Search code examples
androidandroid-sourceparcel

How can I inspect methods called with Parcel.transact

I have a problem regarding viewing & following method calls in the android source code when Parcels get involved.

I wanted to find out more about the inner workings of PendingIntents by checking out the Android source code, but just when things get interesting, Parcels pop up a few ambiguous functions are called, and the important bit is over.

I belive specifically the following lines in the send() method of IIntentSender is important:

mRemote.transact(Stub.TRANSACTION_send, _data, _reply, 0);

This is where I get lost. How can I track down the method which is called next? Trying to view the source of transact method just reveals an interface with no code!
The type of mRemote is android.os.IBinder (an interface again)

Thanks for your help in advance!

(P.S: I used grepcode.com to inspect the source code)

Solution

  • The Binder is just the "guts" of an inter-process function call. Providers, Intents, and Messages are actually just abstractions of the Binder protocol. There is a lot of information out there about the Binder protocol, however it is designed so that most people don't have to worry about it.

    When you call functions such as getActivity() you are acquiring an intent object that will be used later, but when that time comes, it uses the binder to do its job.

    This is all to say, you've gone too far into the "guts," and need to take a step back. The Binder is literally used everywhere and is just a generic way to communicate. Whatever is on the other side of that .transact call is dependent upon the means in which the Binder (or in this case, the PendingIntent) was acquired.

    Try to deduce what component would handle an intent of your particular variety, and look for a .transact method in its code. This will usually take the form of a huge switch statement that calls different functions based upon .transact's first argument. Whatever the case block calls will be what is "interesting" to you.

    In your case TRANSACTION_send makes me think of finding some activity with the capability of "sending" something. Well, this sounds like a job for the ActivityManager. This code can be found here. Check out the onTransact method for some potential breakpoint positions.