You’re almost there — sign up to start building in Notion today.
Sign up or login
Reverse Engineering
Android Debug Bridge

Android Debug Bridge

Android Debug Bridge (
adb
) is a versatile command-line tool that lets you communicate with a device. The 
adb
 command facilitates a variety of device actions, such as installing and debugging apps. 
adb
 provides access to a Unix shell that you can use to run a variety of commands on a device.

ADB Components

ADB Server
It installed on our computer when installing android SDK. It’s listen on port 5037. It will start when running ADB command.
It manages communication between the client and the daemon. The server runs as a background process on your development machine.
ADB Daemon
It installed by manufacture on the android device. When you enable USB debugging it will be listen on port 5555.
It runs commands on a device. The daemon runs as a background process on each device.
ADB Binary
It’s in
android_sdk/platform-tools/
.
The client runs on your development machine. You can invoke a client from a command-line terminal by issuing an 
adb
 command.

How ADB Work?

When you start an 
adb
 client, the client first checks whether there is an 
adb
 server process already running. If there isn't, it starts the server process. When the server starts, it binds to local TCP port 5037 and listens for commands sent from 
adb
 clients.
The server then sets up connections to all running devices. It locates emulators by scanning odd-numbered ports in the range 5555 to 5585, which is the range used by the first 16 emulators. Where the server finds an 
adb
 daemon (adbd), it sets up a connection to that port.
Each emulator uses a pair of sequential ports — an even-numbered port for console connections and an odd-numbered port for 
adb
 connections. For example:
Emulator 1, console: 5554
Emulator 1, 
adb
: 5555
Emulator 2, console: 5556
Emulator 2, 
adb
: 5557
and so on.
As shown, the emulator connected to 
adb
 on port 5555 is the same as the emulator whose console listens on port 5554.
After these steps we run our command for example
adb shell whoami
. The ADB binary connect to ADB server, The ADB server get the command and send it to ADB daemon and wait for response. ADB server get response and forward it to the ADB binary.

Note about Allow USB Debugging Warning

This alert if asking permission to allow the PC/Laptop to connect to this android device. The RSA key which is used for authorizing is stored in both PC/Laptop and android device. To seeing these keys in you PC/Laptop:
Go to
/home
directory
Press
CTR + h
to see hidden files and directories
go to
.android
directory
You see multiple files. The abdkey.pub is public key and
adbkey
is you private key.
Don’t reveal your private key. If attacker could stole it, he/she can access to your device with ADB connection.
PC/Laptop public key is stored in
/data/misc/adb/adb_keys
path. The laptop send a encrypted message via its public key. If the device cloud decrypt the message then it allow ADB connection.
The ADB protocol is plain-text protocol and it’s not encrypted by default. You can capture this traffic via Wireshark.

Working with ADB

Testing ADB Connection

To getting list of available devices:
adb devices
​
To connecting specific one:
adb -s [serial number] shell
​
If you connected via IP address, the serial number is the IP address.

Installing APK

adb install app.apk
​
Installing debug-able apk or apks which made for test:
apkt install -t app.apk
​
In case of
INSTALL_FAILED_TEST_ONLY
you should provide
-t
switch:

Port forwarding using ADB

adb forward tcp:1337 tcp:31415
​
Every packet which send to 1337 port on your PC will forwarded to 31415 mobile port. To do that vise versa, I mean forward each packet receive on 31415 mobile to 1337 PC you can use this command:
adb reverse tcp:31415 tcp:1337
​

Push And Pull files using ADB

To upload a file to your android device:
adb push myfile.txt /sdcard/
​
The host privilege without root only access to
/sdcard
and
/data/tmp
paths.
/sdcard
point to internal devices disk.

App And Device Logs

You can get applications and devices log via
logcat
. It’s important to save all logs of application and analysis them. For this purpose you should open enter
adb logcat
and store result in a file. Then opening the app. After investigating on the application, close the app and then close the
logcat
.
adb logcat
​
Do you want more beautiful log? use
pidcat
.

Restarting ADB Server

To restart of ADB server in case any trouble or bug, you can use
abd kill-server
command. After that use
adb shell
to start ADB Server automatically.
adb kill-server adb shell
​

Running adbd Service as Root

In some cases you need to running adbd service as root. For example you want to push some files in
/data/data
directory. Or you want working with some files and folders which you doesn’t have permissions by default. In these cases you can run adbd service with root user by using
adb root
command.
abd root
​

Getting Backup

Backup everything including APKs data and excluding system apks and files.
adb backup -f all -all -apk -nosystem
​