What's Inside Google Android?

Linux, Java, and a few more surprises. See what's under the hood of Google's upcoming mobile platform.



Android is Google's foray into the handheld OS realm. It follows a path trodden by -- among others -- Symbian's Quartz, the SavaJe operating system, and J2ME. In fact, one of Android's stated goals is to overcome some of J2ME's shortcomings. Whether or not Android succeeds, either at that specific goal, or in general, remains to be seen.

This article addresses a specific question: What is it like to work with the Android SDK? And to a lesser extent: What is under the Android hood? As these questions are answered, bear in mind that the version of the Android SDK I used was not in final form. Some of the problems described may have -- in fact, I hope will have -- been corrected by the time you read this. In addition, while Android development is supported on Linux, Mac OS X, and Windows, I did all my testing on Windows systems.
Inside an Android

Peel away Android's carapace, dig down to its marrow, and you'll find a Linux kernel. Libraries are a layer above, a variety of frameworks above that, and a final layer of applications sits on the top. The library layer is home to code for entities such as media processors for playback and recording of audio and video, the core of the Web browser, font rendering, and the SQLite relational database engine. The Android runtime also lives in the library layer.

Above the libraries reside frameworks, which are sets of reusable services and common components available to applications. For example, one sort of framework is a content provider, which is any service that handles the storage and retrieval of data. The application interface into the SQLite engine is a specific instance of a content provider.

Applications run at the top of the OS stack. Android will ship (assuming that it eventually does ship) with a set of core applications, including an e-mail client, a calendar, a Web browser, and more. And, of course, it is toward this topmost layer that all of the faculties of the Android SDK are directed.

When a developer writes an Android application, that developer codes in Java. The Java source is compiled to Java bytecodes, but -- to execute the application on Android -- the developer must execute a tool called dx. This tool converts Java bytecode to what is referred to as dex bytecodes. "Dex" is short for "Dalvik executable," Dalvik being the virtual machine that actually executes Android applications.

From a developer's perspective, Dalvik looks like a Java Virtual Machine, but strictly speaking, Dalvik is not a JVM. As stated above, Dalvik executes dex bytecode, not Java bytecode. And there are differences in the structure of Dalvik class files as compared to Java class files. Nevertheless, for all intents and purposes, building an Android application is really an exercise in building a peculiar sort of Java application.
The Android SDK

The Europa version of Eclipse is the preferred development platform for Android applications. In addition, you need at least a JDK 5 or JDK 6 installation to use the Android tools (the JRE that Eclipse typically installs is insufficient). Instructions on the Android site walk you through installing the Android Development Tools plug-in for Eclipse, and verifying the installation's correct operation by guiding you through the creation and execution of a quintessential "hello world" application.

However, you are not tied to Eclipse as your Android development system. The Android SDK does provide tools that let you use other IDEs in place of Eclipse. For example, the IntelliJ IDE is mentioned specifically in the Android documentation.

Hard-core developers will be satisfied to work solely with the collection of command-line tools that come with the SDK. For example, the activityCreator tool -- which is provided as a batch file for Windows, and as a Python script for Mac and Linux users -- will construct the framework for an Android Activity. (Activity is the Android equivalent of an application; more on this later.) Executing activityCreator will build skeletal Java files, create the Android project's required subdirectories, and build the necessary manifest XML files. The tool also creates an Ant script file for compiling the source and building the application. Once built, the application can be launched via the SDK's adb tool, the Android debug bridge.

Other command-line tools in the SDK include logcat, which outputs a log of system messages. Thanks to the stack trace provided by logcat, it is useful whenever an error occurs on the Android emulator. If you need deep analysis of what is going on in errant code, you can import a special Debug class into your application. This class provides methods for starting and stopping execution traces. When activated, Debug will log method calls to a trace file, which can be examined later with the toolkit's TraceView application. From within TraceView, you can view thread interactions, as well as examine execution paths. TraceView also shows the amount of time spent in each method, so you can use the tool as an execution profiler.

