Android逆向 adb总结

adb 常用命令

模拟器需要链接手机调试
adb connect 127.0.0.1:7555

https://github.com/mzlogin/awesome-adb

adb 实现原理

https://www.jianshu.com/p/6769bfc3e2da

adb 最后时通过socket 传输命令

PC端有一个socket是 adb-client 和 adb-server；
adb-server 再和手机端的adbd通讯

数据包格式：
http://androidxref.com/9.0.0_r3/xref/system/core/adb/protocol.txt
struct message {
unsigned command; /* command identifier constant (A_CNXN, ...) /
unsigned arg0; / first argument /
unsigned arg1; / second argument /
unsigned data_length; / length of payload (0 is allowed) /
unsigned data_crc32; / crc32 of data payload /
unsigned magic; / command ^ 0xffffffff */
};

实现过程：

package com.android.motionelf.tools;

import android.annotation.TargetApi;
import android.os.Build;
import java.io.BufferedInputStream;
import java.io.BufferedOutputStream;
import java.io.ByteArrayOutputStream;
import java.io.Closeable;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.math.BigInteger;
import java.net.InetAddress;
import java.net.Socket;
import java.net.UnknownHostException;
import java.nio.ByteBuffer;
import java.nio.ByteOrder;
import java.nio.charset.StandardCharsets;
import java.util.Arrays;

public class SimpleAdbUtils {

    public String getString(ByteBuffer buffer) {
        byte[] byteArray = buffer.array();
        char[] hexArray = "0123456789ABCDEF".toCharArray();
        char[] hexChars = new char[byteArray.length * 2];
        for (int j = 0; j < byteArray.length; j++) {
            int v = byteArray[j] & 0xFF;
            hexChars[j * 2] = hexArray[v >>> 4];
            hexChars[j * 2 + 1] = hexArray[v & 0x0F];
        }
        return new String(hexChars);
    }

    public static final int A_SYNC = 0X434E5953;
    public static final int A_CNXN = 0X4E584E43;
    public static final int A_AUTH = 0X48545541;
    public static final int A_OPEN = 0X4E45504F;
    public static final int A_OKAY = 0X59414B4F;
    public static final int A_CLSE = 0X45534C43;
    public static final int A_WRTE = 0X45545257;

    public static void main(String args[]) {
        String[] v0 = new String[3];
        SimpleAdbUtils simpleAdbUtils = new SimpleAdbUtils();
   
        try {
            simpleAdbUtils.tcpip5555(5555, v0);
        } catch (IOException v0_1) {
            v0_1.printStackTrace();
        }
        return;
    }

    public class AdbException extends IOException {
        public AdbException() {
            super();
        }
    }

    public class message {
        public int commond;
        public int b;
        public int c;
        public int d;
        public byte[] e;

        public message() {
            super();
        }
    }

    public final BigInteger a;
    public final BigInteger b;
    public final String c;
    public int d;
    public static byte[] e;

    static {
        SimpleAdbUtils.e = new byte[]{0, 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 0, 0x30, 33, 0x30, 9, 6, 5, 43, 14, 3, 2, 26, 5, 0, 4, 20};
    }

