Chapter 3: The Right Tool for the Job

Chapter 3 

The Right Tool for the Job

READ ALSO   : CHAPTER 1
                             CHAPTER 2

In this chapter:

• Hardware and prerequisites for hacking 

• Android Debug Bridge basic commands 

• Fastboot commands 

• The ADB shell

Most root procedures rely on similar tools. The processes, exploits, and level of access may differ, but the toolkit you use to get a device to run with S-OFF or root file system access will always be fairly small. A solid understanding ofthe tools and how they are used will help you with your comfort level when rooting a new device.

Ready, Set, ... Wait I Have to Have What? 

Before starting most hacking jobs, or even an Android exploratory mission, you need to be able to connect your phone to your computer and you need access to hacking tools.

Connecting a Phone to a CODlputer 

You need to make sure that you have an appropriate cable for the physical connection to a PC and drivers to enable your computer to make sense ofthe connection. Many devices ship without drivers-they depend on native drivers included with the operating system installed on your computer. 

Depending on the modes your device has when connected to a computer, the computer may recognize it as a mass-storage device and connect to it as ifit were an external hard drive or memory card. 

You need to install some form of debug or developer driver on your computer and make sure that USB Debugging (debug mode) is enabled for any interactions between the computer and the phone. Debug mode opens the connection with your computer and allows signals and commands to be sent to and received from Android.

Hacking Tools 

Android hacking tools fall into three basic categories: 

• developer tools from the SDK and third parties 

• scripts 

• Linux executables and commands on the phone. 

Developer tools include the Android Debug Bridge (ADB) and more advanced tools, such as smali and baksmali, for taking apart Android application package (APK) files and putting them back together. 

Some Linux shell commands are included on the Android device; others are placed on the device during the hacking process. The most popular and easiest bundle of Linux shell commands for Android is the BusyBox package (more on BusyBox later in this chapter). These commands are often executed in a script-a series of Linux shell commands that can be run either from the Android device or from an ADB shell on a connected computer.

USB Cables 

Your device likely shipped with a cable to connect from the device to a computer. The most popular cable and connection type is the USB micro, shown in Figure 3-1.

Depending on how much and how rougWy a cable has been used, it may be able to charge a phone or tablet but be completely unable to reliably transmit data. Some cheap cables (usually found with cheap car chargers) only have the charging pins ofthe micro USB jack connected, so they will never be able to connect to your computer for data transfer. If your OEM's cable is in great condition without harsh bends, kinks or cat tooth marks, then you should be fine. However, if you have lost, damaged or replaced your OEM cable make sure that you replace it with a similar cable.

 A USB cable is a USB cable. However, not all USB cables are created equally in terms of quality and fit. The micro jack end of a USB cable is particularly prone to have a poor fit that gives a bad connection or poorly supports the delicate jack socket components. Unfortunately, USB cable issues can be difficult to diagnose or detect. Unless you have disconnection issues that are obviously related to movement, you will need to have a spare cable to swap with a suspected bad cable. 

If you connect your device via a USB hub or a USB port on the front ofyour computer, you are likely to experience connection issues. Your device should be connected to a USB port on the back ofyour computer or one you know is directly connected to the main USB bus.

 I struggledfor hours with my Xoom USB cable plugged into a front USB port. The device connects but appears as 'offline'~ It instantly connects 'online"when I plug the USB cable into the rear ofmy computer.

USB Debugging 

With a known, or assumed, good USB cable connection, you need to tum on USB debugging on your phone or tablet. Debug mode allows ADB system commands to travel between your device and your computer. You can also view system logs and the file structure, and push or pull applications and files. However, some caution must be exercised when enabling USB debugging, as a connected computer can potentially install applications, copy data, and read logs on the device. 

It is important to remember that many operations you perform while in debug mode end by automatically resetting or turning off USB debugging. This means that before each major step in a hacking procedure you need to check that your device is in debug mode. Luckily Android makes this very easy. Whenever your device is in debug mode, you will see the debug mode icon in the notification bar (see Figure 3-2).

