                                                                                                                            DalvikVM
                                                                                                           DalvikVM
                                                                                                                                                                                                                                /system/framework/framework.jar
                                                                                                          classes.dex
                                                                                                                                                                                                                                android.net.wifi.IWifiManager.Stub
                                                                                               com.example.app.ExampleActivity
                                                                                                                                                                                                                                android.net.wifi.WifiStateMachine




                                                                                                                                                                                                        calls
                                                    calls




                                                                                                /system/framework/framework.jar                                                                                                     android.net.wifi.WifiNative




                                                                                                                                                                                                                                                                                       extends
                                                                                                                                                                                          creates




                                                                                                                                                      calls
                                                                                                    android.net.wifi.WifiManager                                                                                                   /system/framework/services.jar




                                                                                                                                                                                                                                                                               calls
                                                                                                                                                                                                                                com.android.server.SystemServer
                                                                                            android.net.wifi.IWifiManager.Stub.Proxy




                                                                                                                                                                                                                                                                                                 calls/links to
gets a reference to the ServiceManager (handle=0)


                                                          looks up "wifi" service via SM




                                                                                                                                                                                                                                 com.android.server.WifiService




                                                                                                                                                         registers "wifi" service via SM
                                                                                                /system/lib/libandroid_runtime.so                                                                                               /system/lib/libandroid_servers.so
                                                                                                                                                                                                                                   android_net_wifi_Wifi.cpp




                                                                                                                                       uses (calls)
                                                                                                     /system/lib/libbinder.so




                                                                                                                                                                                                                                                                                       calls
                                                                                                                                                                                          references
                                                                                                                                                                                                                                /system/lib/libhardware_legacy.so
                                                                                                       /system/lib/lib*.so                                                                                                                    wifi.c




                                                                                                                                                                                                                                                                                                 calls
                                                                                                                                                                                                                                   /system/lib/libwpa_client.so
                                                                                                  /system/bin/servicemanager                                                                                                               wpa_ctrl.c




                                                                                                                                                                                                                                                                                               sends commands
                                                                                                      service_manager.c                                                                                                                /system/lib/lib*.so
                                                                                                                                                                                                  invokes
                                                    references




                                                                                                        /system/lib/lib*.so
                                                                                                                                                                                                                                        wpa_supplicant


                                                                                                              /dev/binder                                                                                                 bcmdhd               /dev/socket/wpa_wlan0
                                                                                                                                                                                      Kernel
                                                    registers as binder context manager
                                                                                                                                                                                                                calls (ioctl)                                       read commands
                                                                                                                                                                                                                as nl80211
Location on Android
                                                                                               com.example.app (/data/app/ExampleApp.apk)                                                                                         system_server

                                                                                                                DalvikVM                                                                                                            DalvikVM
                                                                                                                                                                                                                         /system/framework/framework.jar
                                                                                                               classes.dex
                                                                                                                                                                                                                              .LocationManager.Stub
                                                                                                    com.example.app.ExampleActivity




                                                                                                                                                                                                          creates




                                                                                                                                                                                                                                                                extends
                                                                                                                                                                                                                          /system/framework/services.jar
                                                    calls




                                                                                                     /system/framework/framework.jar                                                                                    com.android.server.SystemServer




                                                                                                                                               calls
                                                                                                    android.location.LocationManager                                                                                        .LocationManagerService




                                                                                                                                                                                                                                                             calls
                                                                                                                                                                                                                          .location.GpsLocationProvider




                                                                                                                                                           registers "location" service via SM
                                                          looks up "location" service via SM
gets a reference to the ServiceManager (handle=0)




                                                                                                       .LocationManager.Stub.Proxy




                                                                                                                                                                                                                                                             links to
                                                                                                                                                                                                                                                               calls
                                                                                                                                                                                                                         /system/lib/libandroid_servers.so
                                                                                                     /system/lib/libandroid_runtime.so                                                                                  _location_GpsLocationProvider.cpp




                                                                                                                                            uses (calls)



                                                                                                                                                                                                 references
                                                                                                          /system/lib/libbinder.so




