com.android.microdroid.empty_payload Copy

This is the empty payload APK that ships with the Android Virtualization Framework (AVF), and like the CompOS payload above it is a platform component rather than an app. In the Android source it is built as EmptyPayloadApp inside the com.android.virt APEX. Its manifest declares the package com.android.microdroid.empty_payload, marks the application android:testOnly="true" with android:hasCode="false", requests MANAGE_VIRTUAL_MACHINE and requires the android.software.virtualization_framework feature. Its native payload does almost nothing: it prints "Hello Microdroid", signals that the payload is ready and then waits, which is what you want when the point is to boot a Microdroid virtual machine and interact with it rather than to run a workload. In other words it exists so that AVF can be brought up with an effectively empty guest, for development, testing and benchmarking of the virtual machine itself. It does nothing at all unless something deliberately starts a VM with it, and its testOnly flag means it is not a normally installable app. Version note: AOSP states that AVF is supported only on ARM64 devices. The source builds this app with a minimum and target SDK of 34, that is Android 14, and our sample records it with target SDK 34 to 37 and platform version names of 15 to 17. No change of role across releases was found. For Android Enterprise, EMM and kiosk use it has no enrolment, policy or user-facing role. It will show up in an app inventory on devices that support AVF and can be ignored. Because it is delivered inside a platform APEX it is not something to strip out, and there is no benefit in trying, so leave it alone.

• Android Virtualization Framework (AVF) overview - Android Open Source Project →
• Microdroid - Android Open Source Project →
• EmptyPayloadApp AndroidManifest.xml - Android (packages/modules/Virtualization) source →
• Package provenance for com.android.microdroid.empty_payload - Android System App Database →

• Re-signed by each device maker with its own platform key - 12 different certificates appear across 9 device makers in our sample. That is the signature of a stock AOSP/system package every OEM builds and signs itself, not a single maker's or a third party's preinstall.
• Its largest observed manifest declares 1 permissions: 1 vendor or uncatalogued.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.