If you don't see the debug icon, you do not have debug connectivity and ADB will not work. 

On most Android devices, the following steps tum on USB debugging: 

1. Access the device settings, usually by tapping the Menu key or soft button on the home screen. (On the Xoom and some other tablet devices, you must tap the area near the clock and then tap Settings.) 

2. On the Settings menu, tap Applications. 

3. Tap Development.

4. Tap the USB debugging check box. 

5. Click OK on the notification. 

The debugging icon should be visible in the notifications area as in Figure 3-2.

Figure 3-2: Debug mode notifications from the Nexus One (top) and the EVO 3D (bottom)

Some Android devices have the ability to put the USB port into other modes, such as "charge only nor 'mass storage You may need to experiment to determine which USB port settings allow your device to work with ADB. Usually the "charge only nor 'Sync nsettings allow you to start hacking across the ADB connection. Check the XDAforumfor your device-it is likely that someone has already figured out the required settingsfor you to connect cleanly. 

Using the Android Debug Bridge 

In this section, we demystify the Android Debug Bridge and walk through all ofthe commands you need to start freeform hacking or to follow rooting instructions. The Android Debug Bridge (usually called ADB) allows you to connect your Android device to your computer. ADB is a command-line tool that nms with various switches or parameters to do different tasks. In today's world of pretty point-and-click interfaces, returning to a command-line interface may seem counterintuitive, though any good hacker worth his weight in unlocked cell phones is comfortable using a command line.

The commands with which you need to be familiar can be broadly separated into two categories: 

• Commands that do something to the Android device. These commands start with one of the Android SDK commands, such as adb or fas tboot. 

• Commands that do something on or in the Android device. These commands are nm in the Android shell and are usually entered on a command line that starts with a hash symbol (#) or a dollar sign ($). 

Some o fthe commands you will use are not ADB or Android commands but commands for your computer's operating system. The most common operating system commands you may need are: 

• change directory: to change the command prompt context to a different folder (cd on Windows, Mac and Linux) 

• directory listing: to list the files and folders in the current folder (d iron Windows; 1s on Mac and Linux) 

• make directory: to make a subfolder in the current folder (mkdi r on Windows, Mac and Linux).

Connectivity between your device and your computer is the starting point for all hacking. Familiarity with ADB and its basic commands will help you as you follow more detailed rooting or hacking instructions. I have found that a fear of, or unfamiliarity with, ADB is the primary stumbling block for beginner hackers. If you use each ofthe commands once during this walkthrough, you will be set to follow actual hacking walkthroughs.

None ofthe following examples and walkthroughs make harmful changes to your device. However, ifyou want to play it very safe (like a really good hacker), make sure you back up any datafrom your device sSD card. You must select the appropriate option in your device sPrivacy Settings menu to enable backing up and restoring ofyour data and applications.

Contacts and applications you have downloadedfrom the Google Apps Marketplace are stored in the Google cloud and will restore themselves ifnecessary.

The rest ofthis chapter assumes you have the Android SDK tools installed on your computer. Refer to Appendix A for the SDK setup procedure if you get the message shown in Figure 3-3.

Figure 3-3: Message indicating that the Android SDK is not set up or not in the current folder

Checking Device Connectivity  

This section describes the most effective way to determine if your computer has the right amount and correct kind of connectivity with your computer.

The adb devices command allows you to see the devices connected to your computer in the Android debug context. It is also the command most Android developers will ask you to run at the beginning of any troubleshooting steps.

Make sure that your Android device is connected to your computer and you have the drivers installed before continuing. Refer to the appropriate XDA forum for links to device drivers you may need.

1. Open a command prompt window. (In Windows, press Windows+R; type cmd in the Run dialog box and press Enter.)

 2. Type adb devices. The results should be as shown in Figure 3-4 if your device is connected and the correct drivers are installed. If no device serial number is listed, then ADB is working correctly but your device is not connected or the driver isn't installed (see the "Troubleshooting a Connection" sidebar).