                                                                                                                                                                                                                                                             loads
                                                                                                                                                                                                                                                              calls
                                                                                                                                                                                                                           /vendor/lib/hw/gps.omap4.so
                                                                                                            /system/lib/lib*.so                                                                                           impl of include/hardware/gps.h

                                                                                                                                                                                                                            /system/lib/libhardware.so
                                                                                                       /system/bin/servicemanager




                                                                                                                                                                                                                                                              uses (io)
                                                                                                                                                                                                                         /system/lib/libandroid_runtime.so
                                                                                                           service_manager.c                                                                                                  /system/lib/libbinder.so
                                                                                                                                                                                                              invokes
                                                    references




                                                                                                             /system/lib/lib*.so                                                                                                /system/lib/lib*.so



                                                                                                                   /dev/binder                                                                                                       /dev/ttyo0
                                                                                                                                                           Kernel
                                                    registers as binder context manager
Audio Policy on Android
                                                                                          com.example.app (/data/app/ExampleApp.apk)                                                                                                    system_server
                                                                                                                                                                                                                                          DalvikVM
                                                                                                            DalvikVM                                                                                                           /system/framework/framework.jar




                                                                                                                                                                                                                                                                                   extends
                                                                                                           classes.dex                                                                                                         android.media.IAudioService.Stub
                                                                                               com.example.app.ExampleActivity
                                                                                                                                                                                                                                   android.media.AudioService




                                                                                                                                                                                                                                                                                         calls
                                                     calls




                                                                                                                                                                                 creates
                                                                                                /system/framework/framework.jar                                                                                                    android.media.AudioSystem




                                                                                                                                                                                                                                                                                 links to/calls
                                                                                                 android.media.AudioManager                                                                                                     /system/framework/services.jar




                                                                                                                                                 calls
                                                                                                                                                                                                                               com.android.server.SystemServer
                                                                                              android.media.IAudioService.Stub.Proxy
                                                        looks up "audio" service via SM
gets a reference to the ServiceManager (handle=0)




                                                                                                                                                                                                                               /system/lib/libandroid_runtime.so




                                                                                                                                                                 registers "audio" service via SM
                                                                                                                                                                                                                               android_media_AudioSystem.cpp




                                                                                                                                                                                                                                                                                 calls
                                                                                                /system/lib/libandroid_runtime.so
                                                                                                                                                                                                                                    /system/lib/libmedia.so
                                                                                                                                                                                                                                     android.AudioSystem




                                                                                                                                                                                                                                                                                         calls
                                                                                                     /system/lib/libbinder.so                                                                                                    android.BpAudioPolicyService



                                                                                                                                                  uses (calls)
                                                                                                        /system/lib/lib*.so




                                                                                                                                                                                                    references
                                                                                                                                                                                                                                         mediaserver




                                                                                                                                                                                                                                                                                 calls
                                                                                                                                                                                                                                                                            extends
                                                                                                                                                                                                                                    /system/lib/libmedia.so
                                                                                                                                                                                                                                 android.BnAudioPolicyService
                                                                                                   /system/bin/servicemanager                                                                                                     /system/lib/libaudioflinger.so
                                                                                                                                                                                                                                   android.AudioPolicyService




                                                                                                                                                                                                                                                                                                  calls
                                                                                                       service_manager.c
                                                                                                                                                                                                                 invokes     /system/lib/hw/audio_policy.default.so
                                                                                                                                                                                                                           android_audio_legacy.AudioPolicyManagerDefault




                                                                                                                                                                                                                                                                                 calls
                                                                                                        /system/lib/lib*.so
                                                                                                                                                                                                                              /system/lib/hw/audio.primary.tuna.so
                                                                                                                                                                                                                                           audio_hw.c




                                                                                                                                                                                                                                                                                 uses (ioctl) calls
                                                                         references                                           looks up "media.audio_policy"
                                                                                                                                                                                                                                    /system/lib/libtinyalsa.so
                                                    registers as binder context manager                                                                                                                                                      mixer.c


