【Android】ServiceNotFoundException: No service published for: search

0x00 一个Crash

Android11 下的一个 system_app_crash

java 复制代码
Process: com.android.permissioncontroller
PID: 2070
UID: 10064
Flags: 0x20c83e05
Package: com.android.permissioncontroller v300000000 (30 system image)
Foreground: Yes
Process-Runtime: 25769047
Build: qti/msmnile_gvmq/msmnile_gvmq:11/RQ3A.211001.001/55:user/test-keys

java.lang.IllegalStateException: android.os.ServiceManager$ServiceNotFoundException: No service published for: search
	at android.app.Activity.ensureSearchManager(Activity.java:6787)
	at android.app.Activity.startSearch(Activity.java:4976)
	at android.app.Activity.onSearchRequested(Activity.java:4923)
	at android.app.Activity.onSearchRequested(Activity.java:4910)
	at com.android.internal.policy.PhoneWindow.launchDefaultSearch(PhoneWindow.java:3153)
	at com.android.internal.policy.PhoneWindow.onKeyUp(PhoneWindow.java:2103)
	at com.android.internal.policy.DecorView.dispatchKeyEvent(DecorView.java:425)
	at android.view.ViewRootImpl$ViewPostImeInputStage.processKeyEvent(ViewRootImpl.java:6066)
	at android.view.ViewRootImpl$ViewPostImeInputStage.onProcess(ViewRootImpl.java:5934)
	at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:5429)
	at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:5486)
	at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:5452)
	at android.view.ViewRootImpl$AsyncInputStage.forward(ViewRootImpl.java:5604)
	at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:5460)
	at android.view.ViewRootImpl$AsyncInputStage.apply(ViewRootImpl.java:5661)
	at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:5433)
	at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:5486)
	at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:5452)
	at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:5460)
	at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:5433)
	at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:5486)
	at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:5452)
	at android.view.ViewRootImpl$AsyncInputStage.forward(ViewRootImpl.java:5637)
	at android.view.ViewRootImpl$ImeInputStage.onFinishedInputEvent(ViewRootImpl.java:5795)
	at android.view.inputmethod.InputMethodManager$PendingEvent.run(InputMethodManager.java:3199)
	at android.view.inputmethod.InputMethodManager.invokeFinishedInputEventCallback(InputMethodManager.java:2741)
	at android.view.inputmethod.InputMethodManager.finishedInputEvent(InputMethodManager.java:2732)
	at android.view.inputmethod.InputMethodManager$ImeInputEventSender.onInputEventFinished(InputMethodManager.java:3176)
	at android.view.InputEventSender.dispatchInputEventFinished(InputEventSender.java:143)
	at android.os.MessageQueue.nativePollOnce(Native Method)
	at android.os.MessageQueue.next(MessageQueue.java:335)
	at android.os.Looper.loop(Looper.java:183)
	at android.app.ActivityThread.main(ActivityThread.java:7663)
	at java.lang.reflect.Method.invoke(Native Method)
	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:600)
	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:947)
Caused by: android.os.ServiceManager$ServiceNotFoundException: No service published for: search
	at android.os.ServiceManager.getServiceOrThrow(ServiceManager.java:153)
	at android.app.SearchManager.<init>(SearchManager.java:560)
	at android.app.Activity.ensureSearchManager(Activity.java:6785)
	... 35 more

0x01 分析

直观感受

单纯看了这个Crash文件,按理说不该出现这个crash,permissioncontroller原生应用,没人动过。

search服务是否加载?

跟踪堆栈信息,从PhoneWindow.launchDefaultSearch()Activity.ensureSearchManager() 再到 android.app.SearchManager() 的构造方法:

java 复制代码
@UnsupportedAppUsage/*package*/ 
SearchManager(Context context, Handler handler) throws ServiceNotFoundException {
    mContext = context;
    mHandler = handler;
    mService = ISearchManager.Stub.asInterface(
            ServiceManager.getServiceOrThrow(Context.SEARCH_SERVICE));
}

没发现啥异常。然后看下service服务是啥时候加载的:

java 复制代码
package com.android.server;

public final class SystemServer {
    private static final String TAG = "SystemServer";
    ...
    private static final String SEARCH_MANAGER_SERVICE_CLASS =
            "com.android.server.search.SearchManagerService$Lifecycle";
    ...
    /**
     * The main entry point from zygote.
     */
    public static void main(String[] args) {
        new SystemServer().run();
    }

    public SystemServer() {
        // Check for factory test mode.
        mFactoryTestMode = FactoryTest.getMode();

