Android weixin service

简介

想了很久，为什么Android 微信的服务杀不死？既没有给它权限、又没有手动启动它，为什么它会自动开启接受消息？奇怪了？

先不管它采用什么方法，看看它的源码，然后分析推出自己的结论。

代码分析

AndroidManifest.xml中的服务与广播
<!-- 通知广播接受 -->
<receiver
    android:name="com.tencent.mm.booter.NotifyReceiver"
    android:exported="false" />
<receiver android:name="com.tencent.mm.booter.notification.NotificationDeleteReceive" />
<!-- 奔溃广播 -->
<receiver
    android:name="com.tencent.mm.sandbox.monitor.CrashUploadAlarmReceiver"
    android:exported="false" />

<receiver android:name="com.tencent.mm.booter.MountReceiver" >
    <intent-filter>
        <action android:name="android.intent.action.MEDIA_MOUNTED" />
        <action android:name="android.intent.action.MEDIA_EJECT" />
        <action android:name="android.intent.action.MEDIA_UNMOUNTED" />
        <action android:name="android.intent.action.MEDIA_SHARED" />
        <action android:name="android.intent.action.MEDIA_SCANNER_STARTED" />
        <action android:name="android.intent.action.MEDIA_SCANNER_FINISHED" />
        <action android:name="android.intent.action.MEDIA_REMOVED" />
        <action android:name="android.intent.action.MEDIA_BAD_REMOVAL" />

        <data android:scheme="file" />
    </intent-filter>

</receiver><service android:name="com.tencent.mm.booter.NotifyReceiver$NotifyService" />
<service android:name="com.tencent.mm.modelfriend.AddrBookObserver$AddrBookService" />
<receiver android:name="com.tencent.mm.booter.BluetoothReceiver" > //蓝牙广播
    <intent-filter>
        <action android:name="android.media.SCO_AUDIO_STATE_CHANGED" />
        <action android:name="android.media.ACTION_SCO_AUDIO_STATE_UPDATED" />
    </intent-filter>

</receiver><receiver android:name="com.tencent.mm.booter.InstallReceiver" > //安装包广告

    <intent-filter>
        <action android:name="com.android.vending.INSTALL_REFERRER" />//只接受错误？
    </intent-filter>

</receiver>
<receiver
    android:name="com.tencent.mm.booter.MMReceivers$ToolsProcessReceiver"
    android:exported="false"
    android:process=":tools" />
<receiver
    android:name="com.tencent.mm.plugin.backup.bakpcmodel.BakchatPcmgrNorify" //通知栏广播
    android:permission="" >

    <intent-filter>
        <action android:name="MMBakchatServiceStart" />
        <action android:name="MMBakchatServiceStop" />
    </intent-filter>

</receiver><service
    android:name="com.tencent.mm.plugin.backup.bakpcmodel.BakchatPcUsbService"
    android:exported="false" >

    <intent-filter>
        <action android:name="com.tencent.mm.plugin.backup.bakpcmodel.BakchatPcUsbService" />
    </intent-filter>

</service><service
    android:name="com.tencent.mm.booter.CoreService"  //核心服务
    android:process=":push" />
<service
    android:name="com.tencent.mm.booter.cache.CacheService" //缓冲服务
    android:process=":push" />
<receiver
    android:name="com.tencent.mm.booter.MMReceivers$BootReceiver" //启动广播
    android:process=":push" >

    <intent-filter>
        <action android:name="android.intent.action.BOOT_COMPLETED" />
    </intent-filter>

</receiver><receiver
    android:name="com.tencent.mm.booter.MMReceivers$ConnectionReceiver" //连接网络广播
    android:process=":push" >

    <intent-filter>
        <action android:name="android.net.conn.CONNECTIVITY_CHANGE" />
    </intent-filter>

</receiver><receiver
    android:name="com.tencent.mm.booter.MMReceivers$AlarmReceiver" //定时器
    android:process=":push" />
<receiver
    android:name="com.tencent.mm.jni.platformcomm.Alarm" //平台定时器
    android:exported="false"
    android:process=":push" />
<receiver android:name="com.tencent.mm.plugin.base.stub.WXEntryActivity$EntryReceiver" >

