Android weixin service 2014-12-13 17:16

 

Android weixin service

2014-12-13 17:16  7017人阅读  评论(5)  收藏  举报

  分类：

android（90） 

版权声明：本文为博主原创文章，未经博主允许不得转载。

目录(?)[+]

简介

想了很久，为什么Android 微信的服务杀不死？既没有给它权限、又没有手动启动它，为什么它会自动开启接受消息？奇怪了？

先不管它采用什么方法，看看它的源码，然后分析推出自己的结论。

代码分析

AndroidManifest.xml中的服务与广播

[java]  view plain  copy

1. <!-- 通知广播接受 -->  
2. <receiver  
3.     android:name="com.tencent.mm.booter.NotifyReceiver"  
4.     android:exported="false" />  
5. <receiver android:name="com.tencent.mm.booter.notification.NotificationDeleteReceive" />  
6. <!-- 奔溃广播 -->  
7. <receiver  
8.     android:name="com.tencent.mm.sandbox.monitor.CrashUploadAlarmReceiver"  
9.     android:exported="false" />  
10.   
11. <receiver android:name="com.tencent.mm.booter.MountReceiver" >  
12.     <intent-filter>  
13.         <action android:name="android.intent.action.MEDIA_MOUNTED" />  
14.         <action android:name="android.intent.action.MEDIA_EJECT" />  
15.         <action android:name="android.intent.action.MEDIA_UNMOUNTED" />  
16.         <action android:name="android.intent.action.MEDIA_SHARED" />  
17.         <action android:name="android.intent.action.MEDIA_SCANNER_STARTED" />  
18.         <action android:name="android.intent.action.MEDIA_SCANNER_FINISHED" />  
19.         <action android:name="android.intent.action.MEDIA_REMOVED" />  
20.         <action android:name="android.intent.action.MEDIA_BAD_REMOVAL" />  
21.   
22.         <data android:scheme="file" />  
23.     </intent-filter>  
24.   
25. </receiver><service android:name="com.tencent.mm.booter.NotifyReceiver$NotifyService" />  
26. <service android:name="com.tencent.mm.modelfriend.AddrBookObserver$AddrBookService" />  
27. <receiver android:name="com.tencent.mm.booter.BluetoothReceiver" > //蓝牙广播  
28.     <intent-filter>  
29.         <action android:name="android.media.SCO_AUDIO_STATE_CHANGED" />  
30.         <action android:name="android.media.ACTION_SCO_AUDIO_STATE_UPDATED" />  
31.     </intent-filter>  
32.   
33. </receiver><receiver android:name="com.tencent.mm.booter.InstallReceiver" > //安装包广告  
34.   
35.     <intent-filter>  
36.         <action android:name="com.android.vending.INSTALL_REFERRER" />//只接受错误？  
37.     </intent-filter>  
38.   
39. </receiver>  
40. <receiver  
41.     android:name="com.tencent.mm.booter.MMReceivers$ToolsProcessReceiver"   
42.     android:exported="false"  
43.     android:process=":tools" />  
44. <receiver  
45.     android:name="com.tencent.mm.plugin.backup.bakpcmodel.BakchatPcmgrNorify" //通知栏广播  
46.     android:permission="" >  
47.   
48.     <intent-filter>  
49.         <action android:name="MMBakchatServiceStart" />  
50.         <action android:name="MMBakchatServiceStop" />  
51.     </intent-filter>  
52.   
53. </receiver><service  
54.     android:name="com.tencent.mm.plugin.backup.bakpcmodel.BakchatPcUsbService"  
55.     android:exported="false" >  
56.   
57.     <intent-filter>  
58.         <action android:name="com.tencent.mm.plugin.backup.bakpcmodel.BakchatPcUsbService" />  
59.     </intent-filter>  
60.   
61. </service><service  
62.     android:name="com.tencent.mm.booter.CoreService"  //核心服务  
63.     android:process=":push" />  
64. <service  
65.     android:name="com.tencent.mm.booter.cache.CacheService" //缓冲服务  
66.     android:process=":push" />  
67. <receiver  
68.     android:name="com.tencent.mm.booter.MMReceivers$BootReceiver" //启动广播  
69.     android:process=":push" >  
70.   
71.     <intent-filter>  
72.         <action android:name="android.intent.action.BOOT_COMPLETED" />  
73.     </intent-filter>  
74.   
75. </receiver><receiver  
76.     android:name="com.tencent.mm.booter.MMReceivers$ConnectionReceiver" //连接网络广播  
77.     android:process=":push" >  
78.   
79.     <intent-filter>  
80.         <action android:name="android.net.conn.CONNECTIVITY_CHANGE" />  
81.     </intent-filter>  
82.   
83. </receiver><receiver  
84.     android:name="com.tencent.mm.booter.MMReceivers$AlarmReceiver" //定时器  