        // Record process start information.
        // Note SYSPROP_START_COUNT will increment by *2* on a FDE device when it fully boots;
        // one for the password screen, second for the actual boot.
        mStartCount = SystemProperties.getInt(SYSPROP_START_COUNT, 0) + 1;
        mRuntimeStartElapsedTime = SystemClock.elapsedRealtime();
        mRuntimeStartUptime = SystemClock.uptimeMillis();
        Process.setStartTimes(mRuntimeStartElapsedTime, mRuntimeStartUptime);

        // Remember if it's runtime restart(when sys.boot_completed is already set) or reboot
        // We don't use "mStartCount > 1" here because it'll be wrong on a FDE device.
        // TODO: mRuntimeRestart will *not* be set to true if the proccess crashes before
        // sys.boot_completed is set. Fix it.
        mRuntimeRestart = "1".equals(SystemProperties.get("sys.boot_completed"));
    }

    private void run() {
        ...        
        // Start services.
        try {
            t.traceBegin("StartServices");
            startBootstrapServices(t);
            startCoreServices(t);
            startOtherServices(t);
        } catch (Throwable ex) {
            Slog.e("System", "******************************************");
            Slog.e("System", "************ Failure starting system services", ex);
            throw ex;
        } finally {
            t.traceEnd(); // StartServices
        }

        StrictMode.initVmDefaults(null);

        if (!mRuntimeRestart && !isFirstBootOrUpgrade()) {
            final long uptimeMillis = SystemClock.elapsedRealtime();
            FrameworkStatsLog.write(FrameworkStatsLog.BOOT_TIME_EVENT_ELAPSED_TIME_REPORTED,
                    FrameworkStatsLog.BOOT_TIME_EVENT_ELAPSED_TIME__EVENT__SYSTEM_SERVER_READY,
                    uptimeMillis);
            final long maxUptimeMillis = 60 * 1000;
            if (uptimeMillis > maxUptimeMillis) {
                Slog.wtf(SYSTEM_SERVER_TIMING_TAG,
                        "SystemServer init took too long. uptimeMillis=" + uptimeMillis);
            }
        }
        // Diagnostic to ensure that the system is in a base healthy state. Done here as a common
        // non-zygote process.
        if (!VMRuntime.hasBootImageSpaces()) {
            Slog.wtf(TAG, "Runtime is not running with a boot image!");
        }
        // Loop forever.
        Looper.loop();
        throw new RuntimeException("Main thread loop unexpectedly exited");
    }
    ...
    /**
     * Starts a miscellaneous grab bag of stuff that has yet to be refactored and organized.
     */
    private void startOtherServices(@NonNull TimingsTraceAndSlog t) {
        t.traceBegin("startOtherServices");
        ...
        if (mFactoryTestMode != FactoryTest.FACTORY_TEST_LOW_LEVEL) {
            ...
            if (!isWatch) {
                t.traceBegin("StartSearchManagerService");
                try {
                    mSystemServiceManager.startService(SEARCH_MANAGER_SERVICE_CLASS);
                } catch (Throwable e) {
                    reportWtf("starting Search Service", e);
                }
                t.traceEnd();
            }
            ...
        }
        ...
        t.traceEnd(); // startOtherServices
    }
}

然后到SearchManagerService :

java 复制代码
package com.android.server.search;
/**
 * The search manager service handles the search UI, and maintains a registry of
 * searchable activities.
 */
public class SearchManagerService extends ISearchManager.Stub {
    private static final String TAG = "SearchManagerService";
    final Handler mHandler;

    public static class Lifecycle extends SystemService {
        private SearchManagerService mService;

        public Lifecycle(Context context) {
            super(context);
        }

        @Override
        public void onStart() {
            mService = new SearchManagerService(getContext());
            publishBinderService(Context.SEARCH_SERVICE, mService);
        }

        @Override
        public void onUnlockUser(final int userId) {
            mService.mHandler.post(new Runnable() {
                @Override
                public void run() {
                    mService.onUnlockUser(userId);
                }
            });
        }

        @Override
        public void onCleanupUser(int userHandle) {
            mService.onCleanupUser(userHandle);
        }
    }
    ...
}

SystemServer 中加载的,很早的。所以在问题出现的点不会还没有加载。

复现场景

整个系统中个人能想到的就是通过settings(已经被隐藏入口,Monkey应该可以打开这个入口)进入permissioncontroller。
adb shell am start com.android.car.settings

打开后进入权限设置的几个界面,尝试模拟发送search按键,没效果:

shell 复制代码
adb shell input keyevent 84
# or
adb shell input keyevent 84 motionevent DOWN && input keyevent 84 motionevent UP

