Most device recovery workflows break down in real-world theft scenarios because they assume an active data uplink. When a phone is stolen, the opportunistic flow is predictable: immediate Airplane Mode toggle, data cut, and fast attempts to access banking or mobile money apps before the user reaches an external computer.
I wanted to design an open-source architecture that operates entirely offline at the telephony layer without requiring Play Services cloud connectivity during a critical event.
I’ve open-sourced the implementation under MIT:
GitHub: https://github.com/kingenious0/trackd
I would appreciate engineering feedback on the native Android architecture and how people are handling edge cases around modern OEM background policies.
Native Android Architectural Decisions
Telephony Layer Interception (SMS_RECEIVED vs abortBroadcast) Because cellular data is typically the first vector cut, the daemon relies on direct SMS commands (#LOCATE#PIN, #SIREN#PIN, #STOLEN#PIN). An ordered BroadcastReceiver with maximum priority (999) intercepts the raw PDU. If authenticated against a local salted hash in Android Keystore, the receiver invokes abortBroadcast() to prevent notification chime alerts or cluttering the default SMS inbox. Outgoing coordinates are returned via SmsManager directly to a designated recovery number.
App Lockdown & Decoy ANRs via AccessibilityService A lightweight AccessibilityService monitors window state change events. When the daemon is switched to an elevated threat state, foreground attempts to launch targeted package names (banking, system settings, mobile money) immediately dispatch a system dialog overlay spoofing a standard Application Not Responding (ANR) crash and redirect to the default launcher.
Cold GPS Fixes Without Network Assistance Standard GPS locks rely on SUPL/A-GPS cellular assistance data to achieve fast fixes. When offline, FusedLocationProviderClient with high accuracy must fall back purely to standalone GNSS satellite tracking, which leads to extended time-to-first-fix. To mitigate this, a last-gasp cache is preserved, while the receiver holds a partial WakeLock to allow the GNSS chip to cycle satellite ephemeris data before dispatching the response.
Questions & Edge Cases for the Community
OEM Background Killers (MIUI/HyperOS & OneUI): Even with a declared Foreground Service and battery optimization bypasses, HyperOS still frequently terminates background jobs after an hour of deep doze unless the user manually grants vendor-specific Autostart and background pop-up toggles. Has anyone discovered cleaner intent deep-links or standard workarounds to keep telephony listeners alive across aggressive Asian vendor skins?
Dual-SIM Default Carrier Selection: On Android 12+ dual-SIM devices, SmsManager.getDefault() occasionally throws exceptions when dispatching background SMS if the user hasn't configured a default SIM for outgoing messages. How are you currently resolving the active SubscriptionInfo safely when sending system alerts?
Android 14/15 Broadcast Restrictions: With increasing platform restrictions on non-default SMS apps handling SMS_RECEIVED, what are your preferred patterns for zero-data telemetry failover?
Source code is available on the GitHub repository above. Any code reviews, PRs, or architecture critiques are welcome!