版权声明:☆☆☆原创文章,转载请注明来自: https://blog.csdn.net/xgbing/article/details/52058390
ADB是Android debug bridge的缩写,它使用PC机可以通过USB或网络与android设备通讯。
adb的源码位于system/core/adb目录下,先来看下编译脚本Android.mk:
# Copyright 2005 The Android Open Source Project
LOCAL_PATH:= $(call my-dir)
# =========================================================
# Default to a virtual (sockets) usb interface
EXTRA_SRCS := get_my_path_linux.c
LOCAL_LDLIBS += -lrt -ldl -lpthread
LOCAL_CFLAGS += -DWORKAROUND_BUG6558362
EXTRA_SRCS := get_my_path_darwin.c
LOCAL_LDLIBS += -lpthread -framework CoreFoundation -framework IOKit -framework Carbon
ifeq ($(HOST_OS),freebsd)
EXTRA_SRCS := get_my_path_freebsd.c
LOCAL_LDLIBS += -lpthread -lusb
ifeq ($(HOST_OS),windows)
USB_SRCS := usb_windows.c
EXTRA_SRCS := get_my_path_windows.c ../libcutils/list.c
EXTRA_STATIC_LIBS := AdbWinApi
ifneq ($(strip $(USE_CYGWIN)),)
LOCAL_LDLIBS += -lpthread -lgdi32
LOCAL_C_INCLUDES += /usr/include/w32api/ddk
ifneq ($(strip $(USE_MINGW)),)
LOCAL_LDLIBS += -lws2_32 -lgdi32
LOCAL_C_INCLUDES += /usr/i586-mingw32msvc/include/ddk
LOCAL_C_INCLUDES += development/host/windows/usb/api/
LOCAL_C_INCLUDES += external/openssl/include
ifneq ($(USE_SYSDEPS_WIN32),)
LOCAL_SRC_FILES += sysdeps_win32.c
LOCAL_SRC_FILES += fdevent.c
LOCAL_CFLAGS += -O2 -g -DADB_HOST=1 -Wall -Wno-unused-parameter
LOCAL_CFLAGS += -D_XOPEN_SOURCE -D_GNU_SOURCE
LOCAL_MODULE_TAGS := debug
LOCAL_STATIC_LIBRARIES := libzipfile libunz libcrypto_static $(EXTRA_STATIC_LIBS)
ifeq ($(USE_SYSDEPS_WIN32),)
LOCAL_STATIC_LIBRARIES += libcutils
include $(BUILD_HOST_EXECUTABLE)
$(call dist-for-goals,dist_files sdk,$(LOCAL_BUILT_MODULE))
ifeq ($(HOST_OS),windows)
$(LOCAL_INSTALLED_MODULE): \
$(HOST_OUT_EXECUTABLES)/AdbWinApi.dll \
$(HOST_OUT_EXECUTABLES)/AdbWinUsbApi.dll
# =========================================================
LOCAL_CFLAGS := -O2 -g -DADB_HOST=0 -Wall -Wno-unused-parameter
LOCAL_CFLAGS += -D_XOPEN_SOURCE -D_GNU_SOURCE
ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
LOCAL_CFLAGS += -DALLOW_ADBD_ROOT=1
LOCAL_FORCE_STATIC_EXECUTABLE := true
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT_SBIN)
LOCAL_UNSTRIPPED_PATH := $(TARGET_ROOT_OUT_SBIN_UNSTRIPPED)
LOCAL_STATIC_LIBRARIES := liblog libcutils libc libmincrypt
include $(BUILD_EXECUTABLE)
# adb host tool for device-as-host
# =========================================================
LOCAL_LDLIBS := -lrt -ldl -lpthread
LOCAL_C_INCLUDES += external/openssl/include
LOCAL_STATIC_LIBRARIES := libzipfile libunz libcutils
LOCAL_SHARED_LIBRARIES := libcrypto
include $(BUILD_EXECUTABLE)
可以看到,最终会有3个执行文件被生成,adbd和两个adb程序。adbd是手机终的守护进程;adb一个是windows、linux、darwin或freebsd运行的程序,另一个是目标机上运行的程序。
宏ADB_HOST用于区分是PC端程序还是目标机端的程序。宏ADB_HOST_ON_TARGET用于区分adb程序是否是在目标机上运行。这3个程序使用的是同一份源码,在内部,使用这些宏来区别不同的程序。
程序的入口在adb.c的main()函数:
int main(int argc, char **argv)
D("Handling commandline()\n");
return adb_commandline(argc - 1, argv + 1);
/* If adbd runs inside the emulator this will enable adb tracing via
* adb-debug qemud service in the emulator. */
if((argc > 1) && (!strcmp(argv[1],"recovery"))) {
adb_device_banner = "recovery";
return adb_main(0, DEFAULT_ADB_PORT);
先来看adbd程序,此时宏的设置是ADB_HOST=0。上面代码中start_device_log()是log的初始化操作,可以重定向输出的log信息,接着进入adb_main()函数。先来看下它的参数DEFAULT_ADB_PORT:
/* adb and adbd are coexisting on the target, so use 5038 for adb
* to avoid conflicting with adbd's usage of 5037
# define DEFAULT_ADB_PORT 5038
# define DEFAULT_ADB_PORT 5037
如果是目标机程序,它的值是5038,否则它的值是5037。这里没有定义ADB_HOST_ON_TARGET, 所以它是5037。
adb_main()的源代码如下:
int adb_main(int is_daemon, int server_port)
char value[PROPERTY_VALUE_MAX];
SetConsoleCtrlHandler( ctrlc_handler, TRUE );
#elif defined(HAVE_FORKEXEC)
// No SIGCHLD. Let the service subproc handle its children.
