观察应用宝进程的自启动行为

摘要

观察应用宝进程的自启动行为

1. 添加观察点-Process.start()

    AMS启动进程最终都会调用Process.start()方法，通过socket向zygote进程发送创建新进程的请求,例如ProcessList.startProcess新增trace调查

import android.os.Debug;@GuardedBy("mService")boolean startProcessLocked(ProcessRecord app, HostingRecord hostingRecord,        int zygotePolicyFlags, boolean disableHiddenApiChecks, boolean disableTestApiChecks,        String abiOverride) {    if (app.isPendingStart()) {        return true;    }    if ("com.tencent.android.qqdownloader".equals(app.info.packageName)            || "com.ayst.helloapptype".equals(app.info.packageName)) {        String callers = Debug.getCallers(10);        Slog.i(TAG, "startProcessLocked " + app.processName, new Throwable());    }

2. 命令强杀应用宝观察自启动行为

adb shell am force-stop com.tencent.android.qqdownloader

3.日志观察应用宝自启动行为

重启静静等应用宝装逼就行了哈

3.1 [bindService后台自启动]com.tencent.android.qqdownloader:live或privileged_process0或sandboxed_process0

开机触发,应用宝后从通知栏划掉应用宝的通知触发，后台随时随地触发，高频触发

2025-07-14 16:24:53.637  1626-3165  ActivityManager         system_server                        I  startProcessLocked com.tencent.android.qqdownloader:livejava.lang.Throwableat com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:1860)at com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:2655)at com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:2801)at com.android.server.am.ActivityManagerService.startProcessLocked(ActivityManagerService.java:3076)at com.android.server.am.ActiveServices.bringUpServiceInnerLocked(ActiveServices.java:5927)at com.android.server.am.ActiveServices.bringUpServiceLocked(ActiveServices.java:5736)at com.android.server.am.ActiveServices.bindServiceLocked(ActiveServices.java:4319)at com.android.server.am.ActivityManagerService.bindServiceInstance(ActivityManagerService.java:14367)at com.android.server.am.ActivityManagerService.bindServiceInstance(ActivityManagerService.java:14327)at android.app.IActivityManager$Stub.onTransact(IActivityManager.java:3089)at com.android.server.am.ActivityManagerService.onTransact(ActivityManagerService.java:2865)at android.os.Binder.execTransactInternal(Binder.java:1500)at android.os.Binder.execTransact(Binder.java:1444) 2025-07-14 16:32:49.088  1626-3163  ActivityManager         system_server                        I  startProcessLocked com.google.android.webview:sandboxed_process0:org.chromium.content.app.SandboxedProcessService0:0java.lang.Throwableat com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:1860)at com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:2655)at com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:2801)at com.android.server.am.ActivityManagerService.startProcessLocked(ActivityManagerService.java:3076)at com.android.server.am.ActiveServices.bringUpServiceInnerLocked(ActiveServices.java:5927)at com.android.server.am.ActiveServices.bringUpServiceLocked(ActiveServices.java:5736)at com.android.server.am.ActiveServices.bindServiceLocked(ActiveServices.java:4319)at com.android.server.am.ActivityManagerService.bindServiceInstance(ActivityManagerService.java:14367)at com.android.server.am.ActivityManagerService.bindServiceInstance(ActivityManagerService.java:14327)at android.app.IActivityManager$Stub.onTransact(IActivityManager.java:3089)at com.android.server.am.ActivityManagerService.onTransact(ActivityManagerService.java:2865)at android.os.Binder.execTransactInternal(Binder.java:1500)at android.os.Binder.execTransact(Binder.java:1444)

拦截建议

3.2 [provider后台自启动]com.tencent.android.qqdownloader:daemon 

​​​​​​​

2025-07-14 16:24:56.506  1626-3060  ActivityManager         system_server                        I  startProcessLocked com.tencent.android.qqdownloader:daemonjava.lang.Throwable	at com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:1860)	at com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:2655)	at com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:2801)	at com.android.server.am.ActivityManagerService.startProcessLocked(ActivityManagerService.java:3076)	at com.android.server.am.ContentProviderHelper.getContentProviderImpl(ContentProviderHelper.java:581)	at com.android.server.am.ContentProviderHelper.getContentProvider(ContentProviderHelper.java:150)	at com.android.server.am.ActivityManagerService.getContentProvider(ActivityManagerService.java:7223)	at android.app.IActivityManager$Stub.onTransact(IActivityManager.java:2966)	at com.android.server.am.ActivityManagerService.onTransact(ActivityManagerService.java:2865)	at android.os.Binder.execTransactInternal(Binder.java:1500)	at android.os.Binder.execTransact(Binder.java:1444)

拦截建议

3.3 [startInstrumentation]com.tencent.android.qqdownloader:daemon

startInstrumentation方法用于启动一个Instrumentation组件，通常在测试应用程序时使用。当需要对应用程序进行自动化测试、性能测试或UI测试时，可以通过startInstrumentation方法启动一个Instrumentation组件。这个方法通常由测试框架或测试工具调用，而不是应用程序本身​​​​

