2

Reversing some Android malware I see that it sets android:priority to 10000 in the AndroidManifest.xml file. Looking at the Android Documentation I see that it needs a value > -1000 and < 1000.

How does this work? Is 10000 a valid priority value? Are there legitimate applications that use that priority value?

1 Answers1

1

The Android documentation does, indeed, specify SYSTEM_HIGH_PRIORITY = 1000 and SYSTEM_LOW_PRIORITY = -1000. Those are guidelines, though: the IntentFilter source code doesn't actually check the priority. This means the actual range is from -2,147,483,648 to 2,147,483,647. By using a very high value the malware can guarantee to run its receiver before any other. Since it doesn't follow the guidelines, it shouldn't be used in production/not malicious code.

Andrea Biondo
  • 430
  • 2
  • 8
  • I've seen more then a few apps that use MAX_INT (2,147,483,647) for the priority of an IntentFilter that weren't considered malware. This use to be used a lot by SMS apps for receiving SMS because you wanted to be able to abort() the broadcast of the SMS to the other apps so that the given app was the only app that got the SMS, but that has gone away mostly with Android L and the Default SMS App feature. – DataDino Sep 08 '16 at 01:18
  • @DataDino Yes, that's true. I wasn't saying that using MAX_INT is only done by malware, I was pointing out the reason why the malware is using it. It's still an hack though, and should be avoided if other options exist (for example, it won't work if two SMS apps use this trick - the one installed first will get it because same-priority receivers are handled in that order). – Andrea Biondo Sep 08 '16 at 18:55