ADB(Android Debug Bridge): How it works?

ADB(Android Debug Bridge): How it works? 2012.2.13 Android Builders Summit Tetsuyuki Kobayashi 1

Lets talk about inside of Android. http://www.kmckk.co.jp/eng/kzma9/ 2 http://www.kmckk.co.jp/eng/jet_index.html

Who am I? 20+ years involved in embedded systems  10 years in real time OS, such as iTRON  10 years in embedded Java Virtual Machine  Now GCC, Linux, QEMU, Android, … Blogs  http://d.hatena.ne.jp/embedded/ (Personal)  http://blog.kmckk.com/ (Corporate)  http://kobablog.wordpress.com/(English) Twitter  @tetsu_koba 3

Todays topics What is ADB? ADB internal Command details & Tips Advanced Topics 4

What is ADB? If you are an Android builder, you have used ”adb logcat”, ”adb shell” Even if you only use DDMS in Eclipse, adb is working under the hood. Using adb, you can connect emulator or actual target device. ”adb kill-server”? what does it mean?

How to connect?Host Target device Emulator Adb clients ”adb shell” Adbd How to connect? QEMU Adbd 6

3 elements of ADB adb clients  executable with subcommand  ”adb shell”, ”adb logcat” : the end point of host side adb server  running on host on back-ground  act as proxy between adb clients and adbd adb daemon (adbd)  running on target device  started by init, if die, restarted by init again 7

ADB overviewHost Target device Execute services on Emulator new thread/subprocess Adb clients Adbd TCP port:5037 TCP Adb server USB/TCP Adbd QEMU 8

2 roles of ADB Providing ”Transport”  communication path between host and target device  USB or TCP: but clients dont have to aware Providing ”Services”  executing something on the target devices through the transport.  ”adb shell” for executing command  ”adb push/pull” for file transfer 9

When does adb server start? Explicitly, ”adb start-server”  It starts adb server as back ground process. Usually it does automatically on demand. You dont have to do ”adb start-server”. When you want to restart adb server, do ”adb kill-server” Actually, adb clients and adb server shares same executable  ”adb start-server” equals ”adb fork-server server &” 10

Port forwarding adb forward tcp:1234 tcp:1234Host Target device Transport client socket server socket USB or TCP port 1234 port 1234 11

Port forwarding (cont.) adb forward tcp:1234 tcp:1234example: connecting to gdbserver in the device from gdb client from host Host Target device gdb client connect to localhost:1234 Transport client socket server socket USB or TCP port 1234 port 1234 listen to localhost:1234 Both gdb client and gdbserver gdbserver do not aware of transport 12

ADB internal Source code How to get ADB logs Sequence chart Simple ruby script to connect adb server Secure mode Switching transport mode 13

Source code system/core/adb in Android source tree  16,000 lines in *.[ch] From this directory adb and adbd are built  Dont confuse.  common files between adb and adbd  adb.c, fdevent.c, transort.c, transport_local.c, tansport_usb.c, service.c, sockets.c, util.c #if ADB_HOST /* code for adb*/ #else /* code for adbd */ #endif 14

Source code(cont.) files only for adbd  backup_service.c, file_sync_service.c, jdwp_service.c, framebuffer_service.c, remount_services.c, usb_linux_clients.c, log_service.c files only for adb  console.c, adb_clients.c, file_sync_client.c, usb_vendors.c, get_my_path_{linux,darwin,windows,freebsd}.c, usb_{linux,macos,libusb,windows}.c documents  OVERVIEW.TXT, SERVICES.TXT, protocol.txt 15

How to get ADB logs For adb clients and adb server, set environment variable ADB_TRACE $ adb kill-server $ ADB_TRACE=all start-server For adbd, set system property ”persist.adb.trace_mask” in hexadecimal # set_property persist.adb.trace_mask 0xfff I found some trivial bugs. see below http://blog.kmckk.com/archives/4080002.html 16 http://blog.kmckk.com/archives/4087230.html

Sequence chart Adb client “adb shell ls” Adb server adbd host:version OKAY0004001dCheck version host:transport-any Specify the OKAY destination shell:ls [OPEN]shell:ls Command subprocess to adbd [OPEN]shell:ls OKAY ls [WRITE]len=247 len=247 stdout len=247 17

