主要內容:

ida server集成到手機系統

adbd進程中添加啟動、停止ida server的邏輯代碼

開發ida server控制App實現控制ida server停止、啟動、端口修改

1.ida server內置

1.1 ida下載

1.2 內置ida中的android_server到手機系統

將下載好的ida工具包解壓之后，在目錄dbgsrv下面存放了android_server程序。目前高版本的ida提供了arm和arm64平臺的android_server。需要根據手機平臺選擇對應的版本。由于個人手機arm64的版本，所以選擇arm64的程序android_server64。

1.2.1 源碼中構建myandroidserverarm64模塊

在源碼中創建目錄"frameworks/base/cmds/mycmds/idaandroidserver"用來存放ida server模塊。在idaandroidserver目錄中，將android_server64可執行程序拷貝到該目錄下面，并重命名為"myandroidserverarm64",然后在該目錄下面創建Android.mk文件配置myandroidserverarm64模塊的編譯規則。Android.mk文件內容如下:

1.2.2 將myandroidserverarm64模塊加入源碼編譯鏈中

在源碼路徑"buildmake argetproductase_system.mk"中將模塊"myandroidserverarm64"添加到模塊編譯鏈中。如下參考:

2.adbd進程中編寫控制myandroidserverarm64邏輯代碼

由于ida server啟動和frida server相似。所以可以將frida server控制的代碼拷貝一份修改一下就可以使用。以下是參考代碼:

//判斷ida server是否正在運行
static int is_ida_server_running() {

int ret=-1;
char buf[256]={0};
FILE * fp=NULL;
if((fp=popen("ps -A","r"))==NULL)
{
MYLOGD("popen error in is_ida_server_running");
return ret;
}

while(fgets (buf,255, fp)!=NULL) {
if(strstr(buf,"myandroidserverarm64")!=NULL)
{
ret=0;
break;
}
}
pclose(fp);
return ret;
}

//發送ida server運行狀態通知App
static void broadcast_ida_server_status(int status,const char * portstr)
{
//am broadcast -a com.android.myaction.IDA_SERVER_STATUS --es isRunning 0
char cmd_buf[128]={0};
sprintf(cmd_buf,"am broadcast -a com.android.myaction.IDA_SERVER_STATUS --es isRunning %d --es port %s",status,portstr);
system(cmd_buf);
MYLOGD("broadcast_ida_server_status success,status:%d current_port:%s",status,portstr);
}

//控制ida server運行、停止的工作線程
void *ida_server_work_thread(void *m)
{
MYLOGD("ida_server_work_thread start");

while(1>0)
{
std::string prop = android::base::GetProperty("sys.boot_completed", "");
std::string myfrd=android::base::GetProperty("xro.start.myidaserver","");
std::string port_str=android::base::GetProperty("xro.start.myidaserver.port","23946");
bool boot_ok = (prop == "1");
MYLOGD("ida_server_work_thread sys.boot_completed:%s",prop.c_str());
if(boot_ok)
{
int ida_server_status=is_ida_server_running();

broadcast_ida_server_status(ida_server_status,port_str.c_str());
MYLOGD("ida_server_work_thread==>%d",ida_server_status);
if(myfrd == "1")
{

MYLOGD("ida_server_work_threadstart to launch myandroidserverarm64");
char cmd_buf[128]={0};
sprintf(cmd_buf,"killall myandroidserverarm64\r\nsleep 1\r\nmyandroidserverarm64 -p %s &",port_str.c_str());
system(cmd_buf);
MYLOGD("ida_server_work_thread start myandroidserverarm64 finish ");
android::base::SetProperty("xro.start.myidaserver","3");

}else if(myfrd=="0"){
MYLOGD("ida_server_work_thread start to stop myandroidserverarm64");
char cmd_buf[128]={0};
sprintf(cmd_buf,"killall myandroidserverarm64");
if(ida_server_status>=0)
{
system(cmd_buf);
}
MYLOGD("ida_server_work_thread stop myandroidserverarm64 finish ");

