Android security Issues (vi) preemptive reception of broadcasts

Guide: This article explains how the system registers the dynamic broadcast and the static broadcast, here mainly notices its registration order

This article is mainly for my first two articles

Android security Issues (iv) preemptive boot-result article

Android security Issues (v.) Preemptive intercept message-result article

Only given the results before, and did not give a code analysis, now give the first step of the analysis

As we all know, broadcast receiver is divided into dynamic registration and static registration two kinds

Static receive, is configured into the manifest.xml file, Packagemanagerservice Scan and record its information ...

Dynamic receive is to register from the code, by calling the following method to implement the

Intent Android.content.Context.registerReceiver (broadcastreceiver receiver, Intentfilter filter)

(The following flowchart estimates the comparison of the water, will be a look at it, you need to cram the UML)

First, analyze the process of static register receiver

Static receiver registration is initialized by the time the Packagemanagerservice is powered on.

(Packagemanagerservice after abbreviation for PMS)

The PMS will scan the system for some directories on the power-on, parsing apk files. Static broadcast receivers are handled by the PMS at the time of the event.

The PMS resolves the apk manifest file, finds the registered receiver here, and loads it into memory.

Let's take a look at how the PMS works.

This part of the content is not difficult, as long as there is patience on the line, I drew a very simple flowchart, starting from calling the PMs constructor

Note that there are several functions with the same name that you need to distinguish. Not the same function called twice

There are only a few places to look.

What did the 1.PMS do when it was initialized?

Of course, PMS will do a lot of things, and here we only look at the parts of our attention that are relevant to this article

Collect all system packages.  
Msystemappdir = new File (Environment.getrootdirectory (), "app");  
Msysteminstallobserver = new Appdirobserver (  
    Msystemappdir.getpath (), observer_events, true);  
Msysteminstallobserver.startwatching ();  
Scandirli (Msystemappdir, Packageparser.parse_is_system | Packageparser.parse_is_system_dir, 

scanmode, 0);

The order in which directories are scanned

System/framework

System/app

Vendor/app

Data/app

Drm/app-private

Here take the System/app directory as an example