2025-07-14 16:32:32.018  1626-1789  ActivityManager         system_server                        I  startProcessLocked com.tencent.android.qqdownloader:daemonjava.lang.Throwable	at com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:1860)	at com.android.server.am.ActivityManagerService.addAppLocked(ActivityManagerService.java:7479)	at com.android.server.am.ActivityManagerService.addAppLocked(ActivityManagerService.java:7410)	at com.android.server.am.ActivityManagerService.startInstrumentation(ActivityManagerService.java:16784)	at android.app.IActivityManager$Stub.onTransact(IActivityManager.java:3182)	at com.android.server.am.ActivityManagerService.onTransact(ActivityManagerService.java:2865)	at android.os.Binder.execTransactInternal(Binder.java:1500)	at android.os.Binder.execTransact(Binder.java:1444)

3.4 [sync]com.tencent.android.qqdownloader:live

AccountManagerService.addAccount的bindService方式

​​​​​​​

2025-07-14 16:32:31.921  1626-10518 ActivityManager         system_server                        I  startProcessLocked com.tencent.android.qqdownloader:livejava.lang.Throwable	at com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:1860)	at com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:2655)	at com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:2801)	at com.android.server.am.ActivityManagerService.startProcessLocked(ActivityManagerService.java:3076)	at com.android.server.am.ActiveServices.bringUpServiceInnerLocked(ActiveServices.java:5927)	at com.android.server.am.ActiveServices.bringUpServiceLocked(ActiveServices.java:5736)	at com.android.server.am.ActiveServices.bindServiceLocked(ActiveServices.java:4319)	at com.android.server.am.ActivityManagerService.bindServiceInstance(ActivityManagerService.java:14367)	at com.android.server.am.ActivityManagerService.bindServiceInstance(ActivityManagerService.java:14327)	at android.app.ContextImpl.bindServiceCommon(ContextImpl.java:2195)	at android.app.ContextImpl.bindServiceAsUser(ContextImpl.java:2115)	at com.android.server.accounts.AccountManagerService$Session.bindToAuthenticator(AccountManagerService.java:5400)	at com.android.server.accounts.AccountManagerService$Session.bind(AccountManagerService.java:5168)	at com.android.server.accounts.AccountManagerService.addAccountAndLogMetrics(AccountManagerService.java:3508)	at com.android.server.accounts.AccountManagerService.addAccount(AccountManagerService.java:3415)	at android.accounts.IAccountManager$Stub.onTransact(IAccountManager.java:726)	at com.android.server.accounts.AccountManagerService.onTransact(AccountManagerService.java:1143)	at android.os.Binder.execTransactInternal(Binder.java:1505)	at android.os.Binder.execTransact(Binder.java:1444)

拦截建议同service的拦截

3.5 [broadcast]com.tencent.android.qqdownloader

​​​​​​​

2025-07-14 16:36:00.138  1626-1689  ActivityManager         system_server                        I  startProcessLocked com.tencent.android.qqdownloaderjava.lang.Throwable	at com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:1860)	at com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:2655)	at com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:2801)	at com.android.server.am.ActivityManagerService.startProcessLocked(ActivityManagerService.java:3076)	at com.android.server.am.BroadcastQueueModernImpl.scheduleReceiverColdLocked(BroadcastQueueModernImpl.java:1026)	at com.android.server.am.BroadcastQueueModernImpl.updateRunningListLocked(BroadcastQueueModernImpl.java:561)	at com.android.server.am.BroadcastQueueModernImpl.updateRunningList(BroadcastQueueModernImpl.java:449)	at com.android.server.am.BroadcastQueueModernImpl.lambda$new$0(BroadcastQueueModernImpl.java:299)	at com.android.server.am.BroadcastQueueModernImpl.$r8$lambda$d79aYiK04-SKNC9AXzRIc2ug0aQ(BroadcastQueueModernImpl.java:0)	at com.android.server.am.BroadcastQueueModernImpl$$ExternalSyntheticLambda12.handleMessage(R8$$SyntheticClass:0)	at android.os.Handler.dispatchMessage(Handler.java:103)	at android.os.Looper.loopOnce(Looper.java:232)	at android.os.Looper.loop(Looper.java:317)	at android.os.HandlerThread.run(HandlerThread.java:85)	at com.android.server.ServiceThread.run(ServiceThread.java:46)

