diff --git a/cmds/servicemanager/Android.mk b/cmds/servicemanager/Android.mk
index b214f19ef..a5e2d980c 100644
--- a/cmds/servicemanager/Android.mk
+++ b/cmds/servicemanager/Android.mk
@@ -18,8 +18,8 @@ LOCAL_MODULE_TAGS := optional
 include $(BUILD_EXECUTABLE)
 
 include $(CLEAR_VARS)
-LOCAL_SHARED_LIBRARIES := liblog libcutils libselinux
-LOCAL_SRC_FILES := service_manager.c binder.c
+LOCAL_SHARED_LIBRARIES := liblog libcutils libselinux libbinder
+LOCAL_SRC_FILES := service_manager.c binder.c hostbinder.cpp
 LOCAL_CFLAGS += $(svc_c_flags)
 LOCAL_MODULE := servicemanager
 LOCAL_INIT_RC := servicemanager.rc
diff --git a/cmds/servicemanager/binder.c b/cmds/servicemanager/binder.c
index 27c461a27..32ff14dc3 100644
--- a/cmds/servicemanager/binder.c
+++ b/cmds/servicemanager/binder.c
@@ -226,6 +226,8 @@ int binder_parse(struct binder_state *bs, struct binder_io *bio,
         fprintf(stderr,"%s:\n", cmd_name(cmd));
 #endif
         switch(cmd) {
+        // ananbox: BR_SPAWN_LOOPER is OK
+        case BR_SPAWN_LOOPER:
         case BR_NOOP:
             break;
         case BR_TRANSACTION_COMPLETE:
diff --git a/cmds/servicemanager/hostbinder.cpp b/cmds/servicemanager/hostbinder.cpp
new file mode 100644
index 000000000..539ee9dcb
--- /dev/null
+++ b/cmds/servicemanager/hostbinder.cpp
@@ -0,0 +1,6 @@
+#include <binder/HostBinder.h>
+extern "C"
+void publishSVM(binder_state *bs) {
+    android::HostBinder host(bs);
+    host.publishSVM();
+}
diff --git a/cmds/servicemanager/hostbinder.h b/cmds/servicemanager/hostbinder.h
new file mode 100644
index 000000000..b47233651
--- /dev/null
+++ b/cmds/servicemanager/hostbinder.h
@@ -0,0 +1,13 @@
+#ifndef __SVCHOSTBINDER_H__
+#define __SVCHOSTBINDER_H__
+struct binder_state
+{
+    int fd;
+    void *mapped;
+    size_t mapsize;
+};
+#ifdef __cplusplus
+extern "C"
+#endif
+void publishSVM(struct binder_state *bs);
+#endif
diff --git a/cmds/servicemanager/service_manager.c b/cmds/servicemanager/service_manager.c
index 68e3ceb8e..579de5deb 100644
--- a/cmds/servicemanager/service_manager.c
+++ b/cmds/servicemanager/service_manager.c
@@ -16,6 +16,7 @@
 #include <selinux/avc.h>
 
 #include "binder.h"
+#include "hostbinder.h"
 
 #if 0
 #define ALOGI(x...) fprintf(stderr, "svcmgr: " x)
@@ -64,6 +65,7 @@ static int selinux_enabled;
 static char *service_manager_context;
 static struct selabel_handle* sehandle;
 
+#if 0
 static bool check_mac_perms(pid_t spid, uid_t uid, const char *tctx, const char *perm, const char *name)
 {
     char *sctx = NULL;
@@ -142,6 +144,7 @@ static int svc_can_find(const uint16_t *name, size_t name_len, pid_t spid, uid_t
     const char *perm = "find";
     return check_mac_perms_from_lookup(spid, uid, perm, str8(name, name_len)) ? 1 : 0;
 }
+#endif
 
 struct svcinfo
 {
@@ -185,7 +188,7 @@ uint16_t svcmgr_id[] = {
 };
 
