import android.app.IServiceConnection; //导入依赖的package包/类
public static boolean unbindService(final IServiceConnection conn) {
    String tmp = null;
    for (Map.Entry<String,AdditionalActivityManagerNative> entry : sBridges.entrySet()) {
        if(entry.getValue().mActiveServiceInfo.containsValue(conn)){
            tmp = entry.getKey();
        }
    }
    final String processOfRemoteService = tmp;
    if(processOfRemoteService!=null) {
        sServicehandler.post(new Runnable() {
            @Override
            public void run() {
                try {
                    AdditionalActivityManagerNative.obtain(processOfRemoteService).mRemoteDelegate.unbindService(conn);
                } catch (RemoteException e) {
                    e.printStackTrace();
                }
            }
        });
        return true;
    }else{
        return false;
    }
}
 

import android.app.IServiceConnection; //导入依赖的package包/类
@Override
public Object call(Object who, Method method, Object... args) throws Throwable {
    IInterface caller = (IInterface) args[0];
    IBinder token = (IBinder) args[1];
    Intent service = (Intent) args[2];
    String resolvedType = (String) args[3];
    IServiceConnection conn = (IServiceConnection) args[4];
    int flags = (int) args[5];
    int userId = VUserHandle.myUserId();
    if (isServerProcess()) {
        userId = service.getIntExtra("_VA_|_user_id_", VUserHandle.USER_NULL);
    }
    if (userId == VUserHandle.USER_NULL) {
        return method.invoke(who, args);
    }
    ServiceInfo serviceInfo = VirtualCore.get().resolveServiceInfo(service, userId);
    if (serviceInfo != null) {
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
            service.setComponent(new ComponentName(serviceInfo.packageName, serviceInfo.name));
        }
        conn = ServiceConnectionDelegate.getDelegate(conn);
        return VActivityManager.get().bindService(caller.asBinder(), token, service, resolvedType,
                conn, flags, userId);
    }
    return method.invoke(who, args);
}
 

import android.app.IServiceConnection; //导入依赖的package包/类
@Override
public void publishService(IBinder token, Intent intent, IBinder service, int userId) {
    synchronized (this) {
        ServiceRecord r = (ServiceRecord) token;
        if (r != null) {
            ServiceRecord.IntentBindRecord boundRecord = r.peekBinding(intent);
            if (boundRecord != null) {
                boundRecord.binder = service;
                for (IServiceConnection conn : boundRecord.connections) {
                    ComponentName component = ComponentUtils.toComponentName(r.serviceInfo);
                    connectService(conn, component, boundRecord);
                }
            }
        }
    }
}
 

import android.app.IServiceConnection; //导入依赖的package包/类
public static IServiceConnection getDelegate(Context context, ServiceConnection connection,int flags) {
    IServiceConnection sd = null;
    if (connection == null) {
        throw new IllegalArgumentException("connection is null");
    }
    try {
        Object activityThread = ActivityThread.currentActivityThread.call();
        Object loadApk = ContextImpl.mPackageInfo.get(VirtualCore.get().getContext());
        Handler handler = ActivityThread.getHandler.call(activityThread);
        sd = LoadedApk.getServiceDispatcher.call(loadApk, connection, context, handler, flags);
    } catch (Exception e) {
        Log.e("ConnectionDelegate", "getServiceDispatcher", e);
    }
    if (sd == null) {
        throw new RuntimeException("Not supported in system context");
    }
    return getDelegate(sd);
}
 

import android.app.IServiceConnection; //导入依赖的package包/类
@Override
public void publishService(IBinder token, Intent intent, IBinder service, int userId) {
    synchronized (this) {
        ServiceRecord r = (ServiceRecord) token;
        if (r != null) {
            ServiceRecord.IntentBindRecord boundRecord = r.peekBinding(intent);
            if (boundRecord != null) {
                boundRecord.binder = service;
                for (IServiceConnection conn : boundRecord.connections) {
                    ComponentName component = ComponentUtils.toComponentName(r.serviceInfo);
                    connectService(conn, component, boundRecord, false);
                }
            }
        }
    }
}
 

import android.app.IServiceConnection; //导入依赖的package包/类
@Override
public boolean unbindService(IServiceConnection conn) throws RemoteException {
    Log.e("BaseDelegateService","unbindService");
    Iterator iter = mActivateServices.entrySet().iterator();
    AdditionalServiceRecord record = null;
    while (iter.hasNext()) {
        Map.Entry<AdditionalServiceRecord,Service> entry = (Map.Entry<AdditionalServiceRecord,Service>) iter.next();
        AdditionalServiceRecord tmpRecord = entry.getKey();
        if(tmpRecord.activeConnections.contains(conn)){
            //service has created
            record = tmpRecord;
            break;
        }
    }
    if(record!=null){
        record.activeConnections.remove(conn);
        if(record.activeConnections.size()==0){
            if(!record.calledStart || (record.calledStart && record.delayStop)){
                //service can stop
                Service service = mActivateServices.remove(record);
                service.onDestroy();
                return true;
            }
        }
    }
    return false;
}
 

import android.app.IServiceConnection; //导入依赖的package包/类
public static ServiceConnectionDelegate getDelegate(IServiceConnection conn) {
    if(conn instanceof ServiceConnectionDelegate){
        return (ServiceConnectionDelegate)conn;
    }
    IBinder binder = conn.asBinder();
    ServiceConnectionDelegate delegate = DELEGATE_MAP.get(binder);
    if (delegate == null) {
        delegate = new ServiceConnectionDelegate(conn);
        DELEGATE_MAP.put(binder, delegate);
    }
    return delegate;
}
 