                                                                                                               /dev/binder                                                                                                         /dev/snd/controlC0 (ALSA)
                                                                                                                                                                       Kernel
Audio Playback on Android
com.ex.app (/data/app/ExampleApp.apk)                                           mediaserver
               DalvikVM                                                                  /system/lib/libmediaplayerservice.so
                                               /system/lib/libmedia.so
              classes.dex
                                          android.BnMediaPlayerService                        android.MediaPlayerService
     com.ex.app.ExampleActivity
                                              android.BnMediaPlayer                       android.MediaPlayerService.Client
   /system/framework/framework.jar         .AudioTrack      .AudioSystem                       android.StagefrightPlayer
     android.media.MediaPlayer
                                                                                          .MediaPlayerService.AudioOutput
                                             /system/lib/libstagefright.so

      /system/lib/libmedia_jni.so        .AwesomePlayer          .AudioPlayer         /system/lib/libstagefright_soft_mp3dec.so
   android_media_MediaPlayer.cpp          .MediaSource           .MP3Source                         android.SoftMP3
                                           .OMXCodec          .MP3Extractor
       /system/lib/libmedia.so                                                                /system/lib/libaudioflinger.so
       android.BpMediaPlayer                                                            .AudioFlinger       .AudioPolicyService

    android.BpMediaPlayerService
                                         /system/lib/hw/audio.primary.tuna.so            /system/lib/              /system/lib/
                                                    audio_hw.c                       libstagefrighthw.so        libOMX_Core.so
          /system/lib/lib*.so
                                                                                      android.TIOMXPlugin           OMX_Core.c

                                               /system/lib/libtinyalsa.so               /system/lib/hw/audio_policy.default.so
     /system/bin/servicemanager
         service_manager.c                               pcm.c                        android_audio_legacy.AudioPolicyManagerDefault

          /system/lib/lib*.so




              /dev/binder                   /dev/snd/pcmC0D0p (ALSA)                          /dev/snd/controlC0 (ALSA)
                                                          Kernel
Telephony on Android
                       PhoneApp                                                                          system_server
                (/system/app/Phone.apk)
                                                                                                        DalvikVM
                          DalvikVM                                                           /system/framework/framework.jar
                          classes.dex                                                           android.media.AudioService
                                                                               uses
                      CallController


                      CallController


                          PhoneUtils

calls       /system/framework/framework.jar


        com.android.internal.telephony.CallManager
                                                          calls
             android.media.AudioManager

           com.android.internal.telephony.Phone
calls
                          implements                                                                           rild
        com.android.internal.telephony.gsm.GSMPhone
                                                                                                              rild.c




                                                                                                                                        calls
                    GsmCallTracker
                                                            Socket messages




                                                                                                       /system/lib/libril.so
                                                                                loads



                             RIL




                                                                                                                                        uses
                                                                                                /system/lib/libsecril-client.so
          RILSender                      RILReceiver
                                                                                                     /vendor/lib/libsec-ril.so

        Socket messages                 Socket messages                                               uses


                   /dev/socket/rild                                                     /dev/ttys0                      Audio drivers
                                                                              Kernel
DevicePolicy on Android
                                                                                                     com.example.enterpriseapp                                                                                                                            system_server
                                                                                                   (/data/app/EnterpriseApp.apk)
                                                                                                                                                                                                                                                          DalvikVM
                                                                                                               DalvikVM
                                                                                                                                                                                                                                               /system/framework/framework.jar
                                                                                                              classes.dex
                                                                                                                                                                                                                                              android.app.admin.DevicePolicyManager.Stub
                                                                                                           .ExampleActivity
                                                       calls




                                                                                                                                                                                                                                                  android.os.RecoverySystem




                                                                                                                                                                                                                                                                                                   calls
                                                                                                                                                                                                                                                                                                  calls
                                                                                                                                                                                                                                                   android.os.PowerManager




                                                                                                                                                                                                                                                                                                                  extends
                                                                                                 /system/framework/framework.jar




