com.qualcomm.qti.uceShimService Copy

A Qualcomm-named system component labelled "uceShimService" in each locale recorded, with no launcher entry in any observation recorded here. No Qualcomm documentation for it was found. The description below comes from copies of Qualcomm's source for it in vendor trees published on GitHub by third parties: an older copy whose files carry Qualcomm copyright dates between 2012 and 2018, and a newer copy with dates up to 2022. It describes those copies; what the builds recorded here contain could not be sourced. In the older copy it is a persistent background service with no screens of its own. A receiver starts its RCSService on boot, including locked boot. That service obtains a Qualcomm vendor HAL, com.qualcomm.qti.uceservice@2.0::IUceService, and registers a binder with the Android service manager under the name "uce". The binder class extends the Android framework's UceServiceBase and logs under the tag "Aidl-shim UceServiceStub"; it passes presence and options requests between that framework interface and the vendor HAL. Callers creating an options or presence service are checked for the permissions ACCESS_UCE_OPTIONS_SERVICE and ACCESS_UCE_PRESENCE_SERVICE respectively. The service follows SIM state: on a SIM state of ready, IMSI or loaded it starts and, once its HAL listener is registered, sends the framework broadcast ImsUceManager.ACTION_UCE_SERVICE_UP; on any other SIM state, if it had started, it sends ACTION_UCE_SERVICE_DOWN. The manifest uses the phone shared user ID, marks the app persistent and direct-boot aware, and runs it in a process named ".dataservices". A sysconfig file shipped with it allows it in power save, and the makefile builds it with the platform certificate. Although it carries a Qualcomm name, it is shipped by device makers. It is recorded here on devices from CipherLab, Crosscall, Datalogic, Elo Touch Solutions, Fairphone, HMD Global, Lenovo, Motorola, OnePlus, Xiaomi and Zebra Technologies. Where this site holds signer data, which is 7 of those 11 makes (Crosscall, Fairphone, HMD Global, Lenovo, Motorola, Xiaomi and Zebra Technologies), each copy is signed by that maker's OEM key, a key that also signs the Android framework, a platform-level key. The permissions recorded here are BROADCAST_STICKY, READ_PRIVILEGED_PHONE_STATE and RECEIVE_BOOT_COMPLETED, which is the set the newer copy's manifest requests; the older manifest requests the other two without READ_PRIVILEGED_PHONE_STATE. This site aggregates permissions across observations rather than per build, so which builds request them cannot be established. For Android Enterprise, EMM and kiosk use no enrolment, policy or management role for it is identified in the sources cited here. In the copies cited it is plumbing between the framework's UCE interface and a Qualcomm vendor HAL, and it starts and stops with SIM state. Which calling or messaging features on the devices recorded here depend on it, and what stops working if the package is disabled, could not be sourced. In those copies it is also a persistent app sharing the phone user ID. The rating below is caution, and any change should be tested on one device with a SIM in use first. Version note: the copies differ. The older makefile carries the comment "Disabling uceShimService App for Android Go" and skips the package on low-RAM targets, and installs it on the product partition. The older tree also holds a second variant, dated up to 2019, that tries version 2.1 of the vendor HAL first and falls back to 2.0. The newer copy targets SDK 33 where the older targets SDK 28, requests READ_PRIVILEGED_PHONE_STATE, no longer declares RCSService exported or gives it an intent filter, installs on the system_ext partition, has no low-RAM condition around the build, and names HAL versions up to 2.3. It is recorded here on devices between API 28 and API 36, and this site's roll-up reports version strings from 13 (oldest) to 16 (newest), target SDK levels from 28 to 36 and APK sizes from about 279 KB to about 468 KB. Those figures do not establish which copy, if any, a given recorded build matches.

• uceShimService AndroidManifest.xml - Sushrut1101/android_vendor_qcom_proprietary (GitHub) →
• uceShimService Android.mk - Sushrut1101/android_vendor_qcom_proprietary (GitHub) →
• whitelist_com.qualcomm.qti.uceShimService.xml - Sushrut1101/android_vendor_qcom_proprietary (GitHub) →
• RCSReceiver.java - Sushrut1101/android_vendor_qcom_proprietary (GitHub) →
• RCSService.java - Sushrut1101/android_vendor_qcom_proprietary (GitHub) →
• RCSServiceStub.java - Sushrut1101/android_vendor_qcom_proprietary (GitHub) →
• RCSService.java, second variant - Sushrut1101/android_vendor_qcom_proprietary (GitHub) →
• uceShimService AndroidManifest.xml, newer copy - aospa-op13/proprietary (GitHub) →
• uceShimService Android.mk, newer copy - aospa-op13/proprietary (GitHub) →
• RCSService.java, newer copy - aospa-op13/proprietary (GitHub) →
• Package provenance for com.qualcomm.qti.uceShimService - Android System App Database →

• Re-signed by each device maker with its own platform key - 10 different certificates appear across 9 device makers in our sample. That is the signature of a stock AOSP/system package every OEM builds and signs itself, not a single maker's or a third party's preinstall. These are platform-level keys: they also sign the Android framework itself.
• Its largest observed manifest declares 3 permissions: 1 signature or system-level and 2 install-time.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.