 
-uint32_t do_find_service(const uint16_t *s, size_t len, uid_t uid, pid_t spid)
+uint32_t do_find_service(const uint16_t *s, size_t len, uid_t uid,  __attribute__ ((unused)) pid_t spid)
 {
     struct svcinfo *si = find_svc(s, len);
 
@@ -202,9 +205,11 @@ uint32_t do_find_service(const uint16_t *s, size_t len, uid_t uid, pid_t spid)
         }
     }
 
+#if 0
     if (!svc_can_find(s, len, spid, uid)) {
         return 0;
     }
+#endif
 
     return si->handle;
 }
@@ -212,7 +217,7 @@ uint32_t do_find_service(const uint16_t *s, size_t len, uid_t uid, pid_t spid)
 int do_add_service(struct binder_state *bs,
                    const uint16_t *s, size_t len,
                    uint32_t handle, uid_t uid, int allow_isolated,
-                   pid_t spid)
+                   __attribute__ ((unused)) pid_t spid)
 {
     struct svcinfo *si;
 
@@ -221,12 +226,15 @@ int do_add_service(struct binder_state *bs,
 
     if (!handle || (len == 0) || (len > 127))
         return -1;
-
+    
+    // Ananbox: disable svc_can_register
+#if 0
     if (!svc_can_register(s, len, spid, uid)) {
         ALOGE("add_service('%s',%x) uid=%d - PERMISSION DENIED\n",
              str8(s, len), handle, uid);
         return -1;
     }
+#endif
 
     si = find_svc(s, len);
     if (si) {
@@ -274,8 +282,11 @@ int svcmgr_handler(struct binder_state *bs,
     //ALOGI("target=%p code=%d pid=%d uid=%d\n",
     //      (void*) txn->target.ptr, txn->code, txn->sender_pid, txn->sender_euid);
 
+    // ananbox: running as virtual servicemanager
+#if 0
     if (txn->target.ptr != BINDER_SERVICE_MANAGER)
         return -1;
+#endif
 
     if (txn->code == PING_TRANSACTION)
         return 0;
@@ -296,6 +307,8 @@ int svcmgr_handler(struct binder_state *bs,
         return -1;
     }
 
+    // Ananbox: disable selinux
+#if 0
     if (sehandle && selinux_status_updated() > 0) {
         struct selabel_handle *tmp_sehandle = selinux_android_service_context_handle();
         if (tmp_sehandle) {
@@ -303,6 +316,7 @@ int svcmgr_handler(struct binder_state *bs,
             sehandle = tmp_sehandle;
         }
     }
+#endif
 
     switch(txn->code) {
     case SVC_MGR_GET_SERVICE:
@@ -332,11 +346,13 @@ int svcmgr_handler(struct binder_state *bs,
     case SVC_MGR_LIST_SERVICES: {
         uint32_t n = bio_get_uint32(msg);
 
+#if 0
         if (!svc_can_list(txn->sender_pid, txn->sender_euid)) {
             ALOGE("list_service() uid=%d - PERMISSION DENIED\n",
                     txn->sender_euid);
             return -1;
         }
+#endif
         si = svclist;
         while ((n-- > 0) && si)
             si = si->next;
@@ -373,16 +389,16 @@ int main()
 {
     struct binder_state *bs;
 
+#if 0
     bs = binder_open(128*1024);
     if (!bs) {
         ALOGE("failed to open binder driver\n");
         return -1;
     }
-
-    if (binder_become_context_manager(bs)) {
-        ALOGE("cannot become context manager (%s)\n", strerror(errno));
-        return -1;
-    }
+#else
+    bs = malloc(sizeof(*bs));
+    publishSVM(bs);
+#endif
 
     selinux_enabled = is_selinux_enabled();
     sehandle = selinux_android_service_context_handle();
diff --git a/include/binder/BpBinder.h b/include/binder/BpBinder.h
index 7ef93aa39..1a659c2a7 100644
--- a/include/binder/BpBinder.h
+++ b/include/binder/BpBinder.h
@@ -28,6 +28,7 @@ class BpBinder : public IBinder
 {
 public:
                         BpBinder(int32_t handle);
+                        BpBinder(int32_t handle, bool incWeak);
 