    <intent-filter>
        <action android:name="com.tencent.mm.plugin.openapi.Intent.ACTION_HANDLE_APP_REGISTER" />
        <action android:name="com.tencent.mm.plugin.openapi.Intent.ACTION_HANDLE_APP_UNREGISTER" />
    </intent-filter>

</receiver><service android:name="com.tencent.mm.remoteservice.RemoteService" />
<receiver
    android:name="com.tencent.mm.modelstat.WatchDogPushReceiver" //看门狗广播
    android:exported="false"
    android:process=":push" />
<service android:name="com.tencent.mm.pluginsdk.model.downloader.FileDownloadManger$FileDownloadService" />
<receiver android:name="com.tencent.mm.pluginsdk.model.downloader.FileDownloadManger$FileDownloadReceiver" >

    <intent-filter>
        <action android:name="android.intent.action.DOWNLOAD_COMPLETE" />
        <action android:name="android.intent.action.DOWNLOAD_NOTIFICATION_CLICKED" />
    </intent-filter>

</receiver><service
    android:name="com.tencent.mm.plugin.accountsync.model.AccountAuthenticatorService"
    android:exported="true" >

    <intent-filter>
        <action android:name="android.accounts.AccountAuthenticator" />
    </intent-filter>

    <meta-data
        android:name="android.accounts.AccountAuthenticator"
        android:resource="@xml/g" />

</service><service
    android:name="com.tencent.mm.plugin.accountsync.model.ContactsSyncService"
    android:exported="true" >

    <intent-filter>
        <action android:name="android.content.SyncAdapter" />
    </intent-filter>

    <meta-data
        android:name="android.content.SyncAdapter"
        android:resource="@xml/bf" />
    <meta-data
        android:name="android.provider.CONTACTS_STRUCTURE"
        android:resource="@xml/aa" />

</service><receiver
    android:name="com.tencent.mm.plugin.gcm.modelgcm.GcmBroadcastReceiver"
    android:permission="com.google.android.c2dm.permission.SEND" >

    <intent-filter>
        <action android:name="com.google.android.c2dm.intent.RECEIVE" />
        <action android:name="com.google.android.c2dm.intent.REGISTRATION" />

        <category android:name="com.tencent.mm" />
    </intent-filter>

</receiver><service android:name="com.tencent.mm.plugin.notification.ui.FailSendMsgNotification$FailSendNormalMsgNotificationService" />
<service android:name="com.tencent.mm.plugin.notification.ui.FailSendMsgNotification$FailSendSnsMsgNotificationService" />
<service
    android:name="com.tencent.mm.sandbox.monitor.ExceptionMonitorService"
    android:process=":sandbox" />
<service //服务
    android:name="com.tencent.mm.sandbox.updater.UpdaterService"
    android:process=":sandbox" />
<receiver //
    android:name="com.tencent.mm.plugin.shoot.remote.RemoteNetSceneMgr$RespReceiver"
    android:exported="false"
    android:process=":tools" >
 -->

</receiver><receiver //注册广播
    android:name="com.tencent.mm.plugin.shootstub.communicate.ReqReceiver"
    android:exported="false" >

    <intent-filter>
        <action android:name="com.tencent.mm.action.SHOOT_STUB_REQ" />
    </intent-filter>

</receiver>
//web服务
<service android:name="com.tencent.mm.plugin.webview.stub.WebViewStubService" />
CoreService核心服务
public class CoreService extends Service implements f, ag, bs {
	private as eoE; // 微信 sdk平台库
	private ab eoF = new ab(); // 网络信息
	private boolean eoG = true;
	public final int eoH = -1213;
	private final ae eoI = new d(this);
	private com.tencent.mm.modelstat.k eoJ = null; // 电话管理接口
	private AddrBookObserver eoK; // 本地通讯录监听
	private WatchDogPushReceiver eoL; // 看门狗（推送消息）
	private WakerLock eoM = null;
	private com.tencent.mm.platformtools.k eoN = new com.tencent.mm.platformtools.k(); // 平台接口
	private ax eoO = new ax(new e(this), false);// 线程相关操作（类似 Handle）

