How to Inspect Media Projection and Screen Recording Sessions on Android Using ADB dumpsys media.projection

In modern Android architecture, applications that capture the screen—such as streaming utilities, video meeting apps, screen recorders, and remote desktop clients—cannot directly access framebuffers or window surfaces. Instead, all screen capture and display casting flows must authenticate through the Android MediaProjection API, governed by the system service media.projection (implemented in MediaProjectionManagerService). With Android 14 and Android 15 introducing granular partial screen sharing (single app sharing) and user re-consent mandates, auditing active projection tokens, recording sessions, and app package IDs is critical for mobile security analysis. Through Android Debug Bridge (ADB), engineers can query this entire subsystem using dumpsys media.projection.

Architecture of the Media Projection Framework

The media.projection service enforces strict security boundaries between capturing apps and system rendering buffers:

• User Consent Dialog: When an app calls MediaProjectionManager.createScreenCaptureIntent(), the system displays a mandatory security prompt asking the user to authorize capture (full display vs single application task).
• Projection Token (IBinder): Upon authorization, the service issues a unique cryptographic Binder token representing the granted session.
• Virtual Display Attachment: The capturing app passes the token to createVirtualDisplay(), which directs SurfaceFlinger to render the display or targeted task hierarchy to an app-provided Surface or ImageReader.
• Lifecycle & Revocation: The service tracks foreground service requirements, task closures, and screen lock events, revoking the token immediately when conditions violate privacy policies.

Querying the Media Projection Subsystem via ADB

Connect your Android device with USB debugging authorized and execute the diagnostic command in your terminal:

adb shell dumpsys media.projection

The output reports currently active projection sessions, granted tokens, client UID mappings, and session history.

Analysing Key Diagnostic Output Sections

1. Active Media Projection Session Details

When an application is actively mirroring or capturing the screen, dumpsys media.projection outputs the live session parameters:

Media Projection:
  mProjectionGrant:
    Package: com.example.screenrecorder
    UID: 10184
    Target Type: ENTIRE_DISPLAY
    Virtual Display ID: 2
    Creation Time: 2026-11-08 10:42:15
    Is Foreground Service Active: true
    Token: android.os.BinderProxy@3a41b2e

Key attributes provide vital security verification:

• Package / UID: Identifies the exact application process consuming the screen capture feed.
• Target Type: On Android 14+, confirms whether the app is recording the ENTIRE_DISPLAY or a restricted SINGLE_TASK (partial screen sharing).
• Virtual Display ID: The ID of the virtual display surface managed by DisplayManagerService.
• Is Foreground Service Active: Verifies that the capturing application maintains a valid foreground service notification with the mediaProjection service type.

2. Idle State Verification

When no application is actively capturing or casting the screen, the service outputs an empty status:

Media Projection:
  mProjectionGrant: null
  mCallback: null

This provides an immediate, foolproof check during security malware audits to confirm that no hidden background spyware or remote monitoring trojan is silently recording the user’s screen.

Inspecting Display Hierarchy Linkages

When a virtual display is spawned by a media projection session, you can cross-reference the Virtual Display ID with dumpsys display to check capture resolution, refresh rates, and color formats:

adb shell dumpsys display | grep -A 8 -i "VirtualDisplay"

This confirms whether the capturing application is downsampling the frame (e.g., rendering at 720p to conserve memory) or capturing at full native resolution (1080p / 1440p).

Monitoring Foreground Service Types

Android 14 requires apps initiating media projections to declare and run a foreground service with the specific type foregroundServiceType=\"mediaProjection\". To verify that an active capture app complies with this mandate:

adb shell dumpsys activity services com.example.screenrecorder | grep -i "foregroundServiceType"

If an app attempts screen capture without an active foreground service of this type, Android terminates the projection grant with a SecurityException.

Terminating Unauthorized Recording Sessions via ADB

If an app becomes unresponsive during capture or you need to forcibly revoke a projection session during QA regression testing, terminate the holding process using ADB:

adb shell am force-stop com.example.screenrecorder

Executing dumpsys media.projection immediately afterwards will confirm that mProjectionGrant has reverted to null, and the associated virtual display surface has been torn down.

Utilising dumpsys media.projection equips mobile security analysts and QA engineers with definitive verification of screen capture activities, ensuring strict adherence to modern Android privacy controls.