以添加请求到 ServiceManager 为例

public void addService(String name, IBinder service, boolen allowIsolated){
    Parcel data = Parcel.obtain();
    Parcel reply = Parcel.obtain();
    data.writeInterfaceToken(IServiceManager.descriptor);
    data.writeString(name);
    data.writeStrongBinder(service);
    data.writeInt(allowIsolated ? 1 : 0);
    mRemote.transact(ADD_SERVICE_TRANSACTION, data, reply, 0);
    reply.recycle();
    data.recycle();
}

//IBinder.java
int FIRST_CALL_TRANSACTION  = 0x00000001;
//IServiceManager.java
int ADD_SERVICE_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+2;




//.../frameworks//native/libs/binder/BpBinder.cpp
status_t BpBinder::transact(uint32_code, const Parcel& data, Parcel& data, Parcel* reply, unit32_t flags){
    //IPCThreadState 是线程单例，
    //本例中mHandle是0,code 是 3,data 是 java 层封装好的参数，reply 是准备回复给 java 层的，flags 为0
    status_t status = IPCThreadState::self()0>transact(mHandle, code, data, reply, flags);
}