分类目录归档:Android

用frida来hook不同的apk加载到同一个进程时找不到类的问题

java.lang.ClassNotFoundException: Didn\’t find class  ...
on path: DexPathList[[zip file “/system/priv-app/TeleService/TeleService.apk”],nativeLibraryDirectories=[/system/priv-app/TeleService/lib/arm64, /system/priv-app/TeleService/TeleService.apk!/lib/arm64-v8a, /system/lib64, /vendor/lib64, /system/lib64, /vendor/lib64]]

原因就是那个apk不在DexPathList里

解决方法1:
https://www.jianshu.com/p/179fc263a253

android qemu内核参数处理

https://android.googlesource.com/platform/system/core/+/master/init/init.cpp

static void import_kernel_nv(const std::string& key, const std::string& value, bool for_emulator) {
    if (key.empty()) return;
    if (for_emulator) {
        // In the emulator, export any kernel option with the "ro.kernel." prefix.
        property_set("ro.kernel." + key, value);
        return;
    }
    if (key == "qemu") {
        strlcpy(qemu, value.c_str(), sizeof(qemu));
    } else if (android::base::StartsWith(key, "androidboot.")) {
        property_set("ro.boot." + key.substr(12), value);
    }
}

socat tun

下载 
http://www.dest-unreach.org/socat/download/socat-1.7.3.2.tar.gz

socat_buildscript_for_android.sh

编译arm64版本,需要修改

ANDROID_NDK="/media/data/Android/android-ndk-r15c"

...

${ANDROID_NDK}/build/tools/make-standalone-toolchain.sh \
 --arch=arm64 \
 --toolchain=aarch64-linux-android \
 --platform=android-23 \
 --install-dir="${OUT}/toolchain" \
 || exit 1

...

${ROOT}/configure \
 --host \
 --disable-openssl \
 --disable-unix \
 CC="${OUT}/toolchain/bin/aarch64-linux-android-gcc -fPIE -pie " \
 || exit 1

测试

服务端 (pc debian buster x86_64)

socat -d -d UDP-LISTEN:1234,reuseaddr TUN:172.16.8.1/24,up


socat UDP:192.0.2.2:9000,bind=192.0.2.1:9000  TUN:10.0.1.1/24,tun-name=tundudp,iff-no-pi,tun-type=tun,iff-up

手机客户端 

 mkdir /dev/net
 ln -s /dev/tun /dev/net/tun

socat UDP:192.168.1.183:1234 TUN:172.16.8.2/24,up


socat UDP:192.0.2.1:9000,bind=192.0.2.2:9000  TUN:10.0.1.2/24,tun-name=tundudp,iff-no-pi,tun-type=tun,iff-up

手动添加ip rule

ip rule add prio 100 from all lookup 100
ip route add table 100 172.16.8.1 dev tun0

从手机上ping 服务器

ping 172.16.8.1

参考文章:
http://www.dest-unreach.org/socat/doc/socat-tun.html

Building TUN based virtual networks with socat

http://tinc_gui.poirsouille.org/
Lollipop uses several routing tables, depending on the available interfaces and/or users

android ip tuntap add不能使用的问题

# ip tuntap add  mode tun name tun0
open: No such file or directory

因为android对linux内核修改了, tun clone device在 /dev/tun

做个符号连接就可以了

# mkdir /dev/net
# ln -s /dev/tun /dev/net/tun

simpletun测试

服务端

# ip tuntap add  mode tun name tun0

# ip tuntap list
tun0: tun persist

# ip link set tun0 up

# ip addr add 172.16.8.1/24 dev tun0

运行
simpletun -i tun0 -s -p 1234 -u -d 

android客户端

ip tuntap add  mode tun name tun0

ip link set tun0 up
ip addr add 172.16.8.2/24 dev tun0

simpletun -i tun0  -c 192.168.1.183  -p  1234  -u -d

netd ndc 命令

# ndc ipfwd status
211 0 Forwarding disabled

# ndc ipfwd status
211 0 Forwarding enabled

# ndc interface list

# ndc interface getcfg wlan0
213 0 00:ec:0a:70:85:92 192.168.1.124 24 up broadcast running multicast

# ndc ipfwd add tun0 wlan0

# ndc nat enable rndis0 tun0

# ndc tether status
210 0 Tethering services started

# ndc tether interface list
111 0 rndis0
200 0 Tether operation succeeded

# ndc tether dns list
115 0 100
112 0 fd3b:fbcb:a1a::1
112 0 192.168.1.1
200 0 Tether operation succeeded

# ndc netd network route add

# iptables -S natctrl_FORWARD                                      
-N natctrl_FORWARD
-A natctrl_FORWARD -i wlan0 -o rndis0 -m state --state RELATED,ESTABLISHED -g natctrl_tether_counters
-A natctrl_FORWARD -i rndis0 -o wlan0 -m state --state INVALID -j DROP
-A natctrl_FORWARD -i rndis0 -o wlan0 -g natctrl_tether_counters
-A natctrl_FORWARD -j DROP


# iptables -S natctrl_nat_POSTROUTING -t nat                                                                                                                    
-N natctrl_nat_POSTROUTING
-A natctrl_nat_POSTROUTING -o wlan0 -j MASQUERADE

成功了

# ndc nat enable tun0 wlan0 1                                                                                                                                     
200 0 Nat operation succeeded


# iptables -S natctrl_nat_POSTROUTING -t nat                                                                                                                      
-N natctrl_nat_POSTROUTING
-A natctrl_nat_POSTROUTING -o wlan0 -j MASQUERADE


iptables -S natctrl_FORWARD                                                                                                                                     
-N natctrl_FORWARD
-A natctrl_FORWARD -i wlan0 -o tun0 -m state --state RELATED,ESTABLISHED -g natctrl_tether_counters
-A natctrl_FORWARD -i tun0 -o wlan0 -m state --state INVALID -j DROP
-A natctrl_FORWARD -i tun0 -o wlan0 -g natctrl_tether_counters
-A natctrl_FORWARD -j DROP

android netd RouteController

https://android.googlesource.com/platform/system/netd/+/refs/heads/master/server/RouteController.cpp

