How it works

How it works

The problem with root shells

The classic way for apps to do privileged things is running commands in a su shell (e.g. pm enable/disable). It has big downsides:

1. Extremely slow — a new process per command.
2. Unreliable — parsing human-readable text output.
3. Limited to whatever commands exist.
4. Needs root even when ADB permissions would be enough.

Binder IPC instead

Android system APIs (like PackageManager#getInstalledPackages()) are IPC calls to the system server over binder. Binder lets the server side see the client's uid/pid and enforce permissions.

The trick Shizuku/Shevery uses:

1. You start a Shizuku server process with root or ADB shell permissions.
2. When any app starts, the server's binder is delivered to it (via IActivityManager#registerProcessObserver + #registerUidObserver).
3. Shevery acts as a middleman: it receives the app's API requests, forwards them to the system server, and returns the results (see transactRemote in rikka.shizuku.server.ShizukuService and moe.shizuku.api.ShizukuBinderWrapper).

To the app, calling a system API through Shevery is almost identical to calling it directly — but with elevated permissions.

Things developers should know

• ADB permissions are limited and differ per Android version. Check granted permissions in AOSP. Use ShizukuService#getUid / #checkPermission before calling APIs.
• Hidden API restrictions (Android 9+): normal apps can't freely use hidden APIs; use e.g. AndroidHiddenApiBypass.
• Android 8.0 + ADB: ADB can't use registerUidObserver on API 26, so for processes not started by an Activity, trigger binder delivery by starting a transparent activity.
• transactRemote codes differ per Android version (SystemServiceHelper.getTransactionCode may miss, e.g. TRANSACTION_getInstalledPackages_47 on API 25). Prefer ShizukuBinderWrapper.
• Android 17: Shevery ships an Android17Compat fallback for changed signatures (e.g. grantRuntimePermission, getInstalledPackages).

Developer entry points: Shizuku-API + samples and the migration guide for pre-v11 apps.