Android Virtualization Product Testing
Tags: android, virtualization, appclone, sandbox
Published: 2022-11-26 10:20:25

## Preface
Nowadays, android virtualization technology has become very popular. There have been a ton of online articles about the principles of virtualization. This article compares the differences between virtualization products from the perspective of real testing.

## Terminology

Abbr. | Full Name | Description
---|--- | ---
Host | Host | The original application, i.e. the application itself
Sub Applications | Sub Applications | The application being run
PMS | PackageManagerService | Package management services in Android
AMS | ActivityManagerService | Activity management services in Android
NMS | NotificationManagerService | Notification management service in Android

## How Virtualization Works？

There have been many similar articles on this issue online, here are a few to read
- https://juejin.cn/post/6964673582924300296
- https://blog.csdn.net/ganyao939543405/article/details/76146760
- https://juejin.cn/post/7028124957141893150

Through the principle analysis, we can see that to achieve virtualization of an application, the most important thing is:  ***when running sub-applications, deceive the system thereby making the system mistakenly believe that the application currently being run is the host application*** , otherwise the system will not hesitate to kill it!

## Entry points for testing

I plan to test the following key aspects of virtualization in order to compare the strengths and weaknesses of each framework.

The products involved in the comparison are:

Name | WebSite
---|---
VirtualApp | https://github.com/asLody/VirtualApp/blob/master/README_eng.md
LBE | http://parallelspace-app.com/index_cn.php
SpaceCore | https://spacecore.dev/
360 FenShenDaShi | http://fenshen.360.cn
ShuangKaiZhuShou | https://www.multiopen.cn/

Items for comparison:

Method | Expected Value
---|---
Context#mBasePackageName | Package name of the application
Context#mOpPackageName | Package name of the application
ActivityThread.H#mCallback | null
ActivityThread#mInstrumentation | android.app.Instrumentation
PMS testing | android.os.BinderProxy@xxxx

Package name of the sub-application for testing：com.virtualchecker

## Testing

#### ReadValue: Context#mBasePackageName
Product | Expected Value | Actual Value
---|--- | ---
Android System | com.virtualchecker | com.virtualchecker
VirtualApp| com.virtualchecker| ❌ io.busniess.va
LBE | com.virtualchecker| ❌ com.lbe.parallel.intl.arm64
SpaceCore | com.virtualchecker | ✅ com.virtualchecker
360 FenShenDaShi | com.virtualchecker | ✅ com.virtualchecker
ShuangKaiZhuShou | com.virtualchecker | ❌ com.exceliance.dualaid

#### ReadValue: Context#mOpPackageName
Product | Expected Value | Actual Value
---|--- | ---
Android System | com.virtualchecker | com.virtualchecker
VirtualApp| com.virtualchecker| ❌ io.busniess.va
LBE| com.virtualchecker| ❌ com.lbe.parallel.intl.arm64
SpaceCore | com.virtualchecker | ✅ com.virtualchecker
360 FenShenDaShi | com.virtualchecker | ✅ com.virtualchecker
ShuangKaiZhuShou | com.virtualchecker | ❌ com.exceliance.dualaid

#### ReadValue: ActivityThread#mInstrumentation
Product | Expected Value | Actual Value
---|--- | ---
Android System | android.app.Instrumentation@ | android.app.Instrumentation@bfcc1e8
VirtualApp| android.app.Instrumentation@| ❌ com.lody.virtual.client.h.a.c@fd146bf
LBE| android.app.Instrumentation@| ❌ com.doubleagent.client.e@a0aac44
SpaceCore | android.app.Instrumentation@ | ✅ android.app.Instrumentation@153bfc9
360 FenShenDaShi | android.app.Instrumentation@ | ❌ com.morgoo.droidplugin.hook.handle.PluginInstrumentation@8e8d100
ShuangKaiZhuShou | android.app.Instrumentation@ | ❌ com.exceliance.kxqp.platform.c.b.e.wy@38e16ce

#### ReadValue: ActivityThread.H#mCallback
Product | Expected Value | Actual Value
---|--- | ---
Android System | null | null
VirtualApp| null| ❌ com.lody.virtual.client.h.d.d.b@800e4de
LBE| null| ❌ com.lbe.doubleagent.client.LocalActivityService$ActivityThreadCallback@3f40957
SpaceCore | null | ❌ com.fvbox.lib.client.hook.HCallbackHook@aa9ba7e
360 FenShenDaShi | null | ❌ com.morgoo.droidplugin.hook.handle.e@91b7b06
ShuangKaiZhuShou | null | ❌ com.excelliance.kxqp.platform.c.b.e.wr@153bfc9

#### PMS Testing
Product | Expected Value | Actual Value
---|--- | ---
Android System | android.os.BinderProxy@ | android.os.BinderProxy@eff05b8
VirtualApp| android.os.BinderProxy@| ❌ com.lody.virtual.client.h.a.c@993b1e1
LBE| android.os.BinderProxy@| ❌ com.lbe.doubleagent.client.hook.BinderProxy@f54e1fe
SpaceCore | android.os.BinderProxy@ | ✅ android.os.BinderProxy@c846443
360 FenShenDaShi | android.os.BinderProxy@ | ❌ com.morgoo.droidplugin.hook.newsolution.BinderHook$BinderWrapper@cf8d1da
ShuangKaiZhuShou | android.os.BinderProxy@ | ✅ android.os.BinderProxy@eff05b8

### Testing Result

Product | mBasePackageName | mOpPackageName | mInstrumentation | PMS | H#mCallback
---|--- | ---| --- |--- | ---
VirtualApp | ❌ | ❌ | ❌ | ❌ | ❌
LBE  | ❌ | ❌ | ❌ | ❌ | ❌
SpaceCore | ✅ |   ✅ | ✅ | ✅  |❌
360 FenShenDaShi | ✅  | ✅  | ❌ | ❌  |❌
ShuangKaiZhuShou | ❌ | ❌ | ❌ | ✅ |❌


### Conclusion
The test above shows that SpaceCore's invasion of the application is more conservative, reflecting sideways that the internal processing logic is better, but the specific implementation details are unknown.


> Keywords：Android Virtualization, App Clone, VirtualApp, LBE, SpaceCore, 360 DroidPlugin, VMOS, Android Sandbox