85.     android:process=":push" />  
86. <receiver  
87.     android:name="com.tencent.mm.jni.platformcomm.Alarm" //平台定时器  
88.     android:exported="false"  
89.     android:process=":push" />  
90. <receiver android:name="com.tencent.mm.plugin.base.stub.WXEntryActivity$EntryReceiver" >  
91.   
92.     <intent-filter>  
93.         <action android:name="com.tencent.mm.plugin.openapi.Intent.ACTION_HANDLE_APP_REGISTER" />  
94.         <action android:name="com.tencent.mm.plugin.openapi.Intent.ACTION_HANDLE_APP_UNREGISTER" />  
95.     </intent-filter>  
96.   
97. </receiver><service android:name="com.tencent.mm.remoteservice.RemoteService" />   
98. <receiver  
99.     android:name="com.tencent.mm.modelstat.WatchDogPushReceiver" //看门狗广播  
100.     android:exported="false"  
101.     android:process=":push" />  
102. <service android:name="com.tencent.mm.pluginsdk.model.downloader.FileDownloadManger$FileDownloadService" />  
103. <receiver android:name="com.tencent.mm.pluginsdk.model.downloader.FileDownloadManger$FileDownloadReceiver" >  
104.   
105.     <intent-filter>  
106.         <action android:name="android.intent.action.DOWNLOAD_COMPLETE" />  
107.         <action android:name="android.intent.action.DOWNLOAD_NOTIFICATION_CLICKED" />  
108.     </intent-filter>  
109.   
110. </receiver><service  
111.     android:name="com.tencent.mm.plugin.accountsync.model.AccountAuthenticatorService"  
112.     android:exported="true" >  
113.   
114.     <intent-filter>  
115.         <action android:name="android.accounts.AccountAuthenticator" />  
116.     </intent-filter>  
117.   
118.     <meta-data  
119.         android:name="android.accounts.AccountAuthenticator"  
120.         android:resource="@xml/g" />  
121.   
122. </service><service  
123.     android:name="com.tencent.mm.plugin.accountsync.model.ContactsSyncService"  
124.     android:exported="true" >  
125.   
126.     <intent-filter>  
127.         <action android:name="android.content.SyncAdapter" />  
128.     </intent-filter>  
129.   
130.     <meta-data  
131.         android:name="android.content.SyncAdapter"  
132.         android:resource="@xml/bf" />  
133.     <meta-data  
134.         android:name="android.provider.CONTACTS_STRUCTURE"  
135.         android:resource="@xml/aa" />  
136.   
137. </service><receiver  
138.     android:name="com.tencent.mm.plugin.gcm.modelgcm.GcmBroadcastReceiver"  
139.     android:permission="com.google.android.c2dm.permission.SEND" >  
140.   
141.     <intent-filter>  
142.         <action android:name="com.google.android.c2dm.intent.RECEIVE" />  
143.         <action android:name="com.google.android.c2dm.intent.REGISTRATION" />  
144.   
145.         <category android:name="com.tencent.mm" />  
146.     </intent-filter>  
147.   
148. </receiver><service android:name="com.tencent.mm.plugin.notification.ui.FailSendMsgNotification$FailSendNormalMsgNotificationService" />  
149. <service android:name="com.tencent.mm.plugin.notification.ui.FailSendMsgNotification$FailSendSnsMsgNotificationService" />  
150. <service  
151.     android:name="com.tencent.mm.sandbox.monitor.ExceptionMonitorService"  
152.     android:process=":sandbox" />  
153. <service //服务  
154.     android:name="com.tencent.mm.sandbox.updater.UpdaterService"  
155.     android:process=":sandbox" />  
156. <receiver //  
157.     android:name="com.tencent.mm.plugin.shoot.remote.RemoteNetSceneMgr$RespReceiver"  
158.     android:exported="false"  
159.     android:process=":tools" >  
160.  -->  
161.   
162. </receiver><receiver //注册广播  
163.     android:name="com.tencent.mm.plugin.shootstub.communicate.ReqReceiver"  
164.     android:exported="false" >  
165.   
166.     <intent-filter>  
167.         <action android:name="com.tencent.mm.action.SHOOT_STUB_REQ" />  
168.     </intent-filter>  
169.   
170. </receiver>  
171. //web服务  
172. <service android:name="com.tencent.mm.plugin.webview.stub.WebViewStubService" />  

