Always-listening services are a defining feature of modern Android, enabling capabilities such as keyword spotting, music recognition, and adaptive audio. Despite their ubiquity, these services remain opaque: users lack visibility into when audio is recorded, where it is processed, and how it's used. Their infrastructure encompasses specialized hardware, low-level system frameworks, machine learning models, and proprietary applications, making them challenging to analyze. We present the first systematic analysis of Android's always-listening ecosystem. We develop a reverse engineering approach that reconstructs the architecture, maps key functions through static analysis, and uses dynamic instrumentation to characterize runtime behaviors. Applying this methodology, we extract and analyze the machine learning models powering these services, uncover undocumented triggers for audio capture, and evaluate a new class of unintentional activations we call "local misactivations". We reveal that keyword spotting and music recognition models can misactivate up to 58 times per hour, capturing several seconds of audio each time without issuing notifications to the user. We further quantify the resource cost of these misactivations, showing that each event increases device power consumption by 18–81% over idle and consumes 305–454 ms of CPU time on the application processor. Our work highlights the need for greater transparency and user control for always-listening services on mobile devices.