Android adb构造特定格式的broadcast intent，伪造短信广播
在姜维大大的小黄书中，提到了很有用的adb命令，其中
adb shell am broadcast这个命令可以在终端构造特定格式的intent并且发送这个广播，这个命令的参数很丰富，可以满足大部分intent构造需求。但是我在百度上没有搜索到完整得参数信息，由于项目的推进，我不得不详细了解这个命令的功能，于是机缘巧合在学长的帮助下找到了这个命令的安卓源码，并且从根本上了解了这个命令的使用方法。
am这个命令最终会调用以下两个源码：参考https://www.jianshu.com/p/a606fc800366
aosp_8/frameworks/base/services/core/java/com/android/server/am/ActivityManagerShellCommand.java
aosp_8/frameworks/base/core/java/android/content/Intent.java
在ActivityManagerShellCommand.java中：此命令最终调用以下函数，我们可以看到intent由makeIntent函数生成，并且在这个函数中设置了flag字段。
int runSendBroadcast(PrintWriter pw) throws RemoteException {
Intent intent;
try {
intent = makeIntent(UserHandle.USER_CURRENT);
} catch (URISyntaxException e) {
throw new RuntimeException(e.getMessage(), e);
}
intent.addFlags(Intent.FLAG_RECEIVER_FROM_SHELL);
IntentReceiver receiver = new IntentReceiver(pw);
String[] requiredPermissions = mReceiverPermission == null ? null
: new String[] {mReceiverPermission};
pw.println("Broadcasting: " + intent);
pw.flush();
mInterface.broadcastIntent(null, intent, null, receiver, 0, null, null, requiredPermissions,
android.app.AppOpsManager.OP_NONE, null, true, false, mUserId);
receiver.waitForFinish();
return 0;
}我们进入makeIntent函数中查看intent是如何构造得：可以看到，Intent.parseCommandArgs()中应该有更大得猫腻。
private Intent makeIntent(int defUser) throws URISyntaxException {
mStartFlags = 0;
mWaitOption = false;
mStopOption = false;
mRepeat = 0;
mProfileFile = null;
mSamplingInterval = 0;
mAutoStop = false;
mStreaming = false;
mUserId = defUser;
mDisplayId = INVALID_DISPLAY;
mStackId = INVALID_STACK_ID;
mTaskId = INVALID_TASK_ID;
mIsTaskOverlay = false;
//hook by xcz，我自己添加了一个-Z开关来改写am命令的某些行为
mSendSmsContent = false;
return Intent.parseCommandArgs(this, new Intent.CommandOptionHandler() {
@Override
public boolean handleOption(String opt, ShellCommand cmd) {
//opt是命令行参数，可以通过相应得开关来设置intent的内容
if (opt.equals("-D")) {
mStartFlags |= ActivityManager.START_FLAG_DEBUG;
} else if (opt.equals("-N")) {
mStartFlags |= ActivityManager.START_FLAG_NATIVE_DEBUGGING;
} else if (opt.equals("-W")) {
mWaitOption = true;
} else if (opt.equals("-P")) {
mProfileFile = getNextArgRequired();
mAutoStop = true;
} else if (opt.equals("--start-profiler")) {
mProfileFile = getNextArgRequired();
mAutoStop = false;
} else if (opt.equals("--sampling")) {
mSamplingInterval = Integer.parseInt(getNextArgRequired());
} else if (opt.equals("--streaming")) {
mStreaming = true;
} else if (opt.equals("--attach-agent")) {
mAgent = getNextArgRequired();
} else if (opt.equals("-R")) {
mRepeat = Integer.parseInt(getNextArgRequired());
} else if (opt.equals("-S")) {
mStopOption = true;
} else if (opt.equals("--track-allocation")) {
mStartFlags |= ActivityManager.START_FLAG_TRACK_ALLOCATION;
} else if (opt.equals("--user")) {
mUserId = UserHandle.parseUserArg(getNextArgRequired());
} else if (opt.equals("--receiver-permission")) {
mReceiverPermission = getNextArgRequired();
} else if (opt.equals("--display")) {
mDisplayId = Integer.parseInt(getNextArgRequired());
} else if (opt.equals("--stack")) {
mStackId = Integer.parseInt(getNextArgRequired());
} else if (opt.equals("--task")) {
mTaskId = Integer.parseInt(getNextArgRequired());
} else if (opt.equals("--task-overlay")) {
mIsTaskOverlay = true;
} else if(opt.equals("-Z")){//我添加得自定义字段，添加后重新编译源码
mSendSmsContent = true;
} else {
return false;
}
return true;
}
});
}我们最后进入到Intent.parseCommandArgs()中：这里可以看到am broadcast命令中所有的开关参数了，可以愉快地构造intent并且进行广播。例如-a指定action，-d指定uri，-p指定包名，-n指定组件名，-es指定{key,value}太多了，自行看源码。
public static Intent parseCommandArgs(ShellCommand cmd, CommandOptionHandler optionHandler)
throws URISyntaxException {
Intent intent = new Intent();
Intent baseIntent = intent;
boolean hasIntentInfo = false;
Uri data = null;
String type = null;
String opt;
