Develop Reference

Issues with hidden API's after updating Android security patch (June 2022)

We have created a Bluetooth application to test different BT profiles. We ran into an issue after an Android update (This is not Android version specific. Issue is seen on both Android 11 and 12. Issue is 100 % reproducible if the security patch date >= June 2022. Do find below the code which was working fine without any problems but now fails with the error, System.err: Caused by: java.lang.SecurityException: Need BLUETOOTH PRIVILEGED permission: Neither user 10243 nor current process has android.permission.BLUETOOTH_PRIVILEGED
This permission android.permission.BLUETOOTH_PRIVILEGED is only applicable for system apps. Seems like Android security update is now restricting usage of some hidden API's on user apps and would only be usable on system apps. There seems to be no other alternative public api for the below use. Can somebody help in this regard in case you had a similar use case and somehow resolved this?
public static void changeScanMode(String cmdSuffix, String strCmdName, BluetoothAdapter mBluetoothAdapter) {
String scanMode = cmdSuffix;
if (scanMode.equalsIgnoreCase("scan_connectable_on")) {
boolean result = setBluetoothScanMode(mBluetoothAdapter, SCAN_MODE_CONNECTABLE);
Log.v(TAG, "set scan mode connectable result " + result);
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S && ActivityCompat.checkSelfPermission(MainActivity.context, Manifest.permission.BLUETOOTH_SCAN) != PackageManager.PERMISSION_GRANTED) {
Log.e(TAG, "Permission not granted");
return;
}
if (mBluetoothAdapter.getScanMode() == SCAN_MODE_CONNECTABLE) {
Log.v(TAG, "[" + strCmdName.toUpperCase() + "] [PASS] scanMode: SCAN_MODE_CONNECTABLE");
} else {
Log.v(TAG, "[" + strCmdName.toUpperCase() + "] [FAIL] scanMode: SCAN_MODE_CONNECTABLE");
}
} else if (scanMode.equalsIgnoreCase("scan_connectable_discoverable_on")) {
boolean result = setBluetoothScanMode(mBluetoothAdapter, SCAN_MODE_CONNECTABLE_DISCOVERABLE);
Log.v(TAG, "set scan mode connectable discoverable result " + result);
if (mBluetoothAdapter.getScanMode() == SCAN_MODE_CONNECTABLE_DISCOVERABLE) {
Log.v(TAG, "[" + strCmdName.toUpperCase() + "] [PASS] scanMode: SCAN_MODE_CONNECTABLE_DISCOVERABLE");
} else {
Log.v(TAG, "[" + strCmdName.toUpperCase() + "] [FAIL] scanMode: SCAN_MODE_CONNECTABLE_DISCOVERABLE");
}
} else if (scanMode.equalsIgnoreCase("scan_mode_none")) {
boolean result = setBluetoothScanMode(mBluetoothAdapter, SCAN_MODE_NONE);
Log.v(TAG, "set scan mode none result " + result);
if (mBluetoothAdapter.getScanMode() == SCAN_MODE_NONE) {
Log.v(TAG, "[" + strCmdName.toUpperCase() + "] [PASS] scanMode: SCAN_MODE_NONE");
} else {
Log.v(TAG, "[" + strCmdName.toUpperCase() + "] [FAIL] scanMode: SCAN_MODE_NONE");
}
} else {
Log.v(TAG, "[" + strCmdName.toUpperCase() + "] [FAIL] scanMode: Enter Valid Scan Mode");
}
}

How was the source code of startService() modified to recognize if it was called from background?

Since about Android 9 it throws an IllegalStateException if startService() was called from the background. I see this exception many times in my developer console:
java.lang.IllegalStateException:
at android.app.ContextImpl.startServiceCommon (ContextImpl.java:1666)
at android.app.ContextImpl.startService (ContextImpl.java:1611)
In these cases, Google recommends to call startForegroundService() and within 5 seconds startForeground(), instead. See "Background execution limits".
Anyway, calling startService() from foreground is perfectly ok. Now, I wonder how exactly Android recognizes/decides that an app is in the foreground to not wrongly throwing an IllegalStateException?
I was starting to dig the source code of Android9/10 and comparing it with 8/7 to discover how startService() was modified to recognize if it was called from foreground/background. But I'm convinced that many developers before me did this already, and I would be happy if they'd give an answer.