import android.app.IServiceConnection; //导入依赖的package包/类
public int bindService(IBinder caller, IBinder token, Intent service, String resolvedType, IServiceConnection connection, int flags, int userId) {
    try {
        return getService().bindService(caller, token, service, resolvedType, connection, flags, userId);
    } catch (RemoteException e) {
        return VirtualRuntime.crash(e);
    }
}
 

import android.app.IServiceConnection; //导入依赖的package包/类
public boolean unbindService(IServiceConnection connection) {
    try {
        return getService().unbindService(connection, VUserHandle.myUserId());
    } catch (RemoteException e) {
        return VirtualRuntime.crash(e);
    }
}
 

import android.app.IServiceConnection; //导入依赖的package包/类
private ServiceRecord findRecordLocked(IServiceConnection connection) {
    synchronized (mHistory) {
        for (ServiceRecord r : mHistory) {
            if (r.containConnection(connection)) {
                return r;
            }
        }
        return null;
    }
}
 

import android.app.IServiceConnection; //导入依赖的package包/类
private void connectService(IServiceConnection conn, ComponentName component, ServiceRecord.IntentBindRecord r) {
    try {
        BinderDelegateService delegateService = new BinderDelegateService(component, r.binder);
        conn.connected(component, delegateService);
    } catch (RemoteException e) {
        e.printStackTrace();
    }
}
 

import android.app.IServiceConnection; //导入依赖的package包/类
public boolean containConnection(IServiceConnection connection) {
	for (IntentBindRecord record : bindings) {
		if (record.containConnection(connection)) {
			return true;
		}
	}
	return false;
}
 

import android.app.IServiceConnection; //导入依赖的package包/类
void addToBoundIntent(Intent intent, IServiceConnection connection) {
	IntentBindRecord record = peekBinding(intent);
	if (record == null) {
		record = new IntentBindRecord();
		record.intent = intent;
		synchronized (bindings) {
			bindings.add(record);
		}
	}
	record.addConnection(connection);
}
 

import android.app.IServiceConnection; //导入依赖的package包/类
public void addConnection(IServiceConnection connection) {
	if (!containConnection(connection)) {
		connections.add(connection);
		try {
			connection.asBinder().linkToDeath(new DeathRecipient(this, connection), 0);
		} catch (RemoteException e) {
			e.printStackTrace();
		}
	}
}
 

import android.app.IServiceConnection; //导入依赖的package包/类
public void removeConnection(IServiceConnection connection) {
	synchronized (connections) {
		Iterator<IServiceConnection> iterator = connections.iterator();
		while (iterator.hasNext()) {
			IServiceConnection conn = iterator.next();
			if (conn.asBinder() == connection.asBinder()) {
				iterator.remove();
			}
		}
	}
}
 

import android.app.IServiceConnection; //导入依赖的package包/类
public int bindService(IApplicationThread caller, IBinder token, Intent service,
                       String resolvedType, IServiceConnection connection, int flags, String callingPackage,
                       int userId) throws TransactionTooLargeException {
    try {
        PreventRunningUtils.setSender(caller);
        if (PreventRunningUtils.hookBindService(caller, token, service)) {
            return bindService$Pr(caller, token, service,
                    resolvedType, connection, flags, callingPackage, userId);
        } else {
            return 0;
        }
    } finally {
        PreventRunningUtils.clearSender();
    }
}
 

import android.app.IServiceConnection; //导入依赖的package包/类
public static IServiceConnection removeDelegate(Context context, ServiceConnection conn) {
    IServiceConnection connection = null;
    try{
        Object loadApk = ContextImpl.mPackageInfo.get(VirtualCore.get().getContext());
        connection = LoadedApk.forgetServiceDispatcher.call(loadApk, context, conn);
    }catch (Exception e){
        Log.e("ConnectionDelegate", "forgetServiceDispatcher", e);
    }
    if(connection == null){
        return null;
    }
    return ServiceConnectionDelegate.removeDelegate(connection);
}
 

import android.app.IServiceConnection; //导入依赖的package包/类
public int bindService(Context context, Intent service, ServiceConnection connection, int flags) {
    try {
        IServiceConnection conn = ServiceConnectionDelegate.getDelegate(context, connection, flags);
        return getService().bindService(null, null, service, null, conn, flags, 0);
    } catch (RemoteException e) {
        return VirtualRuntime.crash(e);
    }
}
 

import android.app.IServiceConnection; //导入依赖的package包/类
public boolean unbindService(Context context, ServiceConnection connection) {
    try {
        IServiceConnection conn = ServiceConnectionDelegate.removeDelegate(context, connection);
        return getService().unbindService(conn, VUserHandle.myUserId());
    } catch (RemoteException e) {
        return VirtualRuntime.crash(e);
    }
}
 

import android.app.IServiceConnection; //导入依赖的package包/类
private void connectService(IServiceConnection conn, ComponentName component, ServiceRecord.IntentBindRecord r,boolean dead) {
    try {
        BinderDelegateService delegateService = new BinderDelegateService(component, r.binder);
        if (Build.VERSION.SDK_INT >= 26) {
            IServiceConnectionO.connected.call(conn, component, delegateService, dead);
        } else {
            conn.connected(component, delegateService);
        }
    } catch (RemoteException e) {
        e.printStackTrace();
    }
}