Caution: AServiceManager_getService() isn't stable ABI

This demo has been tested on Android 11. If you want to run on different Android version, you have to figure out the transact code of broadcastIntent in IActivityManager.aidl.

This is a simple demo shows one possible way that two processes or more can do binder IPC purely using NDKBinder without the help of JNI.

The key point is that how native server can publish their service & native client can get it.

After doing some research, I found two possible ways:

1. Do it like the native codes in Android Framework does.

   It's impossible in userspace because those APIs isn't exported to NDK & some require privilege.

2. Using BroadcastReceiver to help exchange binder

   Parcel.writeStrongBinder transfers Binder object into flatten_binder. The kernel driver finds it & creates the reference of binder for the client so that client can talk to the server directly.

   I tried implement bindService() first, but it isn't an easy way to do this.

   And I found the Shizuku implement a command line tool in JAVA with the help of BroadcastReceiver

By the way, NDKBinder from Android 10 (API 29) provide us the code we need to build Parcel & do binder transaction.

However, the NDKBinder Demo here only creates the Parcel in native and Java does the rest.

Luckily, this answer on Stackoverflow shows that we can get the binder to the ActivityManager in native, the possibility to get two processes exchange their binder.

1. Figure out how binder really works

2. Figure out the format of the parcel or make the Android Framework's Parcel available under NDK.

   The parcel used by broadcastIntent() works in a weired way.

   For example, it will get broken if I change Intent's mPackage field.

3. Support for API <= 29

   Try to implement it without the help of NDKBinder.