    public SimpleAdbUtils() {
        super();
        this.d = 0;
        this.c = "QAAAAMX7NM/zNF0rm8UwGpkYyPPtelfR3dKH9+hSR+neEUUzbZLkqg9iQgDQCV7tlbXVYd9be/moIwDi1fGHvHK/bv27AliJVPu6yxTkYee0Z2ro54Q8gP/iffKEme+q1sZFNGXWUJmv0ccyJH/l5+HroCPDH4MTVj4FNPjQqoh5kdzeQXNLKSyNUFZIV+IC+DG4wAbbJfTMTd+jup9cHY89LFxnIOxi+VHyDrBY+JFG95gMZgjvkXa0KFzE+BHfXOI2H7OtN96dVGAWZyeWtC72P/HxBm4jTv44s+R5JzuuLX56KFfAzLe5WAMOuRMg4y/+UsGYfIOtzj0hYIYDLxxbTLVknvTJifbvd84bKTp+QmfaL3ZqXpT3ZXvIFmXlMXeiUv4YEhWYBgyl5P0WFcZpMSxaSGopoNREaRh+B0aR9mKDlfKHUNhGZflFucs4ruo5x57KnpxyH34Z+++lxzWJij7EalhmRZTx3/QOFgks+wqRPtmw5BNM9oBItnQ05t9Pgr8tjhSIkssKgcd/r/Bj8Y6s3mtMKcVpy5xRVbfZCyuUHyLakXn2GO8NKW48IIJ97kQwKJZAgoYztWggKVrgOocb8skmNgvQ2/H2Bnudx48nhM+zQmdlxfACFyYpo7lafS1I6irkrUXZOyRdqBxlc64ONju7FF8jc0uvTtS6M79gRhVjKQEAAQA= unknown@unknown";
        this.b = new BigInteger("00:c9:f4:9e:64:b5:4c:5b:1c:2f:03:86:60:21:3d:ce:ad:83:7c:98:c1:52:fe:2f:e3:20:13:b9:0e:03:58:b9:b7:cc:c0:57:28:7a:7e:2d:ae:3b:27:79:e4:b3:38:fe:4e:23:6e:06:f1:f1:3f:f6:2e:b4:96:27:67:16:60:54:9d:de:37:ad:b3:1f:36:e2:5c:df:11:f8:c4:5c:28:b4:76:91:ef:08:66:0c:98:f7:46:91:f8:58:b0:0e:f2:51:f9:62:ec:20:67:5c:2c:3d:8f:1d:5c:9f:ba:a3:df:4d:cc:f4:25:db:06:c0:b8:31:f8:02:e2:57:48:56:50:8d:2c:29:4b:73:41:de:dc:91:79:88:aa:d0:f8:34:05:3e:56:13:83:1f:c3:23:a0:eb:e1:e7:e5:7f:24:32:c7:d1:af:99:50:d6:65:34:45:c6:d6:aa:ef:99:84:f2:7d:e2:ff:80:3c:84:e7:e8:6a:67:b4:e7:61:e4:14:cb:ba:fb:54:89:58:02:bb:fd:6e:bf:72:bc:87:f1:d5:e2:00:23:a8:f9:7b:5b:df:61:d5:b5:95:ed:5e:09:d0:00:42:62:0f:aa:e4:92:6d:33:45:11:de:e9:47:52:e8:f7:87:d2:dd:d1:57:7a:ed:f3:c8:18:99:1a:30:c5:9b:2b:5d:34:f3".replaceAll("[ :\n]", ""), 16);
        this.a = new BigInteger("5d:70:52:80:a1:e9:4c:16:44:22:4b:5f:da:c1:70:08:93:d7:68:0d:ba:4a:64:f9:9e:f3:c1:21:1c:a7:46:76:25:c3:b0:0f:c8:6c:ec:d1:ba:08:cf:ba:e2:b9:31:e0:11:40:6c:f2:2f:fe:b9:f6:6e:13:32:f3:dd:44:80:a1:f2:18:ac:c3:3d:63:f5:63:a6:c9:f7:e1:52:0a:7b:44:88:cc:a1:84:25:bb:f8:5c:ac:58:cd:1f:d8:2a:81:86:f3:1f:f0:f6:21:8d:4e:86:12:bd:b2:21:76:84:70:c8:ad:05:7e:cb:27:0b:92:02:ff:c2:9d:43:98:bb:f8:34:6e:16:2d:f3:05:29:37:82:f4:ce:cc:10:1f:79:45:84:a5:6b:1f:4b:8f:81:96:fc:e8:df:0d:43:0f:c7:7e:d2:2a:71:1d:a0:f5:b4:57:e1:55:9d:a0:34:07:63:06:a0:52:29:3f:7f:e3:67:59:f8:fe:6f:83:11:79:0d:33:59:85:8c:79:78:26:3b:58:c5:f0:4c:3b:74:c8:88:fb:1e:34:88:77:d4:08:71:41:cd:84:1e:33:da:81:f6:63:84:14:b2:88:e2:af:5b:ec:b7:6e:50:14:27:fc:b5:00:68:a5:95:62:7c:8e:e5:96:3d:24:31:e9:e6:ef:57:01:c1".replaceAll("[ :\n]", ""), 16);
    }

