Android weixin service

简介

想了很久，为什么Android 微信的服务杀不死？既没有给它权限、又没有手动启动它，为什么它会自动开启接受消息？奇怪了？

先不管它采用什么方法，看看它的源码，然后分析推出自己的结论。

代码分析

AndroidManifest.xml中的服务与广播

<!-- 通知广播接受 --><receiver    android:name="com.tencent.mm.booter.NotifyReceiver"    android:exported="false" /><receiver android:name="com.tencent.mm.booter.notification.NotificationDeleteReceive" /><!-- 奔溃广播 --><receiver    android:name="com.tencent.mm.sandbox.monitor.CrashUploadAlarmReceiver"    android:exported="false" /><receiver android:name="com.tencent.mm.booter.MountReceiver" >    <intent-filter>        <action android:name="android.intent.action.MEDIA_MOUNTED" />        <action android:name="android.intent.action.MEDIA_EJECT" />        <action android:name="android.intent.action.MEDIA_UNMOUNTED" />        <action android:name="android.intent.action.MEDIA_SHARED" />        <action android:name="android.intent.action.MEDIA_SCANNER_STARTED" />        <action android:name="android.intent.action.MEDIA_SCANNER_FINISHED" />        <action android:name="android.intent.action.MEDIA_REMOVED" />        <action android:name="android.intent.action.MEDIA_BAD_REMOVAL" />        <data android:scheme="file" />    </intent-filter></receiver><service android:name="com.tencent.mm.booter.NotifyReceiver$NotifyService" /><service android:name="com.tencent.mm.modelfriend.AddrBookObserver$AddrBookService" /><receiver android:name="com.tencent.mm.booter.BluetoothReceiver" > //蓝牙广播    <intent-filter>        <action android:name="android.media.SCO_AUDIO_STATE_CHANGED" />        <action android:name="android.media.ACTION_SCO_AUDIO_STATE_UPDATED" />    </intent-filter></receiver><receiver android:name="com.tencent.mm.booter.InstallReceiver" > //安装包广告    <intent-filter>        <action android:name="com.android.vending.INSTALL_REFERRER" />//只接受错误？    </intent-filter></receiver><receiver    android:name="com.tencent.mm.booter.MMReceivers$ToolsProcessReceiver"     android:exported="false"    android:process=":tools" /><receiver    android:name="com.tencent.mm.plugin.backup.bakpcmodel.BakchatPcmgrNorify" //通知栏广播    android:permission="" >    <intent-filter>        <action android:name="MMBakchatServiceStart" />        <action android:name="MMBakchatServiceStop" />    </intent-filter></receiver><service    android:name="com.tencent.mm.plugin.backup.bakpcmodel.BakchatPcUsbService"    android:exported="false" >    <intent-filter>        <action android:name="com.tencent.mm.plugin.backup.bakpcmodel.BakchatPcUsbService" />    </intent-filter></service><service    android:name="com.tencent.mm.booter.CoreService"  //核心服务    android:process=":push" /><service    android:name="com.tencent.mm.booter.cache.CacheService" //缓冲服务    android:process=":push" /><receiver    android:name="com.tencent.mm.booter.MMReceivers$BootReceiver" //启动广播    android:process=":push" >    <intent-filter>        <action android:name="android.intent.action.BOOT_COMPLETED" />    </intent-filter></receiver><receiver    android:name="com.tencent.mm.booter.MMReceivers$ConnectionReceiver" //连接网络广播    android:process=":push" >    <intent-filter>        <action android:name="android.net.conn.CONNECTIVITY_CHANGE" />    </intent-filter></receiver><receiver    android:name="com.tencent.mm.booter.MMReceivers$AlarmReceiver" //定时器    