I. Overview
AndroidWe will examine the different layers of the Android operating system, which is based on Linux and Java. These layers include the Linux Kernel, the Hardware Abstraction Layer (HAL), Native C/C++ Libraries, the Android Runtime, the Java API Framework, and System Apps. We will explore the role and functionality of each layer. Linux KernelIt manages and controls the entire system, including hardware, network, and file system access. HALIt provides a standard interface for device hardware functions through the Java API framework. Native C/C++ LibrariesIt allows users to utilize technologies such as FreeFont (font), Webkit (browser engine), Media (codec), and SQLite (lightweight database). Android RuntimeThis allows the operating system to run Android applications. Java API FrameworkIt includes components such as the Activity Manager (for telephony, resource management, and notifications), Content Providers, and the View System, and provides an interface for hardware control. Application LayerThese are divided into system applications and user applications. System applications, which can be managed with the highest level of user permissions (root access), include applications like phone and messaging. User applications, which can be managed by regular users, include applications like KakaoTalk and Naver.
II. Android
Linux Kernel and Hardware Abstraction Layer (HAL)
AndroidIt is an operating system designed for mobile devices. Based on the Linux kernel, it recently supports application development using Java, and also Kotlin. It also allows for development using C and C++ on Android through the Native Development Kit.
Android typically follows this structure, as shown below Linux Kernel LayersLet's start by examining it. As an operating system (OS) developed based on the Linux kernel, the kernel, like other operating systems, It manages and controls the entire system, including hardware, network, and file system access. The software includes advanced security settings, memory management, power management, network system management, and device driver management (including Bluetooth devices, network devices, batteries, AP chips, and various sensors). Following that, HAL (Hardware Abstraction Layer)This is the case. HAL stands for Hardware Abstraction Layer, which refers to a layer that allows access to hardware components. In Windows, hardware is accessed through various API interfaces. In Android, the device's hardware functions are accessed through a standard interface provided by the Java API framework. As shown in the image above, This includes features that enable audio functionality, as well as modules for specific types of hardware components such as Bluetooth, camera, and sensors.
※ While most Android devices use CPUs based on RISC architecture, there are also Android devices that use Intel-based CPUs. For more detailed information about CPUs, please refer to the article below.
[SK Hynix SeSAC, Dong-Seoul Branch 1] CPU Architecture, Memory Architecture
2. Native C/C++ Libraries and ART (Android Runtime)
Next, Native C/C++ Libraries LayerThis layer includes the Android Native Development Kit (NDK), which was briefly mentioned earlier. The Android NDK allows for the development of apps using C or C++, and, as a library, provides access to resources such as FreeFont (fonts), Webkit (browser engine), Media (codecs), and SQLite (lightweight database). The layer directly adjacent to the native layer in the image is Android Runtime LayerThis allows the operating system to run multiple Android applications. It was previously known as Dalvik, but is now ART (Android Runtime)This process, often referred to as "DEX conversion," involves converting the bytecode generated during the Java compilation process into the DEX format, then packaging it as an APK file, allowing it to be executed. However, this explanation might be confusing. Let's explore how Java is compiled and executed.
2-1. JVM (Java Virtual Machine) and DVM (Dalvik Virtual Machine)
After developing in Java, the Java compiler creates Java bytecode based on the class. With this, Java Virtual MachineThis program can be executed, and the file that allows it to run is a JAR file, which is in Java bytecode format. To illustrate this further,
If a program developed in Java, as shown in the image, is converted to ByteCode through a compiler, and this ByteCode becomes a standard Java program JAR file, then The Android application is initially compiled into Dalvik ByteCode (.dex) and then converted into an APK file. The converted JAR and APK files are JVM (Java Virtual Machine)Egg ART (Android Runtime)This allows users to experience the application in a way that mirrors how they would actually use the Naver Maps app to find places they want to visit.
※ The JVM (Java Virtual Machine) operates between the shell and user programs (applications). For Android, it is known as the Dalvik Virtual Machine and is cross-compiled. Cross-compilationIt can create an application that compiles Java code on platform A and runs on platform B. Think of it as being able to compile on Linux and run on Android. While the JVM itself can run on any operating system, it has some drawbacks, especially when running on Android, where it needs to be lighter and cross-compiled. Dalvik ByteCode (specifically, the classes.dex file)This involves running the application on the Dalvik Virtual Machine.