signal(SIGPIPE, SIG_IGN);
init_transport_registration();
local_init(DEFAULT_ADB_LOCAL_TRANSPORT_PORT);
build_local_name(local_name, sizeof(local_name), server_port);
if(install_listener(local_name, "*smartsocket*", NULL)) {
property_get("ro.adb.secure", value, "0");
auth_enabled = !strcmp(value, "1");
// Our external storage path may be different than apps, since
// we aren't able to bind mount after dropping root.
const char* adb_external_storage = getenv("ADB_EXTERNAL_STORAGE");
if (NULL != adb_external_storage) {
setenv("EXTERNAL_STORAGE", adb_external_storage, 1);
D("Warning: ADB_EXTERNAL_STORAGE is not set. Leaving EXTERNAL_STORAGE"
/* don't listen on a port (default 5037) if running in secure mode */
/* don't run as root if we are running in secure mode */
if (should_drop_privileges()) {
struct __user_cap_header_struct header;
struct __user_cap_data_struct cap;
if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) != 0) {
** AID_ADB to access the USB driver
** AID_LOG to read system logs (adb logcat)
** AID_INPUT to diagnose input issues (getevent)
** AID_INET to diagnose network issues (netcfg, ping)
** AID_GRAPHICS to access the frame buffer
** AID_NET_BT and AID_NET_BT_ADMIN to diagnose bluetooth (hcidump)
** AID_SDCARD_R to allow reading from the SD card
** AID_SDCARD_RW to allow writing to the SD card
** AID_MOUNT to allow unmounting the SD card before rebooting
** AID_NET_BW_STATS to read out qtaguid statistics
gid_t groups[] = { AID_ADB, AID_LOG, AID_INPUT, AID_INET, AID_GRAPHICS,
AID_NET_BT, AID_NET_BT_ADMIN, AID_SDCARD_R, AID_SDCARD_RW,
AID_MOUNT, AID_NET_BW_STATS };
if (setgroups(sizeof(groups)/sizeof(groups[0]), groups) != 0) {
/* then switch user and group to "shell" */
if (setgid(AID_SHELL) != 0) {
if (setuid(AID_SHELL) != 0) {
/* set CAP_SYS_BOOT capability, so "adb reboot" will succeed */
header.version = _LINUX_CAPABILITY_VERSION;
cap.effective = cap.permitted = (1 << CAP_SYS_BOOT);
D("Local port disabled\n");
build_local_name(local_name, sizeof(local_name), server_port);
if(install_listener(local_name, "*smartsocket*", NULL)) {
if (access(USB_ADB_PATH, F_OK) == 0 || access(USB_FFS_ADB_EP0, F_OK) == 0) {
// If one of these properties is set, also listen on that port
// If one of the properties isn't set and we couldn't listen on usb,
// listen on the default port.
property_get("service.adb.tcp.port", value, "");
property_get("persist.adb.tcp.port", value, "");
if (sscanf(value, "%d", &port) == 1 && port > 0) {
printf("using port=%d\n", port);
// listen on TCP port specified by service.adb.tcp.port property
// listen on default port
local_init(DEFAULT_ADB_LOCAL_TRANSPORT_PORT);
D("adb_main(): pre init_jdwp()\n");
D("adb_main(): post init_jdwp()\n");
// inform our parent that we are up and running.
