Android weixin service

標籤：des   android   http   io   ar   os   sp   for   java   

簡介

想了很久，為什麼Android 的服務殺不死？既沒有給它許可權、又沒有手動啟動它，為什麼它會自動開啟接受訊息？奇怪了？

先不管它採用什麼方法，看看它的源碼，然後分析推出自己的結論。

程式碼分析AndroidManifest.xml中的服務與廣播

<!-- 通知廣播接受 --><receiver    android:name="com.tencent.mm.booter.NotifyReceiver"    android:exported="false" /><receiver android:name="com.tencent.mm.booter.notification.NotificationDeleteReceive" /><!-- 奔潰廣播 --><receiver    android:name="com.tencent.mm.sandbox.monitor.CrashUploadAlarmReceiver"    android:exported="false" /><receiver android:name="com.tencent.mm.booter.MountReceiver" >    <intent-filter>        <action android:name="android.intent.action.MEDIA_MOUNTED" />        <action android:name="android.intent.action.MEDIA_EJECT" />        <action android:name="android.intent.action.MEDIA_UNMOUNTED" />        <action android:name="android.intent.action.MEDIA_SHARED" />        <action android:name="android.intent.action.MEDIA_SCANNER_STARTED" />        <action android:name="android.intent.action.MEDIA_SCANNER_FINISHED" />        <action android:name="android.intent.action.MEDIA_REMOVED" />        <action android:name="android.intent.action.MEDIA_BAD_REMOVAL" />        <data android:scheme="file" />    </intent-filter></receiver><service android:name="com.tencent.mm.booter.NotifyReceiver$NotifyService" /><service android:name="com.tencent.mm.modelfriend.AddrBookObserver$AddrBookService" /><receiver android:name="com.tencent.mm.booter.BluetoothReceiver" > //藍芽廣播    <intent-filter>        <action android:name="android.media.SCO_AUDIO_STATE_CHANGED" />        <action android:name="android.media.ACTION_SCO_AUDIO_STATE_UPDATED" />    </intent-filter></receiver><receiver android:name="com.tencent.mm.booter.InstallReceiver" > //安裝包廣告    <intent-filter>        <action android:name="com.android.vending.INSTALL_REFERRER" />//只接受錯誤？    </intent-filter></receiver><receiver    android:name="com.tencent.mm.booter.MMReceivers$ToolsProcessReceiver"     android:exported="false"    android:process=":tools" /><receiver    android:name="com.tencent.mm.plugin.backup.bakpcmodel.BakchatPcmgrNorify" //通知欄廣播    android:permission="" >    <intent-filter>        <action android:name="MMBakchatServiceStart" />        <action android:name="MMBakchatServiceStop" />    </intent-filter></receiver><service    android:name="com.tencent.mm.plugin.backup.bakpcmodel.BakchatPcUsbService"    android:exported="false" >    <intent-filter>        <action android:name="com.tencent.mm.plugin.backup.bakpcmodel.BakchatPcUsbService" />    </intent-filter></service><service    android:name="com.tencent.mm.booter.CoreService"  //核心服務    android:process=":push" /><service    android:name="com.tencent.mm.booter.cache.CacheService" //緩衝服務    android:process=":push" /><receiver    android:name="com.tencent.mm.booter.MMReceivers$BootReceiver" //啟動廣播    android:process=":push" >    <intent-filter>        <action android:name="android.intent.action.BOOT_COMPLETED" />    </intent-filter></receiver><receiver    android:name="com.tencent.mm.booter.MMReceivers$ConnectionReceiver" //串連網路廣播    android:process=":push" >    <intent-filter>        <action android:name="android.net.conn.CONNECTIVITY_CHANGE" />    </intent-filter></receiver><receiver    android:name="com.tencent.mm.booter.MMReceivers$AlarmReceiver" //定時器    