Let's first understand JVM and DVM more precisely. JVM stands for Java Virtual Machine, which is used to execute Java bytecode. Java Virtual MachineIt is a tool for running Android applications. Dalvik virtual machineIt is platform-dependent. In other words,
The JVM differs depending on the operating system. However, The compiled Java bytecode (in JAR format) can be executed on any JVM. The Dalvik virtual machine is designed to run efficiently on mobile devices, with limitations in memory due to factors like battery life and performance constraints. Both of these virtual machines are based on Java. If you write code in Java, you'll be able to view the .java files, which contain the Java source code. The .class files contain the Java bytecode. The Dalvik virtual machine converts the .class file into a format that can be executed as a DEX file. Another notable feature is
JVM stands for StackWhile based on [original concept], DVM is RegisterIt is based on this. Therefore, during the calculation process, the JVM uses operators similar to PUSH and POP, which were briefly encountered in the assembly language previously. In contrast, DVM uses operands that are stored, so it operates with simpler commands without PUSH and POP, resulting in fewer commands but longer code. Similar to how assembly language allows humans to somewhat understand machine code, it is possible to decompile DEX in Android and verify it as Smali code (Android DEX assembly language).
※ For reference, Windows also operates on a stack-based system.
2-2. ART (Android Runtime), APK (Android Package Kit), and DEX (Dalvik Executable)
ART has been modified by Google to improve performance in DVM. DVM's Just-In-Time (JIT) compilation processfor AOT (Ahead-of-Time) compilation processHowever, both processes are currently in use, and AOT compilation is Garbage CollectionThis has been improved. Let's take a closer look at JIT (Just In Time). JIT is Dynamic TranslationIt is also referred to as "machine translation at the initial app launch." Instead, Due to the increased hardware load, it can negatively impact battery life and other factors (such as the CPU), and also lead to slower performance. However, it has a small capacity and fast installation speed. AOT (Ahead of Time) is Compilation is performed at the time of installation. This reduces power consumption and can improve performance by up to twice. However, they have a larger size and slower installation speed. Despite this, they offer faster execution speeds and reduce hardware usage (battery, CPU). Since Android 7.0 (Nougat) in 2016, ART has been using both JIT and AOT compilation. During installation, JIT is used, but AOT is applied flexibly depending on the situation.
APK is a file format used for distributing applications on Android. A file distributed in a program format.It is a ZIP archive format, an extension of the Java program format. The APK package file is installed in the directories /data/app/package_name and /data/data/package_name. DEX is Dalvik ExecutableIt is a collection of class files written in Java.
You'll likely find it easier to understand this if you look at the image. Java source code is first compiled into classes, and these classes are then combined to create a file called Classes.dex, which is then executed by the Dalvik Virtual Machine (DVM).
※ As mentioned in the previous post, Windows utilizes a PE (Portable Executable) structure. This structure allows Windows to optimize performance through a feature called Prefetch, which targets files with the ".pf" extension. Applying this optimization after the first use can result in faster execution later. You can view various ".pf" files by installing and opening the "WinPrefetchView" program, as different programs may have different paths for these files. In essence, as described above, Android's DEX (Dalvik Executable) is responsible for application optimization. However, it's important to note that Android's pathing can differ.
View the contents of Windows Prefetch (.pf) files
3. Java API Framework and Application Layer
I've retrieved the image of the Android layer structure again from the top (since I've already retrieved it from there). Java API FrameworkAs briefly mentioned above, this is within the HAL layer. Refer to the framework for using the interface to enable hardware functionality.As stated, various features of the Android OS are accessible through this API. These include the Activity Manager (for Telephony, Resources, Notifications, etc.), Content Providers, and the View System. I believe that when discussing application-level components, we will delve into these aspects in more detail.
Application LayerThese are divided into system applications and user applications. System applications reside in the /system directory and are not modifiable or controllable by users. When considering Android phones, think of the pre-installed apps (like phone, messaging, etc.). User applications reside in the /data directory and can be modified or deleted by users. Each application... SandboxThese are installed separately and cannot directly affect or communicate with each other. Access is only granted to resources that have the necessary permissions for each application, such as KakaoTalk and Naver, which are considered user applications. Thinking about our use of apps and granting permissions as part of a sandbox environment helps to understand this concept.
※ Let's elaborate a bit on the concept of a sandbox: It's essentially a restricted area, a space that is off-limits to everyone. Each application A separate spaceIt's natural for this to run within the sandbox, and furthermore, it should be contained within it. It cannot reduce the impact on other applications either. The user app functions with standard user permissions, while system apps can only be controlled or modified with administrator privileges. Similarly, apps protected by a sandbox can also be bypassed with administrator privileges. This bypass of the sandbox protection is what Android users often refer to as "rooting." Rooting essentially allows a user to gain administrator privileges, similar to how programs can be modified in Linux using `setuid` and `setgid`. In essence, rooting involves modifying the program's ownership, which can compromise the security of the Linux kernel (if you've ever used the `sudo su` command in Linux, you know what `su` means: "switch user").
Let's delve a bit deeper into sandboxing and rooting:
Like all security features, application sandboxes are also not foolproof. However, to bypass the sandbox on a properly configured device, one must compromise the security of the Linux kernel.
