Android adb構造特定格式的broadcast intent，僞造短信廣播

在姜維大大的小黃書中，提到了很有用的adb命令，其中

adb shell am broadcast

這個命令可以在終端構造特定格式的intent並且發送這個廣播，這個命令的參數很豐富，可以滿足大部分intent構造需求。但是我在百度上沒有搜索到完整得參數信息，由於項目的推進，我不得不詳細瞭解這個命令的功能，於是機緣巧合在學長的幫助下找到了這個命令的安卓源碼，並且從根本上了解了這個命令的使用方法。

am這個命令最終會調用以下兩個源碼：參考https://www.jianshu.com/p/a606fc800366

aosp_8/frameworks/base/services/core/java/com/android/server/am/ActivityManagerShellCommand.java
aosp_8/frameworks/base/core/java/android/content/Intent.java

在ActivityManagerShellCommand.java中：此命令最終調用以下函數，我們可以看到intent由makeIntent函數生成，並且在這個函數中設置了flag字段。

int runSendBroadcast(PrintWriter pw) throws RemoteException {
        Intent intent;
        try {
            intent = makeIntent(UserHandle.USER_CURRENT);
        } catch (URISyntaxException e) {
            throw new RuntimeException(e.getMessage(), e);
        }
        intent.addFlags(Intent.FLAG_RECEIVER_FROM_SHELL);
        IntentReceiver receiver = new IntentReceiver(pw);
        String[] requiredPermissions = mReceiverPermission == null ? null
                : new String[] {mReceiverPermission};
        
        pw.println("Broadcasting: " + intent);
        pw.flush();
        mInterface.broadcastIntent(null, intent, null, receiver, 0, null, null, requiredPermissions,
                android.app.AppOpsManager.OP_NONE, null, true, false, mUserId);
        receiver.waitForFinish();
        return 0;
    }

我們進入makeIntent函數中查看intent是如何構造得：可以看到，Intent.parseCommandArgs()中應該有更大得貓膩。

private Intent makeIntent(int defUser) throws URISyntaxException {
        mStartFlags = 0;
        mWaitOption = false;
        mStopOption = false;
        mRepeat = 0;
        mProfileFile = null;
        mSamplingInterval = 0;
        mAutoStop = false;
        mStreaming = false;
        mUserId = defUser;
        mDisplayId = INVALID_DISPLAY;
        mStackId = INVALID_STACK_ID;
        mTaskId = INVALID_TASK_ID;
        mIsTaskOverlay = false;
        //hook by xcz，我自己添加了一個-Z開關來改寫am命令的某些行爲
        mSendSmsContent = false;

        return Intent.parseCommandArgs(this, new Intent.CommandOptionHandler() {
            @Override
            public boolean handleOption(String opt, ShellCommand cmd) {
                //opt是命令行參數，可以通過相應得開關來設置intent的內容
                if (opt.equals("-D")) {
                    mStartFlags |= ActivityManager.START_FLAG_DEBUG;
                } else if (opt.equals("-N")) {
                    mStartFlags |= ActivityManager.START_FLAG_NATIVE_DEBUGGING;
                } else if (opt.equals("-W")) {
                    mWaitOption = true;
                } else if (opt.equals("-P")) {
                    mProfileFile = getNextArgRequired();
                    mAutoStop = true;
                } else if (opt.equals("--start-profiler")) {
                    mProfileFile = getNextArgRequired();
                    mAutoStop = false;
                } else if (opt.equals("--sampling")) {
                    mSamplingInterval = Integer.parseInt(getNextArgRequired());
                } else if (opt.equals("--streaming")) {
                    mStreaming = true;
                } else if (opt.equals("--attach-agent")) {
                    mAgent = getNextArgRequired();
                } else if (opt.equals("-R")) {
                    mRepeat = Integer.parseInt(getNextArgRequired());
                } else if (opt.equals("-S")) {
                    mStopOption = true;
                } else if (opt.equals("--track-allocation")) {
                    mStartFlags |= ActivityManager.START_FLAG_TRACK_ALLOCATION;
                } else if (opt.equals("--user")) {
                    mUserId = UserHandle.parseUserArg(getNextArgRequired());
                } else if (opt.equals("--receiver-permission")) {
                    mReceiverPermission = getNextArgRequired();
                } else if (opt.equals("--display")) {
                    mDisplayId = Integer.parseInt(getNextArgRequired());
                } else if (opt.equals("--stack")) {
                    mStackId = Integer.parseInt(getNextArgRequired());
                } else if (opt.equals("--task")) {
                    mTaskId = Integer.parseInt(getNextArgRequired());
                } else if (opt.equals("--task-overlay")) {
                    mIsTaskOverlay = true;
                } else if(opt.equals("-Z")){//我添加得自定義字段，添加後重新編譯源碼
                    mSendSmsContent = true;
                } else {
                    return false;
                }
                return true;
            }
        });
    }