标记进入网络的包

iptables -t mangle -A routectrl_mangle_INPUT -i wlan0 -j MARK --set-mark 0x/0x  

这样, 内核可以
1)使用正确的fwmark(也因此能选择正确的路由) 来回复(TCP 复位, ICMP错误, ping回复, SYN确认等)
2)标记一些”接受从这个接口来的连接”的socket, 以便这些连接永远保持在同样的网络接口

调用关系
int PhysicalNetwork::addInterface(const std::string& interface)
RouteController::addInterfaceToPhysicalNetwork(mNetId, interface.c_str(), mPermission))
modifyPhysicalNetwork(netId, interface, permission, ACTION_ADD))
     getRouteTableForInterface
     modifyIncomingPacketMark
     modifyExplicitNetworkRule
     modifyOutputInterfaceRules


union Fwmark {
    uint32_t intValue;
    struct {
        unsigned netId          : 16;
        bool explicitlySelected :  1;
        bool protectedFromVpn   :  1;
        Permission permission   :  2;
        bool uidBillingDone     :  1;
    };
    Fwmark() : intValue(0) {}

    static inline uint32_t getUidBillingMask() {
        Fwmark m;
        m.uidBillingDone = true;
        return m.intValue;
    }

};





    fwmark.netId = netId;
    fwmark.explicitlySelected = true;
    fwmark.protectedFromVpn = true;
    fwmark.permission = permission;

     const uint32_t mask = ~Fwmark::getUidBillingMask();

vpn server route

0: from all lookup local
10000: from all fwmark 0xc0000/0xd0000 lookup legacy_system
10500: from all oif dummy0 uidrange 0-0 lookup dummy0
10500: from all oif rmnet_data0 uidrange 0-0 lookup rmnet_data0
10500: from all oif rmnet_data1 uidrange 0-0 lookup rmnet_data1
13000: from all fwmark 0x10063/0x1ffff lookup local_network
13000: from all fwmark 0x1000b/0x1ffff lookup rmnet_data0
13000: from all fwmark 0x10079/0x1ffff lookup rmnet_data1
14000: from all oif dummy0 lookup dummy0
14000: from all oif rmnet_data0 lookup rmnet_data0
14000: from all oif rmnet_data1 lookup rmnet_data1
15000: from all fwmark 0x0/0x10000 lookup legacy_system
16000: from all fwmark 0x0/0x10000 lookup legacy_network
17000: from all fwmark 0x0/0x10000 lookup local_network
19000: from all fwmark 0xb/0x1ffff lookup rmnet_data0
19000: from all fwmark 0x79/0x1ffff lookup rmnet_data1
22000: from all fwmark 0x0/0xffff lookup rmnet_data1
23000: from all fwmark 0x0/0xffff uidrange 0-0 lookup main
32000: from all unreachable

ip route show table rmnet_data1
default via 10.69.124.197 dev rmnet_data1 proto static
10.69.124.196/30 dev rmnet_data1 proto static scope link

ip route show table main
10.69.124.196/30 dev rmnet_data1 proto kernel scope link src 10.69.124.198

—————————————————–

0: from all lookup local
10000: from all fwmark 0xc0000/0xd0000 lookup legacy_system
10500: from all oif dummy0 uidrange 0-0 lookup dummy0
10500: from all oif rmnet_data0 uidrange 0-0 lookup rmnet_data0
10500: from all oif rmnet_data1 uidrange 0-0 lookup rmnet_data1

10500: from all oif rndis0 uidrange 0-0 lookup local_network

13000: from all fwmark 0x10063/0x1ffff lookup local_network
13000: from all fwmark 0x1000b/0x1ffff lookup rmnet_data0
13000: from all fwmark 0x10079/0x1ffff lookup rmnet_data1
14000: from all oif dummy0 lookup dummy0
14000: from all oif rmnet_data0 lookup rmnet_data0
14000: from all oif rmnet_data1 lookup rmnet_data1

14000: from all oif rndis0 lookup local_network

15000: from all fwmark 0x0/0x10000 lookup legacy_system
16000: from all fwmark 0x0/0x10000 lookup legacy_network
17000: from all fwmark 0x0/0x10000 lookup local_network

18000: from all iif rndis0 lookup rmnet_data1

19000: from all fwmark 0xb/0x1ffff lookup rmnet_data0
19000: from all fwmark 0x79/0x1ffff lookup rmnet_data1
22000: from all fwmark 0x0/0xffff lookup rmnet_data1
23000: from all fwmark 0x0/0xffff uidrange 0-0 lookup main
32000: from all unreachable

ip route show table main
10.69.124.196/30 dev rmnet_data1 proto kernel scope link src 10.69.124.198
192.168.42.0/24 dev rndis0 proto kernel scope link src 192.168.42.129 linkdown

———————————–

ip rule show

0: from all lookup local
10000: from all fwmark 0xc0000/0xd0000 lookup legacy_system
10500: from all oif dummy0 uidrange 0-0 lookup dummy0
10500: from all oif rmnet_data0 uidrange 0-0 lookup rmnet_data0
10500: from all oif rmnet_data1 uidrange 0-0 lookup rmnet_data1

10500: from all oif rndis0 uidrange 0-0 lookup local_network
11000: from all iif tun0 lookup local_network

12000: from all fwmark 0x0/0x20000 iif lo uidrange 0-99999 lookup tun0

12000: from all fwmark 0xc007a/0xcffff lookup tun0

13000: from all fwmark 0x10063/0x1ffff lookup local_network
13000: from all fwmark 0x1000b/0x1ffff lookup rmnet_data0
13000: from all fwmark 0x10079/0x1ffff lookup rmnet_data1

13000: from all fwmark 0x1007a/0x1ffff uidrange 0-99999 lookup tun0
13000: from all fwmark 0x1007a/0x1ffff uidrange 0-0 lookup tun0

14000: from all oif dummy0 lookup dummy0
14000: from all oif rmnet_data0 lookup rmnet_data0
14000: from all oif rmnet_data1 lookup rmnet_data1
14000: from all oif rndis0 lookup local_network
14000: from all oif tun0 uidrange 0-99999 lookup tun0
15000: from all fwmark 0x0/0x10000 lookup legacy_system
16000: from all fwmark 0x0/0x10000 lookup legacy_network
17000: from all fwmark 0x0/0x10000 lookup local_network

