diff --git a/cmds/cmd/cmd.cpp b/cmds/cmd/cmd.cpp
index 01d0a47..ed740d3 100644
--- a/cmds/cmd/cmd.cpp
+++ b/cmds/cmd/cmd.cpp
@@ -90,6 +90,7 @@
     }
 
     // TODO: block until a result is returned to MyResultReceiver.
-    service->shellCommand(STDIN_FILENO, STDOUT_FILENO, STDERR_FILENO, args, new MyResultReceiver());
+    IBinder::shellCommand(service, STDIN_FILENO, STDOUT_FILENO, STDERR_FILENO, args,
+            new MyResultReceiver());
     return 0;
 }
diff --git a/include/binder/BpBinder.h b/include/binder/BpBinder.h
index 88cfbf6..7ef93aa 100644
--- a/include/binder/BpBinder.h
+++ b/include/binder/BpBinder.h
@@ -35,8 +35,6 @@
     virtual bool        isBinderAlive() const;
     virtual status_t    pingBinder();
     virtual status_t    dump(int fd, const Vector<String16>& args);
-    virtual status_t    shellCommand(int in, int out, int err, Vector<String16>& args,
-                                     const sp<IResultReceiver>& resultReceiver);
 
     virtual status_t    transact(   uint32_t code,
                                     const Parcel& data,
diff --git a/include/binder/IBinder.h b/include/binder/IBinder.h
index a25dc7f..97f1fc2 100644
--- a/include/binder/IBinder.h
+++ b/include/binder/IBinder.h
@@ -77,7 +77,8 @@
     virtual bool            isBinderAlive() const = 0;
     virtual status_t        pingBinder() = 0;
     virtual status_t        dump(int fd, const Vector<String16>& args) = 0;
-    virtual status_t        shellCommand(int in, int out, int err, Vector<String16>& args,
+    static  status_t        shellCommand(const sp<IBinder>& target, int in, int out, int err,
+                                         Vector<String16>& args,
                                          const sp<IResultReceiver>& resultReceiver);
 
     virtual status_t        transact(   uint32_t code,
diff --git a/libs/binder/Binder.cpp b/libs/binder/Binder.cpp
index c459d3f..c4d47ca 100644
--- a/libs/binder/Binder.cpp
+++ b/libs/binder/Binder.cpp
@@ -61,16 +61,21 @@
 }
 
 
-status_t IBinder::shellCommand(int /*in*/, int out, int /*err*/, Vector<String16>& /*args*/,
-    const sp<IResultReceiver>& resultReceiver)
+status_t IBinder::shellCommand(const sp<IBinder>& target, int in, int out, int err,
+    Vector<String16>& args, const sp<IResultReceiver>& resultReceiver)
 {
-    if (out >= 0) {
-        dprintf(out, "Shell commands not supported.\n");
+    Parcel send;
+    Parcel reply;
+    send.writeFileDescriptor(in);
+    send.writeFileDescriptor(out);
+    send.writeFileDescriptor(err);
+    const size_t numArgs = args.size();
+    send.writeInt32(numArgs);
+    for (size_t i = 0; i < numArgs; i++) {
+        send.writeString16(args[i]);
     }
-    if (resultReceiver != NULL) {
-        resultReceiver->send(INVALID_OPERATION);
-    }
-    return NO_ERROR;
+    send.writeStrongBinder(resultReceiver != NULL ? IInterface::asBinder(resultReceiver) : NULL);
+    return target->transact(SHELL_COMMAND_TRANSACTION, send, &reply);
 }
 
 // ---------------------------------------------------------------------------
@@ -230,7 +235,11 @@
             sp<IResultReceiver> resultReceiver = IResultReceiver::asInterface(
                     data.readStrongBinder());
 
-            return shellCommand(in, out, err, args, resultReceiver);
+            // XXX can't add virtuals until binaries are updated.
+            //return shellCommand(in, out, err, args, resultReceiver);
+            if (resultReceiver != NULL) {
+                resultReceiver->send(INVALID_OPERATION);
+            }
         }
 
         case SYSPROPS_TRANSACTION: {
diff --git a/libs/binder/BpBinder.cpp b/libs/binder/BpBinder.cpp
index 5cf720c..c0e0296 100644
--- a/libs/binder/BpBinder.cpp
+++ b/libs/binder/BpBinder.cpp
@@ -157,23 +157,6 @@
     return err;
 }
 
-status_t BpBinder::shellCommand(int in, int out, int err, Vector<String16>& args,
-    const sp<IResultReceiver>& resultReceiver)
-{
-    Parcel send;
-    Parcel reply;
-    send.writeFileDescriptor(in);
-    send.writeFileDescriptor(out);
-    send.writeFileDescriptor(err);
-    const size_t numArgs = args.size();
-    send.writeInt32(numArgs);
-    for (size_t i = 0; i < numArgs; i++) {
-        send.writeString16(args[i]);
-    }
-    send.writeStrongBinder(resultReceiver != NULL ? IInterface::asBinder(resultReceiver) : NULL);
-    return transact(SHELL_COMMAND_TRANSACTION, send, &reply);
-}
-
 status_t BpBinder::transact(
     uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
 {