Guys,
I'm running CM54 trying to get ssh access using authorized_key exchange and the dropbear binary is segfaulting. I followed the instructions on how to set it up on cyanogen's wiki. Here is a debug trace of the connect event:
Code:
# dropbear -v -s -g -F -E
TRACE (15551): enter loadhostkeys
TRACE (15551): enter buf_get_priv_key
TRACE (15551): enter rsa_key_free
TRACE (15551): leave rsa_key_free: key == NULL
TRACE (15551): enter buf_get_rsa_priv_key
TRACE (15551): enter buf_get_rsa_pub_key
TRACE (15551): leave buf_get_rsa_pub_key: success
TRACE (15551): leave buf_get_rsa_priv_key
TRACE (15551): leave buf_get_priv_key
TRACE (15551): enter buf_get_priv_key
---snip---
TRACE (15558): shell is /system/bin/sh
TRACE (15558): test shell is '/bin/sh'
TRACE (15558): test shell is 'test shell is '%s''
TRACE (15558): test shell is 'garbage'
TRACE (15558): test shell is 'garbage'
TRACE (15558): test shell is 'garbage'
TRACE (15558): test shell is 'garbage'
TRACE (15558): test shell is 'garbage'
TRACE (15558): test shell is 'garbage'
TRACE (15558): Aiee, segfault! You should probably report this as a bug to the developer
Where garbage is unprintable characters. For some reason the board prevents me from pasting these in without detecting it as an outside link.
Is anyone else seeing this? Looks like I gotta cross-compile this myself and see if I can get it working that way, because I have tried just about everything else and it looks to be a bad binary. It will immediately kick me out if I don't enable debug also. Also /bin/sh is a bit disconcerting since it is not on the system.
echo "/system/bin/sh" >> /etc/shells
That did it, thanks.
You'd think that it would have complained that /etc/shells didn't exist (which it didn't before I ran your suggestion) or at least complained that the default shell is not a valid shell. It reminds me of the days where I used to work for IBM and merely misspelling an argument to many of the in-house tools would cause them to core dump. Fun stuff.
Thanks again.
ah, thanks, dropbear working, finally
Can you help me get access to dropbear via password. I make all like in cyanogen's wiki, but i can't find passwd.
Please Help.
Break Action said:
Can you help me get access to dropbear via password. I make all like in cyanogen's wiki, but i can't find passwd.
Please Help.
Click to expand...
Click to collapse
Perhaps the very bottom of the "About" section in Settings
bobtentpeg said:
Perhaps the very bottom of the "About" section in Settings
Click to expand...
Click to collapse
Sorry, but in Cyanogen Mode i can't find any password in About.
If you follow the instructions for generating a key pair and put your public key in the .ssh/authorized_keys then you don't need a password. If it is asking for a password than you have done something wrong. Check your permissions on the files. You can run dropbear in debug mode like I did on the OP. Also you can run ssh in debug mode on your client machine using -vvv at the command line.
Related
Hello, maybe here someone will help me
I'm writing a file manager app and I want to allow it for browsing with root permissions.
All I have so far is creation of a Process object using Runtime.exec("su"). Then I get output stream from it and write "ls" command. And here goes the question. How to read the output of the "ls"? Getting the input stream from the process gives me stdout of the "su" which is useless.
glodos said:
Hello, maybe here someone will help me
I'm writing a file manager app and I want to allow it for browsing with root permissions.
All I have so far is creation of a Process object using Runtime.exec("su"). Then I get output stream from it and write "ls" command. And here goes the question. How to read the output of the "ls"? Getting the input stream from the process gives me stdout of the "su" which is useless.
Click to expand...
Click to collapse
Use the -c option of su:
Code:
su -c 'ls -l /system/'
I think I'm closer, but still it doesn't work
I have this:
Code:
p = Runtime.getRuntime().exec("/system/bin/su -c 'ls -d -1 "+directory.getAbsolutePath()+"/*'");
So the command for a directory /data will be:
Code:
/system/bin/su -c 'ls -d -1 /data/*'
But it gives me:
Code:
W/su (13979): request rejected (0->0 'ls)
I have tried putting the command's parts into array but then system asks for su permission on every command. For ex. ls /data needs permission and ls /system needs another permission beacuse the command is different.
