• ida server集成到手机系统

• adbd进程中添加启动、停止ida server的逻辑代码

• 开发ida server控制App实现控制ida server停止、启动、端口修改

1.ida server内置

1.1 ida下载

下载地址参考:

https://down.52pojie.cn/Tools/Disassemblers/

1.2 内置ida中的android_server到手机系统

将下载好的ida工具包解压之后，在目录dbgsrv下面存放了android_server程序。目前高版本的ida提供了arm和arm64平台的android_server。需要根据手机平台选择对应的版本。由于个人手机arm64的版本，所以选择arm64的程序android_server64。

1.2.1 源码中构建myandroidserverarm64模块

在源码中创建目录"frameworks/base/cmds/mycmds/idaandroidserver"用来存放ida server模块。在idaandroidserver目录中，将android_server64可执行程序拷贝到该目录下面，并重命名为"myandroidserverarm64",然后在该目录下面创建Android.mk文件配置myandroidserverarm64模块的编译规则。Android.mk文件内容如下:

LOCAL_PATH:= $(call my-dir)
include $(CLEAR_VARS)
LOCAL_MODULE := myandroidserverarm64
LOCAL_MODULE_CLASS := EXECUTABLES
LOCAL_SRC_FILES := myandroidserverarm64
include $(BUILD_PREBUILT)

1.2.2 将myandroidserverarm64模块加入源码编译链中

在源码路径"build\make\target\product\base_system.mk"中将模块"myandroidserverarm64"添加到模块编译链中。如下参考:

...
# Base modules and settings for the system partition.
PRODUCT_PACKAGES += \
    myandroidserverarm64 \
    abb \
    adbd \
...    

2.adbd进程中编写控制myandroidserverarm64逻辑代码

由于ida server启动和frida server相似。所以可以将frida server控制的代码拷贝一份修改一下就可以使用。以下是参考代码:

//判断ida server是否正在运行
static int  is_ida_server_running() {
    int ret=-1;
    char buf[256]={0};
    FILE * fp=NULL;
    if((fp=popen("ps -A","r"))==NULL)
    {
       MYLOGD("popen error in is_ida_server_running");
       return ret;
    }
    while(fgets (buf,255, fp)!=NULL) {
        if(strstr(buf,"myandroidserverarm64")!=NULL)
        {
           ret=0;
           break;
        }
     }
   pclose(fp);
   return ret;
}
//发送ida server运行状态通知App
static void  broadcast_ida_server_status(int status,const char * portstr)
{
    //am broadcast -a com.android.myaction.IDA_SERVER_STATUS --es isRunning 0
    char cmd_buf[128]={0};
    sprintf(cmd_buf,"am broadcast -a com.android.myaction.IDA_SERVER_STATUS --es isRunning %d  --es port %s",status,portstr);
    system(cmd_buf);
    MYLOGD("broadcast_ida_server_status success,status:%d current_port:%s",status,portstr);
}
//控制ida server运行、停止的工作线程
void *ida_server_work_thread(void *m)
{
   MYLOGD("ida_server_work_thread start");
   while(1>0)
   {
      std::string prop = android::base::GetProperty("sys.boot_completed", "");
      std::string myfrd=android::base::GetProperty("xro.start.myidaserver","");
      std::string port_str=android::base::GetProperty("xro.start.myidaserver.port","23946");
      bool boot_ok = (prop == "1");
      MYLOGD("ida_server_work_thread sys.boot_completed:%s",prop.c_str());
      if(boot_ok)
      {
        int ida_server_status=is_ida_server_running();
        broadcast_ida_server_status(ida_server_status,port_str.c_str());
        MYLOGD("ida_server_work_thread==>%d",ida_server_status);
        if(myfrd == "1")
        {
          MYLOGD("ida_server_work_threadstart to launch myandroidserverarm64");
          char cmd_buf[128]={0};
          sprintf(cmd_buf,"killall myandroidserverarm64\r\nsleep 1\r\nmyandroidserverarm64 -p %s &",port_str.c_str());
          system(cmd_buf);
          MYLOGD("ida_server_work_thread start myandroidserverarm64 finish ");
          android::base::SetProperty("xro.start.myidaserver","3");
        }else if(myfrd=="0"){
          MYLOGD("ida_server_work_thread start to stop myandroidserverarm64");
          char cmd_buf[128]={0};
          sprintf(cmd_buf,"killall myandroidserverarm64");
          if(ida_server_status>=0)
          {
             system(cmd_buf);
          }
          MYLOGD("ida_server_work_thread stop myandroidserverarm64 finish ");
        }else if(myfrd=="3"){
           if(ida_server_status<0)
            {
               //说明adbd 第一次启动，并且状态属性为3说明adbd被重启了，需要重新启动ida server
               //测试过程中发现adbd挂了 ida server也会被杀掉
               MYLOGD("adbd restart,start to launch myfridaserverarm64");
               char cmd_buf[128]={0};
               sprintf(cmd_buf,"killall myandroidserverarm64\r\nsleep 1\r\nmyandroidserverarm64 -p %s &",port_str.c_str());
               system(cmd_buf);
               MYLOGD("ida_server_work_thread adbd restart,start myandroidserverarm64 finish ");
               //android::base::SetProperty("xro.start.myfrd","3");
            }
           MYLOGD("ida_server_work_thread myandroidserverarm64 is running");
        }else{
        }
      }else{
          //LOG(DEBUG) << "sys.boot_completed:"<<prop;
      }
       sleep(1);       
   }
   return NULL;
}
//启动ida server
static void  start_ida_server()
{
   MYLOGD("start_ida_server start ");
   pthread_t thread_id;
   int i = 9;
   pthread_create(&thread_id, NULL, &ida_server_work_thread, (void*)&i);
   MYLOGD("start_ida_server thread is created!");
}

