Android Debug Bridge
Android Debug Bridge
Tetsuyuki Kobayashi
1
http://www.kmckk.co.jp/eng/kzma9/ http://www.kmckk.co.jp/eng/jet_index.html
Who am I?
10 years in real time OS, such as iTRON 10 years in embedded Java Virtual Machine Now GCC, Linux, QEMU, Android, http://d.hatena.ne.jp/embedded/ (Personal) http://blog.kmckk.com/ (Corporate) http://kobablog.wordpress.com/(English) @tetsu_koba
3
Blogs
What is ADB?
If you are an Android builder, you have used adb logcat, adb shell Even if you only use DDMS in Eclipse, adb is working under the hood. Using adb, you can connect emulator or actual target device. adb kill-server? what does it mean?
How to connect?
Host
Target device
Emulator
Adbd QEMU
ADB overview
Host
Target device
Emulator
Adb clients
Adbd
TCP
TCP port:5037
QEMU
Adb server
USB/TCP
Adbd
2 roles of ADB
Providing Transport
communication path between host and target device USB or TCP: but clients don't have to aware executing something on the target devices through the transport.
Providing Services
adb shell for executing command adb push/pull for file transfer
7
3 elements of ADB
adb clients
executable with subcommand adb shell, adb logcat : the end point of host side running on host on back-ground act as proxy between adb clients and adbd running on target device started by init, if die, restarted by init again
8
adb server
Usually it does automatically on demand. You don't have to do adb start-server. When you want to restart adb server, do adb kill-server Actually, adb clients and adb server shares same executable
ADB internal
Source code How to get ADB logs Sequence chart Simple ruby script to connect adb server Command details Secure mode Add USB Vendor ID Switching transport mode
10
Source code
system/core/adb in Android source tree From this directory adb and adbd are built
backup_service.c, file_sync_service.c, jdwp_service.c, framebuffer_service.c, remount_services.c, usb_linux_clients.c, log_service.c console.c, adb_clients.c, file_sync_client.c, usb_vendors.c, get_my_path_{linux,darwin,windows,freebsd}.c, usb_{linux,macos,libusb,windows}.c
12
For adb clients and adb server, set environment variable ADB_TRACE For adbd, set system property persist.adb.trace_mask
http://blog.kmckk.com/archives/4080002.html
13
Sequence chart
Adb client adb shell ls host:version OKAY0004001d host:transport-any Specify the destination OKAY shell:ls Command to adbd OKAY [OPEN]shell:ls [OPEN]shell:ls subprocess Adb server adbd
Check version
ls
[WRITE]len=247 len=247
stdout
len=247
14
15
Command details
adb logcat adb install/uninstall adb reboot screen capture from DDMS
16
Secure mode
Android smart phone products have adbd. Usually it runs on secure mode. (secure = 1) if secure == 1, change adbd as SHELL user(= not privileged), else it keeps running as root user In secure mode, all services invoked by adbd ran as SHELL user. Some causes permission denied.
17
All Android phone products are shipped in ro.secure = 1, ro.debuggable = 0. See adb.c: adb_main
18
When connecting USB device, adb checks USB Vendor ID Many USB Vendor IDs are hard coded in adb. (But not enough) To add USB Vendor ID, make $HOME/.android/adb_usb.ini and write one ID in one line See usb_vendors.c
19
0x00000049 0x00001043
Note: before Android 4.0, this cause permission denied in secure mode and ignored silently! init restarts adbd. service.adb.tcp.port is checked in adb.c adb_main
21
Tips
adb emu adb backup/restore Joke commands Modify emulator to allow any server socket
22
adb emu
http://developer.android.com/guide/developing/devices/emulator.html
Simple example. adb emu window scale 0.5 after starting emulator
http://blog.kmckk.com/archives/4091258.html
23
adb backup/restore
New in Android 4.0 You can backup/restore installed applications with their saved status.
24
Joke commands
adb hell
same as adb shell except hell color :) Just try. same as adb logcat
adb lolcat
25
Adb clients
Emulator
Adb clients
TCP port:5037
Adbd
TCP
TCP port:5037
Adb server
QEMU
Adb server
All server sockets in Android emulator accepts only from localhost. If you feel inconvenient in this restriction, apply the patch in next page. http://blog.kmckk.com/archives/3882865.html
26
diff --git a/sockets.c b/sockets.c index 1063339..55b5d57 100644 --- a/sockets.c +++ b/sockets.c @@ -1337,6 +1337,11 @@ socket_in_client( SockAddress* return socket_connect_client( s, to ); }
to, SocketType
type )
+int +socket_inaddr_any_server( int port, SocketType type ) +{ + return socket_in_server( INADDR_ANY, port, type ); +} int socket_loopback_server( int port, SocketType type ) 27
Advanced Topics
28
Usually, adb is running on the host side, such as Linux, MacOS and Windows In Android 4.0 there is /system/bin/adb in Android file system What for is this?
29
Restart adbd in TCP mode Then type adb devices It can connect its own adbd by local loop back
Target device Adb clients But what is the use case?
TCP port:5038
Adbd
TCP
Adb server
http://blog.kmckk.com/archives/4092970.html
30
http://blog.kmckk.com/archives/4094716.html
31
It worked! You can do adb shell, adb logcat, too. Even you can install application from the board to NexusOne by adb install foo.apk.
32
33
Quick hack!
/sbin/adbd is statically linked executable. Just copy this file to ARM Ubuntu 11.10 just for experience (using Android patched kernel) Somehow, it worked without any recompilation
sudo chmod 666 /dev/android_adb* make symbolic link /bin/sh to /system/bin/sh adbd runs in secure mode It worked adb shell, adb push/pull
34
http://blog.kmckk.com/archives/4093193.html
adb install/uninstall, adb bugreport framebuffer service invokes /system/bin/screencap At the binary experiment, all property_get returns default values.
Q&A