     inline  int32_t     handle() const { return mHandle; }
 
diff --git a/include/binder/HostBinder.h b/include/binder/HostBinder.h
new file mode 100644
index 000000000..5c29ee2d8
--- /dev/null
+++ b/include/binder/HostBinder.h
@@ -0,0 +1,38 @@
+#ifndef __HOSTBINDER_H__
+#define __HOSTBINDER_H__
+#include <utils/RefBase.h>
+#include <binder/HostBinderShim.h>
+struct binder_state
+{
+    int fd;
+    void *mapped;
+    size_t mapsize;
+};
+namespace android {
+    class IBinder;
+    class HostBinder {
+        public:
+            HostBinder(int mDriverFD_);
+            HostBinder(binder_state* bs);
+            sp<IBinder> getSVMObj();
+            void publishSVM();
+        private:
+            int mDriverFD;
+            std::shared_ptr<HostBinderShim> shim;
+            std::shared_ptr<HostBinderShim> getShim();
+    };
+    class LocalBinder : public BBinder
+    {
+        public:
+            sp<IBinder> remoteBinder;
+            LocalBinder(std::shared_ptr<HostBinderShim> &shim_);
+        protected:
+            virtual status_t    onTransact( uint32_t code,
+                    const Parcel& data,
+                    Parcel* reply,
+                    uint32_t flags = 0);
+        private:
+            std::shared_ptr<HostBinderShim> shim;
+    };
+}
+#endif
diff --git a/include/binder/HostBinderShim.h b/include/binder/HostBinderShim.h
new file mode 100644
index 000000000..2dab70416
--- /dev/null
+++ b/include/binder/HostBinderShim.h
@@ -0,0 +1,22 @@
+#ifndef __HOSTBINDERSHIM_H__
+#define __HOSTBINDERSHIM_H__
+#include <utils/RefBase.h>
+#include <utils/String16.h>
+#include <binder/IBinder.h>
+#include <binder/Parcel.h>
+namespace android {
+    class Parcel;
+    class IBinder;
+    class HostBinderShim {
+        public:
+            sp<IBinder> getHostAMS(); 
+            virtual void writeInterfaceToken(Parcel &data, String16 name) = 0;
+            virtual void writeIntent(Parcel &out, const char *mPackage, const char *mClass, bool hasBundle) = 0;
+            virtual void writeBroadcastBundle(Parcel &data, const char *key, sp<IBinder> binder) = 0;
+            virtual void broadCastIntent(Parcel &data, const char* key, sp<IBinder> binder) = 0;
+            virtual void sendBroadCast(sp<IBinder> ams, Parcel &data) = 0;
+            virtual void enforceDescriptor(const Parcel &data) = 0;
+            virtual bool needReadStatus() = 0;
+    };
+}
+#endif
diff --git a/include/binder/HostBinderShim30.h b/include/binder/HostBinderShim30.h
new file mode 100644
index 000000000..94c8e7458
--- /dev/null
+++ b/include/binder/HostBinderShim30.h
@@ -0,0 +1,16 @@
+#ifndef __HOSTBINDERSHIM30_H__
+#define __HOSTBINDERSHIM30_H__
+#include <binder/HostBinderShim.h>
+namespace android {
+    class HostBinderShim30: public HostBinderShim {
+        public:
+            void writeInterfaceToken(Parcel &data, String16 name);
+            void writeIntent(Parcel &out, const char *mPackage, const char *mClass, bool hasBundle);
+            void writeBroadcastBundle(Parcel &data, const char *key, sp<IBinder> binder);
+            void broadCastIntent(Parcel &data, const char* key, sp<IBinder> binder);
+            void sendBroadCast(sp<IBinder> ams, Parcel &data);
+            void enforceDescriptor(const Parcel &data);
+            bool needReadStatus();
+    };
+}
+#endif
diff --git a/include/binder/IPCThreadState.h b/include/binder/IPCThreadState.h
index 1853cff23..40b3b65d4 100644
--- a/include/binder/IPCThreadState.h
+++ b/include/binder/IPCThreadState.h
@@ -89,6 +89,7 @@ class IPCThreadState
             void                blockUntilThreadAvailable();
 