                                                                                                                                                                                  calls
                                                                                                                                                                                                                                              com.android.internal.app.ShutdownThread
                                                                                               android.app.admin.DevicePolicyManager
                                                                                                                                                                                                                                                        android.os.Power
                                                    looks up "device_policy" service via SM




                                                                                                                                                   calls




                                                                                                                                                                                                                                                                                                calls
                                                                                                                                                                registers "device_policy" service via SM

                                                                                                                                                                                                                 creates




                                                                                                                                                                                                                                                                                             calls
                                                                                                                                                                                                                                                /system/framework/services.jar
gets a reference to the ServiceManager (handle=0)




                                                                                              android.app.admin.DevicePolicyManager.Stub.Proxy
                                                                                                                                                                                                                                               com.android.server.SystemServer
                                                                                                                                                                                                                                             com.android.server.DevicePolicyManagerService
                                                                                                 /system/lib/libandroid_runtime.so
                                                                                                                                                                                                                                              com.android.server.PowerManagerService
                                                                                                       /system/lib/libbinder.so




                                                                                                                                                                                                                                                                                              links to/calls
                                                                                                                                                                                                                       references
                                                                                                          /system/lib/lib*.so                                                                                                                  /system/lib/libandroid_runtime.so

                                                                                                                                                 uses (calls)



                                                                                                                                                                                                           invokes transaction
                                                                                                                                                                                                                                                     android_os_Power.cpp




                                                                                                                                                                                                                                    reboot
                                                                                                    /system/bin/servicemanager                                                                                                                          /system/lib/lib*.so

                                                                                                         service_manager.c                                                                                                                                   recovery




                                                                                                                                                                                                                                                                                                               writes
                                                                     references




                                                                                                                                                                                                                                                                                                  reads
                                                                                                           /system/lib/lib*.so                                                                                                                               recovery.c



                                                                                                                                                                                                                                                   /cache/recovery/command
                                                                                                                   /dev/binder
                                                                                                                                                                /dev/block/platform/omap/omap_hsmmc.0/by-name/userdata                                                                        erases
                                                                                                                                                                 Kernel                                                                                                                      formats
                                                                   registers as binder context manager
                                                                                                                                                                                                                                    gets a reference to the ServiceManager (handle=0)
Thank You




For the complete screencast of this presentation go to
                http://mrkn.co/munz7