    @TargetApi(Build.VERSION_CODES.KITKAT)
    public static byte[] wraperMessage(String arg1) {
        System.out.println("\nstr:" + arg1);
        byte[] v1 = arg1.getBytes(StandardCharsets.UTF_8);
        return Arrays.copyOf(v1, v1.length + 1);
    }

    public message wraperMessage(InputStream arg3) throws IOException {
        byte[] v1 = new byte[24];

        if (arg3.read(v1) == 24) {
            ByteBuffer v0 = ByteBuffer.wrap(v1);
            System.out.println("ret:" + getString(v0));
            v0.order(ByteOrder.LITTLE_ENDIAN);
            message v1_1 = new message();
            v1_1.commond = v0.getInt();
            v1_1.b = v0.getInt();
            v1_1.c = v0.getInt();
            v1_1.d = v0.getInt();
            v0.getInt();
            v0.getInt();
            int v0_1 = v1_1.d;
            if (v0_1 > 0) {
                byte[] v2 = new byte[v0_1];
                if (arg3.read(v2) == v0_1) {
                    v1_1.e = v2;
                } else {
                    throw new AdbException();
                }
            }

            return v1_1;
        }

        throw new AdbException();
    }

    @TargetApi(Build.VERSION_CODES.KITKAT)
    public String tcpip5555(int port, String arg10[]) throws UnknownHostException {
        BufferedInputStream v0_1 = null;
        BufferedOutputStream v9 = null;
//        InetAddress v0 = InetAddress.getByAddress("localhost", new byte[]{0x7F, 0, 0, 1});
        InetAddress v0 = InetAddress.getByAddress("localhost", new byte[]{0x7F, 0, 0, 1});

        Socket v5 = null;
        try {
            v5 = new Socket("192.168.101.125", port);
            v9 = new BufferedOutputStream(v5.getOutputStream());
            v0_1 = new BufferedInputStream(v5.getInputStream());
            this.send(((OutputStream) v9), ((InputStream) v0_1), arg10);
            System.out.println(" return ");

        } catch (Throwable v10) {
            v10.printStackTrace();
        }

        Closeable[] v4_1 = new Closeable[3];
        v4_1[0] = v5;
        v4_1[1] = v9;
        v4_1[2] = v0_1;

        return "";
    }

    public final String send(OutputStream arg13, InputStream arg14, String arg15[]) throws IOException {
        ByteBuffer v9_1;
        int v10;
        byte[] v7_1;
        int v9;
        int v1_2;
        byte[] v3_1;
        int v8;
        int v7;
        ByteArrayOutputStream v0 = new ByteArrayOutputStream();
        byte[] v1 = SimpleAdbUtils.wraperMessage("host::qxstart");
        int v2 = 0;

        int v3 = v1.length;
        int v4 = 0;
        int v5 = 0;
        while (v4 < v3) {
            v5 += v1[v4] & 0xFF;
            ++v4;
        }

        v3 = v1.length;
        ByteBuffer v4_1 = ByteBuffer.allocate(v3 + 24);
        v4_1.order(ByteOrder.LITTLE_ENDIAN);
        int v6;
        v4_1.putInt(A_CNXN);
        v4_1.putInt(0x1000000);
        v4_1.putInt(0x1000);
        v4_1.putInt(v3);
        v4_1.putInt(v5);
        v4_1.putInt(~A_CNXN);
        if (v3 > 0) {
            v4_1.put(v1);
        }

        System.out.println("send:" + getString(v4_1));
        arg13.write(v4_1.array());
        arg13.flush();
        message v1_1 = wraperMessage(arg14);
        do {
            v3 = v1_1.commond;
            if (v3 == A_CNXN) {
                v3_1 = SimpleAdbUtils.wraperMessage("shell:");
                v5 = v3_1.length;
                v6 = 0;
                v7 = 0;
                while (v6 < v5) {
                    v7 += v3_1[v6] & 0xFF;
                    ++v6;
                }

                v5 = v3_1.length;
                ByteBuffer v6_1 = ByteBuffer.allocate(v5 + 24);
                v6_1.order(ByteOrder.LITTLE_ENDIAN);
                v6_1.putInt(A_OPEN);
                v6_1.putInt(1);
                v6_1.putInt(0);
                v6_1.putInt(v5);
                v6_1.putInt(v7);
                v6_1.putInt(~A_OPEN);
                if (v5 > 0) {
                    v6_1.put(v3_1);
                }
                System.out.println("send:" + getString(v6_1));

                arg13.write(v6_1.array());
                arg13.flush();
                v1_1 = wraperMessage(arg14);
                v3 = v1_1.commond;

