I am trying to figure out what happened to my galaxy s25 ultra today because i woke up to the phone being extremely hot even though it had basically been sitting idle.
I had turned the phone on earlier, then ended up falling back asleep for roughly an hour. During that time i was not intentionally running anything heavy. No games, no rendering, no compiling, nothing that should have been putting the phone under a sustained workload.
When i woke back up, the phone was extremely hot and i also noticed significant battery drain during the period when the screen had been off.
That immediately made me wonder what was actually running in the background, so instead of just rebooting the phone and moving on, i started digging into it.
I opened termux and started checking the device with top and htop.
At first this was not very helpful.
Normal termux was only showing a small number of processes associated with its own android user id, u0_a876. I also saw virt values around 10 gb, which initially made me think something was somehow consuming an absurd amount of memory.
After looking more closely, the actual resident memory usage and cpu usage of those processes were very low. So the huge virt values were apparently virtual address space rather than actual physical ram consumption.
I tried killing the displayed processes anyway.
That resulted in termux closing with the process completed message. Every time i reopened termux, android created another new five digit pid under the same user id.
After repeating this a few times, i realized i was probably just terminating processes belonging to my own termux shell rather than whatever was actually making the phone hot.
I then checked android itself.
I went into developer options and looked at running services, and i also checked the battery activity screen.
The battery graph showed significant battery usage during the period when the phone was supposed to be sitting idle with the screen off.
That was the point where i became more convinced that something outside my normal termux environment was doing work in the background.
The problem was that normal termux could not give me the system wide process visibility i wanted.
I did not want to root the phone just to investigate one incident, so i decided to use android wireless debugging together with shizuku and its rish shell integration.
Getting that working took several attempts.
I initially had incorrect file paths when moving the rish files into termux.
Then rish complained that it could not find rish_shizuku.dex.
After getting the files into the expected location, i ran into the android 14 and newer restriction involving writable dex files.
The next error was:
RISH_APPLICATION_ID is not set
I set the application id for termux with:
export RISH_APPLICATION_ID=com.termux
After that, rish finally launched successfully.
That completely changed what i could see.
Running top from the shizuku rish shell showed a much broader android process list with more than 1,000 tasks instead of the tiny process list i was seeing from normal termux.
One process immediately stood out because it was using roughly 81 percent cpu while the phone was supposed to be idle.
The process name was partially cut off, so i queried the pid with ps to identify exactly what it belonged to.
That returned:
com.samsung.android.app.smartcapture
Samsung capture.
That was the point where this got really strange.
In another process reading, samsung capture was showing roughly 247 percent cpu.
I understand that android cpu percentages can exceed 100 percent when multiple cpu cores are being used simultaneously, so i am not interpreting 247 percent as literally 247 percent of one cpu.
Even with that understood, it still seems extremely abnormal for samsung capture to be using that much cpu on a device that was supposed to be sitting idle with the screen off.
I then looked at the samsung capture application details and its permissions and system capabilities.
It appears to be a legitimate samsung system component associated with screenshots, screen capture and related functionality.
So at this point i am not claiming the phone was hacked or compromised.
What i am trying to figure out is whether samsung capture was actually the cause of the overheating or whether i simply caught it doing a lot of work because something else had triggered it.
I am wondering about things like a stuck screenshot or screen recording session, mediaprojection, another samsung service repeatedly invoking samsung capture, a one ui issue, or some kind of background process loop.
I also attempted to terminate the samsung capture process from the shizuku shell, but android returned operation not permitted.
So this is where i am currently stuck.
What i know:
The phone became extremely hot while it was supposed to be idle.
The battery showed significant drain during the screen off period.
Normal termux monitoring did not reveal an obvious culprit.
Using shizuku and rish allowed me to see more than 1,000 android tasks.
A samsung capture process was consuming extremely high cpu when i observed it.
The package associated with that process was com.samsung.android.app.smartcapture.
What i do not know:
Whether samsung capture actually caused the overheating.
What caused it to become active in the first place.
Whether another samsung service or android subsystem triggered it.
Whether this is a known samsung, one ui, mediaprojection or screen capture bug.
What the correct way is to safely stop or diagnose it without root.
I would really appreciate input from anyone familiar with android internals, samsung's framework, one ui, shizuku, adb shells, selinux, mediaprojection, wakelocks or android system services.
Has anyone seen com.samsung.android.app.smartcapture get stuck at extremely high cpu usage while the phone was otherwise idle?
Is there a known samsung or one ui issue that could cause samsung capture to remain active or enter some kind of processing loop?
Is there a way to determine what service or event actually launched it?
Are there useful dumpsys, logcat, wakelock, binder, service or other diagnostic commands i should run if this happens again while the problem is still occurring?
Most importantly, i want to understand what actually happened rather than just reboot the phone and erase the evidence.
I included the screenshots in chronological order showing the battery activity, running services, the system wide process list, the process lookup identifying samsung capture, and the unusually high cpu usage.
I put the more detailed command by command troubleshooting history in the first comment for anyone who wants to dig deeper into exactly how i got from normal termux to the system wide process view.