Digging Into Android Startup Dave Smith NewCircle, Inc. @devunwired 1 

Device Startup 2 Bootloader(s) Linux Kernel Init/ Zygote(s) SystemServer Home App 

Early Stages 3 Bootloader(s) Li2leKernel, U-Boot, UEFI Linux Kernel initramfs 

ramdisk.img RootFS 4 default.prop dev/ file_contexts fstab.goldfish init init.environ.rc init.goldfish.rc init.rc init.trace.rc init.usb.rc init.zygote32.rc proc/ property_contexts sbin/ seapp_contexts selinux_version sepolicy service_contexts sys/ ueventd.goldfish.rc ueventd.rc 

5 system_server zygote Init ZygoteInit SystemServer LocationManagerService Launcher installd logd lmkd ueventd … PowerManagerService ActivityManagerService LauncherActivity 

6 system_server zygote Init ZygoteInit SystemServer LocationManagerService Launcher installd logd lmkd ueventd … PowerManagerService ActivityManagerService LauncherActivity 

init.*.rc 7 on init mkdir /system mkdir /data 0771 system system mkdir /cache 0770 system cache mkdir /config 0500 root root # See storage config details at http://source.android.com/tech/storage/ mkdir /mnt/shell 0700 shell shell mkdir /mnt/media_rw 0700 media_rw media_rw mkdir /storage 0751 root sdcard_r ... on fs mount_all /fstab.goldfish ... on property:selinux.reload_policy=1 restart ueventd restart installd ... on property:sys.usb.config=adb write /sys/class/android_usb/android0/enable 0 write /sys/class/android_usb/android0/idVendor 18d1 write /sys/class/android_usb/android0/idProduct 4EE7 write /sys/class/android_usb/android0/functions ${sys.usb.config} write /sys/class/android_usb/android0/enable 1 start adbd setprop sys.usb.state ${sys.usb.config} 

Mounted Partitions 8 # Android fstab file. # # The filesystem that contains the filesystem checker binary (typically / system) cannot # specify MF_CHECK, and must come before any filesystems that do specify MF_CHECK /dev/block/mtdblock0 /system ext4 ro,barrier=1 wait /dev/block/mtdblock1 /data ext4 noatime,nosuid,nodev,barrier=1,nomblk_io_submit wait,check /dev/block/mtdblock2 /cache ext4 noatime,nosuid,nodev wait,check /devices/platform/goldfish_mmc.0 auto vfat defaults voldmanaged=sdcard:auto /fstab.goldfish 

init.*.rc 9 class_start core class_start main service logd /system/bin/logd class core socket logd stream 0666 logd logd socket logdr seqpacket 0666 logd logd socket logdw dgram 0222 logd logd seclabel u:r:logd:s0 ... service installd /system/bin/installd class main socket installd stream 600 system system ... service servicemanager /system/bin/servicemanager class core user system group system critical onrestart restart healthd onrestart restart zygote onrestart restart media onrestart restart surfaceflinger onrestart restart drm ... 

10 system_server zygote Init ZygoteInit SystemServer LocationManagerService Launcher installd logd lmkd ueventd … PowerManagerService ActivityManagerService LauncherActivity 

Zygote 11 zygote Preloaded Java Classes Preloaded Framework Resources VM/Runtime Preloaded Shared Libraries service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server class main socket zygote stream 660 root system onrestart write /sys/android_power/request_state wake onrestart write /sys/power/state on onrestart restart media onrestart restart netd 

Look Familiar? 12 java.lang.NullPointerException: Attempt to invoke virtual method 'xxx' on a null object reference at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:2298) at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:2360) at android.app.ActivityThread.access$800(ActivityThread.java:144) at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1278) at android.os.Handler.dispatchMessage(Handler.java:102) at android.os.Looper.loop(Looper.java:135) at android.app.ActivityThread.main(ActivityThread.java:5221) at java.lang.reflect.Method.invoke(Native Method) at java.lang.reflect.Method.invoke(Method.java:372) at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:899) at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:694) 

13 system_server zygote Init ZygoteInit SystemServer LocationManagerService Launcher installd logd lmkd ueventd … PowerManagerService ActivityManagerService LauncherActivity 

ActivityManagerService 14 Broadcast: action.PRE_BOOT_COMPLETED Launch Home Activity 

Default Launcher Application 15 
 
 
 

ActivityManagerService 16 Broadcast: action.PRE_BOOT_COMPLETED Broadcast: action.BOOT_COMPLETED Launch Home Activity 

App Launch 17 system_server ActivityManagerService Current App MainActivity Next App ActivityThread zygote ZygoteInit android.os.Process ActivityManagerNative NewActivity ActivityManagerNative start() fork() scheduleLaunchActivity() attachApplication() 

64-bit Support 18 Zygote32 Zygote64 Zygote service zygote /system/bin/app_process64 -Xzygote /system/bin --zygote --start-system-server --socket-name=zygote class main socket zygote stream 660 root system onrestart write /sys/android_power/request_state wake onrestart write /sys/power/state on onrestart restart media onrestart restart netd service zygote_secondary /system/bin/app_process32 -Xzygote /system/bin --zygote --socket-name=zygote_secondary class main socket zygote_secondary stream 660 root system onrestart restart zygote 

64-bit Support • Zygote ABI Selection – adb install --abi – ApplicationInfo.primaryCpuAbi • Inferred from native ABIs in the APK – getprop ro.product.cpu.abilist • Nexus 9 • [arm64-v8a,armeabi-v7a,armeabi] • Defaults to first item • Precompiled cache is now split by arch – arm/arm64 – x86/x86_64 19 

Let's Connect! • Dave Smith • Twitter: @devunwired • Google+ – http://plus.google.com/+DaveSmithDev • Blog – http://wiresareobsolete.com • Training – http://newcircle.com 20