	private void DV() // 重新启动
	{
		x.w("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "[COMPLETE EXIT]");
		br.IS().e(3, 10000, "");
		bn.onDestroy();
		try {
			// 定时器
			MMReceivers.AlarmReceiver.ao(getApplicationContext());
			MMReceivers.AlarmReceiver.am(getApplicationContext());
			Alarm.aB(getApplicationContext());
			x.appenderClose(); // 日志记录
			Process.killProcess(Process.myPid());
			return;
		} catch (Exception localException) {
		}
	}

	public final void as(boolean paramBoolean) // 类似start
	{
		if (!paramBoolean) {
			x.w("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "[NETWORK LOST]");
			br.IO().eBE = false;
			br.IP().gn(0);
			br.IN().a(10502, "", null);
			if (this.eoG) {
				br.IR().Iy();
				this.eoF.Ei();
			}
			this.eoG = false;
		}
		while (true) {
			return;
			x.w("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "[NETWORK CONNECTED]");
			br.IO().eBE = true;
			boolean bool = this.eoF.Ej();
			if ((this.eoG) && (!bool)) {
				Object[] arrayOfObject = new Object[1];
				arrayOfObject[0] = Boolean.valueOf(this.eoG);
				x.i("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd",
						"network not change or can‘t get network info, lastStatus connect:%b",
						arrayOfObject);
			}
			if (bool)
				br.IR().Iy();
			this.eoG = true;
			br.IP().gn(1);
			br.IN().a(10501, "", null);
			if (this.eoM == null)
				this.eoM = new WakerLock(getApplicationContext());
			if (!this.eoM.isLocking())
				this.eoM.lock(14000L);
			x.i("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd",
					"checking ready, start in 7000ms");
			this.eoO.dv(7000L);
		}
	}

	public final boolean b(int paramInt, byte[] paramArrayOfByte)
{
  int i = 0;
  if (getSharedPreferences("system_config_prefs", m.Gh()).getBoolean("settings_fully_exit", true))
    x.i("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "fully exited, no need to notify worker");
  while (true)
  {
    return i;
    Intent localIntent = new Intent(this, NotifyReceiver.class);
    localIntent.putExtra("notify_option_type", 2);
    localIntent.putExtra("notify_uin", this.eoE.ID().qk());
    localIntent.putExtra("notify_respType", paramInt);
    localIntent.putExtra("notify_respBuf", paramArrayOfByte);
    localIntent.putExtra("notfiy_recv_time", cm.Jo());
    localIntent.putExtra("notify_skey", this.eoE.ID().sq());
    x.i("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "notify broadcast:" + localIntent.getAction() + ", type=" + paramInt);
    try
    {
      sendBroadcast(localIntent);
      label165: i = 1;
    }
    catch (Exception localException)
    {
      Object[] arrayOfObject = new Object[1];
      arrayOfObject[i] = localException.toString();
      x.f("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onNotify hasDestroyed %s", arrayOfObject);
      break label165:
    }
  }
}

	public IBinder onBind(Intent paramIntent) {
		x.d("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onBind~~~ threadID:"
				+ Thread.currentThread());
		return this.eoE;
	}

	@JgMethodChecked(author=20, fComment="checked", lastDate="20140429", reviewer=20, vComment={com.jg.EType.RECEIVERCHECK})
public void onCreate()
{
  Object localObject = null;
  x.d("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onCreate~~~threadID:" + Thread.currentThread());
  super.onCreate();
  if (Build.VERSION.SDK_INT < 18) //根据版本 设置进程属性
    startForeground(-1213, new Notification());
  ClassLoader localClassLoader = CoreService.class.getClassLoader(); //加载服务
  o.a(com.tencent.mm.sdk.a.jBq, localClassLoader);
  //对应的属性jbq如下
//  public static String jBq = "wechatbaseprj";
//  public static String jBr = "wechatnetwork";
//  public static String jBs = "wechatxlog";
//  public static String jBt = "wechatkvcomm";
//  public static String jBu = "wechatcdn";
//  public static String jBv = "wechataccessory";
//  public static String jBx = "wechatwebp";
//  public static String jBy = "wechatutils";