我們最後進入到Intent.parseCommandArgs()中：這裏可以看到am broadcast命令中所有的開關參數了，可以愉快地構造intent並且進行廣播。例如-a指定action，-d指定uri，-p指定包名，-n指定組件名，-es指定{key,value}太多了，自行看源碼。

public static Intent parseCommandArgs(ShellCommand cmd, CommandOptionHandler optionHandler)
            throws URISyntaxException {
        Intent intent = new Intent();
        Intent baseIntent = intent;
        boolean hasIntentInfo = false;

        Uri data = null;
        String type = null;

        String opt;
        while ((opt=cmd.getNextOption()) != null) {
            switch (opt) {
                case "-a":
                    intent.setAction(cmd.getNextArgRequired());
                    if (intent == baseIntent) {
                        hasIntentInfo = true;
                    }
                    break;
                case "-d":
                    data = Uri.parse(cmd.getNextArgRequired());
                    if (intent == baseIntent) {
                        hasIntentInfo = true;
                    }
                    break;
                case "-t":
                    type = cmd.getNextArgRequired();
                    if (intent == baseIntent) {
                        hasIntentInfo = true;
                    }
                    break;
                case "-c":
                    intent.addCategory(cmd.getNextArgRequired());
                    if (intent == baseIntent) {
                        hasIntentInfo = true;
                    }
                    break;
                case "-e":
                case "--es": {
                    String key = cmd.getNextArgRequired();
                    String value = cmd.getNextArgRequired();
                    intent.putExtra(key, value);
                }
                break;
                case "--esn": {
                    String key = cmd.getNextArgRequired();
                    intent.putExtra(key, (String) null);
                }
                break;
                case "--ei": {
                    String key = cmd.getNextArgRequired();
                    String value = cmd.getNextArgRequired();
                    intent.putExtra(key, Integer.decode(value));
                }
                break;
                case "--eu": {
                    String key = cmd.getNextArgRequired();
                    String value = cmd.getNextArgRequired();
                    intent.putExtra(key, Uri.parse(value));
                }
                break;
                case "--ecn": {
                    String key = cmd.getNextArgRequired();
                    String value = cmd.getNextArgRequired();
                    ComponentName cn = ComponentName.unflattenFromString(value);
                    if (cn == null)
                        throw new IllegalArgumentException("Bad component name: " + value);
                    intent.putExtra(key, cn);
                }
                break;
                case "--eia": {
                    String key = cmd.getNextArgRequired();
                    String value = cmd.getNextArgRequired();
                    String[] strings = value.split(",");
                    int[] list = new int[strings.length];
                    for (int i = 0; i < strings.length; i++) {
                        list[i] = Integer.decode(strings[i]);
                    }
                    intent.putExtra(key, list);
                }
                break;
                case "--eial": {
                    String key = cmd.getNextArgRequired();
                    String value = cmd.getNextArgRequired();
                    String[] strings = value.split(",");
                    ArrayList<Integer> list = new ArrayList<>(strings.length);
                    for (int i = 0; i < strings.length; i++) {
                        list.add(Integer.decode(strings[i]));
                    }
                    intent.putExtra(key, list);
                }
                break;
                case "--el": {
                    String key = cmd.getNextArgRequired();
                    String value = cmd.getNextArgRequired();
                    intent.putExtra(key, Long.valueOf(value));
                }
                break;
                case "--ela": {
                    String key = cmd.getNextArgRequired();
                    String value = cmd.getNextArgRequired();
                    String[] strings = value.split(",");
                    long[] list = new long[strings.length];
                    for (int i = 0; i < strings.length; i++) {