android:process=":push" /><receiver    android:name="com.tencent.mm.jni.platformcomm.Alarm" //平台定時器    android:exported="false"    android:process=":push" /><receiver android:name="com.tencent.mm.plugin.base.stub.WXEntryActivity$EntryReceiver" >    <intent-filter>        <action android:name="com.tencent.mm.plugin.openapi.Intent.ACTION_HANDLE_APP_REGISTER" />        <action android:name="com.tencent.mm.plugin.openapi.Intent.ACTION_HANDLE_APP_UNREGISTER" />    </intent-filter></receiver><service android:name="com.tencent.mm.remoteservice.RemoteService" /> <receiver    android:name="com.tencent.mm.modelstat.WatchDogPushReceiver" //看門狗廣播    android:exported="false"    android:process=":push" /><service android:name="com.tencent.mm.pluginsdk.model.downloader.FileDownloadManger$FileDownloadService" /><receiver android:name="com.tencent.mm.pluginsdk.model.downloader.FileDownloadManger$FileDownloadReceiver" >    <intent-filter>        <action android:name="android.intent.action.DOWNLOAD_COMPLETE" />        <action android:name="android.intent.action.DOWNLOAD_NOTIFICATION_CLICKED" />    </intent-filter></receiver><service    android:name="com.tencent.mm.plugin.accountsync.model.AccountAuthenticatorService"    android:exported="true" >    <intent-filter>        <action android:name="android.accounts.AccountAuthenticator" />    </intent-filter>    <meta-data        android:name="android.accounts.AccountAuthenticator"        android:resource="@xml/g" /></service><service    android:name="com.tencent.mm.plugin.accountsync.model.ContactsSyncService"    android:exported="true" >    <intent-filter>        <action android:name="android.content.SyncAdapter" />    </intent-filter>    <meta-data        android:name="android.content.SyncAdapter"        android:resource="@xml/bf" />    <meta-data        android:name="android.provider.CONTACTS_STRUCTURE"        android:resource="@xml/aa" /></service><receiver    android:name="com.tencent.mm.plugin.gcm.modelgcm.GcmBroadcastReceiver"    android:permission="com.google.android.c2dm.permission.SEND" >    <intent-filter>        <action android:name="com.google.android.c2dm.intent.RECEIVE" />        <action android:name="com.google.android.c2dm.intent.REGISTRATION" />        <category android:name="com.tencent.mm" />    </intent-filter></receiver><service android:name="com.tencent.mm.plugin.notification.ui.FailSendMsgNotification$FailSendNormalMsgNotificationService" /><service android:name="com.tencent.mm.plugin.notification.ui.FailSendMsgNotification$FailSendSnsMsgNotificationService" /><service    android:name="com.tencent.mm.sandbox.monitor.ExceptionMonitorService"    android:process=":sandbox" /><service //服務    android:name="com.tencent.mm.sandbox.updater.UpdaterService"    android:process=":sandbox" /><receiver //    android:name="com.tencent.mm.plugin.shoot.remote.RemoteNetSceneMgr$RespReceiver"    android:exported="false"    android:process=":tools" > --></receiver><receiver //註冊廣播    android:name="com.tencent.mm.plugin.shootstub.communicate.ReqReceiver"    android:exported="false" >    <intent-filter>        <action android:name="com.tencent.mm.action.SHOOT_STUB_REQ" />    </intent-filter></receiver>//web服務<service android:name="com.tencent.mm.plugin.webview.stub.WebViewStubService" />

