Dynamic Code Loading

I've been looking for a way to upgrade an Android application without any interaction with the user, and pushed through several options. Along the way, I found a few dusty corners of Android which I think are worth mentioning.

The first thing I wanted to try is just remotely installing an application - download it from some server, and then install it. Long story short: can't be done. Applications don't have the security permissions to install other applications. Certainly, that's a good thing, and it was a relief to see that it isn't so easy.

So then I thought "Why not just use a framework that dynamically loads some class files and executes them on some standard interface, such as Runnable. As I expected, I wasn't the first to think this. It turns out that some really sharp guys got it running for Apache Felix, which is a framework that does basically what I'm looking to do. But the trick is, they did it with 0.9 of the SDK. When Google put out 1.0, they changed some permissions so that it would no longer work. The in's and out's of this are interesting, so let's delve a little deeper.

As you may know, Android uses a custom VM called dalvik to run Java. Why? Maybe just to circumvent Sun, but my guess is they have some other trick up their sleeves. Dalvik doesn't use standard Java .class files, but instead uses .dex files - a format that has yet to be finalized (They're still fiddling with the opcodes). With an ordinary JVM, a developer could download a jar, unpack it, and use the classes inside. With dalvik, developers need to re-code their .class files into .dex files before loading them. That gets done by a tool called dx that ships with the Android SDK. So far, so good. Now, standard java class loaders can't handle .dex files, so the use of a different class loader is needed. Here's where it gets problematic. 

First of all, there's no documentation. Up until October, that was no problem. But when Google released SDK 1.0, they locked up some security. Now the undocumented class loader puts the bytes of the unpacked class into a part of the disk that only the system has access to. If an application tries to load a class there, it fails the permissions check. Is there a workaround? Not that I can find or figure out. Luckily, I'm not the only one trying to do this. In fact, Google is going to be officially releasing a dynamic code loading API in Cupcake. Those of you with Macs or Linux boxes can download the source and see it in action. But if you're looking to put something on the Market now that can load code dynamically, I'm afraid you're just out of luck.