                if (v3 == A_OKAY) {
                    try {
                        this.a(arg13, arg14, ((OutputStream) v0));
                    } catch (AdbException e) {
                        e.printStackTrace();
                    }
                } else if (v3 == A_CLSE) {
                    v3 = v1_1.b;
                    v7_1 = new byte[0];
                    v8 = v7_1.length;
                    v9 = 0;
                    v10 = 0;
                    while (v9 < v8) {
                        v10 += v7_1[v9] & 0xFF;
                        ++v9;
                    }

                    v8 = v7_1.length;
                    v9_1 = ByteBuffer.allocate(v8 + 24);
                    v9_1.order(ByteOrder.LITTLE_ENDIAN);
                    v9_1.putInt(A_CLSE);
                    v9_1.putInt(1);
                    v9_1.putInt(v3);
                    v9_1.putInt(v8);
                    v9_1.putInt(v10);
                    v9_1.putInt(~A_CLSE);
                    if (v8 > 0) {
                        v9_1.put(v7_1);
                    }
                    System.out.println("send:" + getString(v9_1));

                    arg13.write(v9_1.array());
                    arg13.flush();
                }

                try {
                    Thread.sleep(50);
                } catch (InterruptedException v3_2) {
                    v3_2.printStackTrace();
                }

                for (String v : arg15) {

                    v1_2 = v1_1.b;
                    v7_1 = SimpleAdbUtils.wraperMessage(v);

                    v8 = v7_1.length;
                    v9 = 0;
                    v10 = 0;
                    while (v9 < v8) {
                        v10 += v7_1[v9] & 0xFF;
                        ++v9;
                    }

                    v8 = v7_1.length;
                    v9_1 = ByteBuffer.allocate(v8 + 24);
                    v9_1.order(ByteOrder.LITTLE_ENDIAN);
                    v9_1.putInt(A_WRTE);
                    v9_1.putInt(1);
                    v9_1.putInt(v1_2);
                    v9_1.putInt(v8);
                    v9_1.putInt(v10);
                    v9_1.putInt(~A_WRTE);
                    if (v8 > 0) {
                        v9_1.put(v7_1);
                    }
                    System.out.println("send:" + getString(v9_1));

                    arg13.write(v9_1.array());
                    arg13.flush();
                    v1_1 = wraperMessage(arg14);
                    v3 = v1_1.commond;
                    if (v3 == A_OKAY) {
                        try {
                            this.a(arg13, arg14, ((OutputStream) v0));
                        } catch (AdbException e) {
                            e.printStackTrace();
                        }
                    } else {
                        if (v3 != A_CLSE) {
                            continue;
                        }

                        int v14 = v1_1.b;
                        byte[] v15 = new byte[0];
                        v1_2 = v15.length;
                        v3 = 0;
                        while (v2 < v1_2) {
                            v3 += v15[v2] & 0xFF;
                            ++v2;
                        }

                        v1_2 = v15.length;
                        ByteBuffer v2_1 = ByteBuffer.allocate(v1_2 + 24);
                        v2_1.order(ByteOrder.LITTLE_ENDIAN);
                        v2_1.putInt(A_CLSE);
                        v2_1.putInt(1);
                        v2_1.putInt(v14);
                        v2_1.putInt(v1_2);
                        v2_1.putInt(v3);
                        v2_1.putInt(~A_CLSE);
                        if (v1_2 > 0) {
                            v2_1.put(v15);
                        }
                        System.out.println("send:" + getString(v2_1));

                        arg13.write(v2_1.array());
                        arg13.flush();
                    }

                    try {
                        Thread.sleep(500);
                    } catch (InterruptedException v3_2) {
                        v3_2.printStackTrace();
                    }
                }
                return "1";
            }


            if (v3 != A_AUTH) {
                return null;
            }


            v3 = this.d;
            v8 = 2;
            if (v3 == 0) {
                v1 = v1_1.e;
                v3_1 = Arrays.copyOf(SimpleAdbUtils.e, 0x100);
                System.arraycopy(v1, 0, v3_1, 0xEC, 20);
                v1 = new BigInteger(v3_1).modPow(this.a, this.b).toByteArray();
                if (v1.length > v3_1.length) {
                    System.arraycopy(v1, v1.length - v3_1.length, v3_1, 0, v3_1.length);
                } else {
                    System.arraycopy(v1, 0, v3_1, v3_1.length - v1.length, v1.length);
                }