}else if(myfrd=="3"){
if(ida_server_status<0)
{

//說明adbd 第一次啟動，并且狀態屬性為3說明adbd被重啟了，需要重新啟動ida server
//測試過程中發現adbd掛了 ida server也會被殺掉
MYLOGD("adbd restart,start to launch myfridaserverarm64");
char cmd_buf[128]={0};
sprintf(cmd_buf,"killall myandroidserverarm64\r\nsleep 1\r\nmyandroidserverarm64 -p %s &",port_str.c_str());
system(cmd_buf);
MYLOGD("ida_server_work_thread adbd restart,start myandroidserverarm64 finish ");
//android::base::SetProperty("xro.start.myfrd","3");
}
MYLOGD("ida_server_work_thread myandroidserverarm64 is running");
}else{

}
}else{
//LOG(DEBUG) << "sys.boot_completed:"< }
sleep(1);
}
return NULL;
}

//啟動ida server
static void start_ida_server()
{

MYLOGD("start_ida_server start ");
pthread_t thread_id;
int i = 9;
pthread_create(&thread_id, NULL, &ida_server_work_thread, (void*)&i);
MYLOGD("start_ida_server thread is created!");

}

3.開發App控制ida server啟動、停止和配置端口

由于ida server配置和frida server配置很相似，可以參考控制frida server的配置頁面寫一個ida server配置的頁面。以下是部分核心參考關鍵代碼:

/廣播監聽狀態
BroadcastReceiver mBroadcastReceiver = new BroadcastReceiver() {
@Override
public void onReceive(Context context, Intent intent) {
String isRunning = intent.getStringExtra("isRunning");
String port = intent.getStringExtra("port");
if (isRunning.equals("0")) {
textViewShowRunningStatus.setText("正在運行");
} else {
textViewShowRunningStatus.setText("未運行");
}

textViewIdaServerPort.setText(port);
}
};

//各種功能按鈕點擊事件
class MyClick implements View.OnClickListener {
@Override
public void onClick(View view) {
switch (view.getId()) {
case R.id.buttonStartIdaServer: {
//啟動 ida server
String port = editTextInputIdaServerPort.getText() + "";
port = port.trim();
if (port.equals("")) {
Toast.makeText(mContext, "當前未配置端口", Toast.LENGTH_LONG).show();
return;
}
try {
int myport = Integer.parseInt(port);
if (myport <= 1024 || myport > 65535) {
Toast.makeText(mContext, "配置端口錯誤,端口范圍1024~65535", Toast.LENGTH_LONG).show();
return;
}
} catch (Exception eeee) {
Toast.makeText(mContext, "配置端口錯誤:" + eeee.toString(), Toast.LENGTH_LONG).show();
return;
}
String getVal = get("xro.start.myidaserver", "");
d("currentVal before:" + getVal);
SystemProperties.set("xro.start.myidaserver.port", port.trim());
SystemProperties.set("xro.start.myidaserver", "1");
getVal = get("xro.start.myidaserver", "");
d("currentVal after:" + getVal);
break;
}
case R.id.buttonStopIdaServer: {
//停止ida server
String getVal = get("xro.start.myidaserver", "");
d("currentVal before:" + getVal);
SystemProperties.set("xro.start.myidaserver", "0");
getVal = SystemProperties.get("xro.start.myidaserver", "");
d("currentVal after:" + getVal);
break;
}

case R.id.buttonRestartAdbd: {
//重啟adbd
String getVal = get("xro.start.myadbd", "");
d("currentVal before:" + getVal);
SystemProperties.set("xro.start.myadbd", "0");
SystemProperties.set("xro.start.myadbd", "1");
getVal = SystemProperties.get("xro.start.myadbd", "");
d("currentVal after:" + getVal);
break;
}

}
}
}

以上修改配置好之后就可以編譯刷機測試驗證效果。

審核編輯：劉清