Table 3/4-1 - (Linux pseudo filesystems actively
used by Android 11) - Added BinderFS and filled in missing description for FunctionFS:
Linux 5.0+: Dynamic Binder devices (q.v. II/8)
USB functions (Gadget driver)
Table 4/2-2 (Qualcomm /vendor/bin) - Added spdaemon which eluded me
because it's not used in Google devices..
Secure Processing Unit (SPU)
manager (on non-Google devices)
Table 4/2-5 (MTK /vendor/bin) - this was left woefully incomplete. Sorry
about that (versioning problem). Here's what it should look like:
… (will add this soon)
Added copy_per_lineinit directive (new in
12.0), and that 'critical' (for services) now takes arguments
Table 8/7-1 (cont):
Added snapuserd.rc under "System & Volume Management" right after snapshotctl.rc (which it apparently replaces)
Filled cppreopts.rc in the table (I had omitted that, sorry)
Copy preoptimized files
Update of Table 9/5-1 with system_server_dumper
Android 12 adds the system_server_dumper service. As its name implies, this is a dumpsys only service with no clients, listing the properties of SystemServer (start count and elapsed time), SystemServiceManager (started service classes) and the SystemServerInitThreadPool.
before Figure 9/4-3
Added (Before Table 9/3-3, to expand on "dynamic" service lookup):
The client API of a.os.ServiceManager allows (as of Android 11.0)
the waitFor[Declared]Service(svcName) methods.
Table 10/3-6 had some missing fields. Here's all of it:
Table 10/3-6: The elements in
/etc/sysconfig/ and /etc/permissions/
Global group IDs given to packages
Built-in UID to permission mappings
permission to uid (III/2)
permission for targetSdk version (III/2)
Built-in shared libraries
Indicate or hide a platform
feature (for <uses-feature>)
Allow package to operate even device is in different
continuous location updates
Exempt broadcast from
8.0 background delivery restrictions
allowed access to full private API
package to interact with allowed package
for data isolation
to generate bug report
in user-type (FULL/PROFILE)
Named actors (used by Overlay
service, q.v. II/3)
Package capable of
validating config_signature for overlays (q.v. II/3)
Apps eligible for
to commit staged install (II/2)
Chapter 13: Thanks to the wonder of writing in HTML,
the Google Pixel Powerstats coverage wasn't printed:
Google documents the
IPowerStats.hal in the Source
site[psh], and its AIDL is similar. The implementation of
the service for Pixel devices
(email@example.com) can be found
open source.[psp] Rails data is collected from
/sys/bus/iio/devices/iio:device#, and the service
recognizes the following power entities:
Table 13/5-3:: The power entities defined by the
Google Pixel powerstats implementation
References: As an appendix (which somehow got omitted
from the first print batch). Now in print and also online at this link
BTC is down to $38k$50k$47k$55k $66k. Sheesh
Added a GREAT tip for starting ADB with env/startup options specified for
shell - Thanks to @KingOfPhp:
Added note: Bionic is also used outside Android (notably in the hardened GrapheneOS),
though Fuchsia's libc is derived from musl[musl].
Updated Figure 1-3/10 to reflect cases where HIDL server doesn't access
hardware directly, but rather through yet another vendor daemon (very popular,
and I discuss it in II/8, but somehow illustration didn't reflect it). So now
it looks like this:
Updated Table 2/1-1 for ARMv9 launch (happened after v2.0.1 came out...)
Also adding /dev/rpmsg_ctrl# - for Linux Remote Processor
Messaging, used by QCom
2/4.1.1 - Google Devices (up to but not including Pixel 6) use
Added footnote for Huawei -
* - The US imposed ban, along with a worldwide chip shortage in 2021, continue
to take its toll on Huawei - it's P50 line of phones not only uses the
Qualcomm SnapDragon 888 chipset, but further ships without 5G capabilities.
The phones ship with HarmonyOS 2.0.
Android 11 mandates kernels not support
debugfs. Somehow I missed that in the A11 release notes, but learned this the hard way trying to run bindump on a redfin
(Pixel 5), which comes with A11 as stock. This breaks my bindump
Note that packages.xml is now ABX! (also, @@TODO no <perms>
Changed Table 5/4-1 (Standard directories created by Android on
SD-Cards) to an output
Output 5/1-2: The loop mounts of apexd - added ls -l
Output 5/1-2: The loop mounts of
Chapter 6: Pixel 6[XL] and onward use FBPKv2
Added a table of the Binder default transactions I had originally set for
Volume II/7 in place of the paragraph listing them (it made sense, now that 11.0 and 12.0 add even more):
Table 9/1-2-b: Default Transaction Codes supported by
(almost) all Binder objects
Requests full dump of service state to specified
fd according to optional arguments. Used by
Requests interface of service object behind handle.