                @agargenta on Twitter
        aleksandar.gargenta@gmail.com on G+

Android Services Black Magic by Aleksandar Gargenta

  • 1.
    Android Services BlackMagic by Aleksandar (Saša) Gargenta, Marakana Inc. Android Builders Summit February 14th, 2012 Redwood Shores, CA Screencast @ http://mrkn.co/munz7
  • 2.
    About Aleksandar (Saša) Gargenta • Developer and instructor of Android Internals and Security training at Marakana • Founder and co-organizer of San Francisco Android User Group (sfandroid.org) • Founder and co-organizer of San Francisco Java User Group (sfjava.org) • Co-founder and co-organizer of San Francisco HTML5 User Group (sfhtml5.org) • Speaker at AnDevCon, AndroidOpen, Android Builders Summit, etc. • Server-side Java and Linux, since 1997 • Android/embedded Java and Linux, since 2009 • Worked on SMS, WAP Push, MMS, OTA provisioning in previous life • @agargenta on Twitter • aleksandar.gargenta@gmail.com on Google+ Marakana - Helping people get better at what they do • Training on cutting edge open source software (like Android!) • Rockstar team of experts, on staff • Content is king • http://marakana.com/
  • 3.
    Android Stack Applications Content Home Contacts Phone Browser Providers Application Framework Activity Window Vibrator WiFi Battery Service Service Service Service Service Package Telephony Resource Location Notification Service Service Manager Service Service Native Layer Surface Media Android Runtime SQLite SSL Flinger Framework Core Libs OpenGL vold netd WebKit Dalvik libwifi libcamera libgps libc VM Display Camera Linux Kernel GPS Binder Driver Driver Driver Driver Keypad WiFi Audio Power Driver Driver Driver Mgmt
  • 4.
    Vibrator on Android com.example.app (/data/app/ExampleApp.apk) system_server DalvikVM DalvikVM classes.dex /system/framework/framework.jar com.example.app.ExampleActivity android.os.IVibratorService.Stub extends calls /system/framework/framework.jar /system/framework/services.jar registers "vibrator" service via ServiceManager android.os.Vibrator com.android.server.SystemServer creates calls android.os.IVibratorService.Stub.Proxy com.android.server.VibratorService looks up "vibrator" service via SM calls/links to gets a reference to the ServiceManager (handle=0) /system/lib/libandroid_servers.so /system/lib/libandroid_runtime.so references uses (calls) com_android_server_VibratorService.cpp /system/lib/libbinder.so calls /system/lib/lib*.so /system/lib/libhardware_legacy.so vibrator.c invokes transaction uses (io write) /system/bin/servicemanager /system/lib/libandroid_runtime.so service_manager.c /system/lib/libbinder.so references /system/lib/lib*.so /system/lib/lib*.so /dev/binder /sys/class/timed_output/vibrator/enable Kernel registers as binder context manager gets a reference to the ServiceManager (handle=0)
  • 5.
    Power on Android com.example.app (/data/app/ExampleApp.apk) system_server DalvikVM DalvikVM /system/framework/framework.jar classes.dex android.os.IPowerManager.Stub com.example.app.ExampleActivity android.os.Power calls calls /system/framework/framework.jar /system/framework/services.jar extends creates registers "power" service via ServiceManager android.os.PowerManager com.android.server.SystemServer creates android.os.PowerManager.WakeLock com.android.server.PowerManagerService looks up "power" service via SM calls/links to gets a reference to the ServiceManager (handle=0) android.os.IPowerManager.Stub.Proxy calls /system/lib/libandroid_runtime.so /system/lib/libandroid_runtime.so references android_os_Power.cpp /system/lib/libbinder.so calls /system/lib/lib*.so /system/lib/libhardware_legacy.so uses (calls) power.c uses (io write) /system/bin/servicemanager /system/lib/libandroid_runtime.so service_manager.c /system/lib/libbinder.so invokes references /system/lib/lib*.so /system/lib/lib*.so /dev/binder /sys/power/wake_lock Kernel registers as binder context manager gets a reference to the ServiceManager (handle=0)
  • 6.