  ak localak = new ak(Looper.getMainLooper()); //消息线程
  PlatformComm.a(ai.getContext(), localak);//平台通用接口
  g localg = new g(this); //一个消息
  localg.DX();
  ac.a(this.eoI);
  if (PlatformComm.exG == null)
    PlatformComm.exG = this;
  br.a(localak); //通讯接口
  br.setContext(getApplicationContext());
  br.a(new bt());
  br.a(new bu());
  br.a(this);//通讯接口
  if (this.eoJ == null)
    this.eoJ = new com.tencent.mm.modelstat.k(); //网络与推送
  br.a(this.eoJ);
  br.a(new bk());
  this.eoE = br.IR();
  if (this.eoE == null)
  {
    x.i("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "autoAuth is null and new one");
    this.eoE = new as(br.Ae());
    br.e(this.eoE);
    label228: bn.onCreate();
    if (br.IS() != null)
      break label551;
    x.i("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "NetTaskAdapter is null and new one");
    br.a(new bp());
  }
  while (true)
  {
    if (br.IT() == null)
    {
      x.i("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "NetTaskAdapter is null and new one");
      br.a(new bo());
      br.IT().eBo = this;
    }
    String str1 = localg.getString(".com.tencent.mm.debug.server.host.http");
    String str2 = localg.getString(".com.tencent.mm.debug.server.ports.http");
    String str3 = localg.getString(".com.tencent.mm.debug.server.host.socket");
    String str4 = localg.getString(".com.tencent.mm.debug.server.ports.socket");
    this.eoE.c(str1, str2, str3, str4);
    String str5 = localg.getString(".com.tencent.mm.debug.server.host.newdns");
    String str6;
    String str7;
    label389: ConnectivityManager localConnectivityManager;
    if ((str5 != null) && (str5.contains(":")))
    {
      String[] arrayOfString = str5.split(":");
      str6 = arrayOfString[0];
      str7 = arrayOfString[1];
      this.eoE.setNewDnsDebugHost(str6, str7);
      MMReceivers.AlarmReceiver.ao(getApplicationContext()); //启动接受
      MMReceivers.AlarmReceiver.an(getApplicationContext());
      localConnectivityManager = (ConnectivityManager)getSystemService("connectivity");
    }
    try
    {
    	//网络
      NetworkInfo localNetworkInfo = localConnectivityManager.getActiveNetworkInfo();
      localObject = localNetworkInfo;
      label436: if ((localObject != null) && (localObject.getState() == NetworkInfo.State.CONNECTED))
        break label581;
      br.IO().eBE = false;
      br.IP().gn(0);
      label464: this.eoK = new AddrBookObserver(this);
      getContentResolver().registerContentObserver(com.tencent.mm.pluginsdk.a.aJf(), true, this.eoK);
      this.eoL = new WatchDogPushReceiver();
      registerReceiver(this.eoL, new IntentFilter("com.tencent.mm.WatchDogPushReceiver"));
      o.a(com.tencent.mm.sdk.a.jBy, CoreService.class.getClassLoader());
      return;
      x.w("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "autoAuth is not null and reset");
      this.eoE.reset();
      break label228:
      label551: x.w("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "NetTaskAdapter is not null and reset");
      label581: br.IS().reset();
    }
    catch (Exception localException)
    {
      x.e("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "getActiveNetworkInfo failed.");
      break label436:
      br.IO().eBE = true;
      br.IP().gn(1);
      break label464:
      str6 = str5;
      str7 = null;
      break label389:
    }
  }
}

	public void onDestroy() // 销毁
	{
		x.d("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onDestroy~~~ threadID:"
				+ Thread.currentThread());
		this.eoJ.a(10002, null, null); // 推送消息相关
		getContentResolver().unregisterContentObserver(this.eoK); // 取消通讯录监听
		unregisterReceiver(this.eoL); // 取消推送
		super.onDestroy();
		DV(); // 重新启动
	}

	public void onRebind(Intent paramIntent) {
		x.d("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onRebind~~~ threadID:"
				+ Thread.currentThread());
		super.onRebind(paramIntent);
	}

	public boolean onUnbind(Intent paramIntent) {
		x.d("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onUnbind~~~ threadID:"
				+ Thread.currentThread());
		br.IO().a(null); // 通讯接口
		br.IU().a(null);
		return super.onUnbind(paramIntent);
	}

	public final void restartProcess() // 重新启动进行
	{
		x.w("[email protected]/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "restartProcess");
		DV();
	}
}