最终没找到复现方法。

分析Log

到这里已经花掉了好长的时间。掉头回去看Logcat日志。

shell 复制代码
2024-07-16 06:02:54.970  5912  5912 I Monkey  : :Sending Key (ACTION_DOWN): 84    // KEYCODE_SEARCH
2024-07-16 06:02:54.972  5912  5912 I Monkey  : :Sending Key (ACTION_UP): 84    // KEYCODE_SEARCH
2024-07-16 06:02:54.973  1028  1174 D InputDispatcher: Waiting to send key to Window{be605a u0 com.android.permissioncontroller/com.android.permissioncontroller.permission.ui.ManagePermissionsActivity} because there are unprocessed events that may cause focus to change
2024-07-16 06:02:54.974  5912  5912 I Monkey  : Sleeping for 300 milliseconds
2024-07-16 06:02:54.976  1028  1028 D InputMethodManagerService: IME window vis: 0 active: 0 inv: 0 displayId: 0
2024-07-16 06:02:54.976  1028  1028 D InputMethodManagerServiceExt: IME window vis: 0 active: 0 inv: 0 displayId: 2
2024-07-16 06:02:54.976  1028  1061 D AutofillManagerService: Close system dialogs
2024-07-16 06:02:54.976   258   258 E SELinux : avc:  denied  { find } for pid=2070 uid=10064 name=search scontext=u:r:permissioncontroller_app:s0:c64,c256,c512,c768 tcontext=u:object_r:search_service:s0 tclass=service_manager permissive=0
2024-07-16 06:02:54.977  2070  2070 E InputEventSender: Exception dispatching finished signal.
2024-07-16 06:02:54.977  2070  2070 E MessageQueue-JNI: Exception in MessageQueue callback: handleReceiveCallback
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: java.lang.IllegalStateException: android.os.ServiceManager$ServiceNotFoundException: No service published for: search
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.app.Activity.ensureSearchManager(Activity.java:6787)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.app.Activity.startSearch(Activity.java:4976)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.app.Activity.onSearchRequested(Activity.java:4923)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.app.Activity.onSearchRequested(Activity.java:4910)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at com.android.internal.policy.PhoneWindow.launchDefaultSearch(PhoneWindow.java:3153)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at com.android.internal.policy.PhoneWindow.onKeyUp(PhoneWindow.java:2103)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at com.android.internal.policy.DecorView.dispatchKeyEvent(DecorView.java:425)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.view.ViewRootImpl$ViewPostImeInputStage.processKeyEvent(ViewRootImpl.java:6066)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.view.ViewRootImpl$ViewPostImeInputStage.onProcess(ViewRootImpl.java:5934)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:5429)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:5486)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:5452)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.view.ViewRootImpl$AsyncInputStage.forward(ViewRootImpl.java:5604)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:5460)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.view.ViewRootImpl$AsyncInputStage.apply(ViewRootImpl.java:5661)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:5433)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:5486)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:5452)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:5460)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:5433)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:5486)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:5452)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.view.ViewRootImpl$AsyncInputStage.forward(ViewRootImpl.java:5637)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.view.ViewRootImpl$ImeInputStage.onFinishedInputEvent(ViewRootImpl.java:5795)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.view.inputmethod.InputMethodManager$PendingEvent.run(InputMethodManager.java:3199)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.view.inputmethod.InputMethodManager.invokeFinishedInputEventCallback(InputMethodManager.java:2741)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.view.inputmethod.InputMethodManager.finishedInputEvent(InputMethodManager.java:2732)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.view.inputmethod.InputMethodManager$ImeInputEventSender.onInputEventFinished(InputMethodManager.java:3176)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.view.InputEventSender.dispatchInputEventFinished(InputEventSender.java:143)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.os.MessageQueue.nativePollOnce(Native Method)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.os.MessageQueue.next(MessageQueue.java:335)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.os.Looper.loop(Looper.java:183)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.app.ActivityThread.main(ActivityThread.java:7663)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at java.lang.reflect.Method.invoke(Native Method)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:600)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:947)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: Caused by: android.os.ServiceManager$ServiceNotFoundException: No service published for: search
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.os.ServiceManager.getServiceOrThrow(ServiceManager.java:153)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.app.SearchManager.<init>(SearchManager.java:560)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	at android.app.Activity.ensureSearchManager(Activity.java:6785)
2024-07-16 06:02:54.978  2070  2070 E MessageQueue-JNI: 	... 35 more
2024-07-16 06:02:54.978  2070  2070 D AndroidRuntime: Shutting down VM
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: FATAL EXCEPTION: main
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: Process: com.android.permissioncontroller, PID: 2070
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: java.lang.IllegalStateException: android.os.ServiceManager$ServiceNotFoundException: No service published for: search
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.app.Activity.ensureSearchManager(Activity.java:6787)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.app.Activity.startSearch(Activity.java:4976)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.app.Activity.onSearchRequested(Activity.java:4923)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.app.Activity.onSearchRequested(Activity.java:4910)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at com.android.internal.policy.PhoneWindow.launchDefaultSearch(PhoneWindow.java:3153)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at com.android.internal.policy.PhoneWindow.onKeyUp(PhoneWindow.java:2103)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at com.android.internal.policy.DecorView.dispatchKeyEvent(DecorView.java:425)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.view.ViewRootImpl$ViewPostImeInputStage.processKeyEvent(ViewRootImpl.java:6066)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.view.ViewRootImpl$ViewPostImeInputStage.onProcess(ViewRootImpl.java:5934)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:5429)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:5486)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:5452)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.view.ViewRootImpl$AsyncInputStage.forward(ViewRootImpl.java:5604)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:5460)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.view.ViewRootImpl$AsyncInputStage.apply(ViewRootImpl.java:5661)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:5433)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:5486)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:5452)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:5460)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:5433)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:5486)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:5452)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.view.ViewRootImpl$AsyncInputStage.forward(ViewRootImpl.java:5637)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.view.ViewRootImpl$ImeInputStage.onFinishedInputEvent(ViewRootImpl.java:5795)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.view.inputmethod.InputMethodManager$PendingEvent.run(InputMethodManager.java:3199)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.view.inputmethod.InputMethodManager.invokeFinishedInputEventCallback(InputMethodManager.java:2741)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.view.inputmethod.InputMethodManager.finishedInputEvent(InputMethodManager.java:2732)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.view.inputmethod.InputMethodManager$ImeInputEventSender.onInputEventFinished(InputMethodManager.java:3176)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.view.InputEventSender.dispatchInputEventFinished(InputEventSender.java:143)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.os.MessageQueue.nativePollOnce(Native Method)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.os.MessageQueue.next(MessageQueue.java:335)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.os.Looper.loop(Looper.java:183)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.app.ActivityThread.main(ActivityThread.java:7663)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at java.lang.reflect.Method.invoke(Native Method)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:600)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:947)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: Caused by: android.os.ServiceManager$ServiceNotFoundException: No service published for: search
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.os.ServiceManager.getServiceOrThrow(ServiceManager.java:153)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.app.SearchManager.<init>(SearchManager.java:560)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	at android.app.Activity.ensureSearchManager(Activity.java:6785)
2024-07-16 06:02:54.979  2070  2070 E AndroidRuntime: 	... 35 more