In AOSP10 (10.0.0_r25):
Server side:
in startServiceLocked from frameworks\base\services\core\java\com\android\server\am\ActiveServices.java:
// Before going further -- if this app is not allowed to start services in the
// background, then at this point we aren't going to let it period.
final int allowed = mAm.getAppStartModeLocked(r.appInfo.uid, r.packageName,
r.appInfo.targetSdkVersion, callingPid, false, false, forcedStandby);
if (allowed != ActivityManager.APP_START_MODE_NORMAL) {
Slog.w(TAG, "Background start not allowed: service "
+ service + " to " + r.shortInstanceName
+ " from pid=" + callingPid + " uid=" + callingUid
+ " pkg=" + callingPackage + " startFg?=" + fgRequired);
......
// This app knows it is in the new model where this operation is not
// allowed, so tell it what has happened.
UidRecord uidRec = mAm.mProcessList.getUidRecordLocked(r.appInfo.uid);
return new ComponentName("?", "app is in background uid " + uidRec);
}
Then in client side:
in ContextImpl.java as your log:
else if (cn.getPackageName().equals("?")) {
throw new IllegalStateException(
"Not allowed to start service " + service + ": " + cn.getClassName());
}

Following this link into Android's soure code we find getAppStartModeLocked():
int getAppStartModeLocked(int uid, String packageName, int packageTargetSdk,
int callingPid, boolean alwaysRestrict, boolean disabledOnly) {
UidRecord uidRec = mActiveUids.get(uid);
if (DEBUG_BACKGROUND_CHECK) Slog.d(TAG, "checkAllowBackground: uid=" + uid + " pkg="
+ packageName + " rec=" + uidRec + " always=" + alwaysRestrict + " idle="
+ (uidRec != null ? uidRec.idle : false));
if (uidRec == null || alwaysRestrict || uidRec.idle) {
boolean ephemeral;
if (uidRec == null) {
ephemeral = getPackageManagerInternalLocked().isPackageEphemeral(
UserHandle.getUserId(uid), packageName);
} else {
ephemeral = uidRec.ephemeral;
}
if (ephemeral) {
// We are hard-core about ephemeral apps not running in the background.
return ActivityManager.APP_START_MODE_DISABLED;
} else {
if (disabledOnly) {
// The caller is only interested in whether app starts are completely
// disabled for the given package (that is, it is an instant app). So
// we don't need to go further, which is all just seeing if we should
// apply a "delayed" mode for a regular app.
return ActivityManager.APP_START_MODE_NORMAL;
}
final int startMode = (alwaysRestrict)
? appRestrictedInBackgroundLocked(uid, packageName, packageTargetSdk)
: appServicesRestrictedInBackgroundLocked(uid, packageName,
packageTargetSdk);
if (DEBUG_BACKGROUND_CHECK) Slog.d(TAG, "checkAllowBackground: uid=" + uid
+ " pkg=" + packageName + " startMode=" + startMode
+ " onwhitelist=" + isOnDeviceIdleWhitelistLocked(uid));
if (startMode == ActivityManager.APP_START_MODE_DELAYED) {
// This is an old app that has been forced into a "compatible as possible"
// mode of background check. To increase compatibility, we will allow other
// foreground apps to cause its services to start.
if (callingPid >= 0) {
ProcessRecord proc;
synchronized (mPidsSelfLocked) {
proc = mPidsSelfLocked.get(callingPid);
}
if (proc != null &&
!ActivityManager.isProcStateBackground(proc.curProcState)) {
// Whoever is instigating this is in the foreground, so we will allow it
// to go through.
return ActivityManager.APP_START_MODE_NORMAL;
}
}
}
return startMode;
}
}
return ActivityManager.APP_START_MODE_NORMAL;
}
And the method appRestrictedInBackgroundLocked() (which is also called from appServicesRestrictedInBackgroundLocked() as fallback) decides about the startMode:
// Unified app-op and target sdk check
int appRestrictedInBackgroundLocked(int uid, String packageName, int packageTargetSdk) {
// Apps that target O+ are always subject to background check
if (packageTargetSdk >= Build.VERSION_CODES.O) {
if (DEBUG_BACKGROUND_CHECK) {
Slog.i(TAG, "App " + uid + "/" + packageName + " targets O+, restricted");
}
return ActivityManager.APP_START_MODE_DELAYED_RIGID;
}
// ...and legacy apps get an AppOp check
int appop = mAppOpsService.noteOperation(AppOpsManager.OP_RUN_IN_BACKGROUND,
uid, packageName);
if (DEBUG_BACKGROUND_CHECK) {
Slog.i(TAG, "Legacy app " + uid + "/" + packageName + " bg appop " + appop);
}
switch (appop) {
case AppOpsManager.MODE_ALLOWED:
return ActivityManager.APP_START_MODE_NORMAL;
case AppOpsManager.MODE_IGNORED:
return ActivityManager.APP_START_MODE_DELAYED;
default:
return ActivityManager.APP_START_MODE_DELAYED_RIGID;
}
}
But the final decision about foreground or background is done in ActivityManager.isProcStateBackground(uidRec.setProcState):
/** #hide Should this process state be considered a background state? */
public static final boolean isProcStateBackground(int procState) {
return procState >= PROCESS_STATE_TRANSIENT_BACKGROUND;
}
So, this section of the first method here gets the current state of foreground or background:
ProcessRecord proc;
synchronized (mPidsSelfLocked) {
proc = mPidsSelfLocked.get(callingPid);
}

