Android Security issues preemptive boot

Introduction: We take the preemptive boot as an example to illustrate the reception order of the static broadcast receivers receiving the disordered broadcast

(Note that the text is only a statement of results, so call the results of the article, then give the source code analysis)

First, let's talk about the broadcast and broadcast receivers in Android.
Broadcast can be divided into order, disorder and sticky a total of three
Broadcast receivers can be divided into two types, static and dynamic


First, we need to clear two questions.
1. The order in which the receivers receiving the unordered broadcasts receive broadcasts is ordered
2. Receivers that receive out-of-order broadcasts can also set the priority


The main point here is that static broadcast receivers in multiple applications ( with the same priority) receive order when they receive an unordered broadcast
NOTE: Here the main description of the conclusion, the specific principle of subsequent given
Note: It is important that the static receivers that appear on the same device at the same time as mentioned in this article have the same priority by default .

For example, we use broadcast Android.intent.action.BOOT_COMPLETED, which is a random broadcast.
If the application wants to turn on self-booting, then listen to this broadcast, before the program starts, the dynamic broadcast receiver must be unusable, I believe you have no doubt about it
If first received, then the program will start first, as for the advantages of first start, I think those who can't wait to know better than anyone


Receive order in the end with what about, to tell the truth, I do not know, but do not rush to shoot me, I am not completely unaware of ...
The order is consistent with the order of the analytic application, but what is the order of the parsing application?
The first thing to tell you is that it has nothing to do with the file name of your apk!
For example, a.apk, b.apk two applications, the result does not guarantee that a can be received before B, or b can be compared to a first received
then tell everyone, this is related to the APK filename!
Yes, but why do you say that?
User installs an application there are so many steps
1 Download an application, assuming that the app is called new.apk when it's downloaded
2 installation. In general, the user will operate on the phone, click on the file, then the system will install the page ... And we all know that. Another case program apes may prefer to use ADB install-r new.apk
As you know, third-party applications are stored in the/data/app directory
When the installation is complete, we go here to see, found a serious problem, that is, you can not find a file called new.apk!
So what are you going to find? You will find a file whose name starts with the app package name new.apk and may then follow the "-Number. apk", for example: com.android.test-1.apk
The order of reception is related to this name! So what is the relationship?
When the system is booting, it will parse the APK in a sequential sequence.
1. First, the/system/framework in the mobile phone directory, the native system, this is a apk-framework-res.apk
Of course, the various manufacturers will also add their own content, such as my directory is com.htc.resources.apk
2. The folders that are then valued are in order:
/system/app
/vendor/app
/data/app
/drm/app-private
(Code analysis is given in the next blog post)

So what is the order of parsing under each folder?
We'll just look at/data/app, which is where the user installs the third-party app.

This is consistent with the order in which the following code returns results

New File ("/data/app/"= File.list ();

That is, we print this array sequentially, we can know which receiver will receive the broadcast first, which will be received after (why is consistent with this result, the next article analysis)

(Remember: These receivers are assumed to have the same priority in this article by default, if the priority is different, of course the high priority is received first)

Now you may have a few questions:

1.string[] Java.io.File.list (), what is the order of the returned results of this function?

2. How to execute the above code?

Answer question 1 First

I do not know!

Let's take a look at the instructions given by Javadoc.

Javadoc wrote

 is inch inch inch  in alphabetical order.

It's clear that people don't give you any assurances.

I heard that in the execution of Windows, the results will be sorted alphabetically, unfortunately, Android is Linux

But we can cheat, print the results above, if your own application shot in the back, it will change the name of the package until you can line up, of course, this is not a good way, but I have no better way to

Answer the question now 2

The execution of this code requires root permissions because the general application does not have read access to the directory.

What if the phone doesn't have root? You don't look for a root to see the results ...

I did an experiment where I wrote a few applications with receiver, and set their package names as common, relational application package names .

Fetion: Cn.com.fetion

Lbe Privacy Defender: Com.lbe.security.lite

Handsent:com.handsent.nextsms

Jinshan Mobile Defender: Com.ijinshan.mguard

360 Mobile Defender: Com.qihoo360.mobilesafe

QQ Mobile Butler: Com.tencent.qqpimsecure

A test application: com.example.boottest

New File ("/data/app/"= file.list ();  for (int0; i < files.length; i++) {    System. out. println ("/data/app/:files["+ (i+1) +"  ]:" + files[i]);}

The result is:

/data/app/:files[8]:com.tencent.qqpimsecure-1.apk

/data/app/:files[9]:com.qihoo360.mobilesafe-1.apk

/data/app/:files[10]:com.ijinshan.mguard-1.apk

/data/app/:files[11]:cn.com.fetion-1.apk

/data/app/:files[12]:com.lbe.security.lite-1.apk

/data/app/:files[13]:com.handsent.nextsms-1.apk

/data/app/:files[14]:com.example.boottest-1.apk

The actual receive order is:

12-06 15:19:58.187:i/system.out (1880): GetPackageName:com.tencent.qqpimsecure

12-06 15:19:58.288:i/system.out (1893): GetPackageName:com.qihoo360.mobilesafe

12-06 15:19:58.378:i/system.out (1906): GetPackageName:com.ijinshan.mguard

12-06 15:19:58.488:i/system.out (1920x1080): getPackageName:cn.com.fetion

12-06 15:19:58.608:i/system.out (1933): GetPackageName:com.lbe.security.lite

12-06 15:19:58.718:i/system.out (1946): GetPackageName:com.handsent.nextsms

12-06 15:19:58.908:i/system.out (1959): GetPackageName:com.example.boottest

If one of these priorities is higher, such as cn.com.fetion, then the actual receive order is

GetPackageName:cn.com.fetion
GetPackageName:com.tencent.qqpimsecure
GetPackageName:com.qihoo360.mobilesafe
GetPackageName:com.ijinshan.mguard
GetPackageName:com.lbe.security.lite
GetPackageName:com.handsent.nextsms
GetPackageName:com.example.boottest

Last Note:

The above is just a simple test, not these applications are in this order, because their priorities may not be consistent, perhaps under the/data/app filename inconsistent, resulting in inconsistent order

However, seeing here, you should know how to get started before they boot up

For the machine after root

Leave everyone a question, if I am a virus, then how should I do?

Obviously, the most ideal way is to find a shell application, the entity virus apk into the/system/framework directory, of course, do not forget to set their own priority to the highest, otherwise it is in vain

Android Security issues preemptive boot