Figure 3-4: The adb devices command showing a connected HTe device

If you get the response shown in Figure 3-3, then the ADB folder is probably not set up correctly in your PATH variable. Refer to Appendix A for setting up ADB so that it is accessible from any folder.

If everything is correctly connected, the adb device s command returns a list of devices connected to the computer. If you have more than one connected Android device in debug mode, each is listed with its serial number. Any Android emulators you may have running also showup.

You can specify the device to which you want to send an ADB command by giving its serial number. This is very tedious and it is easier to connect only the device with which you are currently working.

Restarting the ADD Service  

Restart the ADB service from the command prompt with the following steps: 

1. Type adb kill-server and press Enter. 

2. Type adb start-server and press Enter. This shuts down the ADB service gracefully and re-initializes it. 

You can then check again for device connectivity using adb devices.

Copying Files to and from Your Device 

One ofthe most useful things you can be comfortable doing is "pushing" files to and "pulling" files from your device. Most root and S-OFF hacks require pushing a script to a device and then running it locally on the device. This walkthrough has you push a simple text file to your SD card and look on your device to see that it is located there. Doing this once with an innocuous text file will give you the comfort level you need to push other types of file to your device.

Make sure you have a localfile system explorer on your device, such as RootExplorer or ESFile Explorer. You need to be able to explore the device file system to verifY that pushing a file to your phone has worked.

First, you need to create a text file: 

1. Open a command prompt window and note the path.

2. Use Windows Explorer to navigate to that folder.

3. Right-click in Windows Explorer and select New --+Text File. 

4. Rename the text file to sample. txt.

The adb push command uses the following pattern: 

adb push  <desired local file> <desired target location>

Copy the text file to the device. Switch back to the command prompt window and enter the following command: 

adb push sample.txt /sdcard/sample.txt

The response should be similar to Figure 3-5.

Now let's check the SD card on your device to see the pushed file. Open the file explorer on the device. Navigate to the root of your SD card. Depending on the file explorer, it may be the default folder; if not, it will be a folder listed in the root ofthe file system. Figure 3-7 shows the file on the SD card using ES File Explorer.

Figure 3-7: The sample.txt file on the SD card in ES File Explorer Now you are going to pull the file from the device back to your computer. 

The adb pull command uses the following pattern:

adb pull <desired device file> <desired local file>

Remember to press the Enter key after you enter the command.

Now type dir *. txt and then press the Enter key. This will give you a list of all the . txt files in the current folder. You should see the sample2. txt file that has been pulled from your Android device.

The pull command pulled a file named sampl e . tx t and wrote it to your localfile system under the new name sample2. txt. You will see this again in the section aboutfile management and will do it many times when following a root instruction guide from the XDA forum. Pulling a file to a new name allows you to keep copies ofthe file straight and is sometimes necessary to correctlyflash image files or updates.

 You may often want to back up some part of your Android device's file system to your computer. You may want to pull a specific application or system file, alter it on your local computer and then push it back to your Android device. You can copy any file using the adb pull and adb push commands.

Rebooting a Device 

After flashing an image or writing a file to the file system, it is sometimes necessary to reboot the device cleanly. The adb reboot command allows you to reboot your Android device from the command line of your computer. You can use the adb reboot command with one of two switches: 

• bootloader: This option boots the device into the bootloader menu (as shown in Figure 3-8). The bootloader menu is sometimes used to access Fastboot and to flash official firmware updates. From the bootloader menu, you can boot the bootloader sequence, reboot the device or power down the device. 

• recovery: This option boots the device into the recovery installed on the device. It reboots into the firmware (the factory recovery or a custom recovery) installed in the recovery partition.

The Power of Fastboot 

The Fastboot command from the Android SDK is a powerful tool for writing to the file system partitions of an Android device. You will mostly use Fastboot commands to flash image files and the contained file systems to various partitions such as the system, boot and recovery partitions

Fastboot commands are not so much exploratory or hacking tools as they are specific tools used when you are going to fundamentally change the file system on an Android device. As such, you should only use them when you know specifically what you are trying to accomplish. Not all devices can boot to Fastboot mode. Typically, you only use Fastboot commands on devices that have the ability to unlock the bootloader.