拦截建议

3.6 [NDK守护进程拉活]com.tencent.android.qqdownloader:daemon​

2025-07-14 17:45:58.957  1626-1677  ActivityManager         system_server                        I  startProcessLocked com.tencent.android.qqdownloader:daemonjava.lang.Throwableat com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:1860)at com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:2655)at com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:2801)at com.android.server.am.ActivityManagerService.startProcessLocked(ActivityManagerService.java:3076)at com.android.server.am.ActivityManagerService$LocalService.startProcess(ActivityManagerService.java:19655)at com.android.server.wm.ActivityTaskManagerService$$ExternalSyntheticLambda20.accept(R8$$SyntheticClass:0)at com.android.internal.util.function.pooled.PooledLambdaImpl.doInvoke(PooledLambdaImpl.java:363)at com.android.internal.util.function.pooled.PooledLambdaImpl.invoke(PooledLambdaImpl.java:204)at com.android.internal.util.function.pooled.OmniFunction.run(OmniFunction.java:87)at android.os.Handler.handleCallback(Handler.java:959)at android.os.Handler.dispatchMessage(Handler.java:100)at android.os.Looper.loopOnce(Looper.java:232)at android.os.Looper.loop(Looper.java:317)at android.os.HandlerThread.run(HandlerThread.java:85)at com.android.server.ServiceThread.run(ServiceThread.java:46)

拦截建议

3.7 [com.google.android.webview拉活]com.google.android.webview:sandboxed_process0

同bindService拦截​​​​​

2025-07-14 17:57:01.305  1450-2960  ActivityManager         system_server                        I  startProcessLocked com.google.android.webview:sandboxed_process0:org.chromium.content.app.SandboxedProcessService0:0                                                                                                    java.lang.Throwableat com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:1860)at com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:2655)at com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:2801)at com.android.server.am.ActivityManagerService.startProcessLocked(ActivityManagerService.java:3076)at com.android.server.am.ActiveServices.bringUpServiceInnerLocked(ActiveServices.java:5927)at com.android.server.am.ActiveServices.bringUpServiceLocked(ActiveServices.java:5736)at com.android.server.am.ActiveServices.bindServiceLocked(ActiveServices.java:4319)at com.android.server.am.ActivityManagerService.bindServiceInstance(ActivityManagerService.java:14367)at com.android.server.am.ActivityManagerService.bindServiceInstance(ActivityManagerService.java:14327)at android.app.IActivityManager$Stub.onTransact(IActivityManager.java:3089)at com.android.server.am.ActivityManagerService.onTransact(ActivityManagerService.java:2865)at android.os.Binder.execTransactInternal(Binder.java:1500)at android.os.Binder.execTransact(Binder.java:1444)

3.8 [MediaRoute拉活]com.tencent.android.qqdownloader:live

本质还是bindService哈

通过MediaRoute2ProviderServiceProxy的bindService方式

​​​​​​​

通过MediaRoute2ProviderServiceProxy的bindService方式01-26 03:00:16.621  7461  7461 I ActivityManager: startProcessLocked com.tencent.android.qqdownloader:live01-26 03:00:16.621  7461  7461 I ActivityManager: java.lang.Throwable01-26 03:00:16.621  7461  7461 I ActivityManager:         at com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:1697)01-26 03:00:16.621  7461  7461 I ActivityManager:         at com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:2418)01-26 03:00:16.621  7461  7461 I ActivityManager:         at com.android.server.am.ProcessList.startProcessLocked(ProcessList.java:2558)01-26 03:00:16.621  7461  7461 I ActivityManager:         at com.android.server.am.ActivityManagerService.startProcessLocked(ActivityManagerService.java:2858)01-26 03:00:16.621  7461  7461 I ActivityManager:         at com.android.server.am.ActiveServices.bringUpServiceLocked(ActiveServices.java:4278)01-26 03:00:16.621  7461  7461 I ActivityManager:         at com.android.server.am.ActiveServices.bindServiceLocked(ActiveServices.java:2956)01-26 03:00:16.621  7461  7461 I ActivityManager:         at com.android.server.am.ActivityManagerService.bindServiceInstance(ActivityManagerService.java:12782)01-26 03:00:16.621  7461  7461 I ActivityManager:         at com.android.server.am.ActivityManagerService.bindServiceInstance(ActivityManagerService.java:12729)01-26 03:00:16.621  7461  7461 I ActivityManager:         at android.app.ContextImpl.bindServiceCommon(ContextImpl.java:2035)01-26 03:00:16.621  7461  7461 I ActivityManager:         at android.app.ContextImpl.bindServiceAsUser(ContextImpl.java:1974)01-26 03:00:16.621  7461  7461 I ActivityManager:         at com.android.server.media.MediaRoute2ProviderServiceProxy.bind(MediaRoute2ProviderServiceProxy.java:243)01-26 03:00:16.621  7461  7461 I ActivityManager:         at com.android.server.media.MediaRoute2ProviderServiceProxy.onBindingDied(MediaRoute2ProviderServiceProxy.java:312)01-26 03:00:16.621  7461  7461 I ActivityManager:         at android.app.LoadedApk$ServiceDispatcher.doConnected(LoadedApk.java:2184)01-26 03:00:16.621  7461  7461 I ActivityManager:         at android.app.LoadedApk$ServiceDispatcher$RunConnection.run(LoadedApk.java:2221)