android2.3.4----7.adb分析(未完成)

一. android板子上的adbd
1. Androi.mk与编译
LOCAL_PATH:= $(call my-dir) include$(CLEAR_VARS)
LOCAL_SRC_FILES := \
adb.c \
fdevent.c \
transport.c \
transport_local.c \
transport_usb.c \
sockets.c \
services.c \
file_sync_service.c \
jdwp_service.c \
framebuffer_service.c \
remount_service.c \
usb_linux_client.c \
log_service.c \
utils.c

LOCAL_CFLAGS := -O2 -g -DADB_HOST=0 -Wall -Wno-unused-parameter
LOCAL_CFLAGS += -D_XOPEN_SOURCE -D_GNU_SOURCE
LOCAL_CFLAGS += -DANDROID_GADGET=1
LOCAL_MODULE := adbd

LOCAL_FORCE_STATIC_EXECUTABLE := true
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT_SBIN) LOCAL_UNSTRIPPED_PATH :=$(TARGET_ROOT_OUT_SBIN_UNSTRIPPED)

LOCAL_STATIC_LIBRARIES := libcutils libc
include $(BUILD_EXECUTABLE)
a. 编译adbd
mmm ./system/core/adb
b.生成的adb 的目录
out/target/product/OK6410/root/sbin/adbd
c. 临时文件的目录
out/target/product/OK6410/obj/EXECUTABLES/adbd_intermediates/
2.
在system/core/adb/adb.c中
int main(int argc, char **argv)
{
adb_trace_init();

if ADB_HOST

else //在Android.mk中定义了ADB_HOST=0

if((argc > 1) && (!strcmp(argv[1],"recovery"))) {
    adb_device_banner = "recovery";
    recovery_mode = 1;
}

start_device_log();
return adb_main(0, DEFAULT_ADB_PORT);

endif

}

二. host 端的adb
1. Android.mk与编译adb
LOCAL_PATH:= $(call my-dir) include$(CLEAR_VARS)
USB_SRCS := usb_linux.c
EXTRA_SRCS := get_my_path_linux.c
LOCAL_LDLIBS += -lrt -lncurses -lpthread

LOCAL_SRC_FILES := \
adb.c \
console.c \
transport.c \
transport_local.c \
transport_usb.c \
commandline.c \
adb_client.c \
sockets.c \
services.c \
file_sync_client.c \
$(EXTRA_SRCS) \ $(USB_SRCS) \
utils.c \
usb_vendors.c
LOCAL_SRC_FILES += fdevent.c

LOCAL_CFLAGS += -O2 -g -DADB_HOST=1 -Wall -Wno-unused-parameter
LOCAL_CFLAGS += -D_XOPEN_SOURCE -D_GNU_SOURCE
LOCAL_MODULE := adb
LOCAL_STATIC_LIBRARIES := libzipfile libunz $(EXTRA_STATIC_LIBS) ifeq ($(USE_SYSDEPS_WIN32),)
LOCAL_STATIC_LIBRARIES += libcutils
endif
include $(BUILD_HOST_EXECUTABLE)

$(call dist-for-goals,droid,$(LOCAL_BUILT_MODULE))
a. 编译adb
mmm ./system/core/adb
b.生成的adb 的目录
out/host/linux-x86/bin/adb
c. 临时文件的目录
out/host/linux-x86/obj/EXECUTABLES/adb_intermediates/
2.
在system/core/adb/adb.c中
int main(int argc, char **argv)
{
adb_trace_init(); //只对adbd有效
//在Android.mk中定义了ADB_HOST=1

if ADB_HOST

adb_sysdeps_init();  //空函数
return adb_commandline(argc - 1, argv + 1);

else

endif

}
2.1 adb devices过程
传给adb_commandline的参数是adb命令的参数
main
–>adb_commandline
在system/core/adb/commandline.c中
int adb_commandline(int argc, char **argv)
{
if(!strcmp(argv[0], “devices”)) {
char *tmp;
snprintf(buf, sizeof buf, “host:%s”, argv[0]);
tmp = adb_query(buf); //buf=”host:devices”
if(tmp) {
printf(“List of devices attached \n”);
printf(“%s\n”, tmp);
return 0;
} else {
return 1;
}
}
}

main
–>adb_commandline
–> adb_query
在system/core/adb/adb_client.c中
char *adb_query(const char *service)
{
char buf[5];
unsigned n;
char *tmp;

int fd = adb_connect(service);
readx(fd, buf, 4);

buf[4] = 0;
n = strtoul(buf, 0, 16);
if(n > 1024) goto oops;

tmp = malloc(n + 1);
if(tmp == 0) goto oops;

if(readx(fd, tmp, n) == 0) {
    tmp[n] = 0;
    adb_close(fd);
    return tmp;
}
free(tmp);

oops:
adb_close(fd);
return 0;
}
main
–>adb_commandline
–> adb_query
–> adb_connect
在system/core/adb/adb_client.c中
int adb_connect(const char *service)
{
int fd = _adb_connect(“host:version”); //如果是第一次打开,则打开失败,下一步要启动server
if(fd == -2) { //打印的这段信息,很熟悉
fprintf(stdout,”* daemon not running. starting it now on port %d *\n”, __adb_server_port);
start_server:
if(launch_server(__adb_server_port)) {
fprintf(stderr,”* failed to start daemon *\n”);
return -1;
} else {
fprintf(stdout,”* daemon started successfully *\n”);
}
/* give the server some time to start properly and detect devices */
adb_sleep_ms(3000);
// fall through to _adb_connect
} else {
// if server was running, check its version to make sure it is not out of date
char buf[100];
int n;
int version = ADB_SERVER_VERSION - 1;