Simple ruby script to connect to adb serverrequire socket hostname = localhost port = 5037def error_exit puts "Error" s = TCPSocket.open(hostname, port) exit 1 send_to_adb(s, "host:version")end error_exit if ! check_version(s) s.closedef send_to_adb(s, msg) s.printf("%04x%s", s = TCPSocket.open(hostname, port)msg.length, msg) send_to_adb(s, "host:transport-any")end error_exit if ! check_okay(s) send_to_adb(s, "shell:ls")def check_okay(s) error_exit if ! check_okay(s) (s.read(4) == "OKAY")end while line = s.gets puts line.chopdef check_version(s) end (s.read(12) == s.close"OKAY0004001d")end change ”shell:ls” as you like. 18http://blog.kmckk.com/archives/4092210.html

Secure mode Android smart phone products have adbd. Usually it runs on secure mode. (secure = 1) if secure == 1, change adbd as SHELL user(= not privileged), else it keeps running as root user In secure mode, all services invoked by adbd ran as SHELL user. Some causes ”permission denied”. 19

How secure mode decided Running on emulator → secure = 0 System property ”ro.secure” == 1 → secure = 1  if ”ro.debuggable” == 1, you can restart adb unsecure by ”adb root” All Android phone products are shipped in ”ro.secure” = 1, ”ro.debuggable” = 0. See adb.c: adb_main http://blog.kmckk.com/archives/4099821.html 20

Switching transport modeSwitching USB mode to TCP mode$ adb shell netcfglo UP 127.0.0.1 255.0.0.0 0x00000049eth0 UP 192.168.1.139 255.255.255.0 0x00001043$ adb tcpip 5555restarting in TCP mode port : 5555$ adb devicesList of devices attached$disconnected from USB. Then restart adb server with specifying target IP address.$ adb kill-server$ ADBHOST=192.168.1.139 adb devices* daemon not running. starting it now on port 5037 ** daemon started successfully *List of devices attachedemulator-5554 device$ 21

Switching transport mode (What happen inside?) See service.c restart_tcp_service property_set(”service.adb.tcp.port”, value);  Note: before Android 4.0, this cause ”permission denied” in secure mode and ignored silently! After that, exit(1);  init restarts adbd.  ”service.adb.tcp.port” is checked in adb.c adb_main 22

Patch to enable switching to TCP mode in secure Android 2.3system/core/init/property_service.c$ diff -u property_service.c.2 property_service.c--- property_service.c.2 2012-02-07 18:40:34.472414791+0900+++ property_service.c 2012-02-07 18:41:24.782801630+0900@@ -79,6 +79,7 @@ { "debug.", AID_SHELL, 0 }, { "log.", AID_SHELL, 0 }, { "service.adb.root", AID_SHELL, 0 },+ { "service.adb.tcp.port", AID_SHELL, 0 }, { "persist.sys.", AID_SYSTEM, 0 }, { "persist.service.", AID_SYSTEM, 0 }, { "persist.security.", AID_SYSTEM, 0 }, This avoids ”permission denied” when set property ”service.adb.tcp.port”. http://blog.kmckk.com/archives/4098873.html

Command details & Tips adb logcat adb install/uninstall adb reboot/reboot-bootloader adb emu adb backup/restore Joke commands Add USB vendor ID Restriction of server socket of Android emulator Similar restriction in server socket created by ”adb forward” 24

adb logcat There is ”log:” subcommand in adb server, but ”adb logcat” doesnt use it ”adb logcat” executes /system/bin/logcat remotely  Tag filtering is done in target side  Logging in DDMS filtering in host side similar to ”adb shell ANDROID_LOG_TAGS=$ANDORID_LOG_TAGS logcat args..” 25

adb install/uninstall adb install  transfer apk file and then execute /system/bin/pm at the device adb uninstall  just execute /system/bin/pm remotely

adb reboot/reboot-bootloader fork&exec /system/bin/vdc to unmount storage wait for the process and then reboot by system call

adb emu You can send a single command to emulator console easily  send only. can not receive.  For emulator console,  http://developer.android.com/guide/developing/devices/emulator.html Simple example. ”adb emu window scale 0.5” after starting emulator http://blog.kmckk.com/archives/4091258.html 28

adb backup/restore New in Android 4.0 You can backup/restore installed applications with their saved status. 29

Joke commands adb hell  same as ”adb shell” except ”hell” color :)  Just try. adb lolcat  same as ”adb logcat” 30

Add USB Vendor ID When connecting USB device, adb checks USB Vendor ID Many USB Vendor IDs are hard coded in adb. (But not enough) To add USB Vendor ID, make ”$HOME/.android/adb_usb.ini” and write one ID in one line See usb_vendors.c 31

Restriction of server socket of Android emulatorOther host Host Emulator Adb clients Adb clients TCP port:5037 Adbd TCP port:5037 TCP Adb server Adb server QEMU All server sockets in Android emulator accepts only from localhost. If you feel inconvenient in this restriction, apply the patch in next page. http://blog.kmckk.com/archives/3882865.html 32