    Alarm on Android com.android.deskclock system_server (/system/app/DeskClock.apk) DalvikVM DalvikVM /system/framework/framework.jar classes.dex android.app.IAlarmManager.Stub calls com.android.deskclock.AlarmClock com.android.deskclock.Alarms extends /system/framework/services.jar uses calls /system/framework/framework.jar registers "alarm" service via ServiceManager com.android.server.SystemServer creates android.app.ContextImpl android.app.AlarmManager .AlarmManagerService looks up "alarm" service via SM calls calls/links to gets a reference to the ServiceManager (handle=0) android.app.IAlarmManager.Stub.Proxy /system/lib/libandroid_runtime.so references /system/lib/libandroid_servers.so /system/lib/libbinder.so uses (calls) com_android_server_AlarmManagerService.cpp /system/lib/lib*.so /system/bin/servicemanager /system/lib/libandroid_runtime.so uses (ioctl) service_manager.c /system/lib/libbinder.so invokes references /system/lib/lib*.so /system/lib/lib*.so /dev/binder /dev/alarm Kernel registers as binder context manager gets a reference to the ServiceManager (handle=0)
  • 7.
    Package Manager onAndroid com.android.packageinstaller system_server (/system/app/PackageInstaller.apk) DalvikVM DalvikVM classes.dex /system/framework/framework.jar .PackageInstallerActivity android.content.pm.IPackageManager.Stub calls .InstallAppProgress extends extends /system/framework/services.jar /system/framework/framework.jar calls creates android.content.pm.PackageManager com.android.server.SystemServer android.app.ApplicationPackageManager com.android.server.pm.PackageManagerService calls calls looks up "package" service via SM registers "package" service via SM gets a reference to the ServiceManager (handle=0) android.content.pm.IPackageManager.Stub.Proxy com.android.server.pm.Installer /system/lib/libandroid_runtime.so /system/lib/libandroid_runtime.so references /system/lib/libbinder.so uses (calls) /system/lib/libbinder.so /system/lib/lib*.so send messages /system/lib/lib*.so invokes transaction /system/bin/servicemanager service_manager.c installd installd.c references /system/lib/lib*.so get messages /dev/binder /dev/socket/installd Kernel registers as binder context manager gets a reference to the ServiceManager (handle=0)
  • 8.
    WiFi Management onAndroid com.example.app (/data/app/ExampleApp.apk) system_server DalvikVM DalvikVM /system/framework/framework.jar classes.dex android.net.wifi.IWifiManager.Stub com.example.app.ExampleActivity android.net.wifi.WifiStateMachine calls calls /system/framework/framework.jar android.net.wifi.WifiNative extends creates calls android.net.wifi.WifiManager /system/framework/services.jar calls com.android.server.SystemServer android.net.wifi.IWifiManager.Stub.Proxy calls/links to gets a reference to the ServiceManager (handle=0) looks up "wifi" service via SM com.android.server.WifiService registers "wifi" service via SM /system/lib/libandroid_runtime.so /system/lib/libandroid_servers.so android_net_wifi_Wifi.cpp uses (calls) /system/lib/libbinder.so calls references /system/lib/libhardware_legacy.so /system/lib/lib*.so wifi.c calls /system/lib/libwpa_client.so /system/bin/servicemanager wpa_ctrl.c sends commands service_manager.c /system/lib/lib*.so invokes references /system/lib/lib*.so wpa_supplicant /dev/binder bcmdhd /dev/socket/wpa_wlan0 Kernel registers as binder context manager calls (ioctl) read commands as nl80211
  • 9.
    Location on Android com.example.app (/data/app/ExampleApp.apk) system_server DalvikVM DalvikVM /system/framework/framework.jar classes.dex .LocationManager.Stub com.example.app.ExampleActivity creates extends /system/framework/services.jar calls /system/framework/framework.jar com.android.server.SystemServer calls android.location.LocationManager .LocationManagerService calls .location.GpsLocationProvider registers "location" service via SM looks up "location" service via SM gets a reference to the ServiceManager (handle=0) .LocationManager.Stub.Proxy links to calls /system/lib/libandroid_servers.so /system/lib/libandroid_runtime.so _location_GpsLocationProvider.cpp uses (calls) references /system/lib/libbinder.so loads calls /vendor/lib/hw/gps.omap4.so /system/lib/lib*.so impl of include/hardware/gps.h /system/lib/libhardware.so /system/bin/servicemanager uses (io) /system/lib/libandroid_runtime.so service_manager.c /system/lib/libbinder.so invokes references /system/lib/lib*.so /system/lib/lib*.so /dev/binder /dev/ttyo0 Kernel registers as binder context manager
  • 10.