while ((opt=cmd.getNextOption()) != null) {
switch (opt) {
case "-a":
intent.setAction(cmd.getNextArgRequired());
if (intent == baseIntent) {
hasIntentInfo = true;
}
break;
case "-d":
data = Uri.parse(cmd.getNextArgRequired());
if (intent == baseIntent) {
hasIntentInfo = true;
}
break;
case "-t":
type = cmd.getNextArgRequired();
if (intent == baseIntent) {
hasIntentInfo = true;
}
break;
case "-c":
intent.addCategory(cmd.getNextArgRequired());
if (intent == baseIntent) {
hasIntentInfo = true;
}
break;
case "-e":
case "--es": {
String key = cmd.getNextArgRequired();
String value = cmd.getNextArgRequired();
intent.putExtra(key, value);
}
break;
case "--esn": {
String key = cmd.getNextArgRequired();
intent.putExtra(key, (String) null);
}
break;
case "--ei": {
String key = cmd.getNextArgRequired();
String value = cmd.getNextArgRequired();
intent.putExtra(key, Integer.decode(value));
}
break;
case "--eu": {
String key = cmd.getNextArgRequired();
String value = cmd.getNextArgRequired();
intent.putExtra(key, Uri.parse(value));
}
break;
case "--ecn": {
String key = cmd.getNextArgRequired();
String value = cmd.getNextArgRequired();
ComponentName cn = ComponentName.unflattenFromString(value);
if (cn == null)
throw new IllegalArgumentException("Bad component name: " + value);
intent.putExtra(key, cn);
}
break;
case "--eia": {
String key = cmd.getNextArgRequired();
String value = cmd.getNextArgRequired();
String[] strings = value.split(",");
int[] list = new int[strings.length];
for (int i = 0; i < strings.length; i++) {
list[i] = Integer.decode(strings[i]);
}
intent.putExtra(key, list);
}
break;
case "--eial": {
String key = cmd.getNextArgRequired();
String value = cmd.getNextArgRequired();
String[] strings = value.split(",");
ArrayList list = new ArrayList<>(strings.length);
for (int i = 0; i < strings.length; i++) {
list.add(Integer.decode(strings[i]));
}
intent.putExtra(key, list);
}
break;
case "--el": {
String key = cmd.getNextArgRequired();
String value = cmd.getNextArgRequired();
intent.putExtra(key, Long.valueOf(value));
}
break;
case "--ela": {
String key = cmd.getNextArgRequired();
String value = cmd.getNextArgRequired();
String[] strings = value.split(",");
long[] list = new long[strings.length];
for (int i = 0; i < strings.length; i++) {
list[i] = Long.valueOf(strings[i]);
}
intent.putExtra(key, list);
hasIntentInfo = true;
}
break;
case "--elal": {
String key = cmd.getNextArgRequired();
String value = cmd.getNextArgRequired();
String[] strings = value.split(",");
ArrayList list = new ArrayList<>(strings.length);
for (int i = 0; i < strings.length; i++) {
list.add(Long.valueOf(strings[i]));
}
intent.putExtra(key, list);
hasIntentInfo = true;
}
break;
case "--ef": {
String key = cmd.getNextArgRequired();
String value = cmd.getNextArgRequired();
intent.putExtra(key, Float.valueOf(value));
hasIntentInfo = true;
}
break;
case "--efa": {
String key = cmd.getNextArgRequired();
String value = cmd.getNextArgRequired();
String[] strings = value.split(",");
float[] list = new float[strings.length];
for (int i = 0; i < strings.length; i++) {
list[i] = Float.valueOf(strings[i]);
}
intent.putExtra(key, list);
hasIntentInfo = true;
}
break;
case "--efal": {
String key = cmd.getNextArgRequired();
String value = cmd.getNextArgRequired();
String[] strings = value.split(",");
ArrayList list = new ArrayList<>(strings.length);
for (int i = 0; i < strings.length; i++) {
list.add(Float.valueOf(strings[i]));
}
intent.putExtra(key, list);
hasIntentInfo = true;
}
break;
case "--esa": {
String key = cmd.getNextArgRequired();
String value = cmd.getNextArgRequired();
// Split on commas unless they are preceeded by an escape.
// The escape character must be escaped for the string and
// again for the regex, thus four escape characters become one.