    // if we have a file descriptor, then parse version result
    if(fd >= 0) {
        if(readx(fd, buf, 4)) goto error;

        buf[4] = 0;
        n = strtoul(buf, 0, 16);
        if(n > (int)sizeof(buf)) goto error;
        if(readx(fd, buf, n)) goto error;
        adb_close(fd);

        if (sscanf(buf, "%04x", &version) != 1) goto error;
    } else {
        // if fd is -1, then check for "unknown host service",
        // which would indicate a version of adb that does not support the version command
        if (strcmp(__adb_error, "unknown host service") != 0)
            return fd;
    }

    if(version != ADB_SERVER_VERSION) {
        printf("adb server is out of date. killing...\n");
        fd = _adb_connect("host:kill");
        adb_close(fd);

        /* XXX can we better detect its death? */
        adb_sleep_ms(2000);
        goto start_server;
    }
}

// if the command is start-server, we are done.
if (!strcmp(service, "host:start-server"))
    return 0;

fd = _adb_connect(service);
if(fd == -2) {
    fprintf(stderr,"** daemon still not running");
}

return fd;

error:
adb_close(fd);
return -1;
}

main
–>adb_commandline
–> adb_query
–> adb_connect
–> _adb_connect
在system/core/adb/adb_client.c中
int _adb_connect(const char *service) //server=”host:version”
{
char tmp[5];
int len;
int fd;
D(“_adb_connect: %s\n”, service);
len = strlen(service);
snprintf(tmp, sizeof tmp, “%04x”, len);

fd = socket_loopback_client(__adb_server_port, SOCK_STREAM);
if(fd < 0) {  //如果是开机后第一次打开adb,没有启动server则打开失败
    strcpy(__adb_error, "cannot connect to daemon");
    return -2;
}

}

main
–>adb_commandline
–> adb_query
–> adb_connect
–> _adb_connect
–> socket_loopback_client
在system/core/adb/adb_client.c中
int socket_loopback_client(int port, int type)
{
struct sockaddr_in addr;
socklen_t alen;
int s;

memset(&addr, 0, sizeof(addr));
addr.sin_family = AF_INET;
addr.sin_port = htons(port);
addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);

s = socket(AF_INET, type, 0);

if(connect(s, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
    close(s);
    return -1;
}

return s;

}
连接到本地的__adb_server_port=5037端口,如果不成功,即服务端没有打开,则返回-1.

int launch_server(int server_port)
{

ifdef HAVE_WIN32_PROC //这儿区分window与linux

elif defined(HAVE_FORKEXEC) //linux have fork exec

char path[PATH_MAX];
int fd[2];

pipe(fd));  //创建管道
get_my_path(path, PATH_MAX);  //获取己执行的adb的路径,为下一步启动adb server作准备
pid_t pid = fork();
if (pid == 0) {     //子进程
    adb_close(fd[0]);
    dup2(fd[1], STDERR_FILENO);     //将管道的输出fd[1]重定向到STDERR,这样好把错误信息打印出来
    adb_close(fd[1]);

    // child process
    int result = execl(path, "adb", "fork-server", "server", NULL);
    // this should not return
    fprintf(stderr, "OOPS! execl returned %d, errno: %d\n", result, errno);
} else {
    // parent side of the fork

    char temp[3];

    temp[0] = 'A'; temp[1] = 'B'; temp[2] = 'C';
    // wait for the "OK\n" message
    adb_close(fd[1]);
    int ret = adb_read(fd[0], temp, 3);
    adb_close(fd[0]);
    if (ret < 0) {
        fprintf(stderr, "could not read ok from ADB Server, errno = %d\n", errno);
        return -1;
    }
    if (ret != 3 || temp[0] != 'O' || temp[1] != 'K' || temp[2] != '\n') {
        fprintf(stderr, "ADB server didn't ACK\n" );
        return -1;
    }

    setsid();
}

else

error “cannot implement background server start on this platform”

endif

return 0;

}

通过pid找到可执行文件所在的路径
void get_my_path(char *exe, size_t maxLen)
{
char proc[64];
snprintf(proc, sizeof proc, “/proc/%d/exe”, getpid());
int err = readlink(proc, exe, maxLen - 1);
if(err > 0) {
exe[err] = ‘\0’;
} else {
exe[0] = ‘\0’;
}
}
cong@ubuntu:/tmp$ls -l /proc/2255/ lrwxrwxrwx 1 cong root 0 Jan 3 11:12 exe -> /tmp/main 这个/proc/$(pid)/exe是一个软链接指向可执行文件所在的路径.

adb start-server
adb kill-server
adb devices
adb push
adb pull
adb uninstall
adb install