//Messenger实现了Parcelable接口，因此可以跨进程传输
public final class Messenger implements Parcelable {
 ...............
}

public final class Messenger implements Parcelable {
 private final IMessenger mTarget;

 public Messenger(Handler target) {
  mTarget = target.getIMessenger();
 }
 ...........
}

 .............
 final IMessenger getIMessenger() {
  synchronized (mQueue) {
   if (mMessenger != null) {
    return mMessenger;
   }
   //返回的是Handler中定义的MessengerImpl
   mMessenger = new MessengerImpl();
   return mMessenger;
  }
 }

 //此处MessengerImpl继承自IMessenger.Stub
 //容易看出MessengerImpl将作为Binder通信的接收端
 private final class MessengerImpl extends IMessenger.Stub {
  public void send(Message msg) {
   msg.sendingUid = Binder.getCallingUid();
   Handler.this.sendMessage(msg);
  }
 }

 //在A进程中将Binder信息写入到Parcel中
 public void writeToParcel(Parcel out, int flags) {
  out.writeStrongBinder(mTarget.asBinder());
 }

 public static final Parcelable.Creator<Messenger> CREATOR
   = new Parcelable.Creator<Messenger>() {
  //在B进程中，重新创建Binder
  public Messenger createFromParcel(Parcel in) {
   IBinder target = in.readStrongBinder();

   //调用Messenger的另一个构造函数
   return target != null ? new Messenger(target) : null;
  }

  public Messenger[] newArray(int size) {
   return new Messenger[size];
  }
 };

public Messenger(IBinder target) {
 //得到的是Binder通信的客户端
 mTarget = IMessenger.Stub.asInterface(target);
}

public void send(Message message) throws RemoteException {
 //mTarget为Binder通信的客户端，将消息发送给服务端的send函数
 //即服务端Handler的MessengerImpl的send函数
 //上文已经附上了对应代码，可以看到对应的消息将递交给Handler处理
 mTarget.send(message);
}

  .....................
  <activity android:name=".MainActivity">
   <intent-filter>
    <action android:name="android.intent.action.MAIN"/>

    <category android:name="android.intent.category.LAUNCHER"/>
   </intent-filter>
  </activity>

  <service
   android:name=".RemoteService"
   android:enabled="true"
   android:exported="true"
   <!--指定服务运行在其它进程-->
   android:process=".remote">
  </service>
  ..............

public class MainActivity extends AppCompatActivity {
 private Button mButton;

 @Override
 protected void onCreate(Bundle savedInstanceState) {
  super.onCreate(savedInstanceState);
  setContentView(R.layout.activity_main);

  //打印Activity的pid及所在进程名称
  Log.d("ZJTest", "Activity, pid: " + Process.myPid() +
    ", name: " + Util.getProcessName(this));

  //启动服务
  startService();

  //绑定服务
  bindService();

  mButton = (Button) findViewById(R.id.test_button);
  mButton.setEnabled(false);
  //点击按键后，利用Messenger向Service发送消息
  mButton.setOnClickListener(new View.OnClickListener() {
   @Override
   public void onClick(View v) {
    if (mMessenger != null) {
     try {
      Message msg = Message.obtain();
      msg.what = 1;
      mMessenger.send(msg);
     } catch (RemoteException e) {
      Log.d("ZJTest", e.toString());
     }
    }
   }
  });
 }

 @Override
 public void onDestroy() {
  super.onDestroy();
  unBindService();
  stopService();
 }

 private Intent mIntent;
 private void startService() {
  mIntent = new Intent(this, RemoteService.class);
  this.startService(mIntent);
 }

 private ServiceConnection mServiceConnection;
 private void bindService() {
  mServiceConnection = new LocalServiceConnection();
  this.bindService(mIntent, mServiceConnection, BIND_AUTO_CREATE);
 }

 Messenger mMessenger;
 private class LocalServiceConnection implements android.content.ServiceConnection {
  @Override
  public void onServiceConnected(ComponentName name, IBinder service) {
   //绑定服务后，获得Messenger并激活Button
   mMessenger = new Messenger(service);
   mButton.setEnabled(true);
  }

  @Override
  public void onServiceDisconnected(ComponentName name) {
   mButton.setEnabled(false);
  }
 }

 private void stopService() {
  stopService(mIntent);
 }

 private void unBindService() {
  unbindService(mServiceConnection);
 }
}

public class RemoteService extends Service {
 private Messenger mMessenger;

 @Override
 public void onCreate() {
  super.onCreate();

  //同样打印进程号及名称
  Log.d("ZJTest", "Service, pid: " + Process.myPid()
    + ", name: " + Util.getProcessName(this));

  LocalHandler mHandler = new LocalHandler();

  mMessenger = new Messenger(mHandler);
 }

 private static class LocalHandler extends Handler{
  @Override
  public void handleMessage(Message msg) {
   Log.d("ZJTest", "receive msg: " + msg.what);
  }
 }

 @Override
 public IBinder onBind(Intent intent) {
  //被绑定时，返回Messenger
  return mMessenger.getBinder();
 }
}

class Util {
 static String getProcessName(Context context) {
  int pid = Process.myPid();
  ActivityManager am = (ActivityManager) context
    .getSystemService(Context.ACTIVITY_SERVICE);

  for (ActivityManager.RunningAppProcessInfo appProcessInfo:
    am.getRunningAppProcesses()) {
   if (appProcessInfo.pid == pid) {
    return appProcessInfo.processName;
   }
  }

  return null;
 }
}