Android 无签名系统 debug 版本APK push到设备引起的开机异常问题分析（zygote进程）

问题背景

前置操作：

替换原system/priv-app 目录下已有的应用包未未签名的debug版本，然后重启。

现象：

无法正常开机，卡在开机动画，并且pm没有起来，因为执行adb install 命令是返回“cmd: Can't find service: package”。

应用信息：

跟Settings系统应用在同一进程。

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    coreApp="true"
    package="com.demo.unit"
    android:sharedUserId="android.uid.system">
    <uses-sdk android:minSdkVersion="28" />

日志分析

//按size值依次添加应用包

11-12 16:36:42.139 3310 3310 D PERF/BehaviorHuber: addPackage-> uid=10059, pkg=com.android.soundpicker, type=643777, size=143

11-12 16:36:42.140 3310 3310 D PERF/BehaviorHuber: addPackage-> uid=2000, pkg=com.android.shell, type=128001, size=144
11-12 16:36:42.144 3310 3310 D PERF/BehaviorHuber: addPackage-> uid=10078, pkg=com.google.android.tag, type=644995, size=146

很明显zygote进程都没跑起来

11-12 16:36:42.146 3310 3310 I PackageManager: /system/priv-app/DemoUnit changed; collecting certs
11-12 16:36:42.149 3310 3310 I Watchdog: Resuming HandlerChecker: main thread for reason: packagemanagermain. Pause count: 0
11-12 16:36:42.149 3310 3310 E System : ******************************************
11-12 16:36:42.149 3310 3310 E System : ************ Failure starting system services
11-12 16:36:42.149 3310 3310 E System : java.lang.IllegalStateException: Signature mismatch on system package com.demo.unit for shared user SharedUserSetting{73b98d7 android.uid.system/1000}
11-12 16:36:42.149 3310 3310 E System :    at com.android.server.pm.ReconcilePackageUtils.reconcilePackages(ReconcilePackageUtils.java:284)
11-12 16:36:42.149 3310 3310 E System :    at com.android.server.pm.InstallPackageHelper.addForInitLI(InstallPackageHelper.java:3988)
11-12 16:36:42.149 3310 3310 E System :    at com.android.server.pm.InstallPackageHelper.installPackagesFromDir(InstallPackageHelper.java:3797)
11-12 16:36:42.149 3310 3310 E System :    at com.android.server.pm.InitAppsHelper.scanDirTracedLI(InitAppsHelper.java:463)
11-12 16:36:42.149 3310 3310 E System :    at com.android.server.pm.InitAppsHelper.scanSystemDirs(InitAppsHelper.java:418)
11-12 16:36:42.149 3310 3310 E System :    at com.android.server.pm.InitAppsHelper.initSystemApps(InitAppsHelper.java:209)
11-12 16:36:42.149 3310 3310 E System :    at com.android.server.pm.PackageManagerService.<init>(PackageManagerService.java:2362)
11-12 16:36:42.149 3310 3310 E System :    at com.android.server.pm.PackageManagerService.main(PackageManagerService.java:1806)
11-12 16:36:42.149 3310 3310 E System :    at com.android.server.SystemServer.startBootstrapServices(SystemServer.java:1366)
11-12 16:36:42.149 3310 3310 E System :    at com.android.server.SystemServer.run(SystemServer.java:983)
11-12 16:36:42.149 3310 3310 E System :    at com.android.server.SystemServer.main(SystemServer.java:685)
11-12 16:36:42.149 3310 3310 E System :    at java.lang.reflect.Method.invoke(Native Method)
11-12 16:36:42.149 3310 3310 E System :    at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:617)
11-12 16:36:42.149 3310 3310 E System :    at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:980)
11-12 16:36:42.149 3310 3310 V SystemServerTiming: StartPackageManagerService took to complete: 784ms
11-12 16:36:42.150 3310 3310 E Zygote : System zygote died with fatal exception
11-12 16:36:42.150 3310 3310 E Zygote : java.lang.IllegalStateException: Signature mismatch on system package com.demo.unit for shared user SharedUserSetting{73b98d7 android.uid.system/1000}
11-12 16:36:42.150 3310 3310 E Zygote :    at com.android.server.pm.ReconcilePackageUtils.reconcilePackages(ReconcilePackageUtils.java:284)
11-12 16:36:42.150 3310 3310 E Zygote :    at com.android.server.pm.InstallPackageHelper.addForInitLI(InstallPackageHelper.java:3988)
11-12 16:36:42.150 3310 3310 E Zygote :    at com.android.server.pm.InstallPackageHelper.installPackagesFromDir(InstallPackageHelper.java:3797)
11-12 16:36:42.150 3310 3310 E Zygote :    at com.android.server.pm.InitAppsHelper.scanDirTracedLI(InitAppsHelper.java:463)
11-12 16:36:42.150 3310 3310 E Zygote :    at com.android.server.pm.InitAppsHelper.scanSystemDirs(InitAppsHelper.java:418)
11-12 16:36:42.150 3310 3310 E Zygote :    at com.android.server.pm.InitAppsHelper.initSystemApps(InitAppsHelper.java:209)
11-12 16:36:42.150 3310 3310 E Zygote :    at com.android.server.pm.PackageManagerService.<init>(PackageManagerService.java:2362)
11-12 16:36:42.150 3310 3310 E Zygote :    at com.android.server.pm.PackageManagerService.main(PackageManagerService.java:1806)
11-12 16:36:42.150 3310 3310 E Zygote :    at com.android.server.SystemServer.startBootstrapServices(SystemServer.java:1366)
11-12 16:36:42.150 3310 3310 E Zygote :    at com.android.server.SystemServer.run(SystemServer.java:983)