CoreService核心服务

[java]  view plain  copy

1. public class CoreService extends Service implements f, ag, bs {  
2.     private as eoE; // 微信 sdk平台库  
3.     private ab eoF = new ab(); // 网络信息  
4.     private boolean eoG = true;  
5.     public final int eoH = -1213;  
6.     private final ae eoI = new d(this);  
7.     private com.tencent.mm.modelstat.k eoJ = null; // 电话管理接口  
8.     private AddrBookObserver eoK; // 本地通讯录监听  
9.     private WatchDogPushReceiver eoL; // 看门狗（推送消息）  
10.     private WakerLock eoM = null;  
11.     private com.tencent.mm.platformtools.k eoN = new com.tencent.mm.platformtools.k(); // 平台接口  
12.     private ax eoO = new ax(new e(this), false);// 线程相关操作（类似 Handle）  
13.   
14.     private void DV() // 重新启动  
15.     {  
16.         x.w("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "[COMPLETE EXIT]");  
17.         br.IS().e(3, 10000, "");  
18.         bn.onDestroy();  
19.         try {  
20.             // 定时器  
21.             MMReceivers.AlarmReceiver.ao(getApplicationContext());  
22.             MMReceivers.AlarmReceiver.am(getApplicationContext());  
23.             Alarm.aB(getApplicationContext());  
24.             x.appenderClose(); // 日志记录  
25.             Process.killProcess(Process.myPid());  
26.             return;  
27.         } catch (Exception localException) {  
28.         }  
29.     }  
30.   
31.     public final void as(boolean paramBoolean) // 类似start  
32.     {  
33.         if (!paramBoolean) {  
34.             x.w("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "[NETWORK LOST]");  
35.             br.IO().eBE = false;  
36.             br.IP().gn(0);  
37.             br.IN().a(10502, "", null);  
38.             if (this.eoG) {  
39.                 br.IR().Iy();  
40.                 this.eoF.Ei();  
41.             }  
42.             this.eoG = false;  
43.         }  
44.         while (true) {  
45.             return;  
46.             x.w("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "[NETWORK CONNECTED]");  
47.             br.IO().eBE = true;  
48.             boolean bool = this.eoF.Ej();  
49.             if ((this.eoG) && (!bool)) {  
50.                 Object[] arrayOfObject = new Object[1];  
51.                 arrayOfObject[0] = Boolean.valueOf(this.eoG);  
52.                 x.i("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd",  
53.                         "network not change or can't get network info, lastStatus connect:%b",  
54.                         arrayOfObject);  
55.             }  
56.             if (bool)  
57.                 br.IR().Iy();  
58.             this.eoG = true;  
59.             br.IP().gn(1);  
60.             br.IN().a(10501, "", null);  
61.             if (this.eoM == null)  
62.                 this.eoM = new WakerLock(getApplicationContext());  
63.             if (!this.eoM.isLocking())  
64.                 this.eoM.lock(14000L);  
65.             x.i("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd",  
66.                     "checking ready, start in 7000ms");  
67.             this.eoO.dv(7000L);  
68.         }  
69.     }  
70.   
71.     public final boolean b(int paramInt, byte[] paramArrayOfByte)  
72. {  
73.   int i = 0;  
74.   if (getSharedPreferences("system_config_prefs", m.Gh()).getBoolean("settings_fully_exit", true))  
75.     x.i("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "fully exited, no need to notify worker");  
76.   while (true)  
77.   {  
78.     return i;  
79.     Intent localIntent = new Intent(this, NotifyReceiver.class);  
80.     localIntent.putExtra("notify_option_type", 2);  
81.     localIntent.putExtra("notify_uin", this.eoE.ID().qk());  
82.     localIntent.putExtra("notify_respType", paramInt);  
