AServiceManager_getService() isn't stable ABI
This is a simple demo shows one possible way that two processes or more can do binder IPC purely using NDKBinder without the help of JNI.
The key point is that how native server can publish their service & native client can get it.
After doing some research, I found two possible ways:
Do it like the native codes in Android Framework does.
It's impossible in userspace because those APIs isn't exported to NDK & some require privilege.
Using BroadcastReceiver to help exchange binder
Parcel.writeStrongBindertransfers Binder object into
flatten_binder. The kernel driver finds it & creates the reference of binder for the client so that client can talk to the server directly.
I tried implement
bindService()first, but it isn't an easy way to do this.
And I found the Shizuku implement a command line tool in JAVA with the help of
By the way, NDKBinder from Android 10 (API 29) provide us the code we need to build Parcel & do binder transaction.
However, the NDKBinder Demo here only creates the Parcel in native and Java does the rest.
Luckily, this answer on Stackoverflow shows that we can get the binder to the ActivityManager in native, the possibility to get two processes exchange their binder.
- Figure out how binder really works
Figure out the format of the parcel or make the Android Framework's
Parcelavailable under NDK.
The parcel used by
broadcastIntent()works in a weired way.
For example, it will get broken if I change Intent's
Support for API <= 29
Try to implement it without the help of NDKBinder.