CoreService核心服務

public class CoreService extends Service implements f, ag, bs {private as eoE; //  sdk平台庫private ab eoF = new ab(); // 網路資訊private boolean eoG = true;public final int eoH = -1213;private final ae eoI = new d(this);private com.tencent.mm.modelstat.k eoJ = null; // 電話管理介面private AddrBookObserver eoK; // 本地通訊錄監聽private WatchDogPushReceiver eoL; // 看門狗（推送訊息）private WakerLock eoM = null;private com.tencent.mm.platformtools.k eoN = new com.tencent.mm.platformtools.k(); // 平台介面private ax eoO = new ax(new e(this), false);// 線程相關操作（類似 Handle）private void DV() // 重新啟動{x.w("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "[COMPLETE EXIT]");br.IS().e(3, 10000, "");bn.onDestroy();try {// 定時器MMReceivers.AlarmReceiver.ao(getApplicationContext());MMReceivers.AlarmReceiver.am(getApplicationContext());Alarm.aB(getApplicationContext());x.appenderClose(); // 日誌記錄Process.killProcess(Process.myPid());return;} catch (Exception localException) {}}public final void as(boolean paramBoolean) // 類似start{if (!paramBoolean) {x.w("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "[NETWORK LOST]");br.IO().eBE = false;br.IP().gn(0);br.IN().a(10502, "", null);if (this.eoG) {br.IR().Iy();this.eoF.Ei();}this.eoG = false;}while (true) {return;x.w("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "[NETWORK CONNECTED]");br.IO().eBE = true;boolean bool = this.eoF.Ej();if ((this.eoG) && (!bool)) {Object[] arrayOfObject = new Object[1];arrayOfObject[0] = Boolean.valueOf(this.eoG);x.i("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd","network not change or can‘t get network info, lastStatus connect:%b",arrayOfObject);}if (bool)br.IR().Iy();this.eoG = true;br.IP().gn(1);br.IN().a(10501, "", null);if (this.eoM == null)this.eoM = new WakerLock(getApplicationContext());if (!this.eoM.isLocking())this.eoM.lock(14000L);x.i("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd","checking ready, start in 7000ms");this.eoO.dv(7000L);}}public final boolean b(int paramInt, byte[] paramArrayOfByte){  int i = 0;  if (getSharedPreferences("system_config_prefs", m.Gh()).getBoolean("settings_fully_exit", true))    x.i("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "fully exited, no need to notify worker");  while (true)  {    return i;    Intent localIntent = new Intent(this, NotifyReceiver.class);    localIntent.putExtra("notify_option_type", 2);    localIntent.putExtra("notify_uin", this.eoE.ID().qk());    localIntent.putExtra("notify_respType", paramInt);    localIntent.putExtra("notify_respBuf", paramArrayOfByte);    localIntent.putExtra("notfiy_recv_time", cm.Jo());    localIntent.putExtra("notify_skey", this.eoE.ID().sq());    x.i("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "notify broadcast:" + localIntent.getAction() + ", type=" + paramInt);    try    {      sendBroadcast(localIntent);      label165: i = 1;    }    catch (Exception localException)    {      Object[] arrayOfObject = new Object[1];      arrayOfObject[i] = localException.toString();      x.f("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onNotify hasDestroyed %s", arrayOfObject);      break label165:    }  }}public IBinder onBind(Intent paramIntent) {x.d("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onBind~~~ threadID:"+ Thread.currentThread());return this.eoE;}@JgMethodChecked(author=20, fComment="checked", lastDate="20140429", reviewer=20, vComment={com.jg.EType.RECEIVERCHECK})public void onCreate(){  Object localObject = null;  x.d("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onCreate~~~threadID:" + Thread.currentThread());  super.onCreate();  if (Build.VERSION.SDK_INT < 18) //根據版本 設定進程屬性    startForeground(-1213, new Notification());  ClassLoader localClassLoader = CoreService.class.getClassLoader(); //載入服務  o.a(com.tencent.mm.sdk.a.jBq, localClassLoader);  //對應的屬性jbq如下//  public static String jBq = "wechatbaseprj";//  public static String jBr = "wechatnetwork";//  public static String jBs = "wechatxlog";//  public static String jBt = "wechatkvcomm";//  public static String jBu = "wechatcdn";//  public static String jBv = "wechataccessory";//  public static String jBx = "wechatwebp";//  public static String jBy = "wechatutils";    ak localak = new ak(Looper.getMainLooper()); //訊息線程  