主要内容:
-
ida server集成到手机系统
-
adbd进程中添加启动、停止ida server的逻辑代码
-
开发ida server控制App实现控制ida server停止、启动、端口修改
1.ida server内置
1.1 ida下载
下载地址参考:
https://down.52pojie.cn/Tools/Disassemblers/
1.2 内置ida中的android_server到手机系统
将下载好的ida工具包解压之后，在目录dbgsrv下面存放了android_server程序。目前高版本的ida提供了arm和arm64平台的android_server。需要根据手机平台选择对应的版本。由于个人手机arm64的版本，所以选择arm64的程序android_server64。
1.2.1 源码中构建myandroidserverarm64模块
在源码中创建目录"frameworks/base/cmds/mycmds/idaandroidserver"用来存放ida server模块。在idaandroidserver目录中，将android_server64可执行程序拷贝到该目录下面，并重命名为"myandroidserverarm64",然后在该目录下面创建Android.mk文件配置myandroidserverarm64模块的编译规则。Android.mk文件内容如下:
LOCAL_PATH:= $(call my-dir)
include $(CLEAR_VARS)
LOCAL_MODULE := myandroidserverarm64
LOCAL_MODULE_CLASS := EXECUTABLES
LOCAL_SRC_FILES := myandroidserverarm64
include $(BUILD_PREBUILT)
1.2.2 将myandroidserverarm64模块加入源码编译链中
在源码路径"buildmaketargetproductbase_system.mk"中将模块"myandroidserverarm64"添加到模块编译链中。如下参考:
...
# Base modules and settings for the system partition.
PRODUCT_PACKAGES +=
myandroidserverarm64
abb
adbd
...
2.adbd进程中编写控制myandroidserverarm64逻辑代码
由于ida server启动和frida server相似。所以可以将frida server控制的代码拷贝一份修改一下就可以使用。以下是参考代码:
//判断ida server是否正在运行
static int is_ida_server_running() {
int ret=-1;
char buf[256]={0};
FILE * fp=NULL;
if((fp=popen("ps -A","r"))==NULL)
{
MYLOGD("popen error in is_ida_server_running");
return ret;
}
while(fgets (buf,255, fp)!=NULL) {
if(strstr(buf,"myandroidserverarm64")!=NULL)
{
ret=0;
break;
}
}
pclose(fp);
return ret;
}
//发送ida server运行状态通知App
static void broadcast_ida_server_status(int status,const char * portstr)
{
//am broadcast -a com.android.myaction.IDA_SERVER_STATUS --es isRunning 0
char cmd_buf[128]={0};
sprintf(cmd_buf,"am broadcast -a com.android.myaction.IDA_SERVER_STATUS --es isRunning %d --es port %s",status,portstr);
system(cmd_buf);
MYLOGD("broadcast_ida_server_status success,status:%d current_port:%s",status,portstr);
}
//控制ida server运行、停止的工作线程
void *ida_server_work_thread(void *m)
{
MYLOGD("ida_server_work_thread start");
while(1>0)
{
std::string prop = android::base::GetProperty("sys.boot_completed", "");
std::string myfrd=android::base::GetProperty("xro.start.myidaserver","");
std::string port_str=android::base::GetProperty("xro.start.myidaserver.port","23946");
bool boot_ok = (prop == "1");
MYLOGD("ida_server_work_thread sys.boot_completed:%s",prop.c_str());
if(boot_ok)
{
int ida_server_status=is_ida_server_running();
broadcast_ida_server_status(ida_server_status,port_str.c_str());
MYLOGD("ida_server_work_thread==>%d",ida_server_status);
if(myfrd == "1")
{
MYLOGD("ida_server_work_threadstart to launch myandroidserverarm64");
char cmd_buf[128]={0};
sprintf(cmd_buf,"killall myandroidserverarm64rnsleep 1rnmyandroidserverarm64 -p %s &",port_str.c_str());
system(cmd_buf);
MYLOGD("ida_server_work_thread start myandroidserverarm64 finish ");
android::base::SetProperty("xro.start.myidaserver","3");
}else if(myfrd=="0"){
MYLOGD("ida_server_work_thread start to stop myandroidserverarm64");
char cmd_buf[128]={0};
sprintf(cmd_buf,"killall myandroidserverarm64");
if(ida_server_status>=0)
{
system(cmd_buf);
}