18000: from all iif rndis0 lookup rmnet_data1

19000: from all fwmark 0xb/0x1ffff lookup rmnet_data0
19000: from all fwmark 0x79/0x1ffff lookup rmnet_data1
21000: from all fwmark 0x7a/0x1ffff lookup rmnet_data1
22000: from all fwmark 0x0/0xffff lookup rmnet_data1
23000: from all fwmark 0x0/0xffff uidrange 0-0 lookup main
32000: from all unreachable

android ip route

ip rule show

ip rule show                                                                                                                                                  
0:	from all lookup local 
10000:	from all fwmark 0xc0000/0xd0000 lookup legacy_system 
10500:	from all oif dummy0 uidrange 0-0 lookup dummy0 
10500:	from all oif rmnet_data0 uidrange 0-0 lookup rmnet_data0 
13000:	from all fwmark 0x10063/0x1ffff lookup local_network 
13000:	from all fwmark 0x1000b/0x1ffff lookup rmnet_data0 
14000:	from all oif dummy0 lookup dummy0 
14000:	from all oif rmnet_data0 lookup rmnet_data0 
15000:	from all fwmark 0x0/0x10000 lookup legacy_system 
16000:	from all fwmark 0x0/0x10000 lookup legacy_network 
17000:	from all fwmark 0x0/0x10000 lookup local_network 
19000:	from all fwmark 0xb/0x1ffff lookup rmnet_data0 
23000:	from all fwmark 0x0/0xffff uidrange 0-0 lookup main 
32000:	from all unreachable

ip route show table 0

                                                                                                                                    
default dev dummy0  table dummy0  proto static  scope link 
broadcast 127.0.0.0 dev lo  table local  proto kernel  scope link  src 127.0.0.1 
local 127.0.0.0/8 dev lo  table local  proto kernel  scope host  src 127.0.0.1 
local 127.0.0.1 dev lo  table local  proto kernel  scope host  src 127.0.0.1 
broadcast 127.255.255.255 dev lo  table local  proto kernel  scope link  src 127.0.0.1 
fe80::/64 dev dummy0  table dummy0  proto kernel  metric 256  pref medium
default dev dummy0  table dummy0  proto static  metric 1024  pref medium
fe80::/64 dev rmnet_data0  table rmnet_data0  proto kernel  metric 256  mtu 2000 pref medium
default via fe80::5d6:b137:94a8:7216 dev rmnet_data0  table rmnet_data0  proto ra  metric 1024  expires 31452sec hoplimit 255 pref medium
local ::1 dev lo  table local  proto none  metric 0  pref medium
local fe80::96a:dd37:62a0:97 dev lo  table local  proto none  metric 0  pref medium
local fe80::1497:ebff:fed9:ea6d dev lo  table local  proto none  metric 0  pref medium
ff00::/8 dev dummy0  table local  metric 256  pref medium
ff00::/8 dev rmnet_data0  table local  metric 256  mtu 2000 pref medium

ip route show table dummy0

                                                                                                                 
default dev dummy0  proto static  scope link 

开启 wifi

0:	from all lookup local 
10000:	from all fwmark 0xc0000/0xd0000 lookup legacy_system 
10500:	from all oif dummy0 uidrange 0-0 lookup dummy0 
10500:	from all oif rmnet_data0 uidrange 0-0 lookup rmnet_data0 

10500:	from all oif wlan0 uidrange 0-0 lookup wlan0 

13000:	from all fwmark 0x10063/0x1ffff lookup local_network 
13000:	from all fwmark 0x1000b/0x1ffff lookup rmnet_data0 

13000:	from all fwmark 0x10074/0x1ffff lookup wlan0 

14000:	from all oif dummy0 lookup dummy0 
14000:	from all oif rmnet_data0 lookup rmnet_data0 

14000:	from all oif wlan0 lookup wlan0 

15000:	from all fwmark 0x0/0x10000 lookup legacy_system 
16000:	from all fwmark 0x0/0x10000 lookup legacy_network 
17000:	from all fwmark 0x0/0x10000 lookup local_network 
19000:	from all fwmark 0xb/0x1ffff lookup rmnet_data0 

19000:	from all fwmark 0x74/0x1ffff lookup wlan0 
22000:	from all fwmark 0x0/0xffff lookup wlan0 

23000:	from all fwmark 0x0/0xffff uidrange 0-0 lookup main 
32000:	from all unreachable

ip route show table wlan0

                                                                                                                                    
default via 192.168.1.1 dev wlan0  proto static 
192.168.1.0/24 dev wlan0  proto static  scope link 

ip route show table main

                                                                                                                                 
192.168.1.0/24 dev wlan0  proto kernel  scope link  src 192.168.1.155 

ip route show table 0

                                                                                                                                     
default via 192.168.1.1 dev wlan0  table wlan0  proto static 
192.168.1.0/24 dev wlan0  table wlan0  proto static  scope link 
default dev dummy0  table dummy0  proto static  scope link 
192.168.1.0/24 dev wlan0  proto kernel  scope link  src 192.168.1.155 
broadcast 127.0.0.0 dev lo  table local  proto kernel  scope link  src 127.0.0.1 
local 127.0.0.0/8 dev lo  table local  proto kernel  scope host  src 127.0.0.1 
local 127.0.0.1 dev lo  table local  proto kernel  scope host  src 127.0.0.1 
broadcast 127.255.255.255 dev lo  table local  proto kernel  scope link  src 127.0.0.1 
broadcast 192.168.1.0 dev wlan0  table local  proto kernel  scope link  src 192.168.1.155 
local 192.168.1.155 dev wlan0  table local  proto kernel  scope host  src 192.168.1.155 
broadcast 192.168.1.255 dev wlan0  table local  proto kernel  scope link  src 192.168.1.155 
fd3b:fbcb:a1a::/64 dev wlan0  table wlan0  proto kernel  metric 256  pref medium
fd3b:fbcb:a1a::/64 dev wlan0  table wlan0  proto static  metric 1024  pref medium
fd3b:fbcb:a1a::/48 via fe80::7aa3:51ff:fe35:9796 dev wlan0  table wlan0  proto ra  metric 1024  pref medium
fe80::/64 dev wlan0  table wlan0  proto kernel  metric 256  pref medium
fe80::/64 dev wlan0  table wlan0  proto static  metric 1024  pref medium
fe80::/64 dev dummy0  table dummy0  proto kernel  metric 256  pref medium
default dev dummy0  table dummy0  proto static  metric 1024  pref medium
fe80::/64 dev rmnet_data0  table rmnet_data0  proto kernel  metric 256  mtu 2000 pref medium
default via fe80::5d6:b137:94a8:7216 dev rmnet_data0  table rmnet_data0  proto ra  metric 1024  expires 31174sec hoplimit 255 pref medium
local ::1 dev lo  table local  proto none  metric 0  pref medium
local fd3b:fbcb:a1a:0:5d79:cfb8:a788:dea4 dev lo  table local  proto none  metric 0  pref medium
local fd3b:fbcb:a1a:0:80d5:910b:2d8f:1d86 dev lo  table local  proto none  metric 0  pref medium
local fe80::96a:dd37:62a0:97 dev lo  table local  proto none  metric 0  pref medium
local fe80::1497:ebff:fed9:ea6d dev lo  table local  proto none  metric 0  pref medium
local fe80::35a4:2e6c:d297:6c0a dev lo  table local  proto none  metric 0  pref medium
ff00::/8 dev dummy0  table local  metric 256  pref medium
ff00::/8 dev rmnet_data0  table local  metric 256  mtu 2000 pref medium
ff00::/8 dev wlan0  table local  metric 256  pref medium

