0

I have an application that uses the ADB interface as communication with my Android phone. When I run the application and press the button, the application somehow sends commands to my android, to activate special features that exist on the android application.

My question is, can I save what action the application does? especially commands related to ADB? How does it work? What are the references and commands?

For Example, there is an app called "Gamesir World" installed on Android device, this app should be activated special feature called "remapper", with pc help, the name of pc app is "xiaoji-vtouch.exe". Between this platform, I see on '%temp%' windows folder, that xiaoji app have a folder that contains ADB, then I assumed this app called some of ADB shell to activate the "Gamesir World, Remapper Special feature". I want to know what the xiaoji do with the ADB, because there another options to activate this feature using there device product called A3 remapper, but I want to pass this, perhaps I can activate this feature without another device.

Link of Applications Android, https://www.xiaoji.com/gsw/index_en.html Windows, https://www.xiaoji.com/download/vtouch/xiaoji-vtouch-1.2.0.zip Documentations, https://www.xiaoji.com/help/gw/2274.html

Improve this question
3
  • 1
    If it runs adb commands locally... you can trick it. Assuming it s a rooted android - Make a adb binary which calls the original one. What you would be doing is just a tee, send the command to the adb and log it somewhere too.
    – Curious Mind
    Feb 12, 2020 at 15:21
  • what is runs adb commands locally ? its from the phone its self ? , sadly my android was not rooted :)
    – bagusa4
    Feb 12, 2020 at 16:18
  • This might be a legit question of "logging ADB commands on Android-side" (if it's even possible), but there's also reverse-engineering the .exe file (which is not about Android at all, even though it calls ADB commands). I've tried opening the .exe file using Notepad++ and found some ADB commands but hard to decipher. That said, we also have a sister site for Reverse Engineering.
    – Andrew T. ♦
    Feb 12, 2020 at 16:46

1 Answer 1

Reset to default
2

There are several solutions:

1. Replace adb binary (see comments by Curious Mind)

Replace the adb executable on the PC with one that calls the original adb executable and print all commands. This variant is pretty limited as it only works if the program calls every command in the staly adb shell commandxyz. If it opens a shell and sends multiple commands in the shell stream you will not be able to trace them.

2. Use an adb binary with trace activated

ADB has some trace capabilities in it's source code. by default it is not active, but using a self-compiled version of adb and a patch that activates this capabilities you would be able t see all commands. See this question for details: https://stackoverflow.com/questions/5791722/how-do-i-enable-adb-tracing

3. Use ADB over IP and capture the data via Wireshark:

Connect to your device via IP: adb tcpip 5555 and the use the IP instead of the USB connection. The IP connection can the be captured by Wireshark (set the capture filter to tcp port 5555).

The main problem is that adb does not transit commands but individual characters. Therefore reconstructing the command is pretty complicated, even when decoding the TCP traffic to port 5555 as ADB protocol (while running select "Decode As" in the context menu).

Then you can filter the traffic for outgoing adb commands: ip.src==<your PC IP> && adb.data

The main problem is that usually every character is sent as individual ADB DATA packet with it's data as 4 bytes length + 4 bytes character (ASCII character decoded as integer).

The following sample screenshot shows the capture of the command hello world 12345 typed in on open adb shell (see the last column and in it the last character of each data packet):

Wireshark capture

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .