Android通过 service call 命令调用 phone 的 AIDL 服务

mTelephonyManager = (TelephonyManager) getSystemService(TELEPHONY_SERVICE);
mTelephonyManager.setPreferredNetworkType(subId, selectNetworkMode);

Context.java

public static final String TELEPHONY_SERVICE = "phone";

通过 service list 查找 phone 服务对应的 aidl

adb shell service list | grep "phone"

phone: [com.android.internal.telephony.ITelephony]

find . -name ITelephony.aidl

frameworks/base/telephony/java/com/android/internal/telephony/ITelephony.aidl

在 ITelephony.aidl 文件中找到 setPreferredNetworkType 方法对应的序号是 104

boolean setPreferredNetworkType(int subId, int networkType);

根据方法中的参数可以看到需要一个 subId(可以在 /data/data/com.android.provider.telephony 下的数据库中看到对应sim卡的subid)，一个networkType(在 NetworkSelectingActivity.java 文件中)

public static final int WCDMA_PREFERRED = TelephonyManager.NETWORK_MODE_WCDMA_PREF; // 0
public static final int GSM_ONLY = TelephonyManager.NETWORK_MODE_GSM_ONLY; // 1
public static final int WCDMA_ONLY = TelephonyManager.NETWORK_MODE_TDSCDMA_WCDMA; // 14
public static final int GSM_WCDMA_AUTO = TelephonyManager.NETWORK_MODE_TDSCDMA_GSM_WCDMA; // 18
public static final int CDMA_EVDO = TelephonyManager.NETWORK_MODE_CDMA_EVDO; // 4
public static final int CDMA_ONLY = TelephonyManager.NETWORK_MODE_CDMA_NO_EVDO; // 5
public static final int EVDO_ONLY = TelephonyManager.NETWORK_MODE_EVDO_NO_CDMA; // 6
public static final int CDMA_EVDO_GSM_WCDMA = TelephonyManager.NETWORK_MODE_TDSCDMA_CDMA_EVDO_GSM_WCDMA;// 21
public static final int LTE_CDMA_EVDO = TelephonyManager.NETWORK_MODE_LTE_CDMA_EVDO; // 8
public static final int LTE_GSM_WCDMA = TelephonyManager.NETWORK_MODE_LTE_TDSCDMA_GSM_WCDMA;// 20
public static final int LTE_CDMA_EVDO_GSM_WCDMA = TelephonyManager.NETWORK_MODE_LTE_TDSCDMA_CDMA_EVDO_GSM_WCDMA;// 22
public static final int LTE_ONLY = TelephonyManager.NETWORK_MODE_LTE_ONLY; // 11
public static final int LTE_WCDMA = TelephonyManager.NETWORK_MODE_LTE_TDSCDMA_WCDMA; // 20
public static final int TDSCDMA_ONLY = TelephonyManager.NETWORK_MODE_TDSCDMA_WCDMA; // 14
public static final int GSM_TDSCDMA_AUTO = TelephonyManager.NETWORK_MODE_TDSCDMA_GSM_WCDMA; //18
public static final int NR_ONLY = TelephonyManager.NETWORK_MODE_NR_ONLY; //23
public static final int NR_LTE = TelephonyManager.NETWORK_MODE_NR_LTE; //24
public static final int NR_LTE_UTMS = TelephonyManager.NETWORK_MODE_NR_LTE_TDSCDMA_WCDMA; //31
public static final int NR_LTE_GSM_UTMS = TelephonyManager.NETWORK_MODE_NR_LTE_TDSCDMA_GSM_WCDMA; //32
public static final int NR_LTE_CDMA_EVDO_GSM_UTMS = TelephonyManager.NETWORK_MODE_NR_LTE_TDSCDMA_CDMA_EVDO_GSM_WCDMA;//33

所以需要把 subId = 1 的 networkType 设置为 GSM_ONLY 只需要调用

adb shell service call phone 104 i32 1 i32 1

其他 system 服务的一些方法也可以这么调用