开启VPN后
ip rule show


0:	from all lookup local 
10000:	from all fwmark 0xc0000/0xd0000 lookup legacy_system 
10500:	from all oif dummy0 uidrange 0-0 lookup dummy0 
10500:	from all oif rmnet_data0 uidrange 0-0 lookup rmnet_data0 
10500:	from all oif wlan0 uidrange 0-0 lookup wlan0 
11000:	from all iif tun0 lookup local_network 

12000:	from all fwmark 0x0/0x20000 iif lo uidrange 0-99999 lookup tun0 
12000:	from all fwmark 0xc0077/0xcffff lookup tun0 

13000:	from all fwmark 0x10063/0x1ffff lookup local_network 
13000:	from all fwmark 0x1000b/0x1ffff lookup rmnet_data0 
13000:	from all fwmark 0x10076/0x1ffff lookup wlan0 

13000:	from all fwmark 0x10077/0x1ffff uidrange 0-99999 lookup tun0 
13000:	from all fwmark 0x10077/0x1ffff uidrange 0-0 lookup tun0 

14000:	from all oif dummy0 lookup dummy0 
14000:	from all oif rmnet_data0 lookup rmnet_data0 
14000:	from all oif wlan0 lookup wlan0 

14000:	from all oif tun0 uidrange 0-99999 lookup tun0 

15000:	from all fwmark 0x0/0x10000 lookup legacy_system 
16000:	from all fwmark 0x0/0x10000 lookup legacy_network 
17000:	from all fwmark 0x0/0x10000 lookup local_network 
19000:	from all fwmark 0xb/0x1ffff lookup rmnet_data0 
19000:	from all fwmark 0x76/0x1ffff lookup wlan0 
21000:	from all fwmark 0x77/0x1ffff lookup wlan0 
22000:	from all fwmark 0x0/0xffff lookup wlan0 
23000:	from all fwmark 0x0/0xffff uidrange 0-0 lookup main 
32000:	from all unreachable

ip route show table main

                                                                                                                                 
172.16.8.0/24 dev tun0  proto kernel  scope link  src 172.16.8.9 
192.168.1.0/24 dev wlan0  proto kernel  scope link  src 192.168.1.155 

ip route show table tun0

                                                                                                                                    
default dev tun0  proto static  scope link 
8.8.0.0/16 dev tun0  proto static  scope link 
172.16.8.0/24 dev tun0  proto static  scope link 

ip route show table wlan0

                                                                                                                                  
default via 192.168.1.1 dev wlan0  proto static 
192.168.1.0/24 dev wlan0  proto static  scope link

ip route show table 0

default via 192.168.1.1 dev wlan0  table wlan0  proto static 
192.168.1.0/24 dev wlan0  table wlan0  proto static  scope link 

default dev tun0  table tun0  proto static  scope link 
8.8.0.0/16 dev tun0  table tun0  proto static  scope link 
172.16.8.0/24 dev tun0  table tun0  proto static  scope link 

default dev dummy0  table dummy0  proto static  scope link 
172.16.8.0/24 dev tun0  proto kernel  scope link  src 172.16.8.9 
192.168.1.0/24 dev wlan0  proto kernel  scope link  src 192.168.1.155 
broadcast 127.0.0.0 dev lo  table local  proto kernel  scope link  src 127.0.0.1 
local 127.0.0.0/8 dev lo  table local  proto kernel  scope host  src 127.0.0.1 
local 127.0.0.1 dev lo  table local  proto kernel  scope host  src 127.0.0.1 
broadcast 127.255.255.255 dev lo  table local  proto kernel  scope link  src 127.0.0.1 
broadcast 172.16.8.0 dev tun0  table local  proto kernel  scope link  src 172.16.8.9 
local 172.16.8.9 dev tun0  table local  proto kernel  scope host  src 172.16.8.9 
broadcast 172.16.8.255 dev tun0  table local  proto kernel  scope link  src 172.16.8.9 
broadcast 192.168.1.0 dev wlan0  table local  proto kernel  scope link  src 192.168.1.155 
local 192.168.1.155 dev wlan0  table local  proto kernel  scope host  src 192.168.1.155 
broadcast 192.168.1.255 dev wlan0  table local  proto kernel  scope link  src 192.168.1.155 
fd3b:fbcb:a1a::/64 dev wlan0  table wlan0  proto kernel  metric 256  pref medium
fd3b:fbcb:a1a::/64 dev wlan0  table wlan0  proto static  metric 1024  pref medium
fd3b:fbcb:a1a::/48 via fe80::7aa3:51ff:fe35:9796 dev wlan0  table wlan0  proto ra  metric 1024  pref medium
fe80::/64 dev wlan0  table wlan0  proto kernel  metric 256  pref medium
fe80::/64 dev wlan0  table wlan0  proto static  metric 1024  pref medium
unreachable default dev lo  table tun0  proto static  metric 1024  error -113 pref medium
fe80::/64 dev dummy0  table dummy0  proto kernel  metric 256  pref medium
default dev dummy0  table dummy0  proto static  metric 1024  pref medium
fe80::/64 dev rmnet_data0  table rmnet_data0  proto kernel  metric 256  mtu 2000 pref medium
default via fe80::5d6:b137:94a8:7216 dev rmnet_data0  table rmnet_data0  proto ra  metric 1024  expires 30405sec hoplimit 255 pref medium
local ::1 dev lo  table local  proto none  metric 0  pref medium
local fd3b:fbcb:a1a:0:5d79:cfb8:a788:dea4 dev lo  table local  proto none  metric 0  pref medium
local fd3b:fbcb:a1a:0:80d5:910b:2d8f:1d86 dev lo  table local  proto none  metric 0  pref medium
local fe80::96a:dd37:62a0:97 dev lo  table local  proto none  metric 0  pref medium
local fe80::1497:ebff:fed9:ea6d dev lo  table local  proto none  metric 0  pref medium
local fe80::35a4:2e6c:d297:6c0a dev lo  table local  proto none  metric 0  pref medium
ff00::/8 dev dummy0  table local  metric 256  pref medium
ff00::/8 dev rmnet_data0  table local  metric 256  mtu 2000 pref medium
ff00::/8 dev wlan0  table local  metric 256  pref medium

