hostsidetests/securitybulletin/test-apps/CVE-2021-0523/src/android/security/cts/CVE_2021_0523/PocService.java

/*
 * Copyright (C) 2021 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package android.security.cts.cve_2021_0523;

import android.app.Service;
import android.content.Intent;
import android.content.res.Resources;
import android.graphics.Bitmap;
import android.graphics.Color;
import android.graphics.PixelFormat;
import android.os.Build;
import android.os.Handler;
import android.os.IBinder;
import android.provider.Settings;
import android.view.Gravity;
import android.view.MotionEvent;
import android.view.View;
import android.view.WindowManager;
import android.view.WindowManager.LayoutParams;
import android.widget.Button;

public class PocService extends Service {
    public static Button mButton;
    private WindowManager mWindowManager;
    private WindowManager.LayoutParams mLayoutParams;

    private static int getScreenWidth() {
        return Resources.getSystem().getDisplayMetrics().widthPixels;
    }

    private static int getScreenHeight() {
        return Resources.getSystem().getDisplayMetrics().heightPixels;
    }

    @Override
    public void onCreate() {
        super.onCreate();
        mWindowManager = getSystemService(WindowManager.class);
        mLayoutParams = new WindowManager.LayoutParams();
        mLayoutParams.type = WindowManager.LayoutParams.TYPE_APPLICATION_OVERLAY;
        mLayoutParams.flags = WindowManager.LayoutParams.FLAG_NOT_TOUCH_MODAL
                | WindowManager.LayoutParams.FLAG_NOT_FOCUSABLE;
        mLayoutParams.format = PixelFormat.OPAQUE;
        mLayoutParams.gravity = Gravity.LEFT | Gravity.TOP;
        mLayoutParams.width = getScreenWidth();
        mLayoutParams.height = getScreenHeight();
        mLayoutParams.x = getScreenWidth() / 2;
        mLayoutParams.y = getScreenHeight() / 2;
    }

    @Override
    public IBinder onBind(Intent intent) {
        return null;
    }

    @Override
    public int onStartCommand(Intent intent, int flags, int startId) {
        showFloatingWindow();
        return super.onStartCommand(intent, flags, startId);
    }

    @Override
    public void onDestroy() {
        if (mWindowManager != null && mButton != null) {
            mWindowManager.removeView(mButton);
        }
        super.onDestroy();
    }

    private void showFloatingWindow() {
        if (Settings.canDrawOverlays(this)) {
            mButton = new Button(getApplicationContext());
            mButton.setBackgroundColor(Color.parseColor("#BEBEBE")); // R-BE G-BE B-BE
            mWindowManager.addView(mButton, mLayoutParams);
            mButton.setOnTouchListener(new FloatingOnTouchListener());
            new Handler().postDelayed(new Runnable() {
                @Override
                public void run() {
                    onDestroy();
                }
            }, 60000); // one minute
            mButton.setTag(mButton.getVisibility());
        }
    }

    private static class FloatingOnTouchListener implements View.OnTouchListener {

        @Override
        public boolean onTouch(View view, MotionEvent event) {
            view.setDrawingCacheEnabled(true);
            view.buildDrawingCache();
            Bitmap bitmap = view.getDrawingCache();
            int pixel = bitmap.getPixel(getScreenWidth() / 2, getScreenHeight() / 2);
            int red = Color.red(pixel);
            int green = Color.green(pixel);
            int blue = Color.blue(pixel);
            view.setDrawingCacheEnabled(false);
            if ((red == 0xBE) && (green == 0xBE) && (blue == 0xBE)) {
                throw new RuntimeException(
                    "Device is vulnerable to b/174047492 hence any app with " +
                    "SYSTEM_ALERT_WINDOW can overlay the WifiScanModeActivity screen");
            }
            return false;
        }
    }
}