When the app is in following case, it will be allowed to started from background.
The app is persistent. Only the prebuilt system app can do this.
The app is not idle. When the app process is in background for a certain time, it will be set idle.
The app is idle but in an whitelist. backgroundWhitelistUid. Only the app with system uid can add apps to this list.

How to add a skip-ad button to exoplayer with IMA extention using react-native-video

Update:
After much research I've asked this question instead. It gets to the core of the problem. Google IMA webview is not showing when used inside react native on android
We are using react-native-video to use the exoplayer on android to show video with adds. The problem is, the exoplayer doesn't show the skip-button when an ad is skippable. To solve this problem we need to know if an ad is skippable and show a custom skipp-button. That's where I'm stuck. I can't get access to this information without changing the sourcecode of the exoplayer ima-extention.
The preferred solution would be to change the ImaAdsLoader**.onAdEvent() to broadcast an event when the add is loaded that exposes the Ad that has been loaded. Then monitor the playback-progress and show/hide a custom skipp-button.
Is there a way to get the information without altering the code of the ima-extention?
#Override
public void onAdEvent(AdEvent adEvent) {
AdEventType adEventType = adEvent.getType();
boolean isLogAdEvent = adEventType == AdEventType.LOG;
if (DEBUG || isLogAdEvent) {
Log.w(TAG, "onAdEvent: " + adEventType);
if (isLogAdEvent) {
for (Map.Entry<String, String> entry : adEvent.getAdData().entrySet()) {
Log.w(TAG, " " + entry.getKey() + ": " + entry.getValue());
}
}
}
if (adsManager == null) {
Log.w(TAG, "Dropping ad event after release: " + adEvent);
return;
}
Ad ad = adEvent.getAd();
switch (adEvent.getType()) {
case LOADED:
//This line is what I need
eventListener.onAdLoaded(ad);
// The ad position is not always accurate when using preloading. See [Internal: b/62613240].
AdPodInfo adPodInfo = ad.getAdPodInfo();
int podIndex = adPodInfo.getPodIndex();
adGroupIndex = podIndex == -1 ? adPlaybackState.adGroupCount - 1 : podIndex;
int adPosition = adPodInfo.getAdPosition();
int adCountInAdGroup = adPodInfo.getTotalAds();
adsManager.start();
if (DEBUG) {
Log.d(TAG, "Loaded ad " + adPosition + " of " + adCountInAdGroup + " in ad group "
+ adGroupIndex);
}
adPlaybackState.setAdCount(adGroupIndex, adCountInAdGroup);
updateAdPlaybackState();
break;
case CONTENT_PAUSE_REQUESTED:
// After CONTENT_PAUSE_REQUESTED, IMA will playAd/pauseAd/stopAd to show one or more ads
// before sending CONTENT_RESUME_REQUESTED.
imaPausedContent = true;
pauseContentInternal();
break;
case STARTED:
if (ad.isSkippable()) {
focusSkipButton();
}
break;
case TAPPED:
if (eventListener != null) {
eventListener.onAdTapped();
}
break;
case CLICKED:
if (eventListener != null) {
eventListener.onAdClicked();
}
break;
case CONTENT_RESUME_REQUESTED:
imaPausedContent = false;
resumeContentInternal();
break;
case ALL_ADS_COMPLETED:
// Do nothing. The ads manager will be released when the source is released.
default:
break;
}
}

