Introduction: Unlocking AAOS for Custom Voice Assistants

Android Automotive OS (AAOS) provides a powerful platform for in-car infotainment systems, featuring deep integration with vehicle hardware. While Google Assistant is the default voice interaction service, many developers and OEMs seek to integrate custom voice assistants for brand differentiation, specialized functionality, or enhanced privacy. This article delves into the intricate process of reverse engineering the default AAOS VoiceAgent and interacting with core system services, enabling advanced, non-Google Assistant voice integration.

Understanding and manipulating the underlying voice interaction framework requires a deep dive into Android’s accessibility and system service architecture, specifically targeting how voice commands are received, processed, and routed to vehicle-specific actions. We’ll explore the relevant Android components, necessary tools, and provide practical steps to achieve a custom voice assistant integration.

Understanding AAOS Voice Architecture

At the heart of Android’s voice interaction lies the VoiceInteractionService. This abstract class provides the core API for interacting with the system as a voice interaction service. In AAOS, a specific implementation of this service, often referred to as the “VoiceAgent,” acts as the primary intermediary for all voice-related input and output. It handles hotword detection, speech-to-text processing (ASR), natural language understanding (NLU), and ultimately dispatches commands to relevant applications or system services.

Key components in this architecture include:

• VoiceInteractionService: The system-level service that manages voice interactions. Only one can be active at a time.
• VoiceInteractionSession: A transient UI session initiated by the VoiceInteractionService to provide visual feedback and context during an interaction.
• CarService: The central AAOS service providing access to vehicle properties and hardware abstractions (e.g., climate, radio, navigation).
• System Broadcasts/Intents: Mechanisms through which the VoiceAgent can communicate with other apps or the system, and vice-versa.

Initial Reconnaissance: Identifying Key Components

Before diving into code, we need to identify the default VoiceAgent application package. This can typically be done using adb commands on a connected AAOS device or emulator.

First, identify the currently active voice interaction service:

adb shell settings get secure voice_interaction_service

This command will usually return a package name and service class (e.g., com.google.android.apps.auto.assistant/com.google.android.apps.auto.assistant.VoiceInteractionService or similar OEM-specific package). Let’s assume for this example it’s com.your_oem.voiceagent.

Next, locate the APK path for this package:

adb shell pm path com.your_oem.voiceagent

This will output something like package:/system/app/VoiceAgent/VoiceAgent.apk. Pull this APK to your local machine:

adb pull /system/app/VoiceAgent/VoiceAgent.apk

With the APK in hand, we can now use decompilation tools like apktool for resource extraction and jadx or Ghidra for Java/Smali code analysis.

Diving into the VoiceAgent APK

Decompiling and Analyzing the Manifest

Use apktool to decompile the APK:

apktool d VoiceAgent.apk -o VoiceAgent_decompiled

Navigate to the VoiceAgent_decompiled directory and examine AndroidManifest.xml. Look for the <service> tag declared with the android.service.voice.VoiceInteractionService intent filter. This confirms the primary VoiceAgent service.

<service android:name=".VoiceInteractionServiceImpl"android:permission="android.permission.BIND_VOICE_INTERACTION"android:exported="true"><meta-data android:name="android.voice_interaction"android:resource="@xml/voice_interaction_service" /><intent-filter><action android:name="android.service.voice.VoiceInteractionService" /></intent-filter></service>

Also, pay close attention to any custom permissions, broadcast receivers, or other services declared in the manifest, as these might indicate specific OEM extensions or communication channels.

Code Analysis with Jadx/Ghidra

Open the `VoiceAgent.apk` in `jadx-gui` or `Ghidra`. Focus on the class identified as the VoiceInteractionService implementation (e.g., VoiceInteractionServiceImpl.java). Key methods to investigate include:

• onReady(): Called when the service is initialized and ready to handle voice interactions.
• onStartCommand(Intent intent, int flags, int startId): Although `VoiceInteractionService` typically doesn’t use this directly for voice interaction, it might be used for background tasks or initial setup.
• onGet : VoiceInteractionSession(): Returns an instance of VoiceInteractionSession when voice interaction begins.
• Any methods related to hotword detection (e.g., `startListening()`, `stopListening()`).
• Any Binder interfaces or AIDL files defined, indicating inter-process communication with other system services or apps.

Look for how the ASR results are handled. Are they passed to an NLU engine locally or sent to a cloud service? How are the NLU results translated into system actions? You’ll likely find calls to `sendBroadcast()` with custom actions or direct calls to `CarService` methods.

Intercepting Voice Commands and Intents

While the VoiceAgent processes commands, you can observe its behavior using adb logcat. Filter logs for keywords like `VoiceInteraction`, `VoiceAgent`, `CarService`, or specific package names to understand the flow.

adb logcat | grep "VoiceInteraction|VoiceAgent|CarService"

This can reveal intents being broadcast, service calls, and the parsed commands. If the VoiceAgent uses custom intents to communicate with other car features, you can identify their actions and data structures this way.