11-12 16:36:42.150 3310 3310 E Zygote :    at com.android.server.SystemServer.main(SystemServer.java:685)
11-12 16:36:42.150 3310 3310 E Zygote :    at java.lang.reflect.Method.invoke(Native Method)
11-12 16:36:42.150 3310 3310 E Zygote :    at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:617)
11-12 16:36:42.150 3310 3310 E Zygote :    at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:980)
11-12 16:36:42.150 3310 3310 D AndroidRuntime: Shutting down VM
--------- beginning of crash
11-12 16:36:42.150 3310 3310 E AndroidRuntime: *** FATAL EXCEPTION IN SYSTEM PROCESS: main
11-12 16:36:42.150 3310 3310 E AndroidRuntime: java.lang.IllegalStateException: Signature mismatch on system package com.demo.unit for shared user SharedUserSetting{73b98d7 android.uid.system/1000}
11-12 16:36:42.150 3310 3310 E AndroidRuntime:    at com.android.server.pm.ReconcilePackageUtils.reconcilePackages(ReconcilePackageUtils.java:284)
11-12 16:36:42.150 3310 3310 E AndroidRuntime:    at com.android.server.pm.InstallPackageHelper.addForInitLI(InstallPackageHelper.java:3988)
11-12 16:36:42.150 3310 3310 E AndroidRuntime:    at com.android.server.pm.InstallPackageHelper.installPackagesFromDir(InstallPackageHelper.java:3797)
11-12 16:36:42.150 3310 3310 E AndroidRuntime:    at com.android.server.pm.InitAppsHelper.scanDirTracedLI(InitAppsHelper.java:463)
11-12 16:36:42.150 3310 3310 E AndroidRuntime:    at com.android.server.pm.InitAppsHelper.scanSystemDirs(InitAppsHelper.java:418)
11-12 16:36:42.150 3310 3310 E AndroidRuntime:    at com.android.server.pm.InitAppsHelper.initSystemApps(InitAppsHelper.java:209)
11-12 16:36:42.150 3310 3310 E AndroidRuntime:    at com.android.server.pm.PackageManagerService.<init>(PackageManagerService.java:2362)
11-12 16:36:42.150 3310 3310 E AndroidRuntime:    at com.android.server.pm.PackageManagerService.main(PackageManagerService.java:1806)
11-12 16:36:42.150 3310 3310 E AndroidRuntime:    at com.android.server.SystemServer.startBootstrapServices(SystemServer.java:1366)
11-12 16:36:42.150 3310 3310 E AndroidRuntime:    at com.android.server.SystemServer.run(SystemServer.java:983)
11-12 16:36:42.150 3310 3310 E AndroidRuntime:    at com.android.server.SystemServer.main(SystemServer.java:685)
11-12 16:36:42.150 3310 3310 E AndroidRuntime:    at java.lang.reflect.Method.invoke(Native Method)
11-12 16:36:42.150 3310 3310 E AndroidRuntime:    at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:617)
11-12 16:36:42.150 3310 3310 E AndroidRuntime:    at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:980)
11-12 16:36:42.152 3310 3310 E AndroidRuntime: Error reporting crash
11-12 16:36:42.152 3310 3310 E AndroidRuntime: java.lang.NullPointerException: Attempt to invoke interface method 'void android.app.IActivityManager.handleApplicationCrash(android.os.IBinder, android.app.ApplicationErrorReport$ParcelableCrashInfo)' on a null object reference
11-12 16:36:42.152 3310 3310 E AndroidRuntime:    at com.android.internal.os.RuntimeInit$KillApplicationHandler.uncaughtException(RuntimeInit.java:207)
11-12 16:36:42.152 3310 3310 E AndroidRuntime:    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1071)
11-12 16:36:42.152 3310 3310 E AndroidRuntime:    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1066)
11-12 16:36:42.152 3310 3310 E AndroidRuntime:    at java.lang.Thread.dispatchUncaughtException(Thread.java:2306)
11-12 16:36:42.152 3310 3310 I Process : Sending signal. PID: 3310 SIG: 9
11-12 16:36:42.188 3129 3129 E Zygote : Zygote failed to write to system_server FD: Connection refused
11-12 16:36:42.188 3129 3129 I Zygote : Process 3310 exited due to signal 9 (Killed)
11-12 16:36:42.188 3129 3129 W libc : Access denied finding property "ro.vendor.iqi"
11-12 16:36:42.188 3129 3129 D Zygote : IQI Zygote false
11-12 16:36:42.188 3129 3129 E Zygote : Exit zygote because system server (pid 3310) has terminated
11-12 16:36:42.229 3133 3133 D DeviceHAL: closeOutputStream mOpenedStreamsCount 5
11-12 16:36:42.229 3133 3142 D DeviceHAL: ~Device ++, doClose()
11-12 16:36:42.229 3133 3142 D DeviceHAL: doClose mIsClosed 0, mOpenedStreamsCount 0
11-12 16:36:42.229 3133 3133 D AudioALSAStreamManager: +closeOutputStream(), out = 0xb40000713de38100, mStreamOutVector.size() = 5
11-12 16:36:42.229 3133 3142 I r_submix: adev_close()
11-12 16:36:42.229 3133 3142 D DeviceHAL: ~Device --
11-12 16:36:42.229 3133 3141 D DeviceHAL: closeOutputStream mOpenedStreamsCount 5

参考资料

The Android Boot Processhttps://copperhead.co/blog/android-boot-process/

1. Boot ROM code execution

2. The bootloader

3. The Linux kernel

4. The ‘Init’ process

5. Zygote and Dalvik VM

6. The System Server and Managers

Zygote launches the system services and forks a new process to launch.