How does an Android system application restart after you kill it on Rooted devices? So to clarify, I would like to know how a system app is able to resurrect itself (auto start) after I issue a kill command. There are ways to remove apps, by using apps-removal apps as well as directly using rm command to physically erase the apk/odex and folders. And there are plenty of answers on this around. My question is related to the auto-starting "mechanism" itself. That is, is there some xml file and some main process running that checks it? Or something like that. For reference, I'm using Android 6.0.1 and MIUI 8.5.3 on a Rooted device.

Basically I'm exploring the possibility that some system apps which you remove (and then they send your phone into bootloop) are not required, but the checking/trying-to-start process is what makes it loop. The reasoning is that, aside from "application stopped working" error, the system seems unaffected. So it's the message that's creating the problem and whatever is behind generating it. This answer will enable me to test out this possibility, and post any findings here. 

Edit1: 
So looks like the answer to half of my own question, (assuming no other "black magic" is going on such as another app checking status...) - restarting is most likely achieved via BroadcastReceiver.

An app can Register a Broadcast Receiver for System Events. The way it works is, when an event happens on the system (USB is plugged in, internet is detected etc) a Broadcast is sent out to all the apps which are Registered to listen for this event. An app can register through its AndroidManifest.XML or pragmatically. But the main part of the question is - where is this registry and how is it possible to alter it (on a rooted device of course)

Edit2: A bit more info. If I do ps, the process shows as normal:

finddevice [....] SyS_epoll_ 7f83b48c54 S com.xiaomi.finddevice


But if I rename a folder of this system process (to disable it), and then kill the process, seems it's binder thread (binder_thr) trying to bring it back to life:

finddevice [....] binder_thr 7f83b48d44 S com.xiaomi.finddevice


And as soon as I rename the folder back to original, it starts it right back displaying as SyS_epoll_
I couldn't comprehend this code much but the information about receivers seems to be kept only in memory (no index file in internal storage). You can use the following command to see which receiver is registered for which type of broadcast.

adb shell dumpsys package


As for disabling a particular receiver, try Elixir 2. You can go into its Applications section, choose your app and then scroll down to find the receivers (static). Next to them would be the option to disable that component. 

Another option is to use ReceiverStop Xposed module. Its free version allows disabling receivers for user-installed apps only.

As for command-line, if you know the name of the receiver/component, you could do:

adb shell su -c 'pm disable PKG/COMP'         # where PKG is package name of the app and COMP is the component you intend to disable.


That said, I did not test whether the said solutions work for dynamically registered receivers.