android hal

andorid HAL

LSHAL
LSHAL 是一种设备端工具,可以列出向 hwservicemanager 注册的所有 HAL 以及设备上所有可用的直通实现(例如 android.hardware.foo@1.0-impl.so)。它还可以根据该列表生成设备清单文件:

adb shell su 0 /system/bin/lshal –init-vintf

xml

# lshal
All binderized services (registered services through hwservicemanager)
Interface                                                                       	Thread Use	Server	Clients
android.frameworks.displayservice@1.0::IDisplayService/default                  	N/A     	N/A  	
android.frameworks.schedulerservice@1.0::ISchedulingPolicyService/default       	N/A     	N/A  	
android.frameworks.sensorservice@1.0::ISensorManager/default                    	N/A     	N/A  	
android.hardware.audio.effect@2.0::IEffectsFactory/default                      	N/A     	N/A  	
android.hardware.audio@2.0::IDevicesFactory/default                             	N/A     	N/A  	
android.hardware.biometrics.fingerprint@2.1::IBiometricsFingerprint/default     	N/A     	N/A  	
android.hardware.bluetooth@1.0::IBluetoothHci/default                           	N/A     	N/A  	
android.hardware.camera.provider@2.4::ICameraProvider/legacy/0                  	N/A     	N/A  	
android.hardware.cas@1.0::IMediaCasService/default                              	N/A     	N/A  	
android.hardware.configstore@1.0::ISurfaceFlingerConfigs/default                	N/A     	N/A  	
android.hardware.drm@1.0::ICryptoFactory/default                                	N/A     	N/A  	
android.hardware.drm@1.0::ICryptoFactory/widevine                               	N/A     	N/A  	
android.hardware.drm@1.0::IDrmFactory/default                                   	N/A     	N/A  	
android.hardware.drm@1.0::IDrmFactory/widevine                                  	N/A     	N/A  	
android.hardware.gatekeeper@1.0::IGatekeeper/default                            	N/A     	N/A  	
android.hardware.gnss@1.0::IGnss/default                                        	N/A     	N/A  	
android.hardware.gnss@1.0::IGnss/gnss_vendor                                    	N/A     	N/A  	
android.hardware.graphics.allocator@2.0::IAllocator/default                     	N/A     	N/A  	
android.hardware.graphics.composer@2.1::IComposer/default                       	N/A     	N/A  	
android.hardware.health@1.0::IHealth/default                                    	N/A     	N/A  	
android.hardware.keymaster@3.0::IKeymasterDevice/default                        	N/A     	N/A  	
android.hardware.light@2.0::ILight/default                                      	N/A     	N/A  	
android.hardware.media.omx@1.0::IOmx/default                                    	N/A     	N/A  	
android.hardware.media.omx@1.0::IOmxStore/default                               	N/A     	N/A  	
android.hardware.memtrack@1.0::IMemtrack/default                                	N/A     	N/A  	
android.hardware.nfc@1.0::INfc/default                                          	N/A     	N/A  	
android.hardware.power@1.0::IPower/default                                      	N/A     	N/A  	
android.hardware.radio.deprecated@1.0::IOemHook/slot1                           	N/A     	N/A  	
android.hardware.radio.deprecated@1.0::IOemHook/slot2                           	N/A     	N/A  	
android.hardware.radio@1.0::IRadio/slot1                                        	N/A     	N/A  	
android.hardware.radio@1.0::IRadio/slot2                                        	N/A     	N/A  	
android.hardware.radio@1.0::ISap/slot1                                          	N/A     	N/A  	
android.hardware.radio@1.0::ISap/slot2                                          	N/A     	N/A  	
android.hardware.radio@1.1::IRadio/slot1                                        	N/A     	N/A  	
android.hardware.radio@1.1::IRadio/slot2                                        	N/A     	N/A  	
android.hardware.radio@1.1::ISap/slot1                                          	N/A     	N/A  	
android.hardware.radio@1.1::ISap/slot2                                          	N/A     	N/A  	
android.hardware.sensors@1.0::ISensors/default                                  	N/A     	N/A  	
android.hardware.soundtrigger@2.0::ISoundTriggerHw/default                      	N/A     	N/A  	
android.hardware.tetheroffload.config@1.0::IOffloadConfig/default               	N/A     	N/A  	
android.hardware.tetheroffload.control@1.0::IOffloadControl/default             	N/A     	N/A  	
android.hardware.thermal@1.0::IThermal/default                                  	N/A     	N/A  	
android.hardware.usb@1.0::IUsb/default                                          	N/A     	N/A  	
android.hardware.vibrator@1.0::IVibrator/default                                	N/A     	N/A  	
android.hardware.vr@1.0::IVr/default                                            	N/A     	N/A  	
android.hardware.wifi.supplicant@1.0::ISupplicant/default                       	N/A     	N/A  	
android.hardware.wifi@1.0::IWifi/default                                        	N/A     	N/A  	
android.hardware.wifi@1.1::IWifi/default                                        	N/A     	N/A  	
android.hidl.allocator@1.0::IAllocator/ashmem                                   	N/A     	N/A  	
android.hidl.base@1.0::IBase/Uim0                                               	N/A     	N/A  	
android.hidl.base@1.0::IBase/Uim1                                               	N/A     	N/A  	
android.hidl.base@1.0::IBase/UimLpa0                                            	N/A     	N/A  	
android.hidl.base@1.0::IBase/ashmem                                             	N/A     	N/A  	
android.hidl.base@1.0::IBase/cnd                                                	N/A     	N/A  	
