Shizuku is an app that runs the Shizuku Server so that apps that need this service can use it, such as App Ops. 'What is Shizuku Server?' you might be wondering. It's a process launched by root or ADB that can apply privileges that many apps don't have permission to.
You'll have to go through a somewhat complicated process to use Shizuku on a non-rooted smartphone. Luckily, the app has a tutorial explaining what to do step by step. You'll need a PC and a cable to connect your Android smartphone to the computer.
Shizuku is a useful app for those who don't have a rooted smartphone but want to use some permissions that usually require root privileges. One of the best examples is the previously mentioned App Ops, which you can use with the help of this app even if you don't have a rooted smartphone.
How does Shizuku work?
First, we have to talk about how the app uses the system API. For example, if the app wants to get installed apps, we all know that we must use the package manager. This is an interprocess communication (IPC) process of the app process and the system server process, just the Android framework did the internal work for us.
Android uses binders to perform this type of IPC. The binder allows the server-side to learn the uid and pid of the client-side so that the system server can check whether the app has permission to operate.
Generally, if there is a "manager" (for example, package manager) for the app to use, then there must be a "service" (for example, package manager service) in the system server process. We can simply think that if the app holds the binder of the "service", it can communicate with the "service". The app process will obtain the binders of system services when it starts.
Shizuku guides users to run the process, Shizuku Server, with root or ADB. When the app starts, the binder for Shizuku Server will also be sent to the app.
The most important feature Shizuku provides is an intermediary to receive requests from the app, send them to the system server, and send the results back. You can see the transactRemote method in the rikka.shizuku.server.ShizukuService class, and see the moe. Class for details.
So, we reached our goal, using the system API with high permission. And for the app, it is almost the same as using the system API directly.