 private:
+            friend class HostBinder;
                                 IPCThreadState();
                                 ~IPCThreadState();
 
diff --git a/include/binder/ProcessState.h b/include/binder/ProcessState.h
index 64cf72e17..ea5c5ffe2 100644
--- a/include/binder/ProcessState.h
+++ b/include/binder/ProcessState.h
@@ -66,6 +66,7 @@ class ProcessState : public virtual RefBase
 
 private:
     friend class IPCThreadState;
+    friend class HostBinder;
     
                                 ProcessState();
                                 ~ProcessState();
diff --git a/libs/binder/Android.mk b/libs/binder/Android.mk
index 14be920d2..5523811d5 100644
--- a/libs/binder/Android.mk
+++ b/libs/binder/Android.mk
@@ -41,13 +41,16 @@ sources := \
     Static.cpp \
     Status.cpp \
     TextOutput.cpp \
+    HostBinder.cpp \
+    HostBinderShim.cpp \
+    HostBinderShim30.cpp
 
 LOCAL_PATH:= $(call my-dir)
 
 include $(CLEAR_VARS)
 LOCAL_MODULE := libbinder
 LOCAL_SHARED_LIBRARIES := liblog libcutils libutils
-
+#LOCAL_SHARED_LIBRARIES += libananbox
 LOCAL_CLANG := true
 LOCAL_SANITIZE := integer
 LOCAL_SRC_FILES := $(sources)
@@ -62,6 +65,7 @@ include $(BUILD_SHARED_LIBRARY)
 include $(CLEAR_VARS)
 LOCAL_MODULE := libbinder
 LOCAL_STATIC_LIBRARIES += libutils
+#LOCAL_WHOLE_STATIC_LIBRARIES += libananbox
 LOCAL_SRC_FILES := $(sources)
 ifneq ($(TARGET_USES_64_BIT_BINDER),true)
 ifneq ($(TARGET_IS_64_BIT),true)
diff --git a/libs/binder/BpBinder.cpp b/libs/binder/BpBinder.cpp
index c0e029622..12beb89f4 100644
--- a/libs/binder/BpBinder.cpp
+++ b/libs/binder/BpBinder.cpp
@@ -99,6 +99,19 @@ BpBinder::BpBinder(int32_t handle)
     IPCThreadState::self()->incWeakHandle(handle);
 }
 
