Android security Issues (vii) preemptive reception of broadcasts

Now give the second step analysis

Let's take a look at the process of sending a broadcast

The implementation of the Sendbroadcast function in the context is in Contextimpl, and the following six functions are associated with sending a broadcast

void Android.app.ContextImpl.sendBroadcast (Intent Intent)

void Android.app.ContextImpl.sendBroadcast (Intent Intent, String receiverpermission)

void Android.app.ContextImpl.sendOrderedBroadcast (Intent Intent, String receiverpermission)

void Android.app.ContextImpl.sendOrderedBroadcast (Intent Intent, String receiverpermission, Broadcastreceiver Resultreceiver, Handler Scheduler, int initialcode, String initialdata, Bundle Initialextras)

void Android.app.ContextImpl.sendStickyBroadcast (Intent Intent)

void Android.app.ContextImpl.sendStickyOrderedBroadcast (Intent Intent, Broadcastreceiver resultreceiver, Handler scheduler, int initialcode, String initialdata, Bundle Initialextras)

Can be divided into 3 groups: 1 ordinary broadcast; 2Ordered broadcast; 3Sticky broadcast

Either way, the end will be handled by Activitymanagerservice.

Private final int broadcastintentlocked (Processrecord 

callerapp,  
        string callerpackage, Intent Intent, string Resolvedtype,  
        iintentreceiver resultto, int resultcode, string resultdata,  
        Bundle Map, string Requiredpermission,  
        Boolean ordered, boolean sticky, int callingpid, int callinguid)

In the first case, the flowchart probably looks like this.

Ordered and sticky are used to differentiate the above 3 sets of broadcasts

Now let's take a closer look at what this means.

deleted some code.

Private final int broadcastintentlocked (Processrecord callerapp, String callerpackage, Intent Intent, string Resolvedtype, iintentreceiver resultto, int resultcode, string resultdata, Bundle map, string required Permission, Boolean ordered, boolean sticky, int callingpid, int callinguid) {...//handling Special intent//Ad  
    D to the Sticky list if requested.  
    ...//handling sticky broadcast//Figure out who all would receive this broadcast.  
    List receivers = NULL;  
    List<broadcastfilter> registeredreceivers = null; try {if (intent.getcomponent ()!= null) {//broadcast is going to one specific class ...  
            .  
                Activityinfo ai = Appglobals.getpackagemanager ().  
            Getreceiverinfo (Intent.getcomponent (), stock_pm_flags);  
                if (AI!= null) {receivers = new ArrayList ();  
                Resolveinfo ri = new Resolveinfo (); Ri.activityInfo = AI;  
            Receivers.add (RI); } else {//Need to resolve the intent to interested receivers ... if (INTENT.GETF  
                    Lags () &intent.flag_receiver_registered_only) = = 0) {receivers = Appglobals.getpackagemanager (). Queryintentreceivers (Intent, Resolvedtype, stock_p  
            M_flags);  
        } registeredreceivers = Mreceiverresolver.queryintent (Intent, Resolvedtype, false);  
    } catch (RemoteException ex) {//PM is in same process, this'll never happen. Final Boolean replacepending = (Intent.getflags () &intent.flag_receiver_replace_pending)!  
    = 0; ... int NR = Registeredreceivers!= null?  
    Registeredreceivers.size (): 0; ...//If the broadcast is ordered, first process the dynamically registered receiver if (!ordered && NR > 0) {//If we are not serializing this broadcast, then send to//registered receivers separately so they don ' t wait for the//component  
        S to be launched. Broadcastrecord r = new Broadcastrecord (Intent, Callerapp, Callerpackage, Callingpid, Callinguid, Requir Edpermission, Registeredreceivers, Resultto, ResultCode, Resultdata, map, ordered, STI  
        CKY, false);  
        ...//mparallelbroadcasts contains only dynamically registered receiver Boolean replaced = false; if (replacepending) {for (int i=mparallelbroadcasts.size ()-1; i>=0; i--) {if (intent.  
                            Filterequals (Mparallelbroadcasts.get (i). Intent)) {if (debug_broadcast) slog.v (TAG,  
                    "* * * dropping PARALLEL:" + intent);  
                    Mparallelbroadcasts.set (i, R);  
                    replaced = true;  
                Break }} if (!replaced) {Mparallelbroadcasts.add (R);  
        Schedulebroadcastslocked ();  
        } registeredreceivers = null;  
    NR = 0;  
    }//Merge into one list.  
    If the broadcast is ordered, merge static, dynamic receiver, or otherwise handle the dynamic receiver, here registeredreceivers is null int ir = 0;   
        if (receivers!= null) {...//merge process, note order int NT = receivers!= null? Receivers.size (): 0;  
        int it = 0;  
        Resolveinfo curt = null;  
        Broadcastfilter curr = null; while (It < NT && IR < NR) {if (curt = null) {curt = (Resolveinfo) receive  
            Rs.get (IT);  
            } if (Curr = = null) {Curr = Registeredreceivers.get (IR);  
            ///If the dynamic receiver is high priority, plug it into the front//else, and then proceed to the next comparison, take a static receiver and compare it to the previous dynamic receiver until you find your location to insert into the list Here, adjust the order of the receiver, the same priority, obviously dynamic to be in the static front if (curr.getpriority () >= Curt.priority) {//Insert this broadcast record into the final list.  
                Receivers.add (it, Curr);  
                ir++;  
                Curr = null;  
                it++;  
            nt++;  
                else {//Skip to the ' next Resolveinfo in the final list.  
                it++;  
            Curt = null; }} while (IR < NR) {receivers = null) {receivers = new Arraylis  
        T ();  
        } receivers.add (Registeredreceivers.get (IR));  
    ir++; } if ((Receivers!= null && receivers.size () > 0) | | Resultto!= NULL) {B Roadcastrecord r = new Broadcastrecord (Intent, Callerapp, Callerpackage, Callingpid, Callinguid, require Dpermission, receivers, Resultto, ResultCode, Resultdata, map, ordered, sticky, false)  
        ; ... if (!repLaced) {Morderedbroadcasts.add (R);  
        Schedulebroadcastslocked ();  
} return broadcast_success; }