Android基础之Binder分析，零基础入门android逆向视频课程

// 935
static int int_register_android_os_BinderInternal(JNIEnv* env){  
// 查找文件kBinderInternalPathName = “com/android/internal/os/BinderInternal”，返回Class对象
jclass clazz = FindClassOrDie(env, kBinderInternalPathName);
// 通过gBinderInternalOffsets，保存Java层BinderInternal类的信息，为JNI层访问java 层提供通道
gBinderInternalOffsets.mClass = MakeGlobalRefOrDie(env, clazz);
gBinderInternalOffsets.mForceGc = GetStaticMethodIDOrDie(env, clazz, “forceBinderGc”, “()V”);

// 通过RegisterMethodsOrDie()，将为gBinderInternalMethods数组完成映射关系，从而为 Java层访问JNI层提供通道
return RegisterMethodsOrDie(      
env, kBinderInternalPathName,      
gBinderInternalMethods,
NELEM(gBinderInternalMethods));
}

2-3.int_register_android_os_BinderProxy

//frameworks/base/core/jni/android_util_Binder.cpp

// 1241
static const JNINativeMethod gBinderProxyMethods[] = {    
/* name, signature, funcPtr /  
{“pingBinder”,         “()Z”, (void)android_os_BinderProxy_pingBinder},  
{“isBinderAlive”,       “()Z”, (void*)android_os_BinderProxy_isBinderAlive},  
{“getInterfaceDescriptor”, “()Ljava/lang/String;”, (void*)android_os_BinderProxy_getInterfaceDescriptor},
{“transactNative”,     “(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z”, (void*)android_os_BinderProxy_transact},
{“linkToDeath”,         “(Landroid/os/IBinderKaTeX parse error: Expected 'EOF', got '}' at position 63: …oxy_linkToDeath}̲, {"unlinkToDe…DeathRecipient;I)Z”, (void*)android_os_BinderProxy_unlinkToDeath},  
{“destroy”,             “()V”, (void*)android_os_BinderProxy_destroy}, };

// 1252
const char* const kBinderProxyPathName = “android/os/BinderProxy”;

// 1254
static int int_register_android_os_BinderProxy(JNIEnv* env) {  
// 查找文件 kBinderProxyPathName = “android/os/BinderProxy”，返回对应Class对象
jclass clazz = FindClassOrDie(env, “java/lang/Error”);  
gErrorOffsets.mClass = MakeGlobalRefOrDie(env, clazz);

// 通过gBinderProxyOffsets，保存Java层BinderProxy类的信息，为JNI层访问Java提供通道
clazz = FindClassOrDie(env, kBinderProxyPathName);  
gBinderProxyOffsets.mClass = MakeGlobalRefOrDie(env, clazz);  
gBinderProxyOffsets.mConstructor = GetMethodIDOrDie(env, clazz, “”, " ()V");  
gBinderProxyOffsets.mSendDeathNotice = GetStaticMethodIDOrDie(env, clazz, “sendDeathNotice”, “(Landroid/os/IBinder$DeathRecipient;)V”);

gBinderProxyOffsets.mObject = GetFieldIDOrDie(env, clazz, “mObject”, “J”);  
gBinderProxyOffsets.mSelf = GetFieldIDOrDie(env, clazz, “mSelf”,“Ljava/lang/ref/WeakReference;”);

gBinderProxyOffsets.mOrgue = GetFieldIDOrDie(env, clazz, “mOrgue”, “J”);

clazz = FindClassOrDie(env, “java/lang/Class”);  
gClassOffsets.mGetName = GetMethodIDOrDie(env, clazz, “getName”, " ()Ljava/lang/String;");

// 通过RegisterMethodsOrDie()，将为gBinderProxyMethods数组完成映射关系，从而为Java 层访问JNI层提供通道
return RegisterMethodsOrDie(      
env, kBinderProxyPathName,      
gBinderProxyMethods, NELEM(gBinderProxyMethods));
}

Binder驱动注册讲解

1.binder_init

主要工作：

1. 分配内存
2. 初始化设备
3. 放入链表 binder_devices

kernel/drivers/staging/android/binder.c

// 4290 设备驱动入口函数
device_initcall(binder_init);

// 4213
static int __init binder_init(void)

// 4220 创建名为binder的单线程的工作队列
binder_deferred_workqueue = create_singlethread_workqueue(“binder”);

// 4269
ret = init_binder_device(device_name);

kernel/drivers/staging/android/binder.c

// 4186
static int __init init_binder_device(const char *name) {
int ret;
struct binder_device *binder_device;

// 4191 1.为binder设备分配内存
binder_device = kzalloc(sizeof(*binder_device), GFP_KERNEL);

// 4195 2.初始化设备
binder_device->miscdev.fops = &binder_fops; // 设备的文件操作结构，这是 file_operations结构

binder_device->miscdev.minor = MISC_DYNAMIC_MINOR; // 次设备号 动态分配
binder_device->miscdev.name = name; // 设备名,“binder”

binder_device->context.binder_context_mgr_uid = INVALID_UID;
binder_device->context.name = name;

// 4202 misc驱动注册
ret = misc_register(&binder_device->miscdev);

// 4208 3.将hlist节点添加到binder_devices为表头的设备链表
hlist_add_head(&binder_device->hlist, &binder_devices);
return ret;
}

misc设备：是没有硬件的一段内存，优点是注册简单

2.binder_open

主要工作：

1. 创建binder_proc对象
2. 当前进程信息proc
3. filp->private_data = proc
4. 添加到binder_procs链表中

kernel/drivers/staging/android/binder.c