Expects UTF-16 interface name as reply
Command interface for
Deprecated: Calls libutils's
report_sysprop_change() and any property callbacks
Null transaction ensuring service object is alive.
an extension BBinder for object
11.0: Return service's process
identifier (i.e. getpid())
12.0 (debug builds, #if
BINDER_RPC_DEV_SERVERS,) set socket FD
Also emphasized webview_zygotedoes not randomize its
address space relative to other Zygote instances.
Also added a footnote:
* - Using interfaces could ostensibly enable a design in which a single service endpoint could support multiple interfaces or
"personalities", though in practice Binder associates a single interface name
with an endpoint.
@TODO: I'll update Output 9/4-4 (Threads of system_server for
new service threads in 12 once the dust settles)
Added NativeTombstoneManager to LocalServices table (9/5-4)
(realized I had missed it earlier since it came into 11.0 but I now discuss tombstones now in II/1):
Manage tombstones and parse protobuf (.pb) tombstones (II/1)
Chapter 10: Added people service
In 2.4 (Task profiles), after 11/2-16:
On kernels which support it, libprocessgroup also adjust
/proc/pid/timerslack_ns, which helps coalesce task wakeups, conserving battery life.
The daemon can thus adjust the "killability" of processes based on the activity state, or other factors (background threads, application services, etc). Google describes the considerations in the ActivityManagerService's
Added performance_hint details (IHintSession,
etc. and dumpsys performance_hint from a Pixel 6)
Chapter 12:firstname.lastname@example.org:IDumpstateDevice.hal is version 1.1
Chapter 13: (before 13/4-5, after mention of
msm_adreno_tz) added "… and other governors
(thankfully very few) typos found by James H (thank you! - see below)
on page 291 paragraph 3, it is stated that "ps -t" on Android will list
Thread. Should be "-T"... (Thanks, John Zou!)
Book-wide: All refs to II/.. corrected with final chapter
numbers and some moved to "IV" (sorry...)
Android 13 , obviously
Table 1/1-1 updated for September 2022, with statistics from Statista
Expanded with ARMv8.6/8.7 and ARMv9.x
Table 2/1-3 now has snapdragon 8 Gen 1. Under ARM Cortex, three rows:
Also made note under ARMv8.3 ARMv8.5 and ARMv8.6 that the first chipsets to
support MTE, when enabled in kernel) is the 8Gen1 and Dimensity 9000
Make note of
/vendor/bin/rebalance_interrupts-vendor in Pixel 6
Note Dimensity 9000 (just announced) and SnapDragon 8 Gen 1. Wen eta
Chapter 3: EROFS - noted that some vendors (notably,
XiaoMi with the Mi 12 filesystem images) have begun to follow in adoption, as
well as Google's adoption in 13.0 native phones for r/o filesystems
Chapter 4: Table 4/1-8
11.0: Simulate input events with UHID
Chapter 5: Made note that several APEX bundles come from
AOSP's packages/modules. Tie to II/1. Also noted "capex" in
Android 13 DP1 (WHY, GOOGL, WHY? Unzipping a double signed payload wasn't
Android 12 (practically, 13) adds support for compressed
APEX files[capex], identified by their .capex
extension. As with normal APEX, these are ZIP files containing the manifest (in
protobuf and XML form) as well as the apex_pubkey, with the
original (i.e. normally archived but otherwise uncompressed) APEX deflated
inside. This aims to reduce the space taken for /system/apex,
assumption that the APEXes within it will inevitably be updated (and thus,
loaded from /data/apex, obviating the need for the
Chapter 9: Table 9/5-1 - added "attention" under
Application Services (yes, I know, it slipped my attention. meh). Also
corrected binder_calls_stats (erroneously listed as
"…call_stats" and mentioned twice in table..)
