com.qualcomm.qcrilmsgtunnel Copy

A Qualcomm-named system component with no label of its own: it is recorded here under its package name in each locale recorded, and has no launcher entry in any observation recorded here. No Qualcomm documentation for it was found. The description below comes from a copy of Qualcomm's source for it in a LeEco MSM8996 vendor tree published on GitHub, whose files carry Qualcomm copyright dates of 2012 and 2013. It describes that copy; what current builds contain could not be sourced. In that copy it is a bridge between apps and the Qualcomm radio interface layer (RIL). Its service file is headed "Communicates with QCRIL for OEM specific reqs/responses", and its interface, described there as "exposed for other apps", has two methods that send a raw OEM request to the RIL, one returning the response directly and one through a callback. The manifest uses the phone shared user ID, defines the permission com.qualcomm.permission.USE_QCRIL_MSG_TUNNEL at protection level signatureOrSystem and guards the exported service with it, and the makefile builds the package with the platform certificate. A boot receiver starts the service unless the system property persist.radio.msgtunnel.start, which defaults to true, is false. The same directory holds the qcrilhook Java library (com.qualcomm.qcrilhook), which binds to this package's service by name and sends its requests through it. Although it carries a Qualcomm name, it is shipped by device makers. It is recorded here on devices from CipherLab, Crosscall, Datalogic, Elo Touch Solutions, Fairphone, HMD Global, HONOR, isafemobile, Motorola, Nothing, OnePlus, Xiaomi and Zebra Technologies. Where this site holds signer data, which is 7 of those 13 makes (Fairphone, Motorola, Nothing, Xiaomi, Crosscall, isafemobile and HMD Global), each copy is signed by that maker's OEM key, a key that also signs the Android framework, a platform-level key. The six permissions recorded here are WAKE_LOCK, RECEIVE_BOOT_COMPLETED, USE_QCRIL_MSG_TUNNEL and three cross-user or cross-profile interaction permissions; the cited manifest requests only the first three, so at least one recorded build differs from that copy. This site aggregates permissions across observations rather than per build, so which builds request them cannot be established. For Android Enterprise, EMM and kiosk use no enrolment, policy or management role for it is identified in the sources cited here. In the copy cited, other components reach the modem through it: the qcrilhook library binds to it, and the data status notification service in the same tree requests its permission and uses that library. If current builds work the same way, disabling it would cut those components off from the RIL. Which features that would affect on a given device could not be sourced, so the rating below is caution and any change should be tested on one device first. Version note: it is recorded here on devices from API 28 to API 36, and this site's roll-up reports version strings from 13 (oldest) to 16 (newest) and target SDK levels from 28 to 35. Those figures do not establish how the package has changed. The source copy cited is far older than the builds recorded here, and whether its role differs on current Android releases could not be sourced.

• qcrilOemHook AndroidManifest.xml - bcyj/android_tools_leeco_msm8996 (GitHub) →
• qcrilOemHook Android.mk - bcyj/android_tools_leeco_msm8996 (GitHub) →
• QcrilMsgTunnelService.java - bcyj/android_tools_leeco_msm8996 (GitHub) →
• IQcrilMsgTunnel.aidl - bcyj/android_tools_leeco_msm8996 (GitHub) →
• QcrilMsgTunnelAutoboot.java - bcyj/android_tools_leeco_msm8996 (GitHub) →
• QcRilHook.java - bcyj/android_tools_leeco_msm8996 (GitHub) →
• DataStatusNotification AndroidManifest.xml - bcyj/android_tools_leeco_msm8996 (GitHub) →
• DataStatusNotificationService.java - bcyj/android_tools_leeco_msm8996 (GitHub) →
• Package provenance for com.qualcomm.qcrilmsgtunnel - Android System App Database →

• Re-signed by each device maker with its own platform key - 8 different certificates appear across 7 device makers in our sample. That is the signature of a stock AOSP/system package every OEM builds and signs itself, not a single maker's or a third party's preinstall. These are platform-level keys: they also sign the Android framework itself.
• Its largest observed manifest declares 6 permissions: 3 signature or system-level, 2 install-time and 1 vendor or uncatalogued. The signature/system share marks it as a privileged component, not an ordinary app.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.