The Fastboot command does not live in the same folder as the adb command. Fastboot is in the c: \Program Files (x8 6) \Android\android-sdk-windows\ tools\ folder. As with the adb command, you use various commands and options following fastboot to change what the Fastboot command does. The walkthroughs and activities below require that your phone be in Fastboot mode. 

Follow the steps below to attempt to put your device in Fastboot mode: 

1. Connect your device to your computer and verify connectivity using adb devices. 

2. Type adb reboot bootloader and press Enter.

Your device should reboot into the bootloader. Make sure to select uFASTBOOT" or equivalent from the bootloader menu (see Figure 3-8).

Unlocking a Device 

A few devices, such as the Nexus One and Xoom tablets, have a built-in ability to unlock and allow the following command to be run: 

fastboot OEM unlock 

This command sequence unlocks the bootloader and allows you to run Fastboot flash and other commands so that root can be acquired.

Updating a Device 

The following command flashes an update . zip file to the Android device:

 fastboot update 

This command is not used much in hacking or rooting procedures although it can be used to bring back a device that is softbricked. Ifthe device can receive Fastboot commands and you

Flashing a Device 

The flash command is perhaps the most useful Fastboot command. It allows you to write the contents of an image file to a named partition on your Android device. 

The argument to the command names the partition that is to be flashed: 

fastboot flash boot 

fastboot flash system 

fastboot flash recovery

On devices that have been unlocked, the flash command is frequently used to flash a file system with root access. For example, if you have a new boot. img file that contains an unlocked bootloader or root access permissions, you can use the flash command to write the contents to the boot partition.

 It is important to note that flashing the wrong thing or interrupting the flashing process can permanently brick your device. Never flash an image file to a partition unless you are certain that you have the correct file for your device and you have read up on the process in the appropriate XDA forum.

Rebooting a Device 

This command is sometimes used after the Fastboot flash command to reboot the device so that the flashed file system can be booted:

fastboot reboot 

Instead of booting normally, the following command boots your Android device directly into the bootloader: 

fastboot reboot-bootloader

Harnessing the Power ofthe Penguin with ADD Shell

ADB can also be used as a direct connection to the Android operating system and harness the power ofLinux. The commands that can be run from inside the operating system shell are many and varied.

The adb shell command opens up your Android device to allow you to run commands directly on the device. The shell isfrequently utilized to make changes to the base Android operating system files.

When you connect to an Android device using ADB shell, the command prompt on your computer changes to indicate you are no longer entering commands that are being picked up and interpreted by your local computer. Instead you are in the Android operating system and the commands you enter at the prompt are picked up and interpreted by it. 

To load the shell, type the command adb shell. The familiar command prompt changes to an enigmatic $ or #. The dollar sign ($) is the Android operating system's way oftelling you that it is waiting for input but that you are not a "privileged" user so you can't really harm anything by poking around. You only see the hashtag (#) prompt if you are in the Android operating system as root user. The hashtag is a beautiful thing to the Android hacker: it means that you have ultimate control over the Android file system. While in the ADB shell, you need to enter Linux (not DOS) commands. For instance, to get a listing offiles and folders in a folder, you enter the command ls instead of dir.

You can send shell commands to your Android device without starting the interactive shell. For example, if you enter the following command:

adb shell cp /sdcard/sample.txt  

&nbsp;&nbsp /sdcard/sample2.txt 

it is performed as ifit had been entered on the command line ofthe shell. Many rooting instructions have you run ADB shell commands in this way. It is a shortcut that allows interactive commands to be run without actually being in the Android shell.

File SysteDl Navigation

In this example, you open the ADB shell and use a few Linux commands to navigate the file system. The commands we cover here are included in the default Android configuration. Because Android is a slimmed down and customized version ofLinux, it only uses a very small subset ofthe possible Linux commands. A later section deals with the more complex Linux commands that you install with the excellent BusyBox package.