+BpBinder::BpBinder(int32_t handle, bool incWeak)
+    : mHandle(handle)
+    , mAlive(1)
+    , mObitsSent(0)
+    , mObituaries(NULL)
+{
+    ALOGV("Creating BpBinder %p handle %d\n", this, mHandle);
+
+    extendObjectLifetime(OBJECT_LIFETIME_WEAK);
+    if (incWeak)
+        IPCThreadState::self()->incWeakHandle(handle);
+}
+
 bool BpBinder::isDescriptorCached() const {
     Mutex::Autolock _l(mLock);
     return mDescriptorCache.size() ? true : false;
diff --git a/libs/binder/HostBinder.cpp b/libs/binder/HostBinder.cpp
new file mode 100644
index 000000000..1e08e1f4a
--- /dev/null
+++ b/libs/binder/HostBinder.cpp
@@ -0,0 +1,84 @@
+#include <binder/HostBinderShim.h> 
+#include <binder/IBinder.h>
+#include <binder/Parcel.h>
+#include <binder/IPCThreadState.h>
+
+#include <binder/HostBinder.h>
+#include <binder/HostBinderShim.h>
+#include <binder/HostBinderShim30.h>
+
+namespace android {
+
+LocalBinder::LocalBinder(std::shared_ptr<HostBinderShim> &shim_): remoteBinder(NULL) {
+    shim = shim_;
+}
+
+status_t LocalBinder::onTransact(
+        uint32_t code, const Parcel& data, Parcel* /*reply*/, uint32_t /*flags*/)
+{
+    switch (code) {
+        case 1:
+            //getPid()
+            return NO_ERROR;
+        case 2:
+            //receiveRemoteBinder
+            ALOGD("onReceiveBinder()\n");
+            // enforce descriptor
+            shim->enforceDescriptor(data);
+
+            remoteBinder = data.readStrongBinder();
+
+            if (remoteBinder != NULL) {
+                ALOGD("get service binder success\n");
+            }
+            else {
+                ALOGE("get service binder failed\n");
+            }
+            return NO_ERROR;
+        default:
+            return NO_ERROR;
+    }
+}
+
+std::shared_ptr<HostBinderShim> HostBinder::getShim() {
+    return std::make_shared<HostBinderShim30>();
+}
+
+HostBinder::HostBinder(int mDriverFD_): mDriverFD(mDriverFD_), shim(getShim()) {
+}
+
+#define BINDER_VM_SIZE ((1*1024*1024) - (4096 *2))
+HostBinder::HostBinder(binder_state *bs): shim(getShim()) {
+    IPCThreadState* ipc = IPCThreadState::self();
+    bs->fd = ipc->mProcess->mDriverFD;
+    bs->mapped = ipc->mProcess->mVMStart;
+    bs->mapsize = BINDER_VM_SIZE;
+    mDriverFD = bs->fd;
+}
+
+sp<IBinder> HostBinder::getSVMObj() {
+    Parcel data;
+    sp<IBinder> object(NULL);
+    IPCThreadState* ipc = IPCThreadState::self();
+    sp<IBinder> ams(shim->getHostAMS());
+    sp<LocalBinder> local = new LocalBinder(shim);
+    shim->broadCastIntent(data, "local", local);
+    shim->sendBroadCast(ams, data);
+    ALOGD("wait for service binder\n");
+    ipc->setupPolling(&mDriverFD);
+    ipc->handlePolledCommands();
+    LOG_ALWAYS_FATAL_IF(local->remoteBinder == NULL, "get service binder failed.  Terminating.");
+    ALOGD("get service binder\n");
+    object = local->remoteBinder;
+    return object;
+}
+
+void HostBinder::publishSVM() {
+    sp<IBinder> ams(shim->getHostAMS());
+    sp<LocalBinder> binder = new LocalBinder(shim);
+    Parcel data;
+    shim->broadCastIntent(data, "binder", binder);
+    shim->sendBroadCast(ams, data);
+}
+
+}
diff --git a/libs/binder/HostBinderShim.cpp b/libs/binder/HostBinderShim.cpp
new file mode 100644
index 000000000..aa622cb29
--- /dev/null
+++ b/libs/binder/HostBinderShim.cpp
@@ -0,0 +1,34 @@
+#include <binder/HostBinderShim.h> 
+#include <binder/IBinder.h>
+#include <binder/Parcel.h>
+#include <binder/IPCThreadState.h>
+
+#include <binder/HostBinderShim30.h>
+
+namespace android {
+
+sp<IBinder> HostBinderShim::getHostAMS() {
+    sp<IBinder> object(NULL);
+    IPCThreadState* ipc = IPCThreadState::self();
+    {
+        Parcel data, reply;
+        //data.writeInterfaceToken(String16("android.os.IServiceManager"));
+        writeInterfaceToken(data, String16("android.os.IServiceManager"));
+        data.writeString16(String16("activity"));
+        status_t result = ipc->transact(0 /*magic*/, 1, data, &reply, 0);
+        if (result == NO_ERROR) {