3.开发App控制ida server启动、停止和配置端口

由于ida server配置和frida server配置很相似，可以参考控制frida server的配置页面写一个ida server配置的页面。以下是部分核心参考关键代码:

//广播监听状态
 BroadcastReceiver mBroadcastReceiver = new BroadcastReceiver() {
        @Override
        public void onReceive(Context context, Intent intent) {
            String isRunning = intent.getStringExtra("isRunning");
            String port = intent.getStringExtra("port");
            if (isRunning.equals("0")) {
                textViewShowRunningStatus.setText("正在运行");
            } else {
                textViewShowRunningStatus.setText("未运行");
            }
            textViewIdaServerPort.setText(port);
        }
    };
//各种功能按钮点击事件
class MyClick implements View.OnClickListener {
        @Override
        public void onClick(View view) {
            switch (view.getId()) {
                case R.id.buttonStartIdaServer: {
                    //启动 ida server
                    String port = editTextInputIdaServerPort.getText() + "";
                    port = port.trim();
                    if (port.equals("")) {
                        Toast.makeText(mContext, "当前未配置端口", Toast.LENGTH_LONG).show();
                        return;
                    }
                    try {
                        int myport = Integer.parseInt(port);
                        if (myport <= 1024 || myport > 65535) {
                            Toast.makeText(mContext, "配置端口错误,端口范围1024~65535", Toast.LENGTH_LONG).show();
                            return;
                        }
                    } catch (Exception eeee) {
                        Toast.makeText(mContext, "配置端口错误:" + eeee.toString(), Toast.LENGTH_LONG).show();
                        return;
                    }
                    String getVal = get("xro.start.myidaserver", "");
                    d("currentVal before:" + getVal);
                    SystemProperties.set("xro.start.myidaserver.port", port.trim());
                    SystemProperties.set("xro.start.myidaserver", "1");
                    getVal = get("xro.start.myidaserver", "");
                    d("currentVal after:" + getVal);
                    break;
                }
                case R.id.buttonStopIdaServer: {
                    //停止ida server
                    String getVal = get("xro.start.myidaserver", "");
                    d("currentVal before:" + getVal);
                    SystemProperties.set("xro.start.myidaserver", "0");
                    getVal = SystemProperties.get("xro.start.myidaserver", "");
                    d("currentVal after:" + getVal);
                    break;
                }
                case R.id.buttonRestartAdbd: {
                    //重启adbd
                    String getVal = get("xro.start.myadbd", "");
                    d("currentVal before:" + getVal);
                    SystemProperties.set("xro.start.myadbd", "0");
                    SystemProperties.set("xro.start.myadbd", "1");
                    getVal = SystemProperties.get("xro.start.myadbd", "");
                    d("currentVal after:" + getVal);
                    break;
                }
            }
        }
    }

以上修改配置好之后就可以编译刷机测试验证效果。