Chapter 10: Table 10/3-6 accidentally omitted "feature" - that's where PMS
gets its getSystemAvailableFeatures() AIDL method (which is noted below table)
Chapter 12: mention dumpstate logs in (/data/user_de/0/com.android.shell/files/bugreports)
Android 13 changes (ongoing list before I integrate it into next book
ARMv9 devices (SD 8Gen1, and 2022+ chipsets) - can also support
ARMv8.5 MTE. Made note about support in hw and :
Android 13 native devices (late 2022) are expected to offer MTE
(through ARMv9, and thus v8.5 compatible chipsets), and AOSP supports
through the bootloader, android:memtagMode Manifest tag,
and arm64.memtag.process.* properties,
documented by Google [amte] and discussed in III.
Chapter 7: Added, after Listing 7/3-4:
Android 13 extends the misc_system_space_layout with a
misc_memtag_message, identifiable by its magic of 0x5afefe5a, to provide the ARMv8.5 MTE hint for the
OS, as discussed in III.
(EXCITING! - Either for Vol III or IV, not sure)
ambient_context: snore/cough detection, really????
IGameService... (will go into IV)
IAttestationVerification[Manager]Service.aidl (will go into III)
Chapter 10: Added ISystemConfig to Table 10/3-7:
Table 10/3-7: The methods exposed by the
Get UIDs holding perm
Get enabled component overrides (in pkgName)
Chapter 11: Added description of the tare ("The Android
Resource Economy") service with dumpsys and link to very detailed README.md in
Chapter 12: ILogcatManagerService detail (too long to list
Updated ARM processor table IDs to include Cortex
X4, A520, A720
Updated QCom chipset table to include SD8650 (8
Table 10/3-6: The elements in /etc/sysconfig/
and /etc/permissions/ files - updates:
package and attributionTag
Prevent apps from being rolled back
package to stopped
*Sigh* Typos: (These don't get you the BTC bounty, but I still
Fixed in v2.0.2 (thanks to James H!):
Page 24, 3.9.2 (Androidisms), ASHMem bullet, second sentence, 'created' to 'create'
Page 24. 3.9.2 (Androidisms), ASHMem bullet, third sentence, 'require' to 'required'
page 87, 4.4 (debugfs), First paragraph, second sentence, sentence terminates without a complete thought: which (as with the other pseudo-filesystems)
page 113, 3 (/data), third bullet point, first sentence, 'but would greatly mitigating' to 'but would greatly mitigate'
page 164, 1 (Android Device Images), second paragraph, second sentence, 'OTA images are arrive at' to 'OTA images arrive at' page 165, 1.1 (Factory Images), first paragraph, second sentence, 'All are all Qualcomm' to 'All are Qualcomm'
page 197, 1.3 (TrustZone/Hypervisor), second paragraph, first sentence, 'ennvironment' to 'environment'
page 198, 1.4.1 (Little Kernel), Apps bullet, first sentence, 'in a full kernel-drive OS' to 'in a full kernel driven OS'
page 214, 1 (The roles and responsibilities of init), first paragraph, second sentence, 'which read' to 'which reads'
page 236, 6 (Zygote), third paragraph, second sentence, 'suchlrequests' to 'such requests'
page 239, 7 (Android Daemons, at a glance), third paragraph, last sentence, 'so that the daemon be able to connect' to 'so that the daemon is able to connect'
page 250, 3 (The servicemanager), fourth paragraph, third sentence, 'to establishes' to 'to establish'
page 259, 5 (A bird's eye view of framework services), last paragraph, 'aims to tackles' to 'aims to tackle'
page 268, 1.2 (The user service), second paragraph, first line, 'inintially' to 'initially'
page 278, 3.3 (The settings service), last paragraph, first line, missing a parethesis
page 280, 3.5 (Server Configurable Flags), first paragraph, first line, 'especciallyl' to 'especially'
page 286, 1.2 (The cmdline and comm), second to last paragraph in experiment, second line, Mentions /lib64 for 32-bit apps.
page 293, 1.5.2 (Thread states and context switches), last paragraph, last
sentence, 'The Zombies are also find peace' to 'The Zombies also find peace' [Aside: your description of Zombies
was rather amusing] page 339, 1.2 (DropBox), first paragraph, last sentence, extra comma at
beginning of sentence and 'logs' to 'log' later in the sentence.
page 343, 2.13 (The shell interface), second paragraph, last sentence, 'manny' to 'many'
page 345, 2.16 (Output files), table 12/2-9, first row, @TODO entry? Intentional?
