How to Inspect Active Screen Recording and Media Projection Tokens on Android Using ADB dumpsys media_projection

Modern mobile operating systems must enforce strict privacy controls around display frame capture. Applications designed for screen recording, enterprise remote assistance, gameplay streaming, and Miracast/Chromecast casting require elevated operating system privileges to capture real-time display buffers. If left unmonitored or granted inadvertently, screen capture privileges present a severe security risk—allowing rogue applications or background malware to harvest passwords, banking credentials, and private messages directly from the display.

Android manages and isolates display capture sessions through the Media Projection Manager Service (media_projection). Whenever an application requests to record or stream the screen, Android requires explicit user consent through an interactive system dialogue and issues an ephemeral cryptographic token bound to the application process. Using the Android Debug Bridge (ADB), security auditors and mobile developers can inspect active projection sessions, granted tokens, and client package identities using dumpsys media_projection.

Understanding the Media Projection Framework

The Android MediaProjection API operates through a structured multi-stage security pipeline:

• Interactive Consent Prompt: The calling application invokes MediaProjectionManager.createScreenCaptureIntent(), prompting the user with a system-managed consent dialog warning that the app will capture everything displayed on screen.
• Token Issuance: Once granted by the user, the system generates an active IBinder token bound to the requesting process UID and package name.
• Virtual Display Binding: The application uses the token to instantiate a VirtualDisplay, directing raw hardware-rendered display frames into an ImageReader or video encoder surface.
• Foreground Service Requirement: Android 10 and newer strictly enforce that any app holding a media projection token must maintain an active foreground service displaying a persistent notification to the user.

Connecting to ADB and Querying Media Projection Status

Connect your Android test device to the administration workstation with USB debugging enabled. Confirm device responsiveness:

adb devices

To inspect the live operational state of the Media Projection service, run:

adb shell dumpsys media_projection

If no applications are currently recording or casting the screen, the service reports an idle state:

MediaProjectionManagerService:
  mActiveProjection: null
  mMediaProjectionSession: null

Inspecting an Active Screen Recording or Casting Session

When a screen recording tool (such as the native Android screen recorder, Google Meet, or a third-party streaming utility) is actively capturing frames, rerun dumpsys media_projection:

adb shell dumpsys media_projection

The diagnostic dump reveals granular process and session parameters:

MediaProjectionManagerService:
  mActiveProjection: MediaProjection{7f3a8b2}
    Package: com.google.android.apps.meetings
    UID: 10185
    Type: TYPE_SCREEN_CAPTURE
    VirtualDisplayId: 1
    TargetDisplayArea: Display#0 [1080x2400]
    ForegroundService: true
    CreationTime: 2026-11-08 00:01:10 UTC

Interpreting Critical Diagnostic Fields

When conducting security audits or debugging capture failures, evaluate the following fields in the dump output:

Field Name	Observed Value	Security and Operational Meaning
Package	Application package name (e.g. com.example.recorder)	Identifies the exact application binary currently capturing display frames
UID	Linux User ID (e.g. 10185)	The security sandboxed user context executing the capture process
Type	TYPE_SCREEN_CAPTURE or TYPE_MIRRORING	Specifies whether the session captures standard display contents or external mirror streams
VirtualDisplayId	Integer identifier	The virtual display instance allocated in SurfaceFlinger to route video frames
ForegroundService	true or false	Verifies that the required persistent status bar notification is active

Correlating Virtual Displays in SurfaceFlinger

To trace how the media projection session interfaces with the low-level graphics compositor, query SurfaceFlinger for active virtual displays:

adb shell dumpsys SurfaceFlinger --displays

Cross-reference the VirtualDisplayId reported by dumpsys media_projection with SurfaceFlinger’s display list to inspect color space formats, surface dimensions, and frame delivery refresh rates.

Auditing Foreground Service Compliance

If an untrusted background application attempts to hold a media projection token without maintaining a visible foreground notification, check the active services bound to the process UID:

adb shell dumpsys activity services | grep -B 2 -A 8 "com.google.android.apps.meetings"

Verify that the service defines foregroundServiceType="mediaProjection" in accordance with modern Android security requirements.

Revoking Active Projection Sessions

If an unauthorized application is detected holding a projection token, administrators can terminate the session immediately by stopping the background application package:

adb shell am force-stop com.example.suspiciousrecorder

Rerunning dumpsys media_projection confirms that the token has been destroyed and mActiveProjection has reverted to null.

By regularly inspecting dumpsys media_projection via ADB, Android security teams, developers, and QA engineers ensure screen recording and casting services operate transparently without leaking confidential user data.