WriteFile( GetStdHandle( STD_OUTPUT_HANDLE ), "OK\n", 3, &count, NULL );
#elif defined(HAVE_FORKEXEC)
D("Event loop starting\n");
(1) init_transport_registration()初始化fevent transport_registration_fde;
(2) 判断系统属性ro.adb.secure,目标板没有设置这个宏;
(3) 没有定义环境变量adb_external_storage;
(4) should_drop_privileges()根据android编译环境should_drop_privileges返回不同的值,如果它的值是userdebug或eng,宏ALLOW_ADBD_ROOT的值被定义为1,执行install_listener(),否则不会定义,这种情况下,由于adbd运行在root下,为保证它的安全性,它需要降级运行;
(5) 判断是否存在设备文件USB_ADB_PATH或USB_FFS_ADB_EP0,存在则执行usb_init();
(6) 读取属性service.adb.tcp.port或persist.adb.tcp.port(目标板均未定义),执行local_init(),它内部会创建adb thread;
(7) 执行init_jdwp(),jdwp是java调试体系中的一种,具体可百度;
(8) 调用fdevent_loop()监听fdevent并处理;
(9) 程序结束。
再来看adb程序的执行:
在main()中调用return adb_commandline(argc - 1, argv + 1):
int adb_commandline(int argc, char **argv)
transport_type ttype = kTransportAny;
char* server_port_str = NULL;
/* If defined, this should be an absolute path to
* the directory containing all of the various system images
* for a particular product. If not defined, and the adb
* command requires this information, then the user must
* specify the path using "-p".
gProductOutPath = getenv("ANDROID_PRODUCT_OUT");
if (gProductOutPath == NULL || gProductOutPath[0] == '\0') {
// TODO: also try TARGET_PRODUCT/TARGET_DEVICE as a hint
serial = getenv("ANDROID_SERIAL");
/* Validate and assign the server port */
server_port_str = getenv("ANDROID_ADB_SERVER_PORT");
int server_port = DEFAULT_ADB_PORT;
if (server_port_str && strlen(server_port_str) > 0) {
server_port = (int) strtol(server_port_str, NULL, 0);
"adb: Env var ANDROID_ADB_SERVER_PORT must be a positive number. Got \"%s\"\n",
/* modifiers and flags */
if(!strcmp(argv[0],"server")) {
} else if(!strcmp(argv[0],"nodaemon")) {
} else if (!strcmp(argv[0], "fork-server")) {
/* this is a special flag used only when the ADB client launches the ADB Server */
} else if(!strcmp(argv[0],"persist")) {
} else if(!strncmp(argv[0], "-p", 2)) {
const char *product = NULL;
if (argv[0][2] == '\0') {
if (argc < 2) return usage();
gProductOutPath = find_product_out_path(product);
if (gProductOutPath == NULL) {
fprintf(stderr, "adb: could not resolve \"-p %s\"\n",
} else if (argv[0][0]=='-' && argv[0][1]=='s') {
if (isdigit(argv[0][2])) {
if(argc < 2 || argv[0][2] != '\0') return usage();
} else if (!strcmp(argv[0],"-d")) {
} else if (!strcmp(argv[0],"-e")) {
/* out of recognized modifiers and flags */
adb_set_transport(ttype, serial);
adb_set_tcp_specifics(server_port);
if (no_daemon || is_daemon) {
r = adb_main(is_daemon, server_port);
r = launch_server(server_port);
fprintf(stderr,"* could not start server *\n");
/* adb_connect() commands */
if(!strcmp(argv[0], "devices")) {
else if (argc == 2 && !strcmp(argv[1], "-l"))
fprintf(stderr, "Usage: adb devices [-l]\n");
snprintf(buf, sizeof buf, "host:%s%s", argv[0], listopt);
printf("List of devices attached \n");
if(!strcmp(argv[0], "connect")) {
fprintf(stderr, "Usage: adb connect <host>[:<port>]\n");
snprintf(buf, sizeof buf, "host:connect:%s", argv[1]);
if(!strcmp(argv[0], "disconnect")) {
fprintf(stderr, "Usage: adb disconnect [<host>[:<port>]]\n");
snprintf(buf, sizeof buf, "host:disconnect:%s", argv[1]);
snprintf(buf, sizeof buf, "host:disconnect:");
if (!strcmp(argv[0], "emu")) {
return adb_send_emulator_command(argc, argv);
if(!strcmp(argv[0], "shell") || !strcmp(argv[0], "hell")) {
char h = (argv[0][0] == 'h');
D("starting interactive shell\n");
snprintf(buf, sizeof buf, "shell:%s", argv[1]);
/* quote empty strings and strings with spaces */
quote = (**argv == 0 || strchr(*argv, ' '));
D("interactive shell loop. buff=%s\n", buf);
D("about to read_and_dump(fd=%d)\n", fd);
D("read_and_dump() done.\n");
fprintf(stderr,"error: %s\n", adb_error());
fprintf(stderr,"\n- waiting for device -\n");
do_cmd(ttype, serial, "wait-for-device", 0);
D("interactive shell loop. return r=%d\n", r);
if(!strcmp(argv[0], "kill-server")) {
fd = _adb_connect("host:kill");
fprintf(stderr,"* server not running *\n");
if(!strcmp(argv[0], "sideload")) {
if(argc != 2) return usage();
if(adb_download("sideload", argv[1], 1)) {
if(!strcmp(argv[0], "remount") || !strcmp(argv[0], "reboot")
|| !strcmp(argv[0], "reboot-bootloader")
|| !strcmp(argv[0], "tcpip") || !strcmp(argv[0], "usb")
|| !strcmp(argv[0], "root")) {
if (!strcmp(argv[0], "reboot-bootloader"))
snprintf(command, sizeof(command), "reboot:bootloader");
snprintf(command, sizeof(command), "%s:%s", argv[0], argv[1]);
snprintf(command, sizeof(command), "%s:", argv[0]);
int fd = adb_connect(command);
fprintf(stderr,"error: %s\n", adb_error());
if(!strcmp(argv[0], "bugreport")) {
if (argc != 1) return usage();
do_cmd(ttype, serial, "shell", "bugreport", 0);
/* adb_command() wrapper commands */
if(!strncmp(argv[0], "wait-for-", strlen("wait-for-"))) {
if (!strncmp(service, "wait-for-device", strlen("wait-for-device"))) {
if (ttype == kTransportUsb) {
service = "wait-for-usb";
} else if (ttype == kTransportLocal) {
service = "wait-for-local";
service = "wait-for-any";
format_host_command(buf, sizeof buf, service, ttype, serial);
D("failure: %s *\n",adb_error());
fprintf(stderr,"error: %s\n", adb_error());
/* Allow a command to be run after wait-for-device,
* e.g. 'adb wait-for-device shell'.