2024-07-16 06:02:54.980   347 12898 I AIS-LOG : ais_client_health_thread:794 HIGH X
2024-07-16 06:02:54.981  1028 12934 I DropBoxManagerService: add tag=system_app_crash isTagEnabled=true flags=0x2
2024-07-16 06:02:54.983  5912  5927 W Monkey  : // CRASH: com.android.permissioncontroller (pid 2070)
2024-07-16 06:02:54.983  5912  5927 W Monkey  : // Short Msg: android.os.ServiceManager$ServiceNotFoundException
2024-07-16 06:02:54.983  5912  5927 W Monkey  : // Long Msg: android.os.ServiceManager$ServiceNotFoundException: No service published for: search
2024-07-16 06:02:54.983  5912  5927 W Monkey  : // Build Label: qti/msmnile_gvmq/msmnile_gvmq:11/RQ3A.211001.001/55:user/test-keys
2024-07-16 06:02:54.983  5912  5927 W Monkey  : // Build Changelist: 55
2024-07-16 06:02:54.983  5912  5927 W Monkey  : // Build Time: 1720990192000
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // java.lang.IllegalStateException: android.os.ServiceManager$ServiceNotFoundException: No service published for: search
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.app.Activity.ensureSearchManager(Activity.java:6787)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.app.Activity.startSearch(Activity.java:4976)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.app.Activity.onSearchRequested(Activity.java:4923)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.app.Activity.onSearchRequested(Activity.java:4910)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at com.android.internal.policy.PhoneWindow.launchDefaultSearch(PhoneWindow.java:3153)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at com.android.internal.policy.PhoneWindow.onKeyUp(PhoneWindow.java:2103)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at com.android.internal.policy.DecorView.dispatchKeyEvent(DecorView.java:425)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.view.ViewRootImpl$ViewPostImeInputStage.processKeyEvent(ViewRootImpl.java:6066)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.view.ViewRootImpl$ViewPostImeInputStage.onProcess(ViewRootImpl.java:5934)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:5429)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:5486)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:5452)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.view.ViewRootImpl$AsyncInputStage.forward(ViewRootImpl.java:5604)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:5460)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.view.ViewRootImpl$AsyncInputStage.apply(ViewRootImpl.java:5661)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:5433)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:5486)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:5452)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:5460)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:5433)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:5486)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:5452)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.view.ViewRootImpl$AsyncInputStage.forward(ViewRootImpl.java:5637)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.view.ViewRootImpl$ImeInputStage.onFinishedInputEvent(ViewRootImpl.java:5795)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.view.inputmethod.InputMethodManager$PendingEvent.run(InputMethodManager.java:3199)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.view.inputmethod.InputMethodManager.invokeFinishedInputEventCallback(InputMethodManager.java:2741)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.view.inputmethod.InputMethodManager.finishedInputEvent(InputMethodManager.java:2732)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.view.inputmethod.InputMethodManager$ImeInputEventSender.onInputEventFinished(InputMethodManager.java:3176)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.view.InputEventSender.dispatchInputEventFinished(InputEventSender.java:143)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.os.MessageQueue.nativePollOnce(Native Method)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.os.MessageQueue.next(MessageQueue.java:335)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.os.Looper.loop(Looper.java:183)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.app.ActivityThread.main(ActivityThread.java:7663)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at java.lang.reflect.Method.invoke(Native Method)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:600)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:947)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // Caused by: android.os.ServiceManager$ServiceNotFoundException: No service published for: search
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.os.ServiceManager.getServiceOrThrow(ServiceManager.java:153)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.app.SearchManager.<init>(SearchManager.java:560)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	at android.app.Activity.ensureSearchManager(Activity.java:6785)
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 	... 35 more
2024-07-16 06:02:54.984  5912  5927 W Monkey  : // 
2024-07-16 06:02:54.984  1028  1693 W ActivityManager: Force-killing crashed app com.android.permissioncontroller at watcher's request
2024-07-16 06:02:54.985  1028  1693 W ActivityTaskManager:   Force finishing activity com.android.permissioncontroller/.permission.ui.ManagePermissionsActivity