android.hidl.base@1.0::IBase/default                                            	N/A     	N/A  	
android.hidl.base@1.0::IBase/dpmQmiService                                      	N/A     	N/A  	
android.hidl.base@1.0::IBase/gnss_vendor                                        	N/A     	N/A  	
android.hidl.base@1.0::IBase/imsradio0                                          	N/A     	N/A  	
android.hidl.base@1.0::IBase/imsradio1                                          	N/A     	N/A  	
android.hidl.base@1.0::IBase/imsrtpservice                                      	N/A     	N/A  	
android.hidl.base@1.0::IBase/legacy/0                                           	N/A     	N/A  	
android.hidl.base@1.0::IBase/oemhook0                                           	N/A     	N/A  	
android.hidl.base@1.0::IBase/oemhook1                                           	N/A     	N/A  	
android.hidl.base@1.0::IBase/slot1                                              	N/A     	N/A  	
android.hidl.base@1.0::IBase/slot2                                              	N/A     	N/A  	
android.hidl.base@1.0::IBase/uimRemoteClient0                                   	N/A     	N/A  	
android.hidl.base@1.0::IBase/uimRemoteClient1                                   	N/A     	N/A  	
android.hidl.base@1.0::IBase/uimRemoteServer0                                   	N/A     	N/A  	
android.hidl.base@1.0::IBase/uimRemoteServer1                                   	N/A     	N/A  	
android.hidl.base@1.0::IBase/widevine                                           	N/A     	N/A  	
android.hidl.manager@1.0::IServiceManager/default                               	N/A     	N/A  	
android.hidl.manager@1.1::IServiceManager/default                               	N/A     	N/A  	
android.hidl.token@1.0::ITokenManager/default                                   	N/A     	N/A  	
android.system.net.netd@1.0::INetd/default                                      	N/A     	N/A  	
android.system.wifi.keystore@1.0::IKeystore/default                             	N/A     	N/A  	
com.qualcomm.qti.ant@1.0::IAntHci/default                                       	N/A     	N/A  	
com.qualcomm.qti.bluetooth_audio@1.0::IBluetoothAudio/default                   	N/A     	N/A  	
com.qualcomm.qti.dpm.api@1.0::IdpmQmi/dpmQmiService                             	N/A     	N/A  	
com.quicinc.cne.api@1.0::IApiService/cnd                                        	N/A     	N/A  	
com.quicinc.cne.server@2.0::IServer/cnd                                         	N/A     	N/A  	
vendor.display.color@1.0::IDisplayColor/default                                 	N/A     	N/A  	
vendor.display.config@1.0::IDisplayConfig/default                               	N/A     	N/A  	
vendor.display.postproc@1.0::IDisplayPostproc/default                           	N/A     	N/A  	
vendor.nxp.nxpnfc@1.0::INxpNfc/default                                          	N/A     	N/A  	
vendor.oneplus.hardware.wifi@1.0::IOneplusWifi/default                          	N/A     	N/A  	
vendor.qti.esepowermanager@1.0::IEsePowerManager/default                        	N/A     	N/A  	
vendor.qti.gnss@1.0::ILocHidlGnss/gnss_vendor                                   	N/A     	N/A  	
vendor.qti.hardware.data.latency@1.0::ILinkLatency/default                      	N/A     	N/A  	
vendor.qti.hardware.fm@1.0::IFmHci/default                                      	N/A     	N/A  	
vendor.qti.hardware.perf@1.0::IPerf/default                                     	N/A     	N/A  	
vendor.qti.hardware.qdutils_disp@1.0::IQdutilsDisp/default                      	N/A     	N/A  	
vendor.qti.hardware.qteeconnector@1.0::IAppConnector/default                    	N/A     	N/A  	
vendor.qti.hardware.qteeconnector@1.0::IGPAppConnector/default                  	N/A     	N/A  	
vendor.qti.hardware.radio.am@1.0::IQcRilAudio/slot1                             	N/A     	N/A  	
vendor.qti.hardware.radio.am@1.0::IQcRilAudio/slot2                             	N/A     	N/A  	
vendor.qti.hardware.radio.ims@1.0::IImsRadio/imsradio0                          	N/A     	N/A  	
vendor.qti.hardware.radio.ims@1.0::IImsRadio/imsradio1                          	N/A     	N/A  	
vendor.qti.hardware.radio.lpa@1.0::IUimLpa/UimLpa0                              	N/A     	N/A  	
vendor.qti.hardware.radio.qcrilhook@1.0::IQtiOemHook/oemhook0                   	N/A     	N/A  	
vendor.qti.hardware.radio.qcrilhook@1.0::IQtiOemHook/oemhook1                   	N/A     	N/A  	
vendor.qti.hardware.radio.qtiradio@1.0::IQtiRadio/slot1                         	N/A     	N/A  	
vendor.qti.hardware.radio.qtiradio@1.0::IQtiRadio/slot2                         	N/A     	N/A  	
vendor.qti.hardware.radio.uim@1.0::IUim/Uim0                                    	N/A     	N/A  	
vendor.qti.hardware.radio.uim@1.0::IUim/Uim1                                    	N/A     	N/A  	
vendor.qti.hardware.radio.uim_remote_client@1.0::IUimRemoteServiceClient/uimRemoteClient0	N/A     	N/A  	
vendor.qti.hardware.radio.uim_remote_client@1.0::IUimRemoteServiceClient/uimRemoteClient1	N/A     	N/A  	
vendor.qti.hardware.radio.uim_remote_server@1.0::IUimRemoteServiceServer/uimRemoteServer0	N/A     	N/A  	
vendor.qti.hardware.radio.uim_remote_server@1.0::IUimRemoteServiceServer/uimRemoteServer1	N/A     	N/A  	
vendor.qti.hardware.tui_comm@1.0::ITuiComm/default                              	N/A     	N/A  	
vendor.qti.hardware.wifi.keystore@1.0::IKeystoreExt/default                     	N/A     	N/A  	
vendor.qti.imsrtpservice@1.0::IRTPService/imsrtpservice                         	N/A     	N/A  	

