SVMP is a platform that allows running Android VMs securely in virtual devices on a server. It uses WebRTC for video/audio streaming and a custom protocol for other inputs. The main components are a client app, overseer, server, and SVMP daemon running in each VM. The daemon handles inputs like touch, sensors, notifications which are forwarded from the client. The Android framework and drivers were modified to support virtual sensors and inputs by intercepting and redirecting certain system calls and intents. This allows the VM to behave like a real mobile device controlled remotely by the client.

1. SVMP: Secure Virtual
Mobile Platform
Yu-Hsin Hung

2. Introduction
• https://svmp.github.io
• Configuration: x86 Android VMs on x86 server
• VM Platform: support KVM, VirtualBox, VMware…
• Cloud Controller: support OpenStack, Amazon EC2…
• Remote Protocol: WebRTC + SVMP Wire Protocol
• Client: Android/iOS app
• Storage (user data) is separated from VM

3. Components
• Client Application: an unprivileged Android/iOS application with WebRTC
peer connection and SVMP protocol messages, similar to clients for VNC
and RDP
• SVMP Overseer: receive login request, perform authentication, and
manage VMs on the cloud
• SVMP Server: routing input message from client connections to SVMP
daemons running inside virtual devices
• SVMP daemon: primary entry point of client user input to the virtual device
• Virtual Device: Virtual Device Image (SVMP Gold Image) + User Data
Volume
• Cloud Controller: support OpenStack, Amazon EC2…

4. Architecture

5. Virtual Device Structure
• The central SVMP daemon
• Touch-screen input injection
• Virtual sensors
• Location update pub/sub
• Notification and Intent forwarding and re-broadcast
• Virtual frame buffer, video encoding, and streaming

6. Virtual Device Structure

7. SVMP Wire Protocol
• SVMP/svmp-protocol-def repository
• Request: client->server
• Response: server->client
• JSON Payload: a type attribute and up to one optional
attribute associated with that subtype, e.g.
{“type”:”ROTATIONINFO”,”rotationInfo":{"rotation":0}}
• Protocol Buffers: protocols are defined using “Protocol
Buffers” - Google's data interchange format, and Java
class definitions are generated by protocol buffer compiler

8. SVMP daemon
• SVMP/android_external_svmp_eventserver repository
• An user-level Android background service, launched when
BroadcastReceiver catches BOOT_COMPLETED Intent
• EventServer: many handlers to handle different events (touch,
sensor, notification…)
• LogHandler: logcat message forwarding
• DatabaseHandler: GPS location service subscription
• WifiSpoofer: spoof that Wi-Fi connection is active
• details in next few pages…

9. SVMP daemon
• proxy socket: a Java server socket to listen events from client
• sensor socket: initialized in init.rc as /dev/socket/svmp_sensors
• Handlers:
• SensorHandler
• LocationHandler
• IntentHandler
• NotificationHandler
• KeyHandler
• ConfigHandler: only keyboard configurations
• LauncherHandler: for single app mode

10. Touch&screen injection
• EventServer.java
• SCREENINFO packet: sync screen resolution
• TOUCHEVENT packet: translate coordinates X, Y
and inject by Android InputManager (native support)
• ROTATION_INFO packet: rotation info is injected by
sending custom broadcast
ROTATION_CHANGED_ACTION, received by
modified framework

11. IntentHandler
• IntentHandler.java
• Android Intent: an abstract description of an operation to
be performed
• Currently support two kinds of intent forwarding
• outgoing call: forward ACTION_NEW_OUTGOING_CALL
from server to client and dial using client’s SIM card
• activity action: forward ACTION_VIEW from client to
server and open URL inside the VM

12. LocationHandler
• LocationHandler.java
• Android natively support mocked location
• Catch custom Intent LOCATION_SUBSCRIBE_ACTION
(sent by modified framework) and forward location request
to client
• Maintain location subscription in DatabaseHandler (single-
shot or not)
• Inject client’s GPS location to VM by spoofing test provider
LocationManager.setTestProviderLocation()

13. NotificationHandler
• NotificationHandler.java
• catch custom Intent
INTERCEPT_NOTIFICATION_ACTION
• use Java Reflection to extract text elements and
icons from RemoteViews and forward notification to
client

14. SensorHandler
• BaseServer.java
• SENSOREVENT packet: forwarded to /dev/socket/
svmp_sensors socket
• Client keep listening to all the available sensors
• Use delay time mechanism to prevent spammy sensor
messages
• SVMP HAL module libsensors listens on the svmp_sensors
socket then processes the actual sensor events, the HAL
interfaces are defined in AOSP hardware/sensors.h

15. Android client
• WebRTC: video & audio streaming
• Corresponding handlers to deal with SVMP daemon
• TouchHandler
• RotationHandler
• KeyHandler
• ConfigHandler
• NotificationHandler
• SensorHandler
• …

16. Android Framework
modification
• InputManagerService.java
• Natively support injecting key events (KeyHandler.java in
SVMP daemon)
• Create a BroadcastReceiver to listen custom intent for hard
keyboard, attach two virtual keyboards when hard keyboard
attached to client
• NotificationManager.java
• Intercept notification by preventing enqueue it and send a
INTERCEPT_NOTIFICATION broadcast, caught by SVMP
daemon

17. Android Framework
modification
• WindowOrientationListener.java
• Create a BroadcastReceiver to listen custom
ROTATION_CHANGED intent and inject the
rotation info
• LocationManager.java
• Intercept location request and send a
LOCATION_SUBSCRIBE_ACTION broadcast,
caught by SVMP daemon then redirected to client

18. Android System Core
modification
• BatteryMonitor.cpp
• Battery injection
• Battery status is always charging
• Battery health is always good
• Battery level is always 100%

19. Android Device Driver
• Lots of things, still tracing…
• Virtual Frame Buffer
• VM write frame to VFB device instead of real video device
• Android surfaceflinger library generates a VSYNC event when
writing
• When VSYNC event occurs, each frame is fed into the WebRTC
subsystem
• Virtual Sensors: libsensors/sensors.cpp
• Re-implement the interface defined by AOSP