Android Q 集成百度定位分析

---

date : 2019 - 12 - 06
email: [email protected]
github: https://github.com/Jess-Pan

---

Android Q 系统集成百度定位流程分析

1. 需求文件

• 百度提供的文件
  • networklocation-xxx-releasee-xxx-signed.apk
  • libnlocSDK7d.so
  • BaiduNLPTestTool-debug.apk
• Android 系统
  • 安装有com.android.location.provider.jar

2. 功能实现

2.1 大致集成步骤

1. 在android框架中集成百度定位（配置frameworks/base/core/res/res/values/config.xml）
2. 将networklocation-xxx-releasee-xxx-signed.apk和libnlocSDK7d.so编入out/.../product/app下
3. 使用BaiduNLPTestTool-debug.apk进行系统网络定位测试

2.2 具体集成代码

2.2.1 配置android框架

frameworks/base/core/res/res/values/config.xml

false
true
com.baidu.map.location

true

    
    com.android.location.fused
    com.baidu.map.location>

2.2.2 集成百度系统定位apk

客制化文件夹路径

1. 将百度提供的networklocation-xxx-releasee-xxx-signed.apk和/so/libs/...下对应系统内核架构的so库放在客制化文件夹下
2. 创建Android.mk文件

LOCAL_PATH := $(my-dir)
# armeabi-v7a
my_archs := arm64 armeabi arm
my_src_arch := $(call get-prebuilt-src-arch, $(my_archs))

include $(CLEAR_VARS)
LOCAL_MODULE := NetworkLocationxxx
LOCAL_MODULE_TAGS := optional
LOCAL_SRC_FILES := ./networklocation-xxx-release-xxx-signed.apk
LOCAL_CERTIFICATE := PRESIGNED
LOCAL_SDK_VERSION := current
LOCCAL_MODULE_PATH := $(PRODUCT_OUT)/product/app
LOCAL_MODULE_CLASS := APPS
LOCAL_MODULE_SUFFIX := $(COMMON_ANDROID_PACKAGE_SUFFIX)
LOCAL_PRODUCT_MODULE := true
$(warning log:$(my_src_arch))
LOCAL_PREBUILT_JNI_LIBS := libs/$(my_src_arch)/libnlocSDK7d.so
LOCAL_MODULE_TARGET_ARCH := $(my_src_arch)
include $(BUILD_PREBUILT)

3. 在系统主make中将该目录包含进去

   PRODUCT_PACKAGES += NetworkLocationxxx
   

2.3 整编系统，测试相关功能

3. 具体分析

使用jadx工具对networklocation-xxx-releasee-xxx-signed.apk进行反编译后进行分析

3.1 有关隐藏桌面图标的问题

• 反编译后得到的清单文件

清单文件中没有android.intent.action.MAIN 和android.intent.category.LAUNCHER 这两个action，意味着程序只接受Intent启动，不会显示桌面图标（如果使用adb install 进行安装会显示默认图标）

3.2 有关应用权限和签名的问题

3.2.1 应用权限

• 百度将apk分为有弹窗授权类和无弹窗授权类两种，沟通时针对项目选择，选择不同的apk版本
• 应Google要求，厂商应用不再编入/system/app下，统一编入/product/app下

3.2.2 应用签名

• 使用apk本身的签名

3.3 有关系统定位广播和输出log的问题

12-05 22:17:16.118631 30105 30739 I System.out: [OkHttp] sendRequest>>
12-05 22:17:16.118902 30105 30739 I System.out: [OkHttp] sendRequest<<

12-05 22:17:16.129574  1858  1858 I NLP     : Location result:[location successful by Baidu], reason:[network location] locType=161

12-05 22:17:22.559460  1858  1916 D NLPLOC  : start network locating ...false  false
12-05 22:17:22.589600  1858  1916 D NLP_STA : network locating ...false  false
12-05 22:17:22.610570   966   984 D LocationManagerService: incoming location from: network

4. Android 系统有关定位信息调用关系

应用调用LocationManagerService

应用调用系统定位服务需要获取LocationManager来选择定位方式（网络定位、GPS定位、WIFI定位）

LocationManager locationManager = (LocationManager)getSystemService(LOCATION_SERVICE);
// NETWORK_PROVIDER, 使用网络定位
// 45000, 定位时间间隔,单位ms
locationManager.requestLocationUpdates(Location.NETWORK_PROVIDER, 45000, 0, locationListioner);

frameworks/base/location/java/android/location/LocationManager.java

public static final String NETWORK_PROVIDER = "network";

    private void requestLocationUpdates(LocationRequest request, LocationListener listener,
            Looper looper, PendingIntent intent) {

        String packageName = mContext.getPackageName();

        // 包装一个监听器
        ListenerTransport transport = wrapListener(listener, looper);

        try {
            // 实则调用mService.requestLocationUpdate(... ...)
            mService.requestLocationUpdates(request, transport, intent, packageName);
       } catch (RemoteException e) {
           throw e.rethrowFromSystemServer();
       }
    }

private final ILocationManager mService;

frameworks/base/location/java/android/location/ILocationManager.aidl

在这个接口中，有很多眼熟的方法

void requestLocationUpdates(in LocationRequest request, in ILocationListener listener,
                            in PendingIntent intent, String packageName);
void removeUpdates(in ILocationListener listener, in PendingIntent intent, String packageName);

void requestGeofence(in LocationRequest request, in Geofence geofence,
                     in PendingIntent intent, String packageName);
void removeGeofence(in Geofence fence, in PendingIntent intent, String packageName);