Android AllJoyn: Connection with second machine gives error of BusAttachement

I have developed application for two different sensors. They are working fine separately but when I try to use them togather and create two diffent buses than Alljoyn gives this exception.
org.alljoyn.services.common.BusAlreadyExistException: The object has
been set previously with a BusAttachment.
Below is my source code for connection. Can anyone tell me why I'm having this issue.
private void connect()
{ org.alljoyn.bus.alljoyn.DaemonInit.PrepareDaemon(getApplicationContext());
bus = new BusAttachment("ControlPanelBrowser", BusAttachment.RemoteMessage.Receive);
bus.registerBusListener(new BusListener());
Status status = bus.registerBusObject(mControlPanelSignalInterface, Constants.SERVICE_PATH);
if (status != Status.OK) {
Log.d(TAG, "Problem while registering bus object");
}
SharedPreferences settings = getSharedPreferences(PREFS_NAME, 0);
srpPassword = settings.getString(PREFS_PASSWORD, DEFAULT_SECURED_SRP_PASSWORD);
SrpAnonymousKeyListener authListener = new SrpAnonymousKeyListener(this, logger, AUTH_MECHANISMS);
Status authStatus = bus.registerAuthListener(authListener.getAuthMechanismsAsString(),
authListener, getKeyStoreFileName());
if ( authStatus != Status.OK ) {
Log.e(TAG, "Failed to register AuthListener");
}
status = bus.connect();
if (Status.OK == status){
String daemonName = Constants.DAEMON_NAME_PREFIX + ".ControlPanelBrowser.G" +
bus.getGlobalGUIDString();
int flag = BusAttachment.ALLJOYN_REQUESTNAME_FLAG_DO_NOT_QUEUE;
Status reqStatus = bus.requestName(daemonName, flag);
if (reqStatus == Status.OK) {
Status adStatus = bus.advertiseName(Constants.DAEMON_QUIET_PREFIX +
daemonName, SessionOpts.TRANSPORT_ANY);
if (adStatus != Status.OK){
bus.releaseName(daemonName);
Log.e(TAG, "Failed to advertise daemon name: '" + daemonName + "', Error: '" + status + "'");
}
else{
Log.d(TAG, "Succefully advertised daemon name: '" + daemonName + "'");
}
}
else {
Log.e(TAG, "Failed to request daemon name: '" + daemonName + "', Error: '" + status + "'");
}
}
status = bus.registerSignalHandlers(mControlPanelSignalInterface);
if (status != Status.OK) {
Log.d(TAG, "Problem while registering signal handlers");
}
// Initialize AboutService
aboutClient = AboutServiceImpl.getInstance();
aboutClient.setLogger(logger);
try {
aboutClient.startAboutClient(bus);
for (String iface : ANNOUNCE_IFACES) {
aboutClient.addAnnouncementHandler(this, new String[] {iface});
}
} catch (Exception e) {
logger.error(TAG, "Unable to start AboutService, Error: " + e.getMessage());
}
}

