pwnlib.protocols.adb
— Protocol implementations
Implementation of the Android Debug Bridge (ADB) protocol.
Documentation is available here.
- class pwnlib.protocols.adb.AdbClient(level=None)[source]
ADB Client
- _autoclose()[source]
Decorator which automatically closes the connection to the ADB server after calling the decorated function.
- _sync()[source]
Decorator which enters ‘sync:’ mode to the selected transport, then invokes the decorated funciton.
- _with_transport()[source]
Decorator which automatically selects a device transport before calling the decorated function, and closes the connection afterward.
- devices(long=False)[source]
- Parameters:
long (bool) – If
True
, fetch the long-format listing.- Returns:
String representation of all available devices.
- execute(argv)[source]
Executes a program on the device.
- Returns:
A
pwnlib.tubes.tube.tube
which is connected to the process.
Examples:
>>> pwnlib.protocols.adb.AdbClient().execute(['echo','hello']).recvall() b'hello\n'
- kill()[source]
Kills the remote ADB server”
>>> c=pwnlib.protocols.adb.AdbClient() >>> c.kill()
The server is automatically re-started on the next request, if the default host/port are used.
>>> c.version() > (4,0) True >>> c.wait_for_device() # ensure doctests alive
- list(path)[source]
Execute the
LIST
command of theSYNC
API.- Parameters:
path (str) – Path of the directory to list.
- Returns:
A dictionary, where the keys are relative filenames, and the values are a dictionary containing the same values as
stat()
supplies.
Note
In recent releases of Android (e.g. 7.0), the domain that adbd executes from does not have access to everything that the shell user does.
Because of this, while the shell user can get listings of e.g. the root directory (‘/’), adbd cannot.
The SYNC APIs are executed within the adbd context, not the shell user context.
This issue is not a problem if the phone is rooted via ‘adb root’, since adbd then runs in the
su
domain.Examples:
>>> _ = AdbClient().root() >>> AdbClient().wait_for_device() >>> pprint(AdbClient().list('/data/user')) {'0': {'mode': 41471, 'size': 10, 'time': ...}} >>> AdbClient().list('/does/not/exist') Traceback (most recent call last): ... PwnlibException: Cannot list directory '/does/not/exist': Does not exist
- read(path, filesize=0, callback=<function AdbClient.<lambda>>)[source]
Execute the
READ
command of theSYNC
API.- Parameters:
- Returns:
The data received as a string.
- stat(path)[source]
Execute the STAT command of the SYNC API.
- Parameters:
path (str) – Path to the file to stat.
- Returns:
On success, a dictionary mapping the values returned. If the file cannot be stat() ed, None is returned.
Example:
>>> expected = {'mode': 16749, 'size': 0, 'time': 0} >>> pwnlib.protocols.adb.AdbClient().stat('/proc') == expected True >>> pwnlib.protocols.adb.AdbClient().stat('/does/not/exist') is None True
- track_devices()[source]
- Returns:
Generator which returns a short-format listing of available devices each time a device state changes.
- transport(serial=None, try_again=True)[source]
Sets the Transport on the remote device.
Examples:
>>> pwnlib.protocols.adb.AdbClient().transport()
- version()[source]
- Returns:
Tuple containing the
(major, minor)
version from the ADB server
Example:
>>> pwnlib.protocols.adb.AdbClient().version() (4, 36)
- write(path, data, mode=493, timestamp=None, callback=None)[source]
Execute the
WRITE
command of theSYNC
API.- Parameters:
path (str) – Path to the file to write
data (str) – Data to write to the file
mode (int) – File mode to set (e.g.
0o755
)timestamp (int) – Unix timestamp to set the file date to
callback (callable) –
Callback function invoked as data is written. Arguments provided are:
File path
All data
Expected size of all data
Current chunk
Expected size of chunk
- class pwnlib.protocols.adb.Connection(host, port, level=None, *a, **kw)[source]
Connection to the ADB server