android:process=":push" /><receiver    android:name="com.tencent.mm.jni.platformcomm.Alarm" //平台定时器    android:exported="false"    android:process=":push" /><receiver android:name="com.tencent.mm.plugin.base.stub.WXEntryActivity$EntryReceiver" >    <intent-filter>        <action android:name="com.tencent.mm.plugin.openapi.Intent.ACTION_HANDLE_APP_REGISTER" />        <action android:name="com.tencent.mm.plugin.openapi.Intent.ACTION_HANDLE_APP_UNREGISTER" />    </intent-filter></receiver><service android:name="com.tencent.mm.remoteservice.RemoteService" /> <receiver    android:name="com.tencent.mm.modelstat.WatchDogPushReceiver" //看门狗广播    android:exported="false"    android:process=":push" /><service android:name="com.tencent.mm.pluginsdk.model.downloader.FileDownloadManger$FileDownloadService" /><receiver android:name="com.tencent.mm.pluginsdk.model.downloader.FileDownloadManger$FileDownloadReceiver" >    <intent-filter>        <action android:name="android.intent.action.DOWNLOAD_COMPLETE" />        <action android:name="android.intent.action.DOWNLOAD_NOTIFICATION_CLICKED" />    </intent-filter></receiver><service    android:name="com.tencent.mm.plugin.accountsync.model.AccountAuthenticatorService"    android:exported="true" >    <intent-filter>        <action android:name="android.accounts.AccountAuthenticator" />    </intent-filter>    <meta-data        android:name="android.accounts.AccountAuthenticator"        android:resource="@xml/g" /></service><service    android:name="com.tencent.mm.plugin.accountsync.model.ContactsSyncService"    android:exported="true" >    <intent-filter>        <action android:name="android.content.SyncAdapter" />    </intent-filter>    <meta-data        android:name="android.content.SyncAdapter"        android:resource="@xml/bf" />    <meta-data        android:name="android.provider.CONTACTS_STRUCTURE"        android:resource="@xml/aa" /></service><receiver    android:name="com.tencent.mm.plugin.gcm.modelgcm.GcmBroadcastReceiver"    android:permission="com.google.android.c2dm.permission.SEND" >    <intent-filter>        <action android:name="com.google.android.c2dm.intent.RECEIVE" />        <action android:name="com.google.android.c2dm.intent.REGISTRATION" />        <category android:name="com.tencent.mm" />    </intent-filter></receiver><service android:name="com.tencent.mm.plugin.notification.ui.FailSendMsgNotification$FailSendNormalMsgNotificationService" /><service android:name="com.tencent.mm.plugin.notification.ui.FailSendMsgNotification$FailSendSnsMsgNotificationService" /><service    android:name="com.tencent.mm.sandbox.monitor.ExceptionMonitorService"    android:process=":sandbox" /><service //服务    android:name="com.tencent.mm.sandbox.updater.UpdaterService"    android:process=":sandbox" /><receiver //    android:name="com.tencent.mm.plugin.shoot.remote.RemoteNetSceneMgr$RespReceiver"    android:exported="false"    android:process=":tools" > --></receiver><receiver //注册广播    android:name="com.tencent.mm.plugin.shootstub.communicate.ReqReceiver"    android:exported="false" >    <intent-filter>        <action android:name="com.tencent.mm.action.SHOOT_STUB_REQ" />    </intent-filter></receiver>//web服务<service android:name="com.tencent.mm.plugin.webview.stub.WebViewStubService" />