In this section, we open an ADB shell prompt, navigate through the file system and exit from the file system.

Accessing the ADD Shell Prompt 

Follow these steps to open an ADB shell prompt: 

1. Open a command prompt window on your local computer. 

2. Enter the command adb 5 he 11.

If your ADB environment has been set up correctly, you are in the Android shell. If you receive an error message, check for connectivity (remember the DUCK troubleshooting model). 

If your phone is currently unrooted, you should see the prompt change to a dollar sign ($) followed by a flashing cursor (see Figure 3-9). 

Your command prompt window is no longer operating in the context of your local computer. Instead it is a "shell" that is mirroring directly to the Android operating system.

Navigating the File System 

The next activity walks you through the important skills of viewing your current folder contents and navigating from folder to folder.

1. In the ADB shell window, type the following command to go to the root ofthe file system: cd /.

2. Enter the command 1 s. Now you should see files such as s y stem and etc in the folder listing.

3. Enter the command cdsYstem to change your active folder context to the s y stem folder.

4. Type the command 1 s . You should see the files and folders that are located in the s y stem folder scroll past.

5. Now navigate back to the root of your file system by using the command cd /.

Linux, and thus Android, is a case-sensitive operating system. So the command cd System returns an error. It is important to keep this case sensitivity in mind as you begin hacking in Android. Remember that CASE MATTERS!

Linux, and thus Android, is a case-sensitive operating system. So the command cd System returns an error. It is important to keep this case sensitivity in mind as you begin hacking in Android. Remember that CASE MATTERS!

Using the cd command, you can wander all through your Android file system. Using the 1 s command, you can see the folders and files in the current folder.

It will help if you keep in mind that the Android file system is like an inverted tree (see Figure 3-10), with the other folders branching down from the root folder. Using the cd command to navigate into a parent folder takes you up in the hierarchy.

You can use the following shortcut command to navigate up one level in the folder hierarchy:

cd ..  

If you start at root and navigate to / sdcard and then to /myfolder, your full path is / sdcard/myfolder. Entering the command cd .. then moves back up from your current location to / sdcard.

File Management 

Hacking is all about getting access and permissions that are not standard. So you need three basic skills for hacking:

• navigating and managing files 
• determining who has what kind of access to files
• changing who has what kind of access to a file.

We have covered navigation and now we go on to learn how to manipulate files and the access to them

In the process of hacking certain devices, you will need to move files to and from the SD card. The SD card is a low-privilege file system, which means that you can place files on the SD card and then pull them into the primary file system, usually after exploiting some part ofthe system with a script such as psneuter.

Some file management tools are not available until you follow the steps to install BusyBox on a rooted device. We discuss BusyBox at the end ofthis chapter and in the device walkthroughs.

Copying Files 

The first thing you need to do is be able to copy files from one location to another. In any Linux-based operating system, you use the cp command to copy files or folders from one location to another. The cp command uses the pattern:

cp<source file name> < destination file name> 

For example, the command cp sample. txt sample2. txt takes the sample. txt file and copies it to a new file named sample2 . txt. So there would then be two files:

sample. txt and sample2. txt. 

The cp command can also take full path names to copy one file to another location. To copy a file to new location, specify the full path for the destination:

cp sample.txt /sdcard/my_folder/sample2.txt 

Frequently, you will use adb push to put an exploit script or firmware file onto your SD card and then use cp to move and rename it.

Deleting Files 

The remove (rm) command allows you to delete files and folders from the file system. The remove command uses the pattern:

rm<path and file name> 

There is no recycle bin in Android, so the results ofthis command are not reversible.

Moving Files  

The move command is equivalent to copying a file and deleting the original. When BusyBox (covered later this chapter) is installed on a rooted device, the move command is available.

mv sample.txt /sdcard/sample2.txt

The above command copies the sample. txt file to a new file on the SD card named sample2 . txt and then removes sample. txt from the current folder.

