How Do We Identify the Owner of a Window?

Question

Suppose we have an Android device, and on that device are 1+ apps capable of creating their own floating windows (e.g., hold the SYSTEM_ALERT_WINDOW permission). Plus, of course, there can be other windows that are not necessarily independently floating (Spinner, Dialog, etc. all create their own windows via WindowManager, just for display over an existing activity).

Given that I know from developer tools a pixel coordinate inside a window, how can I determine the process or app that created the window containing that pixel? IOW, how can I find out who to blame for the existence of a given window?

I thought that perhaps adb shell dumpsys window would have that information, but if it does, I'm not seeing it.

Note that I am happy to settle for a solution involving development tools. I would hope that determining this information at runtime would be difficult or impossible without special privileges.

Answer 1

Running this command adb shell dumpsys input gives me the following output:

[...bunch of stuff...]

    6: name='Window{5e9310c u0 com.example.overlayservice/com.example.overlayservice.MainActivity}', 
    displayId=0, paused=false, hasFocus=true, hasWallpaper=false,
    visible=true, canReceiveKeys=true, flags=0x81810120, type=0x00000001, layer=21010, 
    frame=[0,0][1440,2560], scale=1.000000, touchableRegion=[0,0][1440,2560], 
    inputFeatures=0x00000000, ownerPid=4086, ownerUid=10083, dispatchingTimeout=5000.000ms

[...bunch more stuff..]

Since I am backing into this, I know that the app is "Overlay Service" that simply shows a system window. The "frame" information would bound the pixel and "ownerUid" would give more info about the owner. (I am thinking that this command is more than a disguised dumpsys window command that is not working for you.)

Although it is not exactly a "this pixel to this app" mapping, assuming that you are seeing the same information on your device, this technique can help to trim down the targets.

---

Alternate

The following is a more direct approach if you have access to the device or are on an emulator.

According to the documentation for dumpsys under the category of Input Dispatcher State,

Input dispatcher state

The InputDispatcher is responsible for sending input events to applications. As shown in the sample output below, its state dump shows information about which window is being touched, the state of the input queue, whether an ANR is in progress, and so on.

Reading further:

After touching the touch screen and running dumpsys at the same time, the TouchStates line correctly identifies the window that you are touching.

Specifically, the string "TouchStates: ..." will identify the window that we are touching at the time we run dumpsys.

So, we should be able to run dumpsys input and look for the string TouchStates and print the following few lines to identify the window. Here is my Windows command line:

timeout 3 & adb shell dumpsys input | grep TouchStates -A 5

And here is the output that identifies Window{e3cd95d u0 com.example.overlayservice/com.example.overlayservice.MainActivity}' as the window being touched.

TouchStatesByDisplay: 0: down=true, split=true, deviceId=0, source=0x00001002 Windows: 0: name='Window{e3cd95d u0 com.example.overlayservice/com.example.overlayservice.MainActivity}', pointerIds=0x80000000, targetFlags=0x107 Windows: 0: name='Window{ef28ce5 u0 NavigationBar}', displayId=0, paused=false, hasFocus=false, hasWallpaper=false, visible=true, canReceiveKeys=false, flags=0x21840068 , type=0x000007e3, layer=231000, frame=[0,1794][1080,1920], scale=1.000000, touchableRegion=[0,1794][1080,1920], inputFeatures=0x00000000, ownerPid=1632, ownerUid= 10027, dispatchingTimeout=5000.000ms

If no window is being touched, then you will see TouchStates: <no displays touched>.