String[] strings = value.split("(? list = new ArrayList<>(strings.length);
for (int i = 0; i < strings.length; i++) {
list.add(strings[i]);
}
intent.putExtra(key, list);
hasIntentInfo = true;
}
break;
case "--ez": {
String key = cmd.getNextArgRequired();
String value = cmd.getNextArgRequired().toLowerCase();
// Boolean.valueOf() results in false for anything that is not "true", which is
// error-prone in shell commands
boolean arg;
if ("true".equals(value) || "t".equals(value)) {
arg = true;
} else if ("false".equals(value) || "f".equals(value)) {
arg = false;
} else {
try {
arg = Integer.decode(value) != 0;
} catch (NumberFormatException ex) {
throw new IllegalArgumentException("Invalid boolean value: " + value);
}
}
intent.putExtra(key, arg);
}
break;
case "-n": {
String str = cmd.getNextArgRequired();
ComponentName cn = ComponentName.unflattenFromString(str);
if (cn == null)
throw new IllegalArgumentException("Bad component name: " + str);
intent.setComponent(cn);
if (intent == baseIntent) {
hasIntentInfo = true;
}
}
break;
case "-p": {
String str = cmd.getNextArgRequired();
intent.setPackage(str);
if (intent == baseIntent) {
hasIntentInfo = true;
}
}
break;
case "-f":
String str = cmd.getNextArgRequired();
intent.setFlags(Integer.decode(str).intValue());
break;
case "--grant-read-uri-permission":
intent.addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION);
break;
case "--grant-write-uri-permission":
intent.addFlags(Intent.FLAG_GRANT_WRITE_URI_PERMISSION);
break;
case "--grant-persistable-uri-permission":
intent.addFlags(Intent.FLAG_GRANT_PERSISTABLE_URI_PERMISSION);
break;
case "--grant-prefix-uri-permission":
intent.addFlags(Intent.FLAG_GRANT_PREFIX_URI_PERMISSION);
break;
case "--exclude-stopped-packages":
intent.addFlags(Intent.FLAG_EXCLUDE_STOPPED_PACKAGES);
break;
case "--include-stopped-packages":
intent.addFlags(Intent.FLAG_INCLUDE_STOPPED_PACKAGES);
break;
case "--debug-log-resolution":
intent.addFlags(Intent.FLAG_DEBUG_LOG_RESOLUTION);
break;
case "--activity-brought-to-front":
intent.addFlags(Intent.FLAG_ACTIVITY_BROUGHT_TO_FRONT);
break;
case "--activity-clear-top":
intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TOP);
break;
case "--activity-clear-when-task-reset":
intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_WHEN_TASK_RESET);
break;
case "--activity-exclude-from-recents":
intent.addFlags(Intent.FLAG_ACTIVITY_EXCLUDE_FROM_RECENTS);
break;
case "--activity-launched-from-history":
intent.addFlags(Intent.FLAG_ACTIVITY_LAUNCHED_FROM_HISTORY);
break;
case "--activity-multiple-task":
intent.addFlags(Intent.FLAG_ACTIVITY_MULTIPLE_TASK);
break;
case "--activity-no-animation":
intent.addFlags(Intent.FLAG_ACTIVITY_NO_ANIMATION);
break;
case "--activity-no-history":
intent.addFlags(Intent.FLAG_ACTIVITY_NO_HISTORY);
break;
case "--activity-no-user-action":
intent.addFlags(Intent.FLAG_ACTIVITY_NO_USER_ACTION);
break;
case "--activity-previous-is-top":
intent.addFlags(Intent.FLAG_ACTIVITY_PREVIOUS_IS_TOP);
break;
case "--activity-reorder-to-front":
intent.addFlags(Intent.FLAG_ACTIVITY_REORDER_TO_FRONT);
break;
case "--activity-reset-task-if-needed":
intent.addFlags(Intent.FLAG_ACTIVITY_RESET_TASK_IF_NEEDED);
break;
case "--activity-single-top":
intent.addFlags(Intent.FLAG_ACTIVITY_SINGLE_TOP);
break;
case "--activity-clear-task":
intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK);
break;
case "--activity-task-on-home":
intent.addFlags(Intent.FLAG_ACTIVITY_TASK_ON_HOME);
break;
case "--receiver-registered-only":
intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY);
break;
case "--receiver-replace-pending":
intent.addFlags(Intent.FLAG_RECEIVER_REPLACE_PENDING);
break;
case "--receiver-foreground":
intent.addFlags(Intent.FLAG_RECEIVER_FOREGROUND);
break;
case "--receiver-no-abort":
intent.addFlags(Intent.FLAG_RECEIVER_NO_ABORT);
break;
case "--receiver-include-background":
intent.addFlags(Intent.FLAG_RECEIVER_INCLUDE_BACKGROUND);
break;
case "--selector":
intent.setDataAndType(data, type);
intent = new Intent();
break;
default:
if (optionHandler != null && optionHandler.handleOption(opt, cmd)) {
// Okay, caller handled this option.
} else {
throw new IllegalArgumentException("Unknown option: " + opt);
}
break;
}
} 最后，我自己加了一个-z参数，发送了含有短信的intent来模拟手机接受到短信。（需要修改源码，并且重新编译安卓系统）
下图是尝试指定pkgname发送短信广播，-es来构造某些结构