page 347, 2.4 (dumpstate/bugreport), second paragraph, second sentence, 'onsists' to 'consists'
page 391, 4.4 (Idle Governors), first paragraph of experiment section, missing a parenthesis
Chapter 4 - AMS
Output 4/3-2 (detailing app spawning by jtraceing Zygote)
somehow had the red-on-black misprinted, thus missing the Zygote arguments. Sorry about that. Here is
what it should look like:
Updated all APEX packages in 14.0: *-I'll need to update Vol I for mgmt
and config - new full chapter coming soon, from the looks of things..
configuration support (I*)
14.0: Device locking
14.0: Health &
14.0: IMS Media
User-oriented feature customization (I*)
(networking) protocol support (IV)
Added Output 1/1-13: Demonstrating new API calls in Bionic, for API level
34, after mention of the
(Not in book but still noted here , from their md documentation)
* `close_range` and `copy_file_range` (Linux-specific GNU extensions).
* `memset_explicit` in (C23 addition).
* `__freadahead` in (in musl but not glibc).
* `posix_spawn_file_actions_addchdir_np` and
`posix_spawn_file_actions_addfchdir_np` in (in musl/glibc and macOS,
but not iOS).
Added artd section to Volume II (note: artd was technically introduced in
13.0, but its AIDL then only had “isAlive()”, so wasn’t worth a mention in the
book. The book considers it to be officially introduced in 14.0.
Android 14 introduces artd as a helper daemon to facilitate
ART profiling and general maintenance, including invoking dex2oat
(still referred to as dexopt). The main aim is to outsource the
tasks requiring elevated permissions from system_server to this
daemon. The documentation states this is method is the default from 14.0
onwards, but refers to the previous method of invocation directly from the
PackageManager (in 4.1) as a "legacy implementation", which will
be removed in 15.0
Note in DEX/ART Management (3/3.3.4) about eventual deprecation
Note "safer" DCL (ensure read only)
Added in 1.4, after note on VDEX:
Overall, there are some 14 ART/OAT files, making up the full runtime and
Android framework support. Although they are separate files, they are rife
with cross file links - from ARTs to OATs (and vice versa), and to other
ARTs/OATs (notably, back references to boot.art and
boot.oat). The system_server additionally loads
services.[art/oat], with code from f/b/services.
All ARTs are loaded and decompressed (i.e, into a read/write
anonymous mapping) at fixed addresses in the 0x7xxxxxxx range (but adjusted by
a runtime slide), next to their corresponding OATs. The ARTs are also
mmap(2)ed (in a read-only, uncompressed mapping) at a higher
address. Table 7/1-1 shows the ARTs, by their usual load order:
Table 7/1-1: The ART files loaded into
Castle crytpo support
support (See IV)
Multimedia Services (see IV)
(btw, JTrace is now up
to date with these changes)
Added BINDER_GET_EXTENDED_ERROR to Table 8/5-2: Binder
Updated Figure 8/5-7: The binder_transaction_data structure to shown
TF_UPDATE_TXN flag (0x40), and emphasized sender_* fields are set/overwritten
by driver (a major tenet for Binder security..)
Android 13 Changes for Vol II (again, running list, not yet in book)
@TODO: AMS's internal services (cacheinfo, processinfo, etc maybe need
their own detail? Not sure about that since they're really so basic)
@JavaDerive(equals = true, toString = true) AIDL annotation -
e.g. Identity.aid l
Bionic, Chapter 2, on MTE:
MTE is supported by Bionic as of 12. As v2.2 of this book goes to
print, Android 13 makes MTE support formal, adding it as a bootloader provided
option and/or configurable system property. This remarkably not only catches
up with Apple Silicon (which adopted ARMv8.3 PAC three years earlier), but
also leaves it behind, as iOS16 on the latest Apple chipset (A16) does not use
Chapter 5: Added update_lock (really minor service, but.. in the interest
of catching 'em all..)
boolean runBackgroundDexoptJob(in List packageNames); - removed
Running list of Android 14 changes
(The tables look a lot better in book, with shading for 13.0 and 14.0 rows..)
Get all instances updatable by the apexName
(Google preaches Stable AIDL, but their own AIDLs aren’t so stable, after
11/2.7. - TARE: Service responds to getEnabledMode() as of 14
Table 4/2-10: Process and UID state
observation methods of ActivityManager