83.     localIntent.putExtra("notify_respBuf", paramArrayOfByte);  
84.     localIntent.putExtra("notfiy_recv_time", cm.Jo());  
85.     localIntent.putExtra("notify_skey", this.eoE.ID().sq());  
86.     x.i("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "notify broadcast:" + localIntent.getAction() + ", type=" + paramInt);  
87.     try  
88.     {  
89.       sendBroadcast(localIntent);  
90.       label165: i = 1;  
91.     }  
92.     catch (Exception localException)  
93.     {  
94.       Object[] arrayOfObject = new Object[1];  
95.       arrayOfObject[i] = localException.toString();  
96.       x.f("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onNotify hasDestroyed %s", arrayOfObject);  
97.       break label165:  
98.     }  
99.   }  
100. }  
101.   
102.     public IBinder onBind(Intent paramIntent) {  
103.         x.d("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onBind~~~ threadID:"  
104.                 + Thread.currentThread());  
105.         return this.eoE;  
106.     }  
107.   
108.     @JgMethodChecked(author=20, fComment="checked", lastDate="20140429", reviewer=20, vComment={com.jg.EType.RECEIVERCHECK})  
109. public void onCreate()  
110. {  
111.   Object localObject = null;  
112.   x.d("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onCreate~~~threadID:" + Thread.currentThread());  
113.   super.onCreate();  
114.   if (Build.VERSION.SDK_INT < 18) //根据版本 设置进程属性  
115.     startForeground(-1213, new Notification());  
116.   ClassLoader localClassLoader = CoreService.class.getClassLoader(); //加载服务  
117.   o.a(com.tencent.mm.sdk.a.jBq, localClassLoader);  
118.   //对应的属性jbq如下  
119. //  public static String jBq = "wechatbaseprj";  
120. //  public static String jBr = "wechatnetwork";  
121. //  public static String jBs = "wechatxlog";  
122. //  public static String jBt = "wechatkvcomm";  
123. //  public static String jBu = "wechatcdn";  
124. //  public static String jBv = "wechataccessory";  
125. //  public static String jBx = "wechatwebp";  
126. //  public static String jBy = "wechatutils";  
127.     
128.   ak localak = new ak(Looper.getMainLooper()); //消息线程  
129.   PlatformComm.a(ai.getContext(), localak);//平台通用接口  
130.   g localg = new g(this); //一个消息  
131.   localg.DX();  
132.   ac.a(this.eoI);  
133.   if (PlatformComm.exG == null)   
134.     PlatformComm.exG = this;  
135.   br.a(localak); //通讯接口  
136.   br.setContext(getApplicationContext());  
137.   br.a(new bt());  
138.   br.a(new bu());  
139.   br.a(this);//通讯接口  
140.   if (this.eoJ == null)  
141.     this.eoJ = new com.tencent.mm.modelstat.k(); //网络与推送  
142.   br.a(this.eoJ);  
143.   br.a(new bk());  
144.   this.eoE = br.IR();  
145.   if (this.eoE == null)  
146.   {  
147.     x.i("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "autoAuth is null and new one");  
148.     this.eoE = new as(br.Ae());  
149.     br.e(this.eoE);  
150.     label228: bn.onCreate();  
151.     if (br.IS() != null)  
152.       break label551;  
153.     x.i("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "NetTaskAdapter is null and new one");  
154.     br.a(new bp());  
155.   }  
156.   while (true)  
157.   {  
158.     if (br.IT() == null)  
159.     {  
160.       x.i("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "NetTaskAdapter is null and new one");  
161.       br.a(new bo());  
162.       br.IT().eBo = this;  
163.     }  
164.     String str1 = localg.getString(".com.tencent.mm.debug.server.host.http");  
165.     String str2 = localg.getString(".com.tencent.mm.debug.server.ports.http");  
166.     String str3 = localg.getString(".com.tencent.mm.debug.server.host.socket");  
167.     String str4 = localg.getString(".com.tencent.mm.debug.server.ports.socket");  
168.     this.eoE.c(str1, str2, str3, str4);  