Not much I can think of to do about that. I had a similar issue once upon a time and I dealt with it by using a script that read its commands from a data file. I'd write the datafile to my program's designated directory (no special permissions required), then run a single command with su and that script would read the datafile to know what to do, otherwise, I had a ****load of su requests bothering the user.
You've got a point there, but making it work with a file manager, where the commands are related to user interaction would be very difficult. Anyway I will put it into my consideration.
I wonder how all these root explorers are made but none of the developers, which I asked so far, were so kind to give me some tips
glodos said:
You've got a point there, but making it work with a file manager, where the commands are related to user interaction would be very difficult. Anyway I will put it into my consideration.
I wonder how all these root explorers are made but none of the developers, which I asked so far, were so kind to give me some tips
Click to expand...
Click to collapse
Well, I suppose you could keep a process open to a shell with root permissions and once open, keep input and output pipes routed to it and send and receive commands as needed.
Gene Poole said:
Well, I suppose you could keep a process open to a shell with root permissions and once open, keep input and output pipes routed to it and send and receive commands as needed.
Click to expand...
Click to collapse
Well, that's what I've tried to do, but as I mentioned in the first post, output pipe gives me stdout of the su process which doesn't write any output (but "ls" does).
glodos said:
Well, that's what I've tried to do, but as I mentioned in the first post, output pipe gives me stdout of the su process which doesn't write any output (but "ls" does).
Click to expand...
Click to collapse
No, I don't think you're following me. Just run su -c 'sh' and it should run a shell and keep it open. From there, you create an input stream, output stream and possibly an error stream, then write commands like "ls -l /system\n" (the \n triggers the shell to execute it) to the output stream, then read the results form the input stream. You keep doing this as needed and when you're done just send "exit\n".
Oh, I understand now. I'll try it ASAP.
Edit:
It works now, but I have problems with stopping the loop. Here is my piece of code:
Code:
String[] cmd = new String[]{"su", "-c", "/system/bin/sh"};
console = Runtime.getRuntime().exec(cmd);
BufferedWriter stdin = new BufferedWriter(new OutputStreamWriter(console.getOutputStream()));
stdin.write("ls -d -1 "+directory.getAbsolutePath()+"/*\n");
BufferedReader stdout = new BufferedReader(new InputStreamReader(console.getInputStream()));
String read;
data1 = new String();
while((read=stdout.readLine())!=null){
data1+=read + "\n";
}
The problem is, that it hangs at some point on invocation of "stdout.readLine()". I have read that it waits for some data to come and it will never be null.
Furthermore if my ls command returns nothing (which can happen) it always hangs forever on readLine().
Anyway I'll try to do something with this. Maybe there is a workaround and reading will not block.
Thank you for your effort, it was really helpful.
glodos said:
The problem is, that it hangs at some point on invocation of "stdout.readLine()". I have read that it waits for some data to come and it will never be null.
Furthermore if my ls command returns nothing (which can happen) it always hangs forever on readLine().
Anyway I'll try to do something with this. Maybe there is a workaround and reading will not block.
Thank you for your effort, it was really helpful.
Click to expand...
Click to collapse
Sorry to ressurect such an old thread. I'd been having the same problem with reads blocking using BufferedReader, InputStream and other variants. Turns out BufferedReader has a ready() method which indicates whether a read() will block. This code works for me:
Code:
String outputStr;
BufferedReader reader = new BufferedReader(new InputStreamReader(suProcess.getInputStream()));
while (reader.ready()) {
outputStr += reader.readLine();
}
Hope it helps someone from the repeating the same frustrations. Heck I hope it helps me in the future in case I forget this
I am running CM 7.1 Jordon Stable
So I disabled the slider unlock, but it stopped recognizing my gesture for some reason and I cannot figure out how to login to my phone. Not sure if I can change that setting somehow from ADP or do something from a terminal... Any ideas?
When I say gesture, I am not referring to the password based on the motion with the dots, I am saying the screen where the unlock / silent toggle was has been disabled and I cannot get passed there.
Here are the things I have tried already
----
Attempt 1:
$ ./adb -d shell
# cd data/data
# sqlite3 ./com.android.providers.settings/databases/settings.db
SQLite version 3.7.2
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite> update system set value=1 where name='lockscreen_disabled';
sqlite> .exit
# reboot
Attempt 2:
adb shell
input keyevent 82
---
Neither of these worked. I think the solution should be in the updating the settings.db, but maybe its a different row/record that contains "ENABLE slider"?
