com.qualcomm.qti.uimGbaApp Copy

A Qualcomm-named system component with no label of its own: it is recorded here under its package name in each locale recorded, and has no launcher entry in any observation recorded here. No Qualcomm documentation for it was found, and no copy of its own source or manifest was found either. What follows comes from a Qualcomm client library that names this package, in two vendor trees published on GitHub by third parties, so it describes what that library expects of the package and not the package as a whole. In both copies, Qualcomm's UimGbaManager class binds to a component named com.qualcomm.qti.uimGbaApp.GbaService in this package. The interface it expects that service to implement says it "provides the APIs for GBA" and, besides callback registration, has two operations. The first, gbaInit, is for a client "to perform bootstrapping procedures(GBA) to generate keys": the caller passes a security protocol identifier (the file points to 3GPP TS 33.220 Annex H), a NAF fully qualified domain name, the SIM slot, the card application type (SIM, USIM, RUIM, CSIM or ISIM), a flag to force bootstrapping and an optional access point name. The callback returns the Ks NAF key in Base64, encrypted or not, with a bootstrapping transaction ID "obtained as part of Bootstrapping with BSF" and a key lifetime. The second, getImpi, reads the IMPI from the card, in encrypted or plain form. If the builds recorded here carry that service, this package is where a client app would ask the SIM for GBA keys. Which apps on a recorded device call it could not be sourced. Although it carries a Qualcomm name, it is shipped by device makers. It is recorded here on devices from Crosscall, Datalogic, Elo Touch Solutions, Fairphone, isafemobile, Lenovo, Motorola, Nothing, OnePlus, Xiaomi and Zebra Technologies. Where this site holds signer data, which is 7 of those 11 makes (Crosscall, Fairphone, isafemobile, Lenovo, Motorola, Nothing and Xiaomi), each copy is signed by that maker's OEM key, a key that also signs the Android framework, a platform-level key. No permission requests are recorded here for it. For Android Enterprise, EMM and kiosk use no enrolment, policy or management role for it is identified in the sources cited here. The cited interface is a SIM key-generation service for other apps to call. Which carrier or device features on the devices recorded here rely on it, and what stops working if the package is disabled, could not be sourced, so the rating below is caution and any change should be tested on one device with a SIM in use first. Version note: the interface files carry Qualcomm copyright dates of 2014 and 2019 and the component name the library binds to is the same in both copies. The older makefile skips the library on targets built without telephony and on low-RAM targets. The newer tree also carries a file, with Qualcomm copyright dates of 2021 and 2024, whose comment says it "is used by the framework to determine the list of applications that need to be disabled for modem-less targets"; it lists this package at /product/app/uimgbaservice. No Android release that changed this package's role could be sourced. It is recorded here on devices between API 31 and API 36, and this site's roll-up reports version strings from 13 (oldest) to 16 (newest) and target SDK levels from 33 to 36. Those figures count changes without describing them.

• UimGbaManager.java - Sushrut1101/android_vendor_qcom_proprietary (GitHub) →
• IUimGbaService.aidl - Sushrut1101/android_vendor_qcom_proprietary (GitHub) →
• IUimGbaServiceCallback.aidl - Sushrut1101/android_vendor_qcom_proprietary (GitHub) →
• UimGba Android.mk - Sushrut1101/android_vendor_qcom_proprietary (GitHub) →
• UimGbaManager.java, newer copy - aospa-op13/proprietary (GitHub) →
• telephony_packages.xml, newer copy - aospa-op13/proprietary (GitHub) →
• Package provenance for com.qualcomm.qti.uimGbaApp - Android System App Database →

• Re-signed by each device maker with its own platform key - 8 different certificates appear across 7 device makers in our sample. That is the signature of a stock AOSP/system package every OEM builds and signs itself, not a single maker's or a third party's preinstall. These are platform-level keys: they also sign the Android framework itself.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.