All interfaces that getService() has ever return as a passthrough interface;
PIDs / processes shown below might be inaccurate because the process
might have relinquished the interface or might have died.
The Server / Server CMD column can be ignored.
The Clients / Clients CMD column shows all process that have ever dlopen'ed 
the library and successfully fetched the passthrough implementation.
Interface                                                                       	Thread Use	Server	Clients
android.hardware.audio.effect@2.0::IEffectsFactory/default                      	N/A     	794  	794
android.hardware.audio@2.0::IDevicesFactory/default                             	N/A     	794  	794
android.hardware.bluetooth@1.0::IBluetoothHci/default                           	N/A     	795  	795
android.hardware.camera.provider@2.4::ICameraProvider/legacy/0                  	N/A     	796  	796
android.hardware.drm@1.0::ICryptoFactory/default                                	N/A     	799  	799
android.hardware.drm@1.0::IDrmFactory/default                                   	N/A     	799  	799
android.hardware.gatekeeper@1.0::IGatekeeper/default                            	N/A     	801  	801
android.hardware.gnss@1.0::IGnss/default                                        	N/A     	818  	818
android.hardware.graphics.allocator@2.0::IAllocator/default                     	N/A     	802  	802
android.hardware.graphics.composer@2.1::IComposer/default                       	N/A     	803  	803
android.hardware.graphics.mapper@2.0::IMapper/default                           	N/A     	N/A  	803 838 947 1446 2560 2575 3425 5432 5710 7612 8568 11210 13730 15194 25175 27603 27627 27819
android.hardware.health@1.0::IHealth/default                                    	N/A     	804  	804
android.hardware.keymaster@3.0::IKeymasterDevice/default                        	N/A     	639  	639
android.hardware.light@2.0::ILight/default                                      	N/A     	805  	805
android.hardware.memtrack@1.0::IMemtrack/default                                	N/A     	806  	806
android.hardware.nfc@1.0::INfc/default                                          	N/A     	815  	815
android.hardware.power@1.0::IPower/default                                      	N/A     	807  	807
android.hardware.sensors@1.0::ISensors/default                                  	N/A     	808  	808
android.hardware.soundtrigger@2.0::ISoundTriggerHw/default                      	N/A     	794  	794
android.hardware.thermal@1.0::IThermal/default                                  	N/A     	809  	809
android.hardware.vibrator@1.0::IVibrator/default                                	N/A     	811  	811
android.hardware.vr@1.0::IVr/default                                            	N/A     	812  	812
android.hidl.memory@1.0::IMapper/ashmem                                         	N/A     	N/A  	932 941 947 1446 2575 3243 5710 11210
com.qualcomm.qti.ant@1.0::IAntHci/default                                       	N/A     	795  	795
com.qualcomm.qti.bluetooth_audio@1.0::IBluetoothAudio/default                   	N/A     	794  	794
vendor.nxp.nxpnfc@1.0::INxpNfc/default                                          	N/A     	815  	815
vendor.qti.esepowermanager@1.0::IEsePowerManager/default                        	N/A     	817  	817
vendor.qti.gnss@1.0::ILocHidlGnss/gnss_vendor                                   	N/A     	818  	818
vendor.qti.hardware.fm@1.0::IFmHci/default                                      	N/A     	795  	795
vendor.qti.hardware.iop@1.0::IIop/default                                       	N/A     	1446 	1446
vendor.qti.hardware.qteeconnector@1.0::IAppConnector/default                    	N/A     	821  	821
vendor.qti.hardware.qteeconnector@1.0::IGPAppConnector/default                  	N/A     	821  	821