Help would be appreciated!
Right, I'm currently working on a project which involves imaging Android phones - specifically, the program I've written is mean to automate identifying the memory block containing the userdata and then using the following sequence of commands (using Android Debug Bridge) to copy it to the computer that the phone is connected to:
Code:
adb forward tcp:5555 tcp:5555
adb shell
busybox nc –l –p 5555 –e dd if=/dev/mtd/mtd[mtd block number] bs=4096
This is done in command prompt and then you have to manually open another command prompt and type in:
Code:
adb forward tcp:5555 tcp:5555
nc 127.0.0.1 5555 | dd of=[chosen file name].bin bs=4096 -- progress
This copies the memory block over without any problems when done manually and even shows you in real time how much data has been transferred.
The problem I have is with automating the process in C#. Specifically, I can get every stage of it to work through using a process to write the commands to standard input and using a tcp listening port to receive the data. Apart from this crucial element of the process:
Code:
adb shell "busybox nc –l –p 5555 –e dd if=/dev/mtd/mtd[mtd block number] bs=4096"
For some reason, no matter how I try to phrase it or do it, C# hates that command and won't execute it. I can manually type the exact same thing into the command prompt and it works fine but trying to do it in C# just leads to busybox acting as though I typed the command in incorrectly - this is what it gives me:
Code:
BusyBox v1.15.2 <2009-11-27 10:38:30 GMT> multi-call binary
Usage: nc [-in] [-wN] [-l] [-p Port] [-f FILENAME|PADDR PORT] [-e PROG]
Open a pipe to IP:port or file
Options:
-e PROG Run prog after connect
-i SEC Delay interval for lines sent
-w SEC Timeout for connect
-f FILE Use file <ala /dev/ttyS0> instead of network
-l Listen mode, for inbound connects
<use -l twice with -e for persistent server>
-p PORT Local port
The problem appears to be particularly with the use of bs=[bytes] but I've no idea why - and I've spent several hours searching all over the web for solutions.
So basically, I was wondering whether anyone else might have encountered this issue before and if anyone has any ideas to get around it? At the moment I'm using a script to send the commands to the command prompt but that's a kludge that I'd really prefer not to have to use.
Thanks in advance for any suggestions or comments and apologies if I've posted this in the wrong place.
Probably has to do with syntax.
In the first instance you don't have it in quotes.
Code:
busybox nc –l –p 5555 –e dd if=/dev/mtd/mtd[mtd block number] bs=4096
Then you do have quotes the second time.
Code:
adb shell "busybox nc –l –p 5555 –e dd if=/dev/mtd/mtd[mtd block number] bs=4096"
Sometimes, using a newer busybox helps too... 1.15.2 is kinda old
The first time is meant to show that it's being done on two different lines though I probably should have made that clearer.
Thanks for the suggestion - I just upgraded to the latest version of busybox and also altered my code so it would open cmd.exe and then run adb.exe rather than skipping straight to running adb.exe. This seems to have fixed the problem some of the time so there's probably a timing issue as well.
So I don't know whether it was the busybox version or the adb.exe/cmd.exe thing but, either way, the problem seems to have disappeared so I'm not going to change anything else in case I break it again.
Thanks very much for your help
Yep I find that there is always 2 or 3 ways to do something and usually only 1 way works all the time (lowest common denominator etc...)
@Antonine May I ask you what's the project you're talking about? I'm interested...
I found I can use these ADB commands to turn on and of the WiFi of a rooted phone:
Code:
adb shell su -c 'svc wifi enable'
adb shell su -c 'svc wifi disable'
However, I'm interested in doing it without having to root the phone for an automatic testing I'm doing. Do you guys know if this is possible?
I found this project which allows me to connect to a WiFi through ADB commands not being a root user. I was wondering if anyone knows how to disconnect also from ADB and not being a root user.
UPDATE:
I've been recently trying:
Code:
C:\adb>adb shell am start -a android.intent.action.MAIN -n com.android.settings/.wifi.WifiSettings
adb server is out of date. killing...