use registerBusObject twince and then you can make one signle bus attachment

why dont you create two Interfaces, one interface for one sensor respectively. then add these two interfaces in a class which implements these two interfaces and the busObject and register an implemntation of this class as a BusObject.
For example
Sensor1_interface.java and Sensor2_interface.java //are my two interface classes
create a new class Sensor_InterfaceList which inplements the two interfaces and the BusObject
class Sensor_InterfaceList implements Sensor1_interface,Sensor2_interface,BusObject
{
// implment your interfaces here
.....
}
private Sensor_InterfaceList mySensor_InterfaceList;
mySensor_InterfaceList = new Sensor_InterfaceList();
myBus.registerBusObject(mySensor_InterfaceList,"/your/path");
This should solve your problem :)

Gear SDK SAFileTransfer FILE_IO error

I'm trying to send file from Android host to Samsung Gear device using Samsung Mobile SDK no matter how had I try, always get FILE_IO error.
I was trying all available permissions (on both sides).
Could anyone send me any hint?
Android side:
String filename = "file:///storage/emulated/0/Download/TestRecipe2-25.zip";
if (mGuruAgentService != null) mGuruAgentService.sendFile(filename);
public int sendFile(String fileName) {
if (mFileTransfer == null)
registerForFileTransfer();
if (mFileTransfer != null) {
try {
Log.i(TAG, "Sending file " + fileName);
tx = mFileTransfer.send(mPeerAgent, fileName);
return tx;
} catch (Exception e)
{
Log.i(TAG, "Cannot send file" + e.getMessage());
}
}
return 0;
}
Tizen side:
function fileReceiveInt() {
var newFilePath = "downloads/file.zip";
var receivefilecallback =
{
onreceive: function(transferId, fileName)
{
console.log("Incoming file transfer request form the remote peer agent. transferId: " + transferId + " file name : " + fileName);
try {
gFileTransfer.receiveFile(transferId, newFilePath);
} catch(e) {
console.log("Error Exception, error name : " + e.name + ", error message : " + e.message);
}
},
onprogress: function(transferId, progress)
{
console.log("onprogress transferId: " + transferId + ", progress : " + progress);
},
oncomplete: function(transferId, localPath)
{
console.log("File transfer complete. transferId: " + transferId);
},
onerror: function(errorCode, transferId)
{
console.log("FileReceiveError transferId: " + transferId + " code : " + errorCode);
}
}
try {
console.log('setting recieve interface');
gFileTransfer = SAAgent.getSAFileTransfer();
gFileTransfer.setFileReceiveListener(receivefilecallback);
} catch (err) {
console.log('getSAFileTransfer exception <' + err.name + '> : ' + err.message);
}
}
I will always get onError in tizen with FILE_IO error :(
I was testing gFileTransfer.receiveFile(transferId, ""); for default path, and File:///opt/usr/media/Downloads...
My tizen privileges:
<tizen:privilege name="http://tizen.org/privilege/content.read"/>
<tizen:privilege name="http://developer.samsung.com/privilege/accessoryprotocol"/>
<tizen:privilege name="http://tizen.org/privilege/content.write"/>
<tizen:privilege name="http://tizen.org/privilege/filesystem.read"/>
<tizen:privilege name="http://tizen.org/privilege/filesystem.write"/>
<tizen:privilege name="http://tizen.org/privilege/unlimitedstorage"/>
Thanks in advance for any help.

Change both filepaths and it should work.
Change Android's side to:
String filename = Environment.getExternalStorageDirectory() + "/Download/TestRecipe2-25.zip";
Change Tizen's side to:
var newFilePath = "file:///opt/usr/media/Downloads/file.zip";