                v1_2 = v3_1.length;
                v5 = 0;
                v9 = 0;

                while (v5 < v1_2) {
                    v9 += v3_1[v5] & 0xFF;
                    ++v5;
                }

                v1_2 = v3_1.length;
                ByteBuffer v5_2 = ByteBuffer.allocate(v1_2 + 24);
                v5_2.order(ByteOrder.LITTLE_ENDIAN);
                v5_2.putInt(A_AUTH);
                v5_2.putInt(v8);
                v5_2.putInt(0);
                v5_2.putInt(v1_2);
                v5_2.putInt(v9);
                v5_2.putInt(~A_AUTH);
                if (v1_2 > 0) {
                    v5_2.put(v3_1);
                }
                System.out.println("send:" + getString(v5_2));

                arg13.write(v5_2.array());
                arg13.flush();
                v1_1 = wraperMessage(arg14);
                this.d = 1;
            } else if (v3 == 1) {
                v1_2 = 3;
                v3_1 = SimpleAdbUtils.wraperMessage(this.c);

                v4 = v3_1.length;
                v5 = 0;
                v9 = 0;

                while (v5 < v4) {
                    v9 += v3_1[v5] & 0xFF;
                    ++v5;
                }

                v4 = v3_1.length;
                ByteBuffer v5_2 = ByteBuffer.allocate(v4 + 24);
                v5_2.order(ByteOrder.LITTLE_ENDIAN);
                v5_2.putInt(A_AUTH);
                v5_2.putInt(v1_2);
                v5_2.putInt(0);
                v5_2.putInt(v4);
                v5_2.putInt(v9);
                v5_2.putInt(~A_AUTH);
                if (v4 > 0) {
                    v5_2.put(v3_1);
                }
                System.out.println("send:" + getString(v5_2));

                arg13.write(v5_2.array());
                arg13.flush();
                v1_1 = wraperMessage(arg14);
                this.d = v8;
            }
        }
        while (v3 != v8);

        return null;
    }

    public final void a(OutputStream arg7, InputStream arg8, OutputStream arg9) throws IOException {
        int v4;
        int v2;
        int v1;
        message v0;
        do {
            v0 = wraperMessage(arg8);
            v1 = v0.commond;

            v4 = 0;
            if (v1 != A_CLSE) {
                if (v1 != A_WRTE) {
                    continue;
                } else {
                    if (v0.d > 0) {
                        arg9.write(v0.e);
                    }

                    int v9 = v0.b;
                    byte[] v0_1 = new byte[0];
                    v1 = v0_1.length;
                    v2 = 0;
                    while (v4 < v1) {
                        v2 += v0_1[v4] & 0xFF;
                        ++v4;
                    }

                    v1 = v0_1.length;
                    ByteBuffer v4_1 = ByteBuffer.allocate(v1 + 24);
                    v4_1.order(ByteOrder.LITTLE_ENDIAN);
                    v4_1.putInt(A_OKAY);
                    v4_1.putInt(1);
                    v4_1.putInt(v9);
                    v4_1.putInt(v1);
                    v4_1.putInt(v2);
                    v4_1.putInt(~A_OKAY);
                    if (v1 > 0) {
                        v4_1.put(v0_1);
                    }
                    System.out.println("send:" + getString(v4_1));

                    arg7.write(v4_1.array());
                    arg7.flush();
                }

                break;
            } else {
                byte[] v9_1 = new byte[0];
                int v0_2 = v9_1.length;
                v1 = 0;

                while (v4 < v0_2) {
                    v1 += v9_1[v4] & 0xFF;
                    ++v4;
                }

                v0_2 = v9_1.length;
                ByteBuffer v4_1 = ByteBuffer.allocate(v0_2 + 24);
                v4_1.order(ByteOrder.LITTLE_ENDIAN);
                v4_1.putInt(A_CLSE);
                v4_1.putInt(1);
                v4_1.putInt(v0.b);
                v4_1.putInt(v0_2);
                v4_1.putInt(v1);
                v4_1.putInt(~A_CLSE);
                if (v0_2 > 0) {
                    v4_1.put(v9_1);
                }
                System.out.println("send:" + getString(v4_1));

                arg7.write(v4_1.array());
                arg7.flush();
            }
        }
        while (true);

    }
}