* daemon started successfully *
Starting: Intent { act=android.intent.action.MAIN cmp=com.android.settings/.wifi.WifiSettings }
Warning: Activity not started, its current task has been brought to the front
and
Code:
C:\adb>adb -s serial_number shell am start -a android.intent.action.MAIN -n com.android.settings/.wifi.WifiSettings
Starting: Intent { act=android.intent.action.MAIN cmp=com.android.settings/.wifi.WifiSettings }
Warning: Activity not started, its current task has been brought to the front
I also found doing this type of command:
Code:
adb shell input keyevent 20 & adb shell input keyevent 23
I can navigate and click. The problem seems to be that I always finish in a different state so the next time I input the command
Code:
adb -s serial_number shell am start -a android.intent.action.MAIN -n com.android.settings/.wifi.WifiSettings
I start in a different place and start clicking elsewhere. I've tried returning home, but that doesn't fix the issue. Is there any way to start always from the same point inside the WiFi settings?
Thanks!
natiya said:
I found I can use these ADB commands to turn on and of the WiFi of a rooted phone:
Code:
adb shell su -c 'svc wifi enable'
adb shell su -c 'svc wifi disable'
However, I'm interested in doing it without having to root the phone for an automatic testing I'm doing. Do you guys know if this is possible?
Click to expand...
Click to collapse
Turn WiFi off
Code:
adb shell settings put global airplane_mode_on 1
adb shell settings put global wifi_on 0
adb shell settings put global wifi_scan_always_enabled 0
Afterwards you've to re-boot the device.
Turn WiFi on
Code:
adb shell settings put global airplane_mode 0
adb shell settings put global wifi_on 1
adb shell settings put global wifi_scan_always_enabled 1
jwoegerbauer said:
Turn WiFi off
Code:
adb shell settings put global airplane_mode_on 1
adb shell settings put global wifi_on 0
adb shell settings put global wifi_scan_always_enabled 0
Afterwards you've to re-boot the device.
Turn WiFi on
Code:
adb shell settings put global airplane_mode 0
adb shell settings put global wifi_on 1
adb shell settings put global wifi_scan_always_enabled 1
Click to expand...
Click to collapse
Thank you, but those don't produce any change on my device. Actually, if I put the first two commands without doing "adb kill-server" in between, I get this message:
error: more than one device/emulator
Click to expand...
Click to collapse
But the output when they work is:
adb server is out of date. killing...
* daemon started successfully *
Click to expand...
Click to collapse
and nothing happens.
I've been recently trying:
Code:
C:\adb>adb shell am start -a android.intent.action.MAIN -n com.android.settings/.wifi.WifiSettings
adb server is out of date. killing...
* daemon started successfully *
Starting: Intent { act=android.intent.action.MAIN cmp=com.android.settings/.wifi.WifiSettings }
Warning: Activity not started, its current task has been brought to the front
and
Code:
C:\adb>adb -s serial_number shell am start -a android.intent.action.MAIN -n com.android.settings/.wifi.WifiSettings
Starting: Intent { act=android.intent.action.MAIN cmp=com.android.settings/.wifi.WifiSettings }
Warning: Activity not started, its current task has been brought to the front
This opens the screen where you can turn on and off the WiFi but it doesn't do it...not sure if I'm missing something!
Just to be shure, make shure your using the latest version of ADB offered by google here:
https://developer.android.com/studio/releases/platform-tools
You could use adb wifi
After activating when using usb it and connecting through the same wifi:
svc wifi enable
works without root
I'm a little late to this thread, but if it still helps the OP, non-rooted Android 10 and below allowed wireless adb connections AFTER a USB connection was first established (adb start-server && adb tcpip 5555 && adb connect [IP]:5555), but that changed (for the better) in Android 11 and above with the new new Developer options Wireless debugging random port assignments (adb connect [IP]:[PORT] or adb pair [IP]:[PORT] [PIN]) such that the adb wireless connection never needs USB cable ever again.
Given Android 11 allows Developer options Wireless debugging via a random port, and Android 12 new Developer options Wireless debugging allows that to be accessed even easier with a new Developer options Wireless debugging tile, the only thing missing is a way to turn the non-rooted Android Wi-Fi on or off via adb (which was the OP's original question after all).
Maybe this will work if we can figure out how to tap the buttons?
adb shell "am start -a android.settings.WIFI_SETTINGS"
Click to expand...
Click to collapse
For swiping on the phone from adb this works...
C:\> adb shell input swipe 500 1000 500 100
This will instantly swipe from center to the top of the screen.
You can add a time period, e.g., take 3 seconds to swipe that.
C:\> adb shell input swipe 500 1000 500 100 3000
Click to expand...