169.     String str5 = localg.getString(".com.tencent.mm.debug.server.host.newdns");  
170.     String str6;  
171.     String str7;  
172.     label389: ConnectivityManager localConnectivityManager;  
173.     if ((str5 != null) && (str5.contains(":")))  
174.     {  
175.       String[] arrayOfString = str5.split(":");  
176.       str6 = arrayOfString[0];  
177.       str7 = arrayOfString[1];  
178.       this.eoE.setNewDnsDebugHost(str6, str7);  
179.       MMReceivers.AlarmReceiver.ao(getApplicationContext()); //启动接受  
180.       MMReceivers.AlarmReceiver.an(getApplicationContext());  
181.       localConnectivityManager = (ConnectivityManager)getSystemService("connectivity");  
182.     }  
183.     try  
184.     {  
185.         //网络  
186.       NetworkInfo localNetworkInfo = localConnectivityManager.getActiveNetworkInfo();  
187.       localObject = localNetworkInfo;  
188.       label436: if ((localObject != null) && (localObject.getState() == NetworkInfo.State.CONNECTED))  
189.         break label581;  
190.       br.IO().eBE = false;  
191.       br.IP().gn(0);  
192.       label464: this.eoK = new AddrBookObserver(this);  
193.       getContentResolver().registerContentObserver(com.tencent.mm.pluginsdk.a.aJf(), true, this.eoK);  
194.       this.eoL = new WatchDogPushReceiver();  
195.       registerReceiver(this.eoL, new IntentFilter("com.tencent.mm.WatchDogPushReceiver"));  
196.       o.a(com.tencent.mm.sdk.a.jBy, CoreService.class.getClassLoader());  
197.       return;  
198.       x.w("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "autoAuth is not null and reset");  
199.       this.eoE.reset();  
200.       break label228:  
201.       label551: x.w("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "NetTaskAdapter is not null and reset");  
202.       label581: br.IS().reset();  
203.     }  
204.     catch (Exception localException)  
205.     {  
206.       x.e("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "getActiveNetworkInfo failed.");  
207.       break label436:  
208.       br.IO().eBE = true;  
209.       br.IP().gn(1);  
210.       break label464:  
211.       str6 = str5;  
212.       str7 = null;  
213.       break label389:  
214.     }  
215.   }  
216. }  
217.   
218.     public void onDestroy() // 销毁  
219.     {  
220.         x.d("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onDestroy~~~ threadID:"  
221.                 + Thread.currentThread());  
222.         this.eoJ.a(10002, null, null); // 推送消息相关  
223.         getContentResolver().unregisterContentObserver(this.eoK); // 取消通讯录监听  
224.         unregisterReceiver(this.eoL); // 取消推送  
225.         super.onDestroy();  
226.         DV(); // 重新启动  
227.     }  
228.   
229.     public void onRebind(Intent paramIntent) {  
230.         x.d("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onRebind~~~ threadID:"  
231.                 + Thread.currentThread());  
232.         super.onRebind(paramIntent);  
233.     }  
234.   
235.     public boolean onUnbind(Intent paramIntent) {  
236.         x.d("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onUnbind~~~ threadID:"  
237.                 + Thread.currentThread());  
238.         br.IO().a(null); // 通讯接口  
239.         br.IU().a(null);  
240.         return super.onUnbind(paramIntent);  
241.     }  
242.   
243.     public final void restartProcess() // 重新启动进行  
244.     {  
245.         x.w("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "restartProcess");  
246.         DV();  
247.     }  
248. }  

结论

为什么它的服务杀不死？笔者猜测如下：

1、反射修改系统有关自己app的属性，从而能使自己接受到广播。（暂未从源码中发现）

2、通用SDK库中有调用，QQ、微信、通讯录等共用一个库，这个库判断有该服务则启动。（暂未从源码中发现）

3、定时器循环触发启动，例如：结束进程是有时间间隔，是否利用此间隔在此互相启动？（猜测，未详细跟进源码）

4、把App列为系统等级，从而安装到系统目录。（未从源码中发现）

不管结论对不对，自己动手测试下便知结果。