Finally, there is the Android emulator itself. When started, the emulator displays the skin of a hypothetical android device, complete with specialized faceplate buttons and QWERTY keyboard. It does its best to mimic an actual device, though there are understandable limitations (it cannot, for example, take incoming phone calls). The Android emulator runs a modified version of Fabrice Bellard's excellent open source simulation/virtualization environment, QEMU. Android's version of QEMU simulates an ARM processor, and on that processor executes the Linux OS.
Working with Eclipse

Once the Android Eclipse plug-in is installed, building an Android application is much like building any other application. The plug-in adds an Android Activity project to Eclipse's project templates tree. Start a new project, and the plug-in builds the foundational Java files, creates the necessary folders, and constructs skeletal resource files.

The Eclipse plug-in handles compilation, conversion to dex, launching the emulator, and downloading the application. Because writing Android code is writing Java code, the editor behaves as it would were you constructing an ordinary Java application. Resource files, which are written in XML, are easily managed by XML editors already available in Eclipse. Debugging is likewise supported from within Eclipse, and Android opens a debug perspective that anyone already familiar with Eclipse will be comfortable with.

Unfortunately, Android introduces a whole new lingo for developers to memorize. Roughly speaking, an application is an Activity. (The current documentation is only marginally helpful on this point, describing an Activity as "a single focused thing that a user can do.") Within an activity, you define one or more views. A view -- realized via the View class -- corresponds to an area on the screen, and manages the drawing and event trapping of its associated area. (So, for Java developers, a View is roughly equivalent to a Canvas.) Event handling is governed by the Intent class, which models an activity's intention to handle events of a given kind.

In short, be prepared to spend some time in the documentation matching what you already understand about GUI application development with the corresponding elements as Android calls them. The documentation is reasonably good on this matter. Nevertheless, as is typical, I found the provided example code to be far more useful.

Just before I began testing the Android SDK in mid-February, a new SDK was released (m5-rc14, to be exact). I installed that SDK (and Eclipse plug-in) on a 1GHz, 1GB Windows XP system. Though installation went smoothly, the emulator took on the order of 30 minutes to complete its boot process when an Activity was launched from within Eclipse. Other users on the Android message boards reported similar behavior, though the problem was by no means universal. The solution appeared to be faster hardware. Luckily, I had a more powerful machine on hand: a 3GHz processor with 2GB of RAM (running Windows 2000). I reinstalled Eclipse and the Android SDK on this faster system, and -- sure enough -- the emulator was up and running my trial application in about 30 seconds after the launch from Eclipse.

Now, 30 seconds -- though worlds better than 30 minutes -- is by no means a comfortable launch latency, particularly if you're stuck in a heavy execute-crash-debug-fix-execute cycle. And I'm not certain that delay can be reduced appreciably. Remember, when you start the emulator, you're starting the QEMU environment, followed by a booting of the Linux kernel, which has to fire up all the framework services. In other words, a lot has to happen just to get to the first bytecode of your target application.
Android on the March

Android is definitely a work in progress. If you want to try your hand at creating a significant Android application with the existing toolkit, I salute you. But be prepared for a challenge.

My biggest concern with Android is that I find nothing compelling in it that sets it apart from other handheld OSes. Though one might be tempted to point to the inclusion of the SQLite database engine as significant, I am unconvinced that an SQL-speaking relational database is the "killer feature" that will help Android succeed where other, similar handheld OSes have simply fizzled.

Nevertheless, Android has the weight of Google behind it. Whether that weight is sufficient to propel Android where other handheld OSes have not gone before is uncertain. For now, I'll simply say that Google has a lot of propelling to do.

Rick Grehan, InfoWorld
 

Read More...

Hackers Turn Google Into Password Hunter

The hacking group Cult of the Dead Cow this week released a tool that turns Google into an automated vulnerability scanner.



The hacking group Cult of the Dead Cow (CDC) this week released a tool that turns Google into an automated vulnerability scanner, scouring websites for sensitive information such as passwords or server vulnerabilities.

CDC first achieved notoriety ten years ago with its backdoor Back Orifice, which demonstrated in a highly public way just how easy it was to take unauthorized control of a Windows PC.

The new tool, called Goolag Scan, is equally provocative, making it easy for unskilled users to track down vulnerabilities and sensitive information on specific websites or broad web domains.