Overriding or Replacing the Default VoiceAgent

The goal is to replace the default VoiceAgent with your custom implementation. First, create your own Android project and implement a class extending VoiceInteractionService.

// com.your.custom.package/YourCustomVoiceService.javaimport android.content.Intent;import android.os.Bundle;import android.service.voice.VoiceInteractionService;import android.service.voice.VoiceInteractionSession;import android.util.Log;public class YourCustomVoiceService extends VoiceInteractionService {    private static final String TAG = "CustomVoiceService";    @Override    public void onReady() {        super.onReady();        Log.d(TAG, "YourCustomVoiceService is ready!");        // You might start hotword detection here    }    @Override    public VoiceInteractionSession onNewSession(Bundle args) {        Log.d(TAG, "New VoiceInteractionSession created.");        return new YourCustomVoiceSession(this);    }    // Implement a simple VoiceInteractionSession    private static class YourCustomVoiceSession extends VoiceInteractionSession {        private static final String SESSION_TAG = "CustomVoiceSession";        public YourCustomVoiceSession(VoiceInteractionService service) {            super(service);        }        @Override        public void onShow(Bundle args, int flags) {            super.onShow(args, flags);            Log.d(SESSION_TAG, "Session shown, ready for input.");            // This is where you'd typically start your ASR process            // For demonstration, let's just respond programmatically            String response = "Hello from your custom voice assistant!";            getService().getVoiceInteractor().submitRequest(                new VoiceInteractor.Prompt(new CharSequence[]{response}), null            );            // After responding, you might want to finish the session            finish();        }        @Override        public void onHandleScreenshot(Bundle args) {            Log.d(SESSION_TAG, "Screenshot requested.");            super.onHandleScreenshot(args);        }    }}

Declare this service in your AndroidManifest.xml:

<service android:name=".YourCustomVoiceService"android:permission="android.permission.BIND_VOICE_INTERACTION"android:exported="true"><meta-data android:name="android.voice_interaction"android:resource="@xml/your_voice_interaction_service" /><intent-filter><action android:name="android.service.voice.VoiceInteractionService" /></intent-filter></service>

And create res/xml/your_voice_interaction_service.xml:

<voice-interaction-serviceandroid:supportsAssist="true"android:canReceiveDisplayPhones="true"android:supportsLaunchVoiceAssistant="true" />

After installing your custom APK as a system app (requiring root or signed firmware), you can set it as the default VoiceInteractionService:

adb shell settings put secure voice_interaction_service com.your.custom.package/com.your.custom.package.YourCustomVoiceService

Reboot the device or restart relevant services. Your custom service should now be active.

Interacting with AAOS System Services

A custom voice assistant is only useful if it can control the vehicle. This is primarily achieved through CarService. To interact with CarService, your app needs the necessary permissions (e.g., android.car.permission.CAR_POWERTRAIN, android.car.permission.CONTROL_CLIMATE) and must be signed with the system signature or installed as a privileged system app.

import android.car.Car;import android.car.CarNotConnectedException;import android.car.hardware.CarPropertyManager;import android.content.ComponentName;import android.content.ServiceConnection;import android.os.IBinder;import android.util.Log;public class CarServiceHelper {    private static final String TAG = "CarServiceHelper";    private Car mCar;    private CarPropertyManager mCarPropertyManager;    private Context mContext;    public CarServiceHelper(Context context) {        mContext = context;        mCar = Car.createCar(mContext, mServiceConnection);    }    public void connect() {        if (mCar != null && !mCar.isConnected()) {            mCar.connect();        }    }    public void disconnect() {        if (mCar != null) {            mCar.disconnect();        }    }    private final ServiceConnection mServiceConnection = new ServiceConnection() {        @Override        public void onServiceConnected(ComponentName name, IBinder service) {            try {                Log.d(TAG, "CarService connected.");                mCarPropertyManager = (CarPropertyManager) mCar.getCarManager(Car.PROPERTY_SERVICE);                // Example: Read current fan speed                int fanSpeed = mCarPropertyManager.getIntProperty(                    CarPropertyManager.SENSOR_FAN_SPEED_LEVEL, 0);                Log.d(TAG, "Current fan speed: " + fanSpeed);                // Example: Set fan speed (requires permission)                mCarPropertyManager.setIntProperty(                    CarPropertyManager.HVAC_FAN_SPEED, 0, 3);            } catch (CarNotConnectedException e) {                Log.e(TAG, "Car not connected", e);            } catch (Exception e) {                Log.e(TAG, "Error getting CarPropertyManager", e);            }        }        @Override        public void onServiceDisconnected(ComponentName name) {            Log.d(TAG, "CarService disconnected.");        }    };}

By integrating this helper into your YourCustomVoiceSession, you can parse voice commands like