CoreService核心服务

public class CoreService extends Service implements f, ag, bs {private as eoE; // 微信 sdk平台库private ab eoF = new ab(); // 网络信息private boolean eoG = true;public final int eoH = -1213;private final ae eoI = new d(this);private com.tencent.mm.modelstat.k eoJ = null; // 电话管理接口private AddrBookObserver eoK; // 本地通讯录监听private WatchDogPushReceiver eoL; // 看门狗（推送消息）private WakerLock eoM = null;private com.tencent.mm.platformtools.k eoN = new com.tencent.mm.platformtools.k(); // 平台接口private ax eoO = new ax(new e(this), false);// 线程相关操作（类似 Handle）private void DV() // 重新启动{x.w("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "[COMPLETE EXIT]");br.IS().e(3, 10000, "");bn.onDestroy();try {// 定时器MMReceivers.AlarmReceiver.ao(getApplicationContext());MMReceivers.AlarmReceiver.am(getApplicationContext());Alarm.aB(getApplicationContext());x.appenderClose(); // 日志记录Process.killProcess(Process.myPid());return;} catch (Exception localException) {}}public final void as(boolean paramBoolean) // 类似start{if (!paramBoolean) {x.w("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "[NETWORK LOST]");br.IO().eBE = false;br.IP().gn(0);br.IN().a(10502, "", null);if (this.eoG) {br.IR().Iy();this.eoF.Ei();}this.eoG = false;}while (true) {return;x.w("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "[NETWORK CONNECTED]");br.IO().eBE = true;boolean bool = this.eoF.Ej();if ((this.eoG) && (!bool)) {Object[] arrayOfObject = new Object[1];arrayOfObject[0] = Boolean.valueOf(this.eoG);x.i("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd","network not change or can't get network info, lastStatus connect:%b",arrayOfObject);}if (bool)br.IR().Iy();this.eoG = true;br.IP().gn(1);br.IN().a(10501, "", null);if (this.eoM == null)this.eoM = new WakerLock(getApplicationContext());if (!this.eoM.isLocking())this.eoM.lock(14000L);x.i("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd","checking ready, start in 7000ms");this.eoO.dv(7000L);}}public final boolean b(int paramInt, byte[] paramArrayOfByte){  int i = 0;  if (getSharedPreferences("system_config_prefs", m.Gh()).getBoolean("settings_fully_exit", true))    x.i("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "fully exited, no need to notify worker");  while (true)  {    return i;    Intent localIntent = new Intent(this, NotifyReceiver.class);    localIntent.putExtra("notify_option_type", 2);    localIntent.putExtra("notify_uin", this.eoE.ID().qk());    localIntent.putExtra("notify_respType", paramInt);    localIntent.putExtra("notify_respBuf", paramArrayOfByte);    localIntent.putExtra("notfiy_recv_time", cm.Jo());    localIntent.putExtra("notify_skey", this.eoE.ID().sq());    x.i("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "notify broadcast:" + localIntent.getAction() + ", type=" + paramInt);    try    {      sendBroadcast(localIntent);      label165: i = 1;    }    catch (Exception localException)    {      Object[] arrayOfObject = new Object[1];      arrayOfObject[i] = localException.toString();      x.f("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onNotify hasDestroyed %s", arrayOfObject);      break label165:    }  }}public IBinder onBind(Intent paramIntent) {x.d("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onBind~~~ threadID:"+ Thread.currentThread());return this.eoE;}@JgMethodChecked(author=20, fComment="checked", lastDate="20140429", reviewer=20, vComment={com.jg.EType.RECEIVERCHECK})public void onCreate(){  Object localObject = null;  x.d("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onCreate~~~threadID:" + Thread.currentThread());  super.onCreate();  if (Build.VERSION.SDK_INT < 18) //根据版本 设置进程属性    startForeground(-1213, new Notification());  ClassLoader localClassLoader = CoreService.class.getClassLoader(); //加载服务  o.a(com.tencent.mm.sdk.a.jBq, localClassLoader);  //对应的属性jbq如下//  public static String jBq = "wechatbaseprj";//  public static String jBr = "wechatnetwork";//  public static String jBs = "wechatxlog";//  public static String jBt = "wechatkvcomm";//  public static String jBu = "wechatcdn";//  public static String jBv = "wechataccessory";//  public static String jBx = "wechatwebp";//  public static String jBy = "wechatutils";    ak localak = new ak(Looper.getMainLooper()); //消息线程  