This capability should serve as a wake-up call for system administrators to run the tool on their own sites before attackers get around to it, according to CDC.

"It's no big secret that the Web is the platform, and this platform pretty much sucks from a security perspective," said CDC spokesperson Oxblood Ruffin, in a statement. "We've seen some pretty scary holes through random tests with the scanner in North America, Europe, and the Middle East. If I were a government, a large corporation, or anyone with a large website, I'd be downloading this beast and aiming it at my site yesterday."

The tool is a stand-alone Windows .Net application, licensed under the open source GNU General Public License, that provides about 1,500 customized searches under categories such as "vulnerable servers," "sensitive online shopping information" and "files containing juicy information."

The results are displayed as a list of links that can be opened directly in a browser. Example results include tell-tale error messages and Java applets for the remote control of surveillance cameras, according to CDC.

Goolag Scan is based on "Google hacking," the practice of exposing vulnerabilities via Google, which CDC says has been pioneered by a hacker going by the handle "Johnny I Hack Stuff."

Goolag Scan is, however, the first time such vulnerability searches have been built into a simple tool, according to CDC.

Read More...

Google finds evil all over the Web

Google turned its Web-crawling technology loose to hunt down malware-serving pages and found 3 million, meaning about one out of every 1,000 pages is malicious

The Web is scarier than most people realize, according to research published recently by Google.



The search engine giant trained its Web crawling software on billions of Web addresses over the past year looking for malicious pages that tried to attack their visitors. They found more than 3 million of them, meaning that about one in 1,000 Web pages is malicious, according to Neils Provos, a senior staff software engineer with Google.

These Web-based attacks, called "drive-by downloads" by security experts, have become much more common in recent years as firewalls and better security practices by Microsoft have made it harder for worms and viruses to directly attack computers.

In the past year the Web sites of Al Gore's An Inconvenient Truth movie and the Miami Dolphins were hacked, and the MySpace profile of Alicia Keys was used to attack visitors.

Criminals are getting better at this kind of work. They have built very successful automated tools that poke and prod Web sites, looking for programming errors and then exploit these flaws to install the drive-by download software. Often this code opens an invisible iFrame page on the victim's browser that redirects it to a malicious Web server. That server then tries to install code on the victim's PC. "The bad guys are getting exceptionally good at automating those attacks," said Roger Thompson, chief research officer with security vendor Grisoft.

In response, Google has stepped up its game. One of the reasons it has been scouring the Web for malicious pages is so that it can identify drive-by-download sites and warn Google searchers before they visit them. Nowadays about 1.3 percent of all Google search queries list malicious results somewhere on the first few pages.

Some of the data surprised Provos.

"When we started going into this, I had the firm intuition that if you go to the sleazier parts of the Web, you are in more danger," he said.

It turns out the Web's nice neighborhoods aren't necessarily safer than its red-light districts.

"We looked into this and indeed we found that if you ended up going to adult-oriented pages, your risk of being exposed [to malicious software] was slightly higher," he said. But "there really wasn't a huge difference."

"Staying away from the disreputable part of the Internet really isn't good enough," he noted.

Another interesting finding: China was far and away the greatest source of malicious Web sites. According to Google's research, 67 percent of all malware distribution sites are hosted in China. The second-worst offender? The U.S., at 15 percent, followed by Russia (4 percent), Malaysia (2.2 percent), and Korea (2 percent).

It costs next to nothing to register a Web domain in China and service providers are often slow to shut down malicious pages, said Thompson. "They're the Kleenex Web sites," he said. Criminals "know they're going to be shut down, and they don't care."

Malicious site operators in China fall into two broad categories, Thompson said: Fraudsters looking to steal your banking password, and teenagers who want to steal your World of Warcraft character.

So how to stop this growing pestilence?

Google's Provos has this advice for Web surfers: Turn automatic updates on. "You should always run your software as updated as possible and install some kind of antivirus technology," he said.

But he also thinks that Webmasters will have to get smarter about building secure Web sites. "I think it will take concentrated efforts on all parts," for the problem to go away, he said.

Read More...