Android 逆向(四) - adb常用逆向命令

本篇文章继续记录下adb 的一些常用逆向命令.

1: adb shell ps

该命令可以查看进程信息.

用法: adb shell ps |grep [pname]

zh@zh:~/workSpace$ adb shell ps
USER PID PPID VSZ RSS WCHAN ADDR S NAME
root 1 0 2189532 3660 0 0 S init
root 2 0 0 0 0 0 S [kthreadd]
root 3 2 0 0 0 0 I [rcu_gp]
root 4 2 0 0 0 0 I [rcu_par_gp]
root 8 2 0 0 0 0 I [mm_percpu_wq]
root 9 2 0 0 0 0 S [ksoftirqd/0]
root 10 2 0 0 0 0 I [rcu_preempt]
root 11 2 0 0 0 0 I [rcu_sched]
root 12 2 0 0 0 0 I [rcu_bh]
root 13 2 0 0 0 0 S [rcuop/0]
root 14 2 0 0 0 0 S [rcuos/0]
root 16 2 0 0 0 0 S [rcuob/0]
root 17 2 0 0 0 0 S [migration/0]
root 18 2 0 0 0 0 S [cpuhp/0]
root 19 2 0 0 0 0 S [cpuhp/1]
root 20 2 0 0 0 0 S [migration/1]
root 21 2 0 0 0 0 S [ksoftirqd/1]
root 23 2 0 0 0 0 I [kworker/1:0H-kblockd]
root 24 2 0 0 0 0 S [rcuop/1]
root 25 2 0 0 0 0 S [rcuos/1]
root 26 2 0 0 0 0 S [rcuob/1]
root 27 2 0 0 0 0 S [cpuhp/2]
root 28 2 0 0 0 0 S [migration/2]
root 29 2 0 0 0 0 S [ksoftirqd/2]
root 31 2 0 0 0 0 I [kworker/2:0H-kblockd]
root 32 2 0 0 0 0 S [rcuop/2]
root 33 2 0 0 0 0 S [rcuos/2]
root 34 2 0 0 0 0 S [rcuob/2]
root 35 2 0 0 0 0 S [cpuhp/3]

过滤进程名称:

zh@zh:~/workSpace$ adb shell ps |grep com.sohu.inputmethod.sogou
u0_a434 29729 733 6858060 173656 0 0 S com.sohu.inputmethod.sogou
u0_a434 29968 733 7345116 174220 0 0 S com.sohu.inputmethod.sogou:home

python 用法:

python 执行adb 命令的代码也很简单,如下:

import subprocess

subprocess.run([“adb”, “shell”, “ps |grep com.sohu.inputmethod.sogou”])

执行结果:

/usr/bin/python3 /home/zh/workSpace/python/Test1/venv/adb.py
u0_a434 29729 733 6858060 173656 0 0 S com.sohu.inputmethod.sogou
u0_a434 29968 733 7327680 174220 0 0 S com.sohu.inputmethod.sogou:home

Process finished with exit code 0

2: adb shell top

该命令可以实时查看资源占用情况

用法: adb shell top

Tasks: 744 total,   6 running, 737 sleeping,   0 stopped,   1 zombie
  Mem:  7823156K total,  7527928K used,   295228K free,   2592768 buffers
 Swap:  4194300K total,  1431156K used,  2763144K free,  3952064K cached
800%cpu 179%user  31%nice 116%sys 451%idle   3%iow  14%irq   5%sirq   0%host
   PID USER         PR  NI VIRT  RES  SHR S[%CPU] %MEM     TIME+ ARGS           
 31951 u0_a170      10 -10 7.3G 216M 141M R  109   2.8   0:02.01 com.android.mms
 29729 u0_a434      20   0 6.5G 166M 150M S 67.0   2.1  59:40.47 com.sohu.input+
  1585 system       18  -2  12G 321M 321M S 38.6   4.1 1051:25.3 system_server
  1049 system       -2  -8 2.6G  17M  13M R 15.0   0.2 510:12.70 surfaceflinger
  3855 radio        20   0 6.7G  55M  55M S  9.6   0.7  61:15.16 com.android.ph+
   156 root         20   0    0    0    0 S  8.0   0.0   8:42.71 [kswapd0:0]
   533 logd         30  10 2.1G 5.8M 2.6M S  7.6   0.0 140:49.31 logd
   947 system       -3   0 2.2G 5.1M 4.3M S  4.6   0.0 135:51.76 vendor.qti.har+
 29120 shell        20   0 2.1G 5.7M 4.3M S  3.3   0.0   0:07.47 adbd --root_se+
 31581 root         20   0    0    0    0 I  3.0   0.0   0:00.44 [kworker/u16:1+
   549 system       20   0 2.0G 2.5M 2.3M S  3.0   0.0   0:56.66 android.hardwa+
 31938 shell        20   0 2.0G 4.4M 3.0M R  2.3   0.0   0:00.37 top
  2711 root         19  -1    0    0    0 S  2.3   0.0  91:36.77 [cds_ol_rx_thr+
   731 root         20   0 2.3G 3.8M 3.3M S  2.3   0.0  18:27.65 netd
  3396 u0_a116      20   0 7.9G 106M 106M S  2.0   1.3 201:44.89 com.android.sy+
 22626 u0_a185      20   0 6.1G 110M  94M S  1.6   1.4   0:07.73 com.oppo.userc+
  1501 mediacodec   20   0 2.6G 4.2M 4.2M S  1.6   0.0   0:27.59 media.swcodec +
  1410 root         30  10 2.0G 5.1M 3.1M S  1.6   0.0   3:56.47 storaged
 10841 u0_a179      20   0 5.4G  89M  89M S  1.3   1.1   0:31.45 com.nearme.sta+
^C 730 statsd       20   0 2.1G 2.0M 2.0M S  1.3   0.0   7:27.43 statsd

列含义:

1. PID(Process ID):进程号
2. USER:进程所属用户
3. PR(Priority):优先级
4. NI(Nice value): 进程优先级的调整值
5. VIRT(Virtual Image (kb)):进程使用的虚拟内存大小
6. RES(Resident size (kb)):进程使用的物理内存大小
7. SHR(Shared memory (kb)):进程使用的共享内存大小
8. S(Process Status): 进程状态 R:运行 S:睡眠
9. %CPU:当前瞬间占用cpu的百分比
10. %MEM:进程使用的内存百分比
11. TIME+:进程运行的累计时间
12. ARGS:进程的命令名称

3: 查询UID

用法: adb shell dumpsys package |grep userId

zh@zh:~$ adb shell dumpsys package com.sohu.inputmethod.sogou |grep userId
userId=10434