PlatformComm.a(ai.getContext(), localak);//平台通用接口  g localg = new g(this); //一个消息  localg.DX();  ac.a(this.eoI);  if (PlatformComm.exG == null)     PlatformComm.exG = this;  br.a(localak); //通讯接口  br.setContext(getApplicationContext());  br.a(new bt());  br.a(new bu());  br.a(this);//通讯接口  if (this.eoJ == null)    this.eoJ = new com.tencent.mm.modelstat.k(); //网络与推送  br.a(this.eoJ);  br.a(new bk());  this.eoE = br.IR();  if (this.eoE == null)  {    x.i("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "autoAuth is null and new one");    this.eoE = new as(br.Ae());    br.e(this.eoE);    label228: bn.onCreate();    if (br.IS() != null)      break label551;    x.i("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "NetTaskAdapter is null and new one");    br.a(new bp());  }  while (true)  {    if (br.IT() == null)    {      x.i("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "NetTaskAdapter is null and new one");      br.a(new bo());      br.IT().eBo = this;    }    String str1 = localg.getString(".com.tencent.mm.debug.server.host.http");    String str2 = localg.getString(".com.tencent.mm.debug.server.ports.http");    String str3 = localg.getString(".com.tencent.mm.debug.server.host.socket");    String str4 = localg.getString(".com.tencent.mm.debug.server.ports.socket");    this.eoE.c(str1, str2, str3, str4);    String str5 = localg.getString(".com.tencent.mm.debug.server.host.newdns");    String str6;    String str7;    label389: ConnectivityManager localConnectivityManager;    if ((str5 != null) && (str5.contains(":")))    {      String[] arrayOfString = str5.split(":");      str6 = arrayOfString[0];      str7 = arrayOfString[1];      this.eoE.setNewDnsDebugHost(str6, str7);      MMReceivers.AlarmReceiver.ao(getApplicationContext()); //启动接受      MMReceivers.AlarmReceiver.an(getApplicationContext());      localConnectivityManager = (ConnectivityManager)getSystemService("connectivity");    }    try    {    //网络      NetworkInfo localNetworkInfo = localConnectivityManager.getActiveNetworkInfo();      localObject = localNetworkInfo;      label436: if ((localObject != null) && (localObject.getState() == NetworkInfo.State.CONNECTED))        break label581;      br.IO().eBE = false;      br.IP().gn(0);      label464: this.eoK = new AddrBookObserver(this);      getContentResolver().registerContentObserver(com.tencent.mm.pluginsdk.a.aJf(), true, this.eoK);      this.eoL = new WatchDogPushReceiver();      registerReceiver(this.eoL, new IntentFilter("com.tencent.mm.WatchDogPushReceiver"));      o.a(com.tencent.mm.sdk.a.jBy, CoreService.class.getClassLoader());      return;      x.w("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "autoAuth is not null and reset");      this.eoE.reset();      break label228:      label551: x.w("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "NetTaskAdapter is not null and reset");      label581: br.IS().reset();    }    catch (Exception localException)    {      x.e("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "getActiveNetworkInfo failed.");      break label436:      br.IO().eBE = true;      br.IP().gn(1);      break label464:      str6 = str5;      str7 = null;      break label389:    }  }}public void onDestroy() // 销毁{x.d("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onDestroy~~~ threadID:"+ Thread.currentThread());this.eoJ.a(10002, null, null); // 推送消息相关getContentResolver().unregisterContentObserver(this.eoK); // 取消通讯录监听unregisterReceiver(this.eoL); // 取消推送super.onDestroy();DV(); // 重新启动}public void onRebind(Intent paramIntent) {x.d("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onRebind~~~ threadID:"+ Thread.currentThread());super.onRebind(paramIntent);}public boolean onUnbind(Intent paramIntent) {x.d("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "onUnbind~~~ threadID:"+ Thread.currentThread());br.IO().a(null); // 通讯接口br.IU().a(null);return super.onUnbind(paramIntent);}public final void restartProcess() // 重新启动进行{x.w("!32@/B4Tb64lLpIzvC/moQitzBn6RBAuk+sd", "restartProcess");DV();}}

结论

为什么它的服务杀不死？笔者猜测如下：

1、反射修改系统有关自己app的属性，从而能使自己接受到广播。（暂未从源码中发现）

2、通用SDK库中有调用，QQ、微信、通讯录等共用一个库，这个库判断有该服务则启动。（暂未从源码中发现）

3、定时器循环触发启动，例如：结束进程是有时间间隔，是否利用此间隔在此互相启动？（猜测，未详细跟进源码）

4、把App列为系统等级，从而安装到系统目录。（未从源码中发现）

不管结论对不对，自己动手测试下便知结果。