                        list[i] = Long.valueOf(strings[i]);
                    }
                    intent.putExtra(key, list);
                    hasIntentInfo = true;
                }
                break;
                case "--elal": {
                    String key = cmd.getNextArgRequired();
                    String value = cmd.getNextArgRequired();
                    String[] strings = value.split(",");
                    ArrayList<Long> list = new ArrayList<>(strings.length);
                    for (int i = 0; i < strings.length; i++) {
                        list.add(Long.valueOf(strings[i]));
                    }
                    intent.putExtra(key, list);
                    hasIntentInfo = true;
                }
                break;
                case "--ef": {
                    String key = cmd.getNextArgRequired();
                    String value = cmd.getNextArgRequired();
                    intent.putExtra(key, Float.valueOf(value));
                    hasIntentInfo = true;
                }
                break;
                case "--efa": {
                    String key = cmd.getNextArgRequired();
                    String value = cmd.getNextArgRequired();
                    String[] strings = value.split(",");
                    float[] list = new float[strings.length];
                    for (int i = 0; i < strings.length; i++) {
                        list[i] = Float.valueOf(strings[i]);
                    }
                    intent.putExtra(key, list);
                    hasIntentInfo = true;
                }
                break;
                case "--efal": {
                    String key = cmd.getNextArgRequired();
                    String value = cmd.getNextArgRequired();
                    String[] strings = value.split(",");
                    ArrayList<Float> list = new ArrayList<>(strings.length);
                    for (int i = 0; i < strings.length; i++) {
                        list.add(Float.valueOf(strings[i]));
                    }
                    intent.putExtra(key, list);
                    hasIntentInfo = true;
                }
                break;
                case "--esa": {
                    String key = cmd.getNextArgRequired();
                    String value = cmd.getNextArgRequired();
                    // Split on commas unless they are preceeded by an escape.
                    // The escape character must be escaped for the string and
                    // again for the regex, thus four escape characters become one.
                    String[] strings = value.split("(?<!\\\\),");
                    intent.putExtra(key, strings);
                    hasIntentInfo = true;
                }
                break;
                case "--esal": {
                    String key = cmd.getNextArgRequired();
                    String value = cmd.getNextArgRequired();
                    // Split on commas unless they are preceeded by an escape.
                    // The escape character must be escaped for the string and
                    // again for the regex, thus four escape characters become one.
                    String[] strings = value.split("(?<!\\\\),");
                    ArrayList<String> list = new ArrayList<>(strings.length);
                    for (int i = 0; i < strings.length; i++) {
                        list.add(strings[i]);
                    }
                    intent.putExtra(key, list);
                    hasIntentInfo = true;
                }
                break;
                case "--ez": {
                    String key = cmd.getNextArgRequired();
                    String value = cmd.getNextArgRequired().toLowerCase();
                    // Boolean.valueOf() results in false for anything that is not "true", which is
                    // error-prone in shell commands
                    boolean arg;
                    if ("true".equals(value) || "t".equals(value)) {
                        arg = true;
                    } else if ("false".equals(value) || "f".equals(value)) {
                        arg = false;
                    } else {
                        try {
                            arg = Integer.decode(value) != 0;
                        } catch (NumberFormatException ex) {
                            throw new IllegalArgumentException("Invalid boolean value: " + value);
                        }
                    }

