An overview of the

Accessibility Service is widely used in all kinds of automatic click apps. However, in the early days, it does not provide rich API and is highly constrained by controls, so the effect can be achieved is far from that of Instrumentation. The dispatchGesture API has been added to The AccessibilityService in Android 7.0, allowing developers to perform highly customized actions on the screen, such as clicking on any coordinates on the screen.

Internet has a lot of performAccessibilityAction related API source code analysis, but many people know little about dispatchGesture. So I analyze its call path a little bit for development and confrontation.

For each section of the source code, I will include links to the AOSP source code and screenshots of key code.

Source code analysis

Entrance function: AccessibilityService: : dispatchGesture (AccessibilityService. Java)

Call logic:

Connection is initialized here:

The dispatchGesture method calls the sendGesture method through Binder. The connection object defined in IAccessibilityServiceConnection. Aidl (IAccessibilityServiceConnection. Aidl).

Realize the stub class is AbstractAccessibilityServiceConnection (AbstractAccessibilityServiceConnection)

If you’re not familiar with Stub and AIDL, check out some Binder and Android IPC articles.

AbstractAccessibilityServiceConnection is an abstract class, its implementation in AccessibilityServiceConnection (AccessibilityServiceConnection). The implementation of the sendGesture method calls the InjectEvents method of the motionEventInject object

mSystemSupport

MSystemSupport initialization in AbstractAccessibilityServiceConnection constructor of a class: through an incoming object initialization.

As you can see, in the AccessibilityManagerService

SystemSupport
this
AccessibilityManagerService

Go back and look at the getMotionEventInjectorLocked method: it returns a member. This member was initialized in the AccessibilityInputFilter as commented by setMotionEventInjector.

See AccessibilityInputFilter (AccessibilityInputFilter. Java), and its initialization really is so simple, no additional pattern.

Back to MotionEventInjector: : injectEvents, its implementation is as follows: MotionEventInjector. Java

It calls a handler that is initialized in the constructor, and handler. callback is the class itself.

handleMessage

SendMotionEventToNext will pass the event to the next handler, but we can focus on injectEventsMainThread for now.

mHandler
handleMessage
sendMotionEventToNext

super.onMotionEvent
EventStreamTransformation
EventStreamTransformation.java

MotionEventInjector
AccessibilityInputFilter

If you look at the onMotionEvent method of AccessibilityInputFilter, you can see:

InputFilter
InputFilter
sendInputEvent

IInputFilterHost
IInputFilterHost.stub
InputManagerService
InputManagerService.java

From here on, the flow of event injection is the same as Instrumentation. Interested friends can go to read the article analysis of Instrumentation event injection source.