+            // API 30: read status
+            if (needReadStatus())
+                reply.readInt32();
+            object = reply.readStrongBinder();
+        }
+    }
+
+    ipc->flushCommands();
+    if (object == NULL) {
+        ALOGE("get host AMS failed\n");
+    }
+    return object;
+}
+
+}
diff --git a/libs/binder/HostBinderShim30.cpp b/libs/binder/HostBinderShim30.cpp
new file mode 100644
index 000000000..afefc54a3
--- /dev/null
+++ b/libs/binder/HostBinderShim30.cpp
@@ -0,0 +1,117 @@
+#include <binder/HostBinderShim30.h>        
+#include <binder/IBinder.h>
+#include <binder/Parcel.h>
+
+namespace android {
+
+bool HostBinderShim30::needReadStatus() {
+    return true;
+}
+
+#define STRICT_MODE_PENALTY_GATHER (0x40 << 16)
+void HostBinderShim30::writeInterfaceToken(Parcel &data, String16 name) {
+    data.writeInt32(STRICT_MODE_PENALTY_GATHER);
+    data.writeInt32(getuid());
+    data.writeInt32(0x53595354);
+    data.writeString16(name);
+}
+
+void HostBinderShim30::writeIntent(Parcel &out, const char *mPackage, const char *mClass, bool hasBundle) {
+    // indicate that there is an intent
+    out.writeInt32(1);
+    // mAction
+    out.writeString16(NULL, -1);
+    // uri mData
+    out.writeInt32(0);
+    // mType
+    out.writeString16(NULL, -1);
+    // mIdentifier
+    out.writeString16(NULL, -1);
+    // mFlags
+    out.writeInt32(0);
+    // mPackage
+    out.writeString16(NULL, -1);
+    // mComponent
+    out.writeString16(String16(mPackage));
+    out.writeString16(String16(mClass));
+    // mSourceBounds
+    out.writeInt32(0);
+    // mCategories
+    out.writeInt32(0);
+    // mSelector
+    out.writeInt32(0);
+    // mClipData
+    out.writeInt32(0);
+    // mContentUserHint
+    out.writeInt32(0);
+    // mExtras
+    if (!hasBundle)
+        out.writeInt32(-1);
+}
+
+void HostBinderShim30::writeBroadcastBundle(Parcel &data, const char *key, sp<IBinder> binder) {
+    // place of length
+    int prev = data.dataPosition();
+    data.writeInt32(0);
+    // magic number
+    data.writeInt32(0x4C444E42);
+    // element count
+    data.writeInt32(1);
+    // Map
+    // first binder element
+    // key: binder
+    data.writeString16(String16(key));
+    // write type code: VAL_IBINDER
+    data.writeInt32(15);
+    data.writeStrongBinder(binder);
+    // finishFlatten: stability
+    if (binder == NULL)
+        data.writeInt32(0);
+    else
+        data.writeInt32(0b001100);
+    int cur = data.dataPosition();
+    // // go back & write length
+    data.setDataPosition(prev);
+    // write length here
+    data.writeInt32(cur - prev - 4);
+    data.setDataPosition(cur);
+}
+
+void HostBinderShim30::broadCastIntent(Parcel &data, const char* key, sp<IBinder> binder) {
+    writeInterfaceToken(data, String16("android.app.IActivityManager"));
+    data.writeStrongBinder(NULL);
+    // finishFlatten
+    data.writeInt32(0);
+    writeIntent(data, "com.github.ananbox", "com.github.ananbox.BinderReceiver", true);
+    writeBroadcastBundle(data, key, binder);
+    data.writeString16(NULL, -1);
+    data.writeStrongBinder(NULL);
+    // finishFlatten
+    data.writeInt32(0);
+    data.writeInt32(0);
+    data.writeString16(NULL, -1);
+    // null bundle
+    data.writeInt32(0);
+    // null string array
+    data.writeInt32(-1);
+    data.writeInt32(-1);
+    data.writeInt32(-1);
+    // null bundle
+    data.writeInt32(0);
+    data.writeBool(true);
+    data.writeBool(false);
+    data.writeInt32(0);
+}
+
+void HostBinderShim30::sendBroadCast(sp<IBinder> ams, Parcel &data) {
+    ams->transact(14, data, NULL, 0);
+}
+
+void HostBinderShim30::enforceDescriptor(const Parcel &data) {
+    data.readInt32();
+    data.readInt32();
+    data.readInt32();
+    data.readString16();
+}
+
+}
diff --git a/libs/binder/ProcessState.cpp b/libs/binder/ProcessState.cpp
index bbf27d2fb..90c1baed0 100644
--- a/libs/binder/ProcessState.cpp
+++ b/libs/binder/ProcessState.cpp
@@ -42,7 +42,7 @@
 #include <sys/stat.h>
 #include <sys/types.h>
 