                    intent.putExtra(key, arg);
                }
                break;
                case "-n": {
                    String str = cmd.getNextArgRequired();
                    ComponentName cn = ComponentName.unflattenFromString(str);
                    if (cn == null)
                        throw new IllegalArgumentException("Bad component name: " + str);
                    intent.setComponent(cn);
                    if (intent == baseIntent) {
                        hasIntentInfo = true;
                    }
                }
                break;
                case "-p": {
                    String str = cmd.getNextArgRequired();
                    intent.setPackage(str);
                    if (intent == baseIntent) {
                        hasIntentInfo = true;
                    }
                }
                break;
                case "-f":
                    String str = cmd.getNextArgRequired();
                    intent.setFlags(Integer.decode(str).intValue());
                    break;
                case "--grant-read-uri-permission":
                    intent.addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION);
                    break;
                case "--grant-write-uri-permission":
                    intent.addFlags(Intent.FLAG_GRANT_WRITE_URI_PERMISSION);
                    break;
                case "--grant-persistable-uri-permission":
                    intent.addFlags(Intent.FLAG_GRANT_PERSISTABLE_URI_PERMISSION);
                    break;
                case "--grant-prefix-uri-permission":
                    intent.addFlags(Intent.FLAG_GRANT_PREFIX_URI_PERMISSION);
                    break;
                case "--exclude-stopped-packages":
                    intent.addFlags(Intent.FLAG_EXCLUDE_STOPPED_PACKAGES);
                    break;
                case "--include-stopped-packages":
                    intent.addFlags(Intent.FLAG_INCLUDE_STOPPED_PACKAGES);
                    break;
                case "--debug-log-resolution":
                    intent.addFlags(Intent.FLAG_DEBUG_LOG_RESOLUTION);
                    break;
                case "--activity-brought-to-front":
                    intent.addFlags(Intent.FLAG_ACTIVITY_BROUGHT_TO_FRONT);
                    break;
                case "--activity-clear-top":
                    intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TOP);
                    break;
                case "--activity-clear-when-task-reset":
                    intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_WHEN_TASK_RESET);
                    break;
                case "--activity-exclude-from-recents":
                    intent.addFlags(Intent.FLAG_ACTIVITY_EXCLUDE_FROM_RECENTS);
                    break;
                case "--activity-launched-from-history":
                    intent.addFlags(Intent.FLAG_ACTIVITY_LAUNCHED_FROM_HISTORY);
                    break;
                case "--activity-multiple-task":
                    intent.addFlags(Intent.FLAG_ACTIVITY_MULTIPLE_TASK);
                    break;
                case "--activity-no-animation":
                    intent.addFlags(Intent.FLAG_ACTIVITY_NO_ANIMATION);
                    break;
                case "--activity-no-history":
                    intent.addFlags(Intent.FLAG_ACTIVITY_NO_HISTORY);
                    break;
                case "--activity-no-user-action":
                    intent.addFlags(Intent.FLAG_ACTIVITY_NO_USER_ACTION);
                    break;
                case "--activity-previous-is-top":
                    intent.addFlags(Intent.FLAG_ACTIVITY_PREVIOUS_IS_TOP);
                    break;
                case "--activity-reorder-to-front":
                    intent.addFlags(Intent.FLAG_ACTIVITY_REORDER_TO_FRONT);
                    break;
                case "--activity-reset-task-if-needed":
                    intent.addFlags(Intent.FLAG_ACTIVITY_RESET_TASK_IF_NEEDED);
                    break;
                case "--activity-single-top":
                    intent.addFlags(Intent.FLAG_ACTIVITY_SINGLE_TOP);
                    break;
                case "--activity-clear-task":
                    intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK);
                    break;
                case "--activity-task-on-home":
                    intent.addFlags(Intent.FLAG_ACTIVITY_TASK_ON_HOME);
                    break;
                case "--receiver-registered-only":
                    intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY);
                    break;
                case "--receiver-replace-pending":
                    intent.addFlags(Intent.FLAG_RECEIVER_REPLACE_PENDING);
                    break;
                case "--receiver-foreground":
                    intent.addFlags(Intent.FLAG_RECEIVER_FOREGROUND);
                    break;
                case "--receiver-no-abort":
                    intent.addFlags(Intent.FLAG_RECEIVER_NO_ABORT);
                    break;
                case "--receiver-include-background":
                    intent.addFlags(Intent.FLAG_RECEIVER_INCLUDE_BACKGROUND);
                    break;
                case "--selector":
                    intent.setDataAndType(data, type);
                    intent = new Intent();
                    break;
                default:
                    if (optionHandler != null && optionHandler.handleOption(opt, cmd)) {
                        // Okay, caller handled this option.
                    } else {
                        throw new IllegalArgumentException("Unknown option: " + opt);
                    }
                    break;
            }
        }

最後，我自己加了一個-z參數，發送了含有短信的intent來模擬手機接受到短信。（需要修改源碼，並且重新編譯安卓系統）

下圖是嘗試指定pkgname發送短信廣播，-es來構造某些結構