if(!strcmp(argv[0], "forward")) {
if(argc != 3) return usage();
snprintf(buf, sizeof buf, "host-serial:%s:forward:%s;%s",serial, argv[1], argv[2]);
} else if (ttype == kTransportUsb) {
snprintf(buf, sizeof buf, "host-usb:forward:%s;%s", argv[1], argv[2]);
} else if (ttype == kTransportLocal) {
snprintf(buf, sizeof buf, "host-local:forward:%s;%s", argv[1], argv[2]);
snprintf(buf, sizeof buf, "host:forward:%s;%s", argv[1], argv[2]);
fprintf(stderr,"error: %s\n", adb_error());
/* do_sync_*() commands */
if(!strcmp(argv[0], "ls")) {
if(argc != 2) return usage();
return do_sync_ls(argv[1]);
if(!strcmp(argv[0], "push")) {
if(argc != 3) return usage();
return do_sync_push(argv[1], argv[2], 0 /* no verify APK */);
if(!strcmp(argv[0], "pull")) {
return do_sync_pull(argv[1], ".");
return do_sync_pull(argv[1], argv[2]);
if(!strcmp(argv[0], "install")) {
if (argc < 2) return usage();
return install_app(ttype, serial, argc, argv);
if(!strcmp(argv[0], "uninstall")) {
if (argc < 2) return usage();
return uninstall_app(ttype, serial, argc, argv);
if(!strcmp(argv[0], "sync")) {
char *srcarg, *android_srcpath, *data_srcpath;
/* No local path was specified. */
} else if (argc >= 2 && strcmp(argv[1], "-l") == 0) {
/* A local path or "android"/"data" arg was specified. */
ret = find_sync_dirs(srcarg, &android_srcpath, &data_srcpath);
if(ret != 0) return usage();
if(android_srcpath != NULL)
ret = do_sync_sync(android_srcpath, "/system", listonly);
if(ret == 0 && data_srcpath != NULL)
ret = do_sync_sync(data_srcpath, "/data", listonly);
/* passthrough commands */
if(!strcmp(argv[0],"get-state") ||
!strcmp(argv[0],"get-serialno") ||
!strcmp(argv[0],"get-devpath"))
format_host_command(buf, sizeof buf, argv[0], ttype, serial);
if(!strcmp(argv[0],"status-window")) {
status_window(ttype, serial);
if(!strcmp(argv[0],"logcat") || !strcmp(argv[0],"lolcat") || !strcmp(argv[0],"longcat")) {
return logcat(ttype, serial, argc, argv);
if(!strcmp(argv[0],"ppp")) {
if (!strcmp(argv[0], "start-server")) {
return adb_connect("host:start-server");
if (!strcmp(argv[0], "backup")) {
return backup(argc, argv);
if (!strcmp(argv[0], "restore")) {
return restore(argc, argv);
if (!strcmp(argv[0], "jdwp")) {
int fd = adb_connect("jdwp");
fprintf(stderr, "error: %s\n", adb_error());
/* "adb /?" is a common idiom under Windows */
if(!strcmp(argv[0], "help") || !strcmp(argv[0], "/?")) {
if(!strcmp(argv[0], "version")) {
它的代码有点长,但可以很容易看明白它根据命令的参数执行不同的功能。adb程序可能以服务的方式或命令行客户端的方式运行。
----------
以上就是main()函数的执行过程,后续将分析其中的细节内容。