PlatformComm.a(ai.getContext(), localak);//平台通用介面  g localg = new g(this); //一個訊息  localg.DX();  ac.a(this.eoI);  if (PlatformComm.exG == null)     PlatformComm.exG = this;  br.a(localak); //通訊介面  br.setContext(getApplicationContext());  br.a(new bt());  br.a(new bu());  br.a(this);//通訊介面  if (this.eoJ == null)    this.eoJ = new com.tencent.mm.modelstat.k(); //網路與推送  br.a(this.eoJ);  br.a(new bk());  this.eoE = br.IR();  if (this.eoE == null)  {    x.i("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "autoAuth is null and new one");    this.eoE = new as(br.Ae());    br.e(this.eoE);    label228: bn.onCreate();    if (br.IS() != null)      break label551;    x.i("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "NetTaskAdapter is null and new one");    br.a(new bp());  }  while (true)  {    if (br.IT() == null)    {      x.i("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "NetTaskAdapter is null and new one");      br.a(new bo());      br.IT().eBo = this;    }    String str1 = localg.getString(".com.tencent.mm.debug.server.host.http");    String str2 = localg.getString(".com.tencent.mm.debug.server.ports.http");    String str3 = localg.getString(".com.tencent.mm.debug.server.host.socket");    String str4 = localg.getString(".com.tencent.mm.debug.server.ports.socket");    this.eoE.c(str1, str2, str3, str4);    String str5 = localg.getString(".com.tencent.mm.debug.server.host.newdns");    String str6;    String str7;    label389: ConnectivityManager localConnectivityManager;    if ((str5 != null) && (str5.contains(":")))    {      String[] arrayOfString = str5.split(":");      str6 = arrayOfString[0];      str7 = arrayOfString[1];      this.eoE.setNewDnsDebugHost(str6, str7);      MMReceivers.AlarmReceiver.ao(getApplicationContext()); //啟動接受      MMReceivers.AlarmReceiver.an(getApplicationContext());      localConnectivityManager = (ConnectivityManager)getSystemService("connectivity");    }    try    {    //網路      NetworkInfo localNetworkInfo = localConnectivityManager.getActiveNetworkInfo();      localObject = localNetworkInfo;      label436: if ((localObject != null) && (localObject.getState() == NetworkInfo.State.CONNECTED))        break label581;      br.IO().eBE = false;      br.IP().gn(0);      label464: this.eoK = new AddrBookObserver(this);      getContentResolver().registerContentObserver(com.tencent.mm.pluginsdk.a.aJf(), true, this.eoK);      this.eoL = new WatchDogPushReceiver();      registerReceiver(this.eoL, new IntentFilter("com.tencent.mm.WatchDogPushReceiver"));      o.a(com.tencent.mm.sdk.a.jBy, CoreService.class.getClassLoader());      return;      x.w("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "autoAuth is not null and reset");      this.eoE.reset();      break label228:      label551: x.w("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "NetTaskAdapter is not null and reset");      label581: br.IS().reset();    }    catch (Exception localException)    {      x.e("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "getActiveNetworkInfo failed.");      break label436:      br.IO().eBE = true;      br.IP().gn(1);      break label464:      str6 = str5;      str7 = null;      break label389:    }  }}public void onDestroy() // 銷毀{x.d("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onDestroy~~~ threadID:"+ Thread.currentThread());this.eoJ.a(10002, null, null); // 推送訊息相關getContentResolver().unregisterContentObserver(this.eoK); // 取消通訊錄監聽unregisterReceiver(this.eoL); // 取消推送super.onDestroy();DV(); // 重新啟動}public void onRebind(Intent paramIntent) {x.d("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onRebind~~~ threadID:"+ Thread.currentThread());super.onRebind(paramIntent);}public boolean onUnbind(Intent paramIntent) {x.d("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onUnbind~~~ threadID:"+ Thread.currentThread());br.IO().a(null); // 通訊介面br.IU().a(null);return super.onUnbind(paramIntent);}public final void restartProcess() // 重新啟動進行{x.w("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "restartProcess");DV();}}

結論

為什麼它的服務殺不死？筆者猜測如下：

1、反射修改系統有關自己app的屬性，從而能使自己接受到廣播。（暫未從源碼中發現）

2、通用SDK庫中有調用，QQ、、通訊錄等共用一個庫，這個庫判斷有該服務則啟動。（暫未從源碼中發現）

3、定時器迴圈觸發啟動，例如：結束進程是有時間間隔，是否利用此間隔在此互相啟動？（猜測，未詳細跟進源碼）

4、把App列為系統等級，從而安裝到系統目錄。（未從源碼中發現）

不管結論對不對，自己動手測試下便知結果。

Android weixin service