Using Reflection to Launch APKs on Android 10 via shellCommand

Multiple methods exist to start an APK, such as using an Intent, adb shell commands, or reflection. Before Android 10, reflection typically invoked the startActivityAndWait(...) method defined in IActivityMessage.java to launch an APK.

With Android 10, the IActivityMessage.java class was removed and replaced by an AIDL file; the startActivityAndWait(...) logic was moved to ActivityManagerServer.java . Consequently, the previous reflection approach no longer works, and developers must reflect the shellCommand(...) method to start APKs.

The core technical solution reflects mAm.asBinder().shellCommand to launch the target APK. The following sequence diagram (image) illustrates the process:

Technical Advantages The method is compatible with Android 10 and later, allowing APK launch via reflection without requiring root or direct system modifications.

Implementation Steps

1. Obtain the ActivityManagerNative class object.

2. Retrieve the IActivityManager object.

3. Determine the current Android system version.

4. Call asBinder() on the IActivityManager to obtain the BinderProxy object.

5. Reflectively acquire the ShellCallback and ResultReceiver class objects.

6. Obtain the shellCommand method reference.

7. Invoke the shellCommand method to start the APK.

Overall Implementation Code

Effect Demonstration

Android 10 device screenshot showing successful launch.

Command‑line output confirming the APK started correctly.

Final screen of the launched APK.