-//#include <ananbox.h>
+#include <binder/HostBinder.h>
 
 #define BINDER_VM_SIZE ((1*1024*1024) - (4096 *2))
 #define DEFAULT_MAX_BINDER_THREADS 15
@@ -84,192 +84,10 @@ void ProcessState::setContextObject(const sp<IBinder>& object)
     setContextObject(object, String16("default"));
 }
 
-#define STRICT_MODE_PENALTY_GATHER (0x40 << 16)
-void writeInterfaceToken(Parcel &data, String16 name) {
-    data.writeInt32(STRICT_MODE_PENALTY_GATHER);
-    data.writeInt32(getuid());
-    data.writeInt32(0x53595354);
-    data.writeString16(name);
-}
-
-sp<IBinder> getHostAMS() {
-    sp<IBinder> object(NULL);
-    IPCThreadState* ipc = IPCThreadState::self();
-    {
-        Parcel data, reply;
-        //data.writeInterfaceToken(String16("android.os.IServiceManager"));
-        writeInterfaceToken(data, String16("android.os.IServiceManager"));
-        data.writeString16(String16("activity"));
-        status_t result = ipc->transact(0 /*magic*/, 1, data, &reply, 0);
-        if (result == NO_ERROR) {
-            // android 11: status
-            reply.readInt32();
-            object = reply.readStrongBinder();
-        }
-    }
-
-    ipc->flushCommands();
-    if (object == NULL) {
-        ALOGE("get host AMS failed\n");
-    }
-    return object;
-}
-
-void writeIntent(Parcel &out, const char *mPackage, const char *mClass, bool hasBundle) {
-    // indicate that there is an intent
-    out.writeInt32(1);
-    // mAction
-    out.writeString16(NULL, -1);
-    // uri mData
-    out.writeInt32(0);
-    // mType
-    out.writeString16(NULL, -1);
-    // mIdentifier
-    out.writeString16(NULL, -1);
-    // mFlags
-    out.writeInt32(0);
-    // mPackage
-    out.writeString16(NULL, -1);
-    // mComponent
-    out.writeString16(String16(mPackage));
-    out.writeString16(String16(mClass));
-    // mSourceBounds
-    out.writeInt32(0);
-    // mCategories
-    out.writeInt32(0);
-    // mSelector
-    out.writeInt32(0);
-    // mClipData
-    out.writeInt32(0);
-    // mContentUserHint
-    out.writeInt32(0);
-    // mExtras
-    if (!hasBundle)
-        out.writeInt32(-1);
-}
-
-void writeBroadcastBundle(Parcel &data, const char *key, sp<IBinder> local) {
-    // place of length
-    int prev = data.dataPosition();
-    data.writeInt32(0);
-    // magic number
-    data.writeInt32(0x4C444E42);
-    // element count
-    data.writeInt32(1);
-    // Map
-    // first binder element
-    // key: binder
-    data.writeString16(String16(key));
-    // write type code: VAL_IBINDER
-    data.writeInt32(15);
-    data.writeStrongBinder(local);
-    // finishFlatten
-    data.writeInt32(0b001100);
-    int cur = data.dataPosition();
-    // // go back & write length
-    data.setDataPosition(prev);
-    // write length here
-    data.writeInt32(cur - prev - 4);
-    data.setDataPosition(cur);
-}
-
-void broadCastIntent(sp<IBinder>& ams, sp<IBinder> local) {
-    Parcel data;
-    writeInterfaceToken(data, String16("android.app.IActivityManager"));
-    data.writeStrongBinder(NULL);
-    // finishFlatten
-    data.writeInt32(0);
