22

As far as I know, apps can't get intents for their own uninstallation:

But how does Dolphin Browser manage to receive a "removed" event and start a browser as in the attached image?

enter image description here

ADB:
        10-20 12:37:00.997: D/BackupManagerService(527): Received broadcast Intent { act=android.intent.action.PACKAGE_REMOVED dat=package:mobi.mgeek.TunnyBrowser flg=0x8000010 (has extras) }
    10-20 12:37:00.997: V/BackupManagerService(527): removePackageParticipantsLocked: uid=10112 #1
    10-20 12:37:01.007: D/dalvikvm(527): GC_EXPLICIT freed 2247K, 12% free 20128K/22868K, paused 3ms+10ms, total 212ms
    10-20 12:37:01.107: D/dalvikvm(527): GC_FOR_ALLOC freed 1508K, 15% free 19649K/22868K, paused 60ms, total 60ms
    10-20 12:37:01.137: D/AndroidRuntime(4028): Calling main entry com.android.commands.am.Am
    10-20 12:37:01.137: D/dalvikvm(4028): Note: class Landroid/app/ActivityManagerNative; has 163 unimplemented (abstract) methods
    10-20 12:37:01.147: I/ActivityManager(527): START u0 {act=android.intent.action.VIEW dat=http://survey.dolphin.com/int/uninstall?id=014f4d1981d6f88bb56630e7a3a7550a&pn=mobi.mgeek.TunnyBrowser&v=248&s=ofw&it=1382250136565&ut=1382250127000&m=Nexus 4&os=android&osv=4.3&cc=US&no=40471&lang=en&jk=uninstalled&ft=212&ht=957&ct=0&nt=1&res=768*1184&ifi=1&lts=1&iow=0&iom=0&iospd=0&iogs=0&debug=false&t=1382252820000 flg=0x10000000 cmp=com.android.chrome/com.google.android.apps.chrome.Main} from pid 4028
    10-20 12:37:01.157: D/AndroidRuntime(4028): Shutting down VM
Community
  • 1
  • 1
NitZRobotKoder
  • 1,046
  • 8
  • 44
  • 74
  • maybe this help : http://stackoverflow.com/questions/7470314/receiving-package-install-and-uninstall-events – Arash GM Oct 20 '13 at 09:30
  • @Arash also found that. I think that happens because when you register in your own app and when the app is uninstalled, the registered BroadcastReceiver has been uninstalled before the app gets uninstalled,so its own uninstallation event won't be received by that BroadcastReceiver. – NitZRobotKoder Oct 20 '13 at 09:35
  • 7
    Presumably, they are exploiting some security hole. I will work to identify the hole and get it fixed. Thanks for pointing this out! – CommonsWare Oct 20 '13 at 10:48
  • 2
    @CommonsWare i've found out about it and asked how they do it, here: http://stackoverflow.com/questions/18440293/how-does-dolpin-web-browser-get-notified-when-its-being-uninstalled – android developer Oct 20 '13 at 15:18
  • @android developer @ CommonsWare FYI this is long waiting topic http://stackoverflow.com/questions/11062780/how-to-start-an-activity-or-service-before-an-app-application-is-uninstalled-by – NitZRobotKoder Oct 20 '13 at 16:27
  • @CommonsWare hmm, yes this is weird. i thought that maybe they read the log to check if the user is about to uninstall the app . but that's not the case. this happens on this app too. i wonder how it works. i happens even when i use ADB to uninstall the app. – android developer Oct 21 '13 at 06:38
  • 5
    I am happy to report that their technique no longer works as of Android 4.4. – CommonsWare Nov 09 '13 at 18:46
  • CommonsWare wheres the documentation it no longer works? – jcaruso Jan 14 '14 at 22:33
  • 1
    @CommonsWare it still works on 4.4.2 – alecnash Feb 04 '14 at 16:44
  • @alecnash: Dolphin must have been tweaked, as it definitely did not pop up the Web page back in November. I'll have to add this back onto my security flaw research list. Thanks for pointing this out! – CommonsWare Feb 04 '14 at 16:50
  • you can run a service that receive your application Remove and then On Receive you can do what do you want. – Mahdi Feb 22 '14 at 13:05
  • @CommonsWare more updates ,we need to run the Dolphin browser at least once to work on 4.4.2. – NitZRobotKoder Feb 24 '14 at 06:30
  • @NitZRobotKoder Did you found the answer to you question? it is something that I'm looking for too – Alex Opent Feb 21 '15 at 20:17
  • Possible duplicate of [How can an app detect that it's going to be uninstalled?](http://stackoverflow.com/questions/18692571/how-can-an-app-detect-that-its-going-to-be-uninstalled) – Dan Dascalescu Jan 22 '16 at 06:54
  • @CommonsWare you mentioned that they are using some security hole. Is there some documentation that shows Android is actively trying to close security holes and wants to prevent uninstall callbacks to apps? I installed, opened and uninstalled dolphin browser today and it did not open up any webpage after uninstall. Tested on Android 9 – Ajay Thomas Jan 28 '20 at 19:48
  • @AjayThomas: Um, https://source.android.com/security ? I don't really know what you are expecting in terms of documentation regarding security fixes. – CommonsWare Jan 28 '20 at 21:25

3 Answers3

8

Here is a way you can get uninstall event of your own app.

Using inotify in native code. For example: You can using inotify_add_watch to monitor your application's data cache folder like: /data/data/your-package-name/cache.
When your application gets uninstalled, you can get the folder's delete event.

Another key point is that inotify should run in a seperate process from your own application.
You can invoke fork() to do this.

I've already verified the logic. :)

S1LENT WARRIOR
  • 11,704
  • 4
  • 46
  • 60
aarontang
  • 229
  • 3
  • 7
  • Can you please provide some more information on how I can implement the inotify in native code? – Talihawk Apr 29 '14 at 13:51
  • @aarontang when we do uninstall will "inotify" code get executed first? inotify might watching our application's cache or data directory delete event and delete event only happen once android package uninstaller delete that cache/data directory. So which one get executed first? I want to update some values in database before it app uninstalled. – Satish Sojitra Sep 07 '17 at 09:09
3

This is a security issue in Andorid, which is already reported to Google Team and fixed in Android 4.4. Here is my explanation of how it can work.

Community
  • 1
  • 1
sergej shafarenka
  • 20,071
  • 7
  • 67
  • 86
-1

When the user go to app manager in phone setting, and click on your app, you receive a broadcast that contain your app name in extras, if the user click uninstall btn, the com.android.uninstaller.UnistallerActivity must be launched.

If you get an intent and your app name in extras, that mean that the user clicked on your app in "app manager", use PackageManager to start an activity watcher and get the top visible activity and his package, if the user click uninstall button you get UnistallerActivity as top activity there you can popup a survey on the web browser or do what do you want do there.

S1LENT WARRIOR
  • 11,704
  • 4
  • 46
  • 60
Smile2Life
  • 1,921
  • 3
  • 16
  • 30
  • 1
    have you tried the above code?"The registered BroadcastReceiver will been uninstalled before the app gets uninstalled,so its own uninstallation event won't be received by that BroadcastReceiver." – NitZRobotKoder Feb 22 '14 at 01:33
  • Every subscribed app will receive a broadcast that your app is being uninstalled, EXCEPT your own app. – Yurets Oct 20 '16 at 09:25