Click to collapse
But you want to tap the buttons, right?
If we can figure out the positions, maybe this would work?
C:\> adb shell am start -n com.google.android.gms/.ads.settings.AdsSettingsActivity
That should pop up an Android "Reset Advertising ID" settings page.
C:\> adb shell input tap 500 400
If run after the command above, that will tap the button to
asking to "Opt out of Ads Personalization" in that Activity
if that button is like mine, at the X=500 & Y=400 location.
On my phone, this is the "Reset advertising ID" button location:
adb shell input tap 500 200
On my phone, this is the "OK" button on that GUI above.
adb shell input tap 700 1000
C:\> adb shell am force-stop com.google.android.gms
If run after bringing up the advertising-id reset Activity,
it will close the activity without doing anything else.
Click to expand...
Click to collapse
Here is a somewhat related post...
[adb,scrcpy,vysor] What ports does Android 12 randomly set when Wi-Fi connecting via Wireless debugging adb "pair" or "connect" commands?
Type adb tcpip 5555 in the command line or Terminal and press Enter.
Find your phone's IP address in Settings > About Phone > Status > IP Address.
Back in the command line or Terminal, type adb connect [your Android's IP address].
Finally, press Enter again.
Regards,
J Wick
I've rooted my phone using Magisk
I want to enable/disable Wifi using a shell script
Enabling or diabling works fine using command below
adb -s <serial> shell "svc wifi enable"
But when i start a SSH session svc throws an "Aborted" error
# svc wifi enable
Aborted
Info:
# adb -s <serial> shell "whoami"
shell
# adb -s <serial> shell "which svc"
/system/bin/svc
# adb -s <serial> shell "which sh"
/system/bin/sh
Also tried logging in SSH as user "shell"
Why is svc giving this error, is there a way to fix this ?
ReMiOS said:
I've rooted my phone using Magisk
I want to enable/disable Wifi using a shell script
Enabling or diabling works fine using command below
adb -s <serial> shell "svc wifi enable"
But when i start a SSH session svc throws an "Aborted" error
# svc wifi enable
Aborted
Info:
# adb -s <serial> shell "whoami"
shell
# adb -s <serial> shell "which svc"
/system/bin/svc
# adb -s <serial> shell "which sh"
/system/bin/sh
Also tried logging in SSH as user "shell"
Why is svc giving this error, is there a way to fix this ?
Click to expand...
Click to collapse
I'm facing the same issue here, did you mage to solve it?
estevaofv said:
I'm facing the same issue here, did you mage to solve it?
Click to expand...
Click to collapse
Unfortunately not ...
i have no clue
Hello friend, I just found the solution:
export ANDROID_DATA=/data
just run the above command, it was an environment variable related issue, I found the solution on the link below:
Can not run some CMDs over SSH · Issue #12 · Magisk-Modules-Repo/ssh
PixelExperience_caf_whyred-9.0 Magisk 19.2 Can not run some su CMDs over SSH shell, but over ADB everything is OK The error gives a sign of 'Aborted' Have been using SSH-Module for some time now, s...
github.com
estevaofv said:
Hello friend, I just found the solution:
export ANDROID_DATA=/data
just run the above command, it was an environment variable related issue, I found the solution on the link below:
Can not run some CMDs over SSH · Issue #12 · Magisk-Modules-Repo/ssh
PixelExperience_caf_whyred-9.0 Magisk 19.2 Can not run some su CMDs over SSH shell, but over ADB everything is OK The error gives a sign of 'Aborted' Have been using SSH-Module for some time now, s...
github.com
Click to expand...
Click to collapse
It works now
Great Solution ! Thanks !
I've put it in my ~/.profile to load it automatically at login (using SSH magisk module)
I've upgraded to Android 10 after this svc just gave an rc =1
# svc
1|
# echo $?
1
Fixed is by adding this to my ~/.profile
export PATH=$PATH:/sbin
export ANDROID_DATA=/data
export ANDROID_RUNTIME_ROOT=/apex/com.android.runtime
export ANDROID_TZDATA_ROOT=/apex/com.android.tzdata
# svc
Available commands:
help Show information about the subcommands
power Control the power manager
data Control mobile data connectivity
wifi Control the Wi-Fi manager
usb Control Usb state
nfc Control NFC functions
bluetooth Control Bluetooth service
system-server System server process related command