Patch to allow connecting from outside (for experiment)external/qemudiff --git a/slirp-android/socket.c b/slirp-android/socket.cindex 439590a..ed16d5a 100644--- a/slirp-android/socket.c+++ b/slirp-android/socket.c@@ -650,7 +650,7 @@ solisten(u_int port, u_int32_t laddr, u_int lport, intflags) so->so_laddr_ip = laddr; /* Ditto */ so->so_haddr_port = port;- s = socket_loopback_server( port, SOCKET_STREAM );+ s = socket_inaddr_any_server( port, SOCKET_STREAM ); if (s < 0) return NULL;diff --git a/sockets.c b/sockets.cindex 1063339..55b5d57 100644--- a/sockets.c+++ b/sockets.c@@ -1337,6 +1337,11 @@ socket_in_client( SockAddress* to, SocketType type ) return socket_connect_client( s, to ); }+int+socket_inaddr_any_server( int port, SocketType type )+{+ return socket_in_server( INADDR_ANY, port, type );+} int 33 socket_loopback_server( int port, SocketType type )

Similar restriction in serversocket created by ”adb forward” adb forward tcp:1234 tcp:1234Other host Host Target device server socket port 1234 Transport client socket client USB or TCP port 1234 From localhost only 34

Patch to allow connecting from outside (for experiment)system/corediff --git a/adb/adb.c b/adb/adb.cindex f5e6e0c..1405e1c 100644--- a/adb/adb.c+++ b/adb/adb.c@@ -481,7 +481,8 @@ int local_name_to_fd(const char *name) if(!strncmp("tcp:", name, 4)){ int ret; port = atoi(name + 4);- ret = socket_loopback_server(port, SOCK_STREAM);+ ret = socket_inaddr_any_server(port, SOCK_STREAM); return ret; } #ifndef HAVE_WIN32_IPC /* no Unix-domain sockets on Win32 */

Advanced Topics adb in Android device Port adbd to other than Android 36

adb in Android device Usually, adb is running on the host side, such as Linux, MacOS and Windows In Android 4.0 there is /system/bin/adb in Android file system What for is this? 37

Connect its own adbd by adb Restart adbd in TCP mode Then type ”adb devices” It can connect its own adbd by local loop back Target device Adb clients But what is the use case? TCP port:5038 TCP Adbd Adb server http://blog.kmckk.com/archives/4092970.html 38

Connect other Android device by adb on AndroidNexusOne(Android 2.3.6) USB Host (A connector) USB device KZM-A9-Dual board (micro B connector) (Android 4.0.3) http://blog.kmckk.com/archives/4094716.html 39

Connect other Android device by adb on Android(cont.) At the serial console on KZM-A9-Dual board # adb devices * daemon not running. starting it now on port 5038 * * daemon started successfully * List of devices attached HT015P803242 device # It worked! You can do ”adb shell”, ”adb logcat”, too. Even you can install application from the board to NexusOne by ”adb install foo.apk”. 40

Port adbd to other than Android Quick hack! Consider dependency for better porting ARM Ubuntu 11.10 ARM Ubuntu 11.10 Adbd Kernel with Android patch Kernel with Android patch 41

Quick hack! /sbin/adbd is statically linked executable. Just copy this file to ARM Ubuntu 11.10 just for experiment (using Android patched kernel) Somehow, it worked without any recompilation  sudo chmod 666 /dev/android_adb*  make symbolic link /bin/sh to /system/bin/sh  adbd runs in secure mode  It worked ”adb shell”, ”adb push/pull” http://blog.kmckk.com/archives/4093193.html 42

Consider dependency for better porting Some service requires other android commands  adb install/uninstall, adb bugreport  framebuffer service invokes /system/bin/screencap Adbd uses Android system properties  At the binary experiment, all property_get returns default values.  Thats why adbd ran in secure mode. Switching adbd mode assumes that init restarts adbd process 43

Q&AThank you for listening!Any comments to blogs are welcome. 44

http://blog.kmckk.com	2150
http://d.hatena.ne.jp	173
http://www.droidnytt.no	150
http://dev.droidnytt.no	22
http://thinkery.me	12
http://webcache.googleusercontent.com	7
http://us-w1.rockmelt.com	4
http://translate.googleusercontent.com	4
https://si0.twimg.com	2
http://www.plurk.com	1

ADB(Android Debug Bridge): How it works?

by Tetsuyuki Kobayashi

Accessibility

Categories

Upload Details

Usage Rights

10 Embeds 2,525

Statistics

ADB(Android Debug Bridge): How it works? Presentation Transcript