Android Debug Bridge

The Android Debug Bridge (commonly abbreviated as adb) is a programming tool used for the debugging of Android-based devices. The daemon on the Android device connects with the server on the host PC over USB or TCP, which connects to the client that is used by the end-user over TCP. Made available as open-source software under the Apache License by Google since 2007, its features include a shell and the possibility to make backups. The adb software is available for Windows, Linux and macOS. It has been misused by botnets and other malware, for which mitigations were developed such as RSA authentication and device whitelisting.

Features

Features of adb include copying files from the host computer, installing apps, viewing logcat output, getting a Unix shell, and rebooting into Qualcomm EDL mode. For example, Android applications can be saved by the command backup to a file. It also includes support for the Java Debug Wire Protocol.

Some graphical interfaces have been made available. The graphical Android Device Monitor in Android Studio can be used for retrieving information from an Android device.

Android's method to install APK files on a device has been used as a way to sideload unofficial apps onto Windows Subsystem for Android and Chrome OS's Android virtual machine.

Shizuku allows an Android phone to connect to its own ADB when connected to a wireless network. The application is available for free on the Google Play Store.

Development history

The Android Software Development Kit (SDK) was first released in 2007. Since 2017, Google made it possible to download adb separately from the Android SDK.

In 2015, Microsoft released an Android emulator that can connect to the adb client. In 2016 for Android Studio 2.0 a 5x performance improvement was made for installing apps and pushing files through adb. For easier usage of Android Things, a wrapper was made in 2017 around manual adb commands. For Android 11 in 2020, Google added adb incremental installations. In 2020, Wi-Fi adb was integrated into Android Studio for macOS. In 2021 for Android 12, the adb backup command was limited so that backing up user data from apps is opt-in using a per-app manifesto configuration after being deprecated in Android 10 along with adb restore. Fuchsia will be backwards-compatible with adb. It will be replaced with fx and ffx.

Setup

Host computer

For Windows, the Android SDK contains the adb.exe binary that can be extracted and installed. How-To Geek recommends adding the folder containing the binaries to the PATH environment variable.

On Ubuntu, adb can be installed with the android-tools-adb package. For Debian, it has been recommended to also install the android-sdk-platform-tools-common package next to the adb package, which installs the udev rules which makes it possible to run the tool without root permissions. For macOS and other Linux distributions, the platform tools can be downloaded and the PATH variable can be modified in bashrc.

Android device

In Android 4.2.2 or later ( API level 17), a dialog is shown with an RSA fingerprint that the user needs to accept. This protects against computers exploiting the debugging mechanism without consent of the device user. Starting in Android 4.2, the developer settings are hidden by default. Pressing seven times on the build number in the about menu makes them visible to the user. After that, the USB debugging option can be enabled. Some Android vendors have different procedures to enable it. For example, Huawei requires entering a pincode before adb can be enabled.

If the touchscreen of an Android device is broken, it can be possible to connect a mouse to the device using USB On-The-Go and enable USB debugging.

Architecture

The adb protocol can be transported over USB or over Wi-Fi through TCP. It uses a client-server architecture. There are two different protocols in use. The first is between the client and the server and the second is between the server and the daemon. The adb daemon is implemented in C and located in the Android user space. The daemon is facilitated by the Android USB framework, UsbDeviceManager and UsbDebuggingManager.

Client ↔ server protocol

The communication mode between the client and server is a TCP socket. The server listens on a port, to which the client has to send a request. The request contains a 4-byte initial field in ASCII and a payload. The payload starts with the word host, to indicate it should be sent to the server. The server can then reply with OKAY or FAIL to indicate the status, combined with an optional payload and length.

Server ↔ daemon protocol

The messages sent from the server consist of a 24-byte long header, with the following fields:

* Command
* First argument
* Second argument
* Length of the payload, 0 or higher
* CRC-32 of the data payload
* Magic value, calculated through command XOR 0xFFFFFFFF

Security

Up to Android 2.2, Android was vulnerable to the ''RageAgainstTheCage'' exploit. The adb daemon did not check for the return value of the setuid system call when dropping privileges. The exploit forks processes until it fails due to the exhaustion of process identifiers. When the daemon crashes and restarts, it cannot start a new process with dropped privileges and keeps running as root. Then adb provided a root shell. In 2017, a security vulnerability was disclosed that exploited ADB to take over the onboard modem. The attack required adb to be already enabled and authorized, although some workarounds were available.

Various families of malware such as ADB.Miner, Ares, IPStorm, Fbot and Trinity have scanned the internet for public availability of the adb interface and installed malware on those devices. adb can also be used to remove malware, by booting into safe mode and running the adb uninstall command.

See also

* Android recovery mode
* Fastboot

References

External links

*
*
*
*
*

{{Android

Android (operating system)
Debugging
Communications protocols
Android (operating system) development software