    Audio Policy onAndroid com.example.app (/data/app/ExampleApp.apk) system_server DalvikVM DalvikVM /system/framework/framework.jar extends classes.dex android.media.IAudioService.Stub com.example.app.ExampleActivity android.media.AudioService calls calls creates /system/framework/framework.jar android.media.AudioSystem links to/calls android.media.AudioManager /system/framework/services.jar calls com.android.server.SystemServer android.media.IAudioService.Stub.Proxy looks up "audio" service via SM gets a reference to the ServiceManager (handle=0) /system/lib/libandroid_runtime.so registers "audio" service via SM android_media_AudioSystem.cpp calls /system/lib/libandroid_runtime.so /system/lib/libmedia.so android.AudioSystem calls /system/lib/libbinder.so android.BpAudioPolicyService uses (calls) /system/lib/lib*.so references mediaserver calls extends /system/lib/libmedia.so android.BnAudioPolicyService /system/bin/servicemanager /system/lib/libaudioflinger.so android.AudioPolicyService calls service_manager.c invokes /system/lib/hw/audio_policy.default.so android_audio_legacy.AudioPolicyManagerDefault calls /system/lib/lib*.so /system/lib/hw/audio.primary.tuna.so audio_hw.c uses (ioctl) calls references looks up "media.audio_policy" /system/lib/libtinyalsa.so registers as binder context manager mixer.c /dev/binder /dev/snd/controlC0 (ALSA) Kernel
  • 11.
    Audio Playback onAndroid com.ex.app (/data/app/ExampleApp.apk) mediaserver DalvikVM /system/lib/libmediaplayerservice.so /system/lib/libmedia.so classes.dex android.BnMediaPlayerService android.MediaPlayerService com.ex.app.ExampleActivity android.BnMediaPlayer android.MediaPlayerService.Client /system/framework/framework.jar .AudioTrack .AudioSystem android.StagefrightPlayer android.media.MediaPlayer .MediaPlayerService.AudioOutput /system/lib/libstagefright.so /system/lib/libmedia_jni.so .AwesomePlayer .AudioPlayer /system/lib/libstagefright_soft_mp3dec.so android_media_MediaPlayer.cpp .MediaSource .MP3Source android.SoftMP3 .OMXCodec .MP3Extractor /system/lib/libmedia.so /system/lib/libaudioflinger.so android.BpMediaPlayer .AudioFlinger .AudioPolicyService android.BpMediaPlayerService /system/lib/hw/audio.primary.tuna.so /system/lib/ /system/lib/ audio_hw.c libstagefrighthw.so libOMX_Core.so /system/lib/lib*.so android.TIOMXPlugin OMX_Core.c /system/lib/libtinyalsa.so /system/lib/hw/audio_policy.default.so /system/bin/servicemanager service_manager.c pcm.c android_audio_legacy.AudioPolicyManagerDefault /system/lib/lib*.so /dev/binder /dev/snd/pcmC0D0p (ALSA) /dev/snd/controlC0 (ALSA) Kernel
  • 12.
    Telephony on Android PhoneApp system_server (/system/app/Phone.apk) DalvikVM DalvikVM /system/framework/framework.jar classes.dex android.media.AudioService uses CallController CallController PhoneUtils calls /system/framework/framework.jar com.android.internal.telephony.CallManager calls android.media.AudioManager com.android.internal.telephony.Phone calls implements rild com.android.internal.telephony.gsm.GSMPhone rild.c calls GsmCallTracker Socket messages /system/lib/libril.so loads RIL uses /system/lib/libsecril-client.so RILSender RILReceiver /vendor/lib/libsec-ril.so Socket messages Socket messages uses /dev/socket/rild /dev/ttys0 Audio drivers Kernel
  • 13.
    DevicePolicy on Android com.example.enterpriseapp system_server (/data/app/EnterpriseApp.apk) DalvikVM DalvikVM /system/framework/framework.jar classes.dex android.app.admin.DevicePolicyManager.Stub .ExampleActivity calls android.os.RecoverySystem calls calls android.os.PowerManager extends /system/framework/framework.jar calls com.android.internal.app.ShutdownThread android.app.admin.DevicePolicyManager android.os.Power looks up "device_policy" service via SM calls calls registers "device_policy" service via SM creates calls /system/framework/services.jar gets a reference to the ServiceManager (handle=0) android.app.admin.DevicePolicyManager.Stub.Proxy com.android.server.SystemServer com.android.server.DevicePolicyManagerService /system/lib/libandroid_runtime.so com.android.server.PowerManagerService /system/lib/libbinder.so links to/calls references /system/lib/lib*.so /system/lib/libandroid_runtime.so uses (calls) invokes transaction android_os_Power.cpp reboot /system/bin/servicemanager /system/lib/lib*.so service_manager.c recovery writes references reads /system/lib/lib*.so recovery.c /cache/recovery/command /dev/binder /dev/block/platform/omap/omap_hsmmc.0/by-name/userdata erases Kernel formats registers as binder context manager gets a reference to the ServiceManager (handle=0)
  • 14.
    Thank You For thecomplete screencast of this presentation go to http://mrkn.co/munz7 @agargenta on Twitter aleksandar.gargenta@gmail.com on G+