File Management Walkthrough

If you still have the sample. txt file from the "Copying Files to and from Your Device" section on your SD card, you can now use file management commands to play around with it. If you do not have the file on your SD card, push a s amp 1 e . txt file to your SD card.

1. Start ADB shell by running adb she 11 from the command prompt window.

2. At the $ prompt, enter the command cd \ sdcard.

3. Enter the command 1 s -1.

4. Verify that the file s amp 1 e . txt is listed.

5. Enter the command cp sample. txt samplecopy. txt.

Now let's make a new folder and copy the samplecopy. txt file to it.

1. Enter the following command: mkdir MyDirectory.

2. Enter the following command:

cp samp1ecopy.txt /MyDirectory/samp1ecopy2.txt 

Filenames and commands in Linux and Android are case sensitive, so mydirectory is an entirely different name from MyDirec tory.

Now delete the old copy of samplecopy. txt and verify the file was moved to MyDirectory.

1. Enter the command: rm samplecopy. txt.

2. Enter the command 1 s -1 and check that s amp 1 e copy . txt is not there.

3. Enter the command cd MyDirectory.

4. Enter the command ls -1 and check that samplecopy. txt is there

File Access Permissions 

Many commands in the Android shell can take "switches." A switch is a parameter that is entered with the command to change the way the command does its job. Let's look at the switches for the list (ls) command you learned earlier. In the ADB shell, type the following command:

ls -?

The shell throws an error but then shows you all the acceptable switches for the ls command. If you use any unacceptable syntax with a command, it shows you a quick listing ofthe accepted switches and parameters. In a full Linux installation, you would be able to use the man command to see the appropriate manual page. Android is a trimmed-down version ofLinux and does not include the manual pages for common commands.

Seeing File Access Permissions 

Notice that one ofthe switches that you can use with ls is the -1 (that's a lowercase L, not a numeric I) switch. When you use this switch, the 1 s command shows much more information. Let's try it. Type the following command in your ADB shell:

Is -1 

Your output should resemble Figure 3-11. Notice all the gibberish at the start of each line-lots ofDs, Rs, Ws and Xs.

You can consider the leftmost column of information in Figure 3-11 to be a table ofrows and columns. Each row refers to the file on the right and the columns contain information about that file (see Table 3-1). Column 1 indicates a folder by the letter "d." The next nine columns refer to the access permissions for a class of person, Columns 2-4 show the access permissions for the User class; columns 5-7 for the Group class; and columns 8-10 for the Others class.

The two aspects of permissions on an Android file are who has the permission and what kind of permission they have. The who definition is broken down into three classes of people:

• User is the owner ofthe file. 
• Group means all the users who are in the same group as the file's owner. 
• Others means all the other users on the device.


BusyBox: Giving the Penguin Back Its Power 
Only a handful ofLinux operating system commands are included with Android. BusyBox is an excellent multi-utility binary that was originally developed by Bruce Perens and has matured into an incredible Swiss Army knife of Linux utilities. It is currently maintained by Stericson, a senior moderator at XDA. When you install the BusyBox binary, you get a much larger subset of Linux commands, all optimized for small systems and limited resources. Because the BusyBox utilities are in a single binary, they can share code, which makes for a small installation package

BusyBox will be a constant companion in your hacking of Android devices. A lot ofthe advanced Linux tools you require are not available until BusyBox is installed. For this reason, installing BusyBox is frequently one of your first tasks in a rooting or hacking session. The process ofinstalling and linking the BusyBox commands differs between devices. Rooting instructions usually have installing BusyBox as a step. Search the XDA forums for instructions on installing BusyBox on your device.

Some applications that require root may also require that BusyBox is installed as they may depend on some ofthe commands in BusyBox. Over 200 commands can be compiled into BusyBox. In the course of hacking, you will probably use only a fraction ofthem. Here we cover three ofthe most frequently used commands from the awesome BusyBox binary. They are used from your Android command shell or an Android terminal program.