-    writeIntent(data, "com.github.ananbox", "com.github.ananbox.BinderReceiver", true);
-    writeBroadcastBundle(data, "local", local);
-    data.writeString16(NULL, -1);
-    data.writeStrongBinder(NULL);
-    // finishFlatten
-    data.writeInt32(0);
-    data.writeInt32(0);
-    data.writeString16(NULL, -1);
-    // null bundle
-    data.writeInt32(0);
-    // null string array
-    data.writeInt32(-1);
-    data.writeInt32(-1);
-    data.writeInt32(-1);
-    // null bundle
-    data.writeInt32(0);
-    data.writeBool(true);
-    data.writeBool(false);
-    data.writeInt32(0);
-    ams->transact(14, data, NULL, 0);
-}
-
-class LocalBinder : public BBinder
-{
-    public:
-        sp<IBinder> remoteBinder;
-        LocalBinder(): remoteBinder(NULL) {}
-    protected:
-        virtual status_t    onTransact( uint32_t code,
-                const Parcel& data,
-                Parcel* reply,
-                uint32_t flags = 0);
-};
-
-status_t LocalBinder::onTransact(
-        uint32_t code, const Parcel& data, Parcel* /*reply*/, uint32_t /*flags*/)
-{
-    switch (code) {
-        case 1:
-            //getPid()
-            return NO_ERROR;
-        case 2:
-            //receiveRemoteBinder
-            ALOGD("onReceiveBinder()\n");
-            // enforce descriptor
-            data.readInt32();
-            data.readInt32();
-            data.readInt32();
-            data.readString16();
-
-            remoteBinder = data.readStrongBinder();
-
-            if (remoteBinder != NULL) {
-                ALOGD("get service binder success\n");
-            }
-            else {
-                ALOGE("get service binder failed\n");
-            }
-            return NO_ERROR;
-        default:
-            return NO_ERROR;
-    }
-}
-
-sp<IBinder> ProcessState::getSVMObj() {
-    sp<IBinder> object(NULL);
-    IPCThreadState* ipc = IPCThreadState::self();
-#if 0
-    getSVM(mDriverFD);
-    uint32_t handle = getSVMHandle();
-#endif
-    sp<IBinder> ams(getHostAMS());
-    sp<LocalBinder> local = new LocalBinder();
-    broadCastIntent(ams, local);
-    ALOGD("wait for service binder\n");
-#if 0
-    ProcessState::self()->startThreadPool();
-    while (local->remoteBinder == NULL); 
-    ALOGD("get service binder\n");
-#endif
-    ipc->setupPolling(&mDriverFD);
-    ipc->handlePolledCommands();
-    LOG_ALWAYS_FATAL_IF(local->remoteBinder == NULL, "get service binder failed.  Terminating.");
-    ALOGD("get service binder\n");
-    object = local->remoteBinder;
-    return object;
-}
-
 sp<IBinder> ProcessState::getContextObject(const sp<IBinder>& /*caller*/)
 {
-    return getSVMObj();
+    HostBinder host(mDriverFD);
+    return host.getSVMObj();
 }
 
 void ProcessState::setContextObject(const sp<IBinder>& object, const String16& name)
@@ -313,7 +131,8 @@ sp<IBinder> ProcessState::getContextObject(const String16& name, const sp<IBinde
     ipc->flushCommands();
 #endif
 
-    object = getSVMObj();
+    HostBinder host(mDriverFD);
+    object = host.getSVMObj();
     
     if (object != NULL) setContextObject(object, name);
     return object;