Even on Android, which is based on Linux, root access grants the ability to perform any task. Top-tier user levelThis is because only a few essential utilities can be run with root privileges, but once you root your Android device, you can use any app with root privileges. In reality, the manufacturer can be considered the owner of the phone we purchase. Although we are the owners physically, we don't have root privileges. However, the reason for rooting varies depending on the user's goals. This is to completely control the device. The purpose might be to personalize your phone with a more beautiful theme, to use apps that can only be installed through rooting, or for studying or working in the fields of development or security. However, this also means DisadvantagesHowever, there are also The device's security is compromised, making it vulnerable to malicious apps.Contact information, messages, and other data that have been compromised and should have originally been protected by a sandbox. Other apps infiltrating and performing additional actions (such as extracting information).This is possible, or if the device is damaged. No longer usable or warranty void.However, it may not be possible to repair it.
※ iPhones are designed from the beginning to be used with root user privileges. In fact, iPhones are also based on Linux. Similarly, they are configured to prevent other apps from accessing them, and rooting an iPhone... Breaking out of prisonThis is known as code signing. The reason why iPhones are considered to have better security is due to this feature. Code signing involves adding a digital signature to the application, which can be verified using a certificate. Establish a trusting relationship. However, Android allows developers to sign their apps, while on iPhones, Apple handles the signing process within the App Store. This means that only apps that have been officially signed by Apple can be used. Therefore, it is considered to have better security. While there are many APK files available online for Android, iPhones don't have the same situation.
3-1. Application Components (Activity, Service, Broadcast Receiver, Content Provider)
Application components (app components)These are essential components that every Android application must have, each functioning independently to fulfill specific roles. There are a total of four components, which determine how the system or user can access the application. Entry pointFirst, ActivityThe activity serves as the primary point of interaction between the user and the system. User Interface (UI)You can interpret it that way. ServiceThis is a versatile entry point for keeping an app running in the background. By "background," we mean a series of processes that can occur even when the app is not actively running, such as playing music, allowing time to pass, downloading or copying large files, or communicating over a network. In other words, when we control a program on Windows using keyboard or mouse input, this is considered "foreground." Conversely, in Android, controlling an app by simply activating the screen and directly touching it is considered "foreground." However, the background should be able to operate independently without direct control. The background does not provide a user interface.
※ The concepts of foreground and background apply to all operating systems.
Broadcast ReceiverThis component enables the system to regularly transmit events to the app. User flow (a non-blocking data stream, meaning a continuous exchange of data) Most broadcasts are initiated by the system, such as when the screen is turned off, the battery is low, or a photo is taken. Even regular apps can use broadcasts to display notifications in the status bar.
※ The "Boot Complete" component in a broadcast receiver functions similarly to the Windows startup program. If malware is registered in this "Boot Complete" component, it can cause the phone to continue running even after being turned off and on.
Finally, Content ProviderIt manages a shared collection of app data within a persistent data storage, such as a file system or SQLite. This shared collection of app data is accessible to web applications and other user apps. For example, a content provider can manage user contact information, and through this, other user apps can also provide functionality related to contact information.
※ While it's beneficial to understand Intents within components, an Intent is a messaging object that can be used to request a specific task from another app component. In other words, Intents are used for communication between different apps or within the same app. For example, if you want to display a screen, you would use an Activity component. If you want a component to run in the background, you would use a Service component. And to send a message to broadcast to other components, you would use a Broadcast Receiver component.
III. Key Takeaways from Expanding the Network
It's best to consider this as a helpful tip. The communication network is based on a national infrastructure, and telecommunication companies use it. To maintain anonymity, individuals can bypass the standard networking process by using tools like proxies, VPNs, and SNI. Typically, data travels through multiple routers from the origin to the destination (this technology originated in the military). ProxyIt essentially acts as an intermediary, carrying out the typical networking process that I just described on my behalf. This means that the Source IP address appears as if it's coming from the proxy server, while the proxy server itself is typically located outside of the server providing the service. VPN (Virtual Private Network)It appears as though I'm starting from an external virtual computer, but I actually travel to my destination through this virtual computer. In other words, my real IP address is hidden by this virtual computer. When using a VPN service, the source IP address becomes that of the VPN provider's virtual computer. SNI (Server Name Indication)This is a method used by Internet Service Providers (ISPs) to filter information about websites and block access to potentially harmful sites. In Korea, this would be similar to SKT, KT, and LG. Therefore, our network activity is actually being monitored to some extent. When a regular user attempts to access a website designated as harmful by the government using HTTP (port 80) or HTTPS (encrypted port 443), the access is blocked. Essentially, this filtering occurs at an intermediate point, before the data reaches the user's device. The source IP address remains unchanged.
※ Please avoid accessing dangerous websites (or... ).
Review
Today marks the final week of the introductory course. We started with the basics of mobile technology, and it's been really interesting to see how much we're covering. However, I'm also a bit concerned that the workload is increasing. From tomorrow, we'll be focusing on practical exercises, and I'm a little worried about whether I can keep up, but I'm also really looking forward to it. 😁