MYLOGD("ida_server_work_thread stop myandroidserverarm64 finish ");
}else if(myfrd=="3"){
if(ida_server_status<0)
{
//说明adbd 第一次启动，并且状态属性为3说明adbd被重启了，需要重新启动ida server
//测试过程中发现adbd挂了 ida server也会被杀掉
MYLOGD("adbd restart,start to launch myfridaserverarm64");
char cmd_buf[128]={0};
sprintf(cmd_buf,"killall myandroidserverarm64rnsleep 1rnmyandroidserverarm64 -p %s &",port_str.c_str());
system(cmd_buf);
MYLOGD("ida_server_work_thread adbd restart,start myandroidserverarm64 finish ");
//android::base::SetProperty("xro.start.myfrd","3");
}
MYLOGD("ida_server_work_thread myandroidserverarm64 is running");
}else{
}
}else{
//LOG(DEBUG) << "sys.boot_completed:"<<prop;
}
sleep(1);
}
return NULL;
}
//启动ida server
static void start_ida_server()
{
MYLOGD("start_ida_server start ");
pthread_t thread_id;
int i = 9;
pthread_create(&thread_id, NULL, &ida_server_work_thread, (void*)&i);
MYLOGD("start_ida_server thread is created!");
}
3.开发App控制ida server启动、停止和配置端口
由于ida server配置和frida server配置很相似，可以参考控制frida server的配置页面写一个ida server配置的页面。以下是部分核心参考关键代码:
//广播监听状态
BroadcastReceiver mBroadcastReceiver = new BroadcastReceiver() {
@Override
public void onReceive(Context context, Intent intent) {
String isRunning = intent.getStringExtra("isRunning");
String port = intent.getStringExtra("port");
if (isRunning.equals("0")) {
textViewShowRunningStatus.setText("正在运行");
} else {
textViewShowRunningStatus.setText("未运行");
}
textViewIdaServerPort.setText(port);
}
};
//各种功能按钮点击事件
class MyClick implements View.OnClickListener {
@Override
public void onClick(View view) {
switch (view.getId()) {
case R.id.buttonStartIdaServer: {
//启动 ida server
String port = editTextInputIdaServerPort.getText() + "";
port = port.trim();
if (port.equals("")) {
Toast.makeText(mContext, "当前未配置端口", Toast.LENGTH_LONG).show();
return;
}
try {
int myport = Integer.parseInt(port);
if (myport <= 1024 || myport > 65535) {
Toast.makeText(mContext, "配置端口错误,端口范围1024~65535", Toast.LENGTH_LONG).show();
return;
}
} catch (Exception eeee) {
Toast.makeText(mContext, "配置端口错误:" + eeee.toString(), Toast.LENGTH_LONG).show();
return;
}
String getVal = get("xro.start.myidaserver", "");
d("currentVal before:" + getVal);
SystemProperties.set("xro.start.myidaserver.port", port.trim());
SystemProperties.set("xro.start.myidaserver", "1");
getVal = get("xro.start.myidaserver", "");
d("currentVal after:" + getVal);
break;
}
case R.id.buttonStopIdaServer: {
//停止ida server
String getVal = get("xro.start.myidaserver", "");
d("currentVal before:" + getVal);
SystemProperties.set("xro.start.myidaserver", "0");
getVal = SystemProperties.get("xro.start.myidaserver", "");
d("currentVal after:" + getVal);
break;
}
case R.id.buttonRestartAdbd: {
//重启adbd
String getVal = get("xro.start.myadbd", "");
d("currentVal before:" + getVal);
SystemProperties.set("xro.start.myadbd", "0");
SystemProperties.set("xro.start.myadbd", "1");
getVal = SystemProperties.get("xro.start.myadbd", "");
d("currentVal after:" + getVal);
break;
}
}
}
}
以上修改配置好之后就可以编译刷机测试验证效果。
原文始发于微信公众号（哆啦安全）：IDA server集成以及App控制启动、停止和配置端口
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论