这是一段连续的日志。从事发前300ms,已经说明了问题。惭愧。

shell 复制代码
2024-07-16 06:02:54.970  5912  5912 I Monkey  : :Sending Key (ACTION_DOWN): 84    // KEYCODE_SEARCH
2024-07-16 06:02:54.972  5912  5912 I Monkey  : :Sending Key (ACTION_UP): 84    // KEYCODE_SEARCH
# Monkey确实发送了search动作
shell 复制代码
2024-07-16 06:02:54.976   258   258 E SELinux : avc:  denied  { find } for pid=2070 uid=10064 name=search scontext=u:r:permissioncontroller_app:s0:c64,c256,c512,c768 tcontext=u:object_r:search_service:s0 tclass=service_manager permissive=0
# 缺少selinux权限,permissioncontroller_app不允许调用search服务。

0x03 结论

提供两种方法解决此问题:

  • Monkey中添加黑名单,不跑settings
  • 给 permissioncontroller_app增加访问search权限

第二种不合适,那就第一种把。

done。

相关推荐
拭心9 小时前
Google 提供的 Android 端上大模型组件:MediaPipe LLM 介绍
android
带电的小王11 小时前
WhisperKit: Android 端测试 Whisper -- Android手机(Qualcomm GPU)部署音频大模型
android·智能手机·whisper·qualcomm
梦想平凡11 小时前
PHP 微信棋牌开发全解析:高级教程
android·数据库·oracle
元争栈道12 小时前
webview和H5来实现的android短视频(短剧)音视频播放依赖控件
android·音视频
阿甘知识库12 小时前
宝塔面板跨服务器数据同步教程:双机备份零停机
android·运维·服务器·备份·同步·宝塔面板·建站
元争栈道13 小时前
webview+H5来实现的android短视频(短剧)音视频播放依赖控件资源
android·音视频
MuYe13 小时前
Android Hook - 动态加载so库
android
居居飒14 小时前
Android学习(四)-Kotlin编程语言-for循环
android·学习·kotlin
Henry_He17 小时前
桌面列表小部件不能点击的问题分析
android
工程师老罗17 小时前
Android笔试面试题AI答之Android基础(1)
android