结论

为什么它的服务杀不死？笔者猜测如下：

1、反射修改系统有关自己app的属性，从而能使自己接受到广播。（暂未从源码中发现）

2、通用SDK库中有调用，QQ、微信、通讯录等共用一个库，这个库判断有该服务则启动。（暂未从源码中发现）

3、定时器循环触发启动，例如：结束进程是有时间间隔，是否利用此间隔在此互相启动？（猜测，未详细跟进源码）

4、把App列为系统等级，从而安装到系统目录。（未从源码中发现）

不管结论对不对，自己动手测试下便知结果。

时间： 2024-11-25 09:45:14

Android weixin service的相关文章

android 远程Service以及AIDL的跨进程通信

在Android中,Service是运行在主线程中的,如果在Service中处理一些耗时的操作,就会导致程序出现ANR. 但如果将本地的Service转换成一个远程的Service,就不会出现这样的问题了. 转换成远程Service非常简单,只需要在注册Service的时候将他的android:process的属性制定成 :remote就可以了. 重新运行项目,你会发现,不会出现ANR了. 为什么将MyService转换成远程Service后就不会导致程序ANR了呢?这是由于,使用了远程Serv

android的Service的实例

package com.android.service; import android.app.IntentService;import android.content.Intent; public class HelloIntentService extends IntentService{ public HelloIntentService() {        super("HelloIntentService");        // TODO Auto-generated c

（六）Android中Service通信

一.启动Service并传递参数 传递参数时只需在startService启动的Intent中传入数据便可,接收参数时可在onStartCommand函数中通过读取第一个参数Intent的内容来实现 1.MainActivity.java package com.example.shiyanshi.serviceconnected; import android.app.Activity;import android.content.Intent;import android.os.Bundle

Android 测试Service的生命周期

1 package com.example.myapp4; 2 3 import android.support.v7.app.ActionBarActivity; 4 import android.content.Intent; 5 import android.os.Bundle; 6 import android.view.Menu; 7 import android.view.MenuItem; 8 import android.view.View; 9 import android.w

Android之Service通信-(2)

一.Service通过IBinder与Activity进行通信 在Service中进行下载 Service package chuiyuan.lsj.androidjava.service; import android.app.Service; import android.content.Intent; import android.os.Binder; import android.os.IBinder; import android.util.Log; import android.wi

Android——判断Service是否已经启动

延续百度地图定位的Demo,采用Service来进行百度定位,并且将数据上传到服务器上遇到了一个问题:在真机中使用清理内存来关闭程序的之后,Service会被关闭,但是过几秒中,它又会自动重启:重启就算了,而且再次登陆系统的时候,又会开启一个一样的服务,在LogCat中就会看到每次都获取到两次的定位数据.然后想想是否可以在建立Service之前判断这个服务有没有被创建?只要能做这个判断,那么服务存在我们就不管它,如果不存在则创建,本着这个思路,百度发现可行(Service后台服务创建时最好都要判

Android Web Service学习总结（一）

最近学习android平台调用webWebService,学习了一篇不错的博客(http://blog.csdn.net/lyq8479/article/details/6428288),可惜是2011年时的方法,而不适合现在android4.0之后的android版本,所以通过一番学习和研究,总结如下. web Service简介 通俗的理解:通过使用WebService,我们能够像调用本地方法一样去调用远程服务器上的方法.我们并不需要关心远程的那个方法是Java写的,还是PHP或C#写的:我

如何从python代码中直接访问Android的Service

在Kivy中,通过pyjnius扩展可以间接调用Java代码,而pyjnius利用的是Java的反射机制.但是在Python对象和Java对象中转来转去总让人感觉到十分别扭.好在android提供了binder这个进程间通信的功能,Java中的Service也是基于Binder的C++代码封装来实现进程间通信的,这也为从Python代码中绕开pyjnius直接访问Java代码提供了可能,既然Java的Service是基于C++的封装来实现的,也同样可以在Python中封装同样的C++代码,这篇文

【Android】Android中Service类onStartCommand的返回值有关问题（转）

@Override public int onStartCommand(Intent intent, int flags, int startId) { System.out.println("---------->>onStartCommand2"); return super.onStartCommand(intent, flags, startId); } Android开发的过程中,每次调用startService(Intent)的时候,都会调用该Service对象