Location getLastLocation(in LocationRequest request, String packageName);

那么该aidl的具体实现是放在了LocationManagerService中

frameworks/base/services/core/java/com/android/server/LocationManagerService.java

首先可以看到LocationManagerService的构造函数

    public LocationManagerService(Context context) {
        super();
        mContext = context;
        mHandler = FgThread.getHandler();
        mLocationUsageLogger = new LocationUsageLogger();
        
        // 找到默认的系统服务提供者
        PackageManagerInternal packageManagerInternal = LocalServices.getService(
                PackageManagerInternal.class);
        // 这里指定了xml中配置好的百度Nlp系统定位apk包名
        packageManagerInternal.setLocationPackagesProvider(
                userId -> mContext.getResources().getStringArray(
                        com.android.internal.R.array.config_locationProviderPackageNames));
        packageManagerInternal.setLocationExtraPackagesProvider(
                userId -> mContext.getResources().getStringArray(
                      com.android.internal.R.array.config_locationExtraPackageNames));
        // 大多数启动推迟到systemRunning()
    }

String[] pkgs = resources.getStringArray(
                com.android.internal.R.array.config_locationProviderPackageNames);
... ...
// bind to network provider
        LocationProvider networkProviderManager = new LocationProvider(NETWORK_PROVIDER, true);
        LocationProviderProxy networkProvider = LocationProviderProxy.createAndBind(
                mContext,
                networkProviderManager,
                NETWORK_LOCATION_SERVICE_ACTION,
                com.android.internal.R.bool.config_enableNetworkLocationOverlay,
                com.android.internal.R.string.config_networkLocationProviderPackageName,
                com.android.internal.R.array.config_locationProviderPackageNames);
        if (networkProvider != null) {
            mRealProviders.add(networkProviderManager);
            addProviderLocked(networkProviderManager);
            networkProviderManager.attachLocked(networkProvider);
        } else {
            Slog.w(TAG, "no network location provider found");
        }

frameworks/base/services/core/java/com/android/server/location/ActivityRecognitionProxy.java

    public static ActivityRecognitionProxy createAndBind(
            Context context,
            boolean activityRecognitionHardwareIsSupported,
            ActivityRecognitionHardware activityRecognitionHardware,
            int overlaySwitchResId,
            int defaultServicePackageNameResId,
            int initialPackageNameResId) {
        ActivityRecognitionProxy activityRecognitionProxy = new ActivityRecognitionProxy(
                context,
                activityRecognitionHardwareIsSupported,
                activityRecognitionHardware,
                overlaySwitchResId,
                defaultServicePackageNameResId,
                initialPackageNameResId);

        if (activityRecognitionProxy.mServiceWatcher.start()) {
            return activityRecognitionProxy;
        } else {
            return null;
        }
    }

frameworks/base/services/core/java/com/android/server/location/ServiceWatcher.java

通过包名来绑定、解绑服务

    private void bind(ComponentName component, int version, int userId) {
        Preconditions.checkState(Looper.myLooper() == mHandler.getLooper());

        Intent intent = new Intent(mAction);
        intent.setComponent(component);

        mBestComponent = component;
        mBestVersion = version;
        mBestUserId = userId;

        if (D) Log.d(mTag, "binding " + component + " (v" + version + ") (u" + userId + ")");
        mContext.bindServiceAsUser(intent, this,
                Context.BIND_AUTO_CREATE | Context.BIND_NOT_FOREGROUND | Context.BIND_NOT_VISIBLE,
                UserHandle.of(userId));
    }

    private void unbind() {
        Preconditions.checkState(Looper.myLooper() == mHandler.getLooper());

        if (mBestComponent != null) {
            if (D) Log.d(mTag, "unbinding " + mBestComponent);
            mContext.unbindService(this);
        }

        mBestComponent = null;
        mBestVersion = Integer.MIN_VALUE;
        mBestUserId = UserHandle.USER_NULL;
    }

由此，系统应用可以通过调用ILocationManager.aidl中的方法，通过LocationManagerService进行定位。

LocationManagerService 调用 NLP

应用申明一个LocationManager 调用 ILocationManager中的方法，这个方法的具体实现放在了LocationManagerService中。LocationManagerService通过调用ILocationProvider.aidl来获取NLP的查询后的结果，而NLP实现的接口则为LocationProviderBase.java

frameworks/base/location/lib/java/com/android/location/provider/LocationProviderBase.java

在系统中打开定位

public void setEnabled(boolean enabled) {
        synchronized (mBinder) {
            if (mEnabled == enabled) {
                return;
            }

            mEnabled = enabled;
        }

        ILocationProviderManager manager = mManager;
        if (manager != null) {
            try {
                manager.onSetEnabled(mEnabled);
            } catch (RemoteException | RuntimeException e) {
                Log.w(mTag, e);
            }
        }
    }

查询位置

    protected abstract void onSetRequest(ProviderRequestUnbundled request, WorkSource source);

5. 测试要求

网络定位需要提前连接Wi-Fi或打开移动网络

• 使用BaiduNLPTestTool-debug.apk进行测试
• 使用内置应用进行测试（浏览器、相机等）
• 使用三方应用进行测试（百度地图、高德地图、QQ、微信、抖音等）