当前位置：首页 > web >正文

Android Native 之 adbd进程分析

web 2025/7/18 10:08:00

1、adbd守护进程

2、adbd权限降级

3、adbd命令解析

1）adb shell

2）adb root

3）adb reboot

4、案例

1）案例之实现不需要执行adb root命令自动具有root权限

2）案例之实现不需要RSA认证直接能够使用adb shell命令

adb源码的架构，其实在system/packages/modules/adb/中有注释，如下两个方向：

PC主机与adb设备的拓扑图

根据下面一段文字的介绍，android设备的adb主要靠守护进程adbd来实现，具体代码实现是在Daemon里面。

1、adbd守护进程

adbd作为android设备的守护进程，android.bp文件定义如下：

回到adbd主函数中调用adbd_main函数里面，源码如下：

//aosp/packages/modules/adb/daemon/main.cpp
int adbd_main(int server_port) {//...省略...//重点1：auth_required为true表示进行RSA校验，其默认值根据ro.adb.secure
#if defined(__ANDROID__)bool device_unlocked = android::base::GetProperty("ro.boot.verifiedbootstate", "") == "orange";if (device_unlocked || __android_log_is_debuggable()) {
#if defined(__ANDROID_RECOVERY__)auth_required = false;  // Bypass authorization when the device transitions to
#else// If we're on userdebug/eng or the device is unlocked, permit no-authentication.auth_required = android::base::GetBoolProperty("ro.adb.secure", false);
#endif}
#endif//重点2：是否进行权限降级
#if defined(__ANDROID__)drop_privileges(server_port);
#endif
#if defined(__ANDROID__)// A thread gets spawned as a side-effect of initializing the watchdog, so it needs to happen after we drop privileges.watchdog::Initialize();
#endif//重点3：证书权限相关校验，如果auth_required为false其adb/daemon/auth.cpp直接返回不需要校验// adbd_auth_init will spawn a thread, so we need to defer it until after selinux transitions.adbd_auth_init();bool is_usb = false;
#if defined(__ANDROID__)if (access(USB_FFS_ADB_EP0, F_OK) == 0) {// Listen on USB.usb_init();is_usb = true;}
#endif// If one of these properties is set, also listen on that port.// If one of the properties isn't set and we couldn't listen on usb, listen on the default port.std::vector<std::string> addrs;std::string prop_addr = android::base::GetProperty("service.adb.listen_addrs", "");if (prop_addr.empty()) {//...省略...} else {addrs = android::base::Split(prop_addr, ",");setup_adb(addrs);}//重点3：关键日志，adbd启动，如果没有这行日志，说明adbd根本无法使用LOG(INFO) << "adbd started";D("adbd_main(): pre init_jdwp()");init_jdwp();D("adbd_main(): post init_jdwp()");D("Event loop starting");//重点4：进入fd事件轮询，即监听pc端发送过来的数据，最终传递在daemon_service_to_fd函数中进行解析fdevent_loop();return 0;
}

总结如上adbd守护进程主函数大致流程如下：

设置auth_required状态，为true表示进行RSA校验，其默认值根据ro.adb.secure。重点，我们可以定制ro.adb.secure属性的值来实现不需要设备授权直接使用adb命令
通过drop_privileges方法来实现权限降级
通过setup_adb设置地址（串口号？），这里除了判断是usb链接还是wifi链接之外，还处理多台usb设备之间的关系
进入fdevent_loop事件轮询，监听PC adb端发送过来的命令

2、adbd权限降级

前面已经介绍了drop_privileges来实现权限降级，那么什么是权限降级呢？这涉及到linux dac机制，在android_filesystem_config.h 文件中定义了大量的权限等级：

AID_XXX定义了android系统中基本能分解的所有用户组和权限（0-100000）。其中AID_ROOT等于0被作为最高用户组。咨询AI这其实就是Linux DAC的实现机制。

回到drop_privileges函数如下内容：

static void drop_privileges(int server_port) {ScopedMinijail jail(minijail_new());// Add extra groups:// AID_ADB to access the USB driver// AID_LOG to read system logs (adb logcat)// AID_INPUT to diagnose input issues (getevent)// AID_INET to diagnose network issues (ping)// AID_NET_BT and AID_NET_BT_ADMIN to diagnose bluetooth (hcidump)// AID_SDCARD_R to allow reading from the SD card// AID_SDCARD_RW to allow writing to the SD card// AID_NET_BW_STATS to read out qtaguid statistics// AID_READPROC for reading /proc entries across UID boundaries// AID_UHID for using 'hid' command to read/write to /dev/uhid// AID_EXT_DATA_RW for writing to /sdcard/Android/data (devices without sdcardfs)// AID_EXT_OBB_RW for writing to /sdcard/Android/obb (devices without sdcardfs)// AID_READTRACEFS for reading tracefs entriesgid_t groups[] = {AID_ADB,          AID_LOG,          AID_INPUT,    AID_INET,AID_NET_BT,       AID_NET_BT_ADMIN, AID_SDCARD_R, AID_SDCARD_RW,AID_NET_BW_STATS, AID_READPROC,     AID_UHID,     AID_EXT_DATA_RW,AID_EXT_OBB_RW,   AID_READTRACEFS};minijail_set_supplementary_gids(jail.get(), arraysize(groups), groups);// Don't listen on a port (default 5037) if running in secure mode.// Don't run as root if running in secure mode.if (should_drop_privileges()) {//...省略...//核心代码：通过minijail_change_gid切换用户组ID为AID_SHELL，属于Linux DAC降低权限minijail_change_gid(jail.get(), AID_SHELL);minijail_change_uid(jail.get(), AID_SHELL);//核心代码：通过minijail_enter执行最终的沙箱隔离操作，属于Linux DAC机制// minijail_enter() will abort if any priv-dropping step fails.minijail_enter(jail.get());//...省略...D("Local port disabled");} else {//核心代码：通过minijail_enter执行最终的沙箱隔离操作，默认是ROOT？// minijail_enter() will abort if any priv-dropping step fails.minijail_enter(jail.get());//防错处理，如果变量root_seclabel设置的selinux安全上下文不是0，即不是root用户，强制属性service.adb.root的在值为0if (root_seclabel != nullptr) {if (selinux_android_setcon(root_seclabel) < 0) {// If we failed to become root, don't try again to avoid a// restart loop.android::base::SetProperty("service.adb.root", "0");LOG(FATAL) << "Could not set SELinux context";}}}
}

如上代码总结如下：