All available passthrough implementations (all -impl.so files)
Interface                                                                       	Thread Use	Server	Clients
android.hardware.audio.effect@2.0::I*/* (/vendor/lib/hw/)                       	N/A     	N/A  	
android.hardware.audio.effect@2.0::I*/* (/vendor/lib64/hw/)                     	N/A     	N/A  	
android.hardware.audio@2.0::I*/* (/vendor/lib/hw/)                              	N/A     	N/A  	
android.hardware.audio@2.0::I*/* (/vendor/lib64/hw/)                            	N/A     	N/A  	
android.hardware.bluetooth@1.0::I*/* (/vendor/lib/hw/) (-qti)                   	N/A     	N/A  	
android.hardware.bluetooth@1.0::I*/* (/vendor/lib64/hw/) (-qti)                 	N/A     	N/A  	
android.hardware.broadcastradio@1.0::I*/* (/vendor/lib/hw/)                     	N/A     	N/A  	
android.hardware.broadcastradio@1.0::I*/* (/vendor/lib64/hw/)                   	N/A     	N/A  	
android.hardware.camera.provider@2.4::I*/* (/vendor/lib/hw/)                    	N/A     	N/A  	
android.hardware.camera.provider@2.4::I*/* (/vendor/lib64/hw/)                  	N/A     	N/A  	
android.hardware.drm@1.0::I*/* (/vendor/lib/hw/)                                	N/A     	N/A  	
android.hardware.gatekeeper@1.0::I*/* (/vendor/lib/hw/)                         	N/A     	N/A  	
android.hardware.gatekeeper@1.0::I*/* (/vendor/lib64/hw/)                       	N/A     	N/A  	
android.hardware.gnss@1.0::I*/* (/vendor/lib/hw/) (-qti)                        	N/A     	N/A  	
android.hardware.gnss@1.0::I*/* (/vendor/lib64/hw/) (-qti)                      	N/A     	N/A  	
android.hardware.graphics.allocator@2.0::I*/* (/vendor/lib/hw/)                 	N/A     	N/A  	
android.hardware.graphics.allocator@2.0::I*/* (/vendor/lib64/hw/)               	N/A     	N/A  	
android.hardware.graphics.composer@2.1::I*/* (/vendor/lib/hw/)                  	N/A     	N/A  	
android.hardware.graphics.composer@2.1::I*/* (/vendor/lib64/hw/)                	N/A     	N/A  	
android.hardware.graphics.mapper@2.0::I*/* (/vendor/lib/hw/)                    	N/A     	N/A  	
android.hardware.graphics.mapper@2.0::I*/* (/vendor/lib64/hw/)                  	N/A     	N/A  	
android.hardware.health@1.0::I*/* (/vendor/lib/hw/)                             	N/A     	N/A  	
android.hardware.health@1.0::I*/* (/vendor/lib64/hw/)                           	N/A     	N/A  	
android.hardware.keymaster@3.0::I*/* (/vendor/lib/hw/)                          	N/A     	N/A  	
android.hardware.keymaster@3.0::I*/* (/vendor/lib64/hw/)                        	N/A     	N/A  	
android.hardware.light@2.0::I*/* (/vendor/lib/hw/)                              	N/A     	N/A  	
android.hardware.light@2.0::I*/* (/vendor/lib64/hw/)                            	N/A     	N/A  	
android.hardware.memtrack@1.0::I*/* (/vendor/lib/hw/)                           	N/A     	N/A  	
android.hardware.memtrack@1.0::I*/* (/vendor/lib64/hw/)                         	N/A     	N/A  	
android.hardware.nfc@1.0::I*/* (/vendor/lib/hw/)                                	N/A     	N/A  	
android.hardware.nfc@1.0::I*/* (/vendor/lib64/hw/)                              	N/A     	N/A  	
android.hardware.power@1.0::I*/* (/vendor/lib/hw/)                              	N/A     	N/A  	
android.hardware.power@1.0::I*/* (/vendor/lib64/hw/)                            	N/A     	N/A  	
android.hardware.renderscript@1.0::I*/* (/vendor/lib/hw/)                       	N/A     	N/A  	
android.hardware.renderscript@1.0::I*/* (/vendor/lib64/hw/)                     	N/A     	N/A  	
android.hardware.sensors@1.0::I*/* (/vendor/lib/hw/)                            	N/A     	N/A  	
android.hardware.sensors@1.0::I*/* (/vendor/lib64/hw/)                          	N/A     	N/A  	
android.hardware.soundtrigger@2.0::I*/* (/vendor/lib/hw/)                       	N/A     	N/A  	
android.hardware.tests.libhwbinder@1.0::I*/* (/system/lib/hw/)                  	N/A     	N/A  	
android.hardware.tests.libhwbinder@1.0::I*/* (/system/lib64/hw/)                	N/A     	N/A  	
android.hardware.thermal@1.0::I*/* (/vendor/lib/hw/)                            	N/A     	N/A  	
android.hardware.thermal@1.0::I*/* (/vendor/lib64/hw/)                          	N/A     	N/A  	
android.hardware.vibrator@1.0::I*/* (/vendor/lib/hw/)                           	N/A     	N/A  	
android.hardware.vibrator@1.0::I*/* (/vendor/lib64/hw/)                         	N/A     	N/A  	
android.hardware.vr@1.0::I*/* (/vendor/lib/hw/)                                 	N/A     	N/A  	
android.hardware.vr@1.0::I*/* (/vendor/lib64/hw/)                               	N/A     	N/A  	
android.hidl.memory@1.0::I*/* (/system/lib/hw/)                                 	N/A     	N/A  	932 941 947 5710
android.hidl.memory@1.0::I*/* (/system/lib64/hw/)                               	N/A     	N/A  	1446 2575 3243 11210
com.qualcomm.qti.ant@1.0::I*/* (/vendor/lib/hw/)                                	N/A     	N/A  	
com.qualcomm.qti.ant@1.0::I*/* (/vendor/lib64/hw/)                              	N/A     	N/A  	
com.qualcomm.qti.bluetooth_audio@1.0::I*/* (/vendor/lib/hw/)                    	N/A     	N/A  	
com.qualcomm.qti.bluetooth_audio@1.0::I*/* (/vendor/lib64/hw/)                  	N/A     	N/A  	
vendor.nxp.nxpnfc@1.0::I*/* (/vendor/lib/hw/)                                   	N/A     	N/A  	
vendor.nxp.nxpnfc@1.0::I*/* (/vendor/lib64/hw/)                                 	N/A     	N/A  	
vendor.qti.esepowermanager@1.0::I*/* (/vendor/lib/hw/)                          	N/A     	N/A  	
vendor.qti.esepowermanager@1.0::I*/* (/vendor/lib64/hw/)                        	N/A     	N/A  	
vendor.qti.gnss@1.0::I*/* (/vendor/lib/hw/)                                     	N/A     	N/A  	
vendor.qti.gnss@1.0::I*/* (/vendor/lib64/hw/)                                   	N/A     	N/A  	
vendor.qti.hardware.fm@1.0::I*/* (/vendor/lib/hw/)                              	N/A     	N/A  	
vendor.qti.hardware.fm@1.0::I*/* (/vendor/lib64/hw/)                            	N/A     	N/A  	
vendor.qti.hardware.iop@1.0::I*/* (/vendor/lib/hw/)                             	N/A     	N/A  	
vendor.qti.hardware.iop@1.0::I*/* (/vendor/lib64/hw/)                           	N/A     	N/A  	
vendor.qti.hardware.qteeconnector@1.0::I*/* (/vendor/lib/hw/)                   	N/A     	N/A  	
vendor.qti.hardware.qteeconnector@1.0::I*/* (/vendor/lib64/hw/)                 	N/A     	N/A  	

Android HIDL and Project Treble

编写客户端要使用该服务,我们将编写一个简单的客户端应用程序 通常,它将成为Google编写的Android框架的一部分。 例如,如果通用框架想要访问振动器服务:在文件框架/ base / services / core / jni / com_android_server_VibratorService.cpp中

static sp mHal;
 
...
 
mHal = IVibrator::getService();
...
Status retStatus = mHal->on(timeout_ms);
...
Status retStatus = mHal->off();