BINDER-CALL(1)

📦 version 1.1.54, in ubuntu stonking

💖 BINDER-CALL(1) — the user command era 💖

okay bestie, pull up a chair because we're about to talk to binder services from the actual command line and it's giving main character energy ✨

🌸 NAME 🌸

binder-call — do binder transactions straight from the command line, no C++ required 💅

✨ SYNOPSIS ✨

binder-call [OPTION...] NAME CODE [VALUE1 [VALUE2 ...]]  [reply [TYPE1 [TYPE2 ...]]]

🦋 DESCRIPTION 🦋

so basically binder-call sends a transaction to the binder service called NAME — and yeah, that's the name it was registered with in servicemanager. and the transaction code CODE? it absolutely has to be >= 1. no zeros allowed, we don't do that here 🙅‍♀️

the optional VALUE arguments are literally the transaction data parcel. and bestie, these values can be integers, floats, strings, structs, or vectors — all formatted according to the type descriptions down below in ARGUMENT FORMAT, okay? by default everything is interpreted as HIDL, but flip the --aidl switch and boom, you get AIDL semantics instead. slay.

if the transaction expects a reply, you write the keyword reply and then a lil list of type specifiers that describe the reply parcel layout. the reply gets printed out in a human-readable form, no cap. 🎀

you can also pick which binder device you wanna talk to with --device. and if you want a one-way transaction (aka no reply at all, ghosting the service fr fr), just pass --oneway.

💅 OPTIONS 💅

  • -d, --device=DEVICE — which binder device to use. the default is _/dev/binder_... ok it's literally /dev/binder 🌈
  • -o, --oneway — use a one-way transaction, meaning no reply is expected. she said don't text back 💀
  • -a, --aidl — treat argument and reply types as AIDL instead of HIDL
  • -v, --verbose — turn on verbose output, for when you need ALL the tea 🍓
  • -q, --quiet — suppress non-error messages. silence is golden ✨
  • -h, --help — show help options. the classic 🫶

🧚 ARGUMENT FORMAT 🧚

values that come before reply can be written like this:

[0-9]*:8  8‑bit integer
[0-9]*    32‑bit integer
[0-9]*L   64‑bit integer
[0-9]*.[0-9]*  32‑bit float
[0-9]*.[0-9]*L 64‑bit double
"[^"]*"   8‑bit AIDL string
"[^"]*"u  UTF‑16 AIDL string
"[^"]*"h  8‑bit HIDL string
{ V1 V2 ... VN }    struct containing the given values
[ V1 V2 ... VN ]    vector of length N (all values must share the same type)

and the reply type specifiers — the ones you put after reply — are:

i8   8‑bit integer
i32  32‑bit integer
i64  64‑bit integer
s8   8‑bit AIDL string
s16  UTF‑16 AIDL string
hstr 8‑bit HIDL string
f or float     32‑bit float
d or double    64‑bit double
[ TYPE ]  vector of TYPE
{ TYPE1 TYPE2 ... } struct with the given member types
not me reminding you that vectors need every single value to share the same type 👀 she's picky but she's valid

🔥 EXAMPLE 🔥

let's call the getSensorsList method (transaction code 1, iconic) on the HIDL sensors service and decode the returned vector of sensor structs:

binder-call -d /dev/hwbinder \
  android.hardware.sensors@1.0::ISensors/default 1 \
  reply i32 "[ { i32 i32 hstr hstr i32 i32 hstr f f f i32 i32 i32 hstr i32 i32 } ]"

👑 SEE ALSO 👑

Project repository: https://github.com/mer-hybris/libgbinder

and that's the whole page bestie, you're officially certified in command-line binder transactions 🎓✨

this was brought to you by libgbinder, dated 2026-05-07 — go forth and make transactions, mwah 💖

📦 where this page comes from