1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
|
This file tries to document all requests a client can make
to the ADB server of an adbd daemon. See the OVERVIEW.TXT document
to understand what's going on here.
HOST SERVICES:
host:version
Ask the ADB server for its internal version number.
As a special exception, the server will respond with a 4-byte
hex string corresponding to its internal version number, without
any OKAY or FAIL.
host:kill
Ask the ADB server to quit immediately. This is used when the
ADB client detects that an obsolete server is running after an
upgrade.
host:devices
host:devices-l
Ask to return the list of available Android devices and their
state. devices-l includes the device paths in the state.
After the OKAY, this is followed by a 4-byte hex len,
and a string that will be dumped as-is by the client, then
the connection is closed
host:track-devices
This is a variant of host:devices which doesn't close the
connection. Instead, a new device list description is sent
each time a device is added/removed or the state of a given
device changes (hex4 + content). This allows tools like DDMS
to track the state of connected devices in real-time without
polling the server repeatedly.
host:emulator:<port>
This is a special query that is sent to the ADB server when a
new emulator starts up. <port> is a decimal number corresponding
to the emulator's ADB control port, i.e. the TCP port that the
emulator will forward automatically to the adbd daemon running
in the emulator system.
This mechanism allows the ADB server to know when new emulator
instances start.
host:transport:<serial-number>
Ask to switch the connection to the device/emulator identified by
<serial-number>. After the OKAY response, every client request will
be sent directly to the adbd daemon running on the device.
(Used to implement the -s option)
host:transport-usb
Ask to switch the connection to one device connected through USB
to the host machine. This will fail if there are more than one such
devices. (Used to implement the -d convenience option)
host:transport-local
Ask to switch the connection to one emulator connected through TCP.
This will fail if there is more than one such emulator instance
running. (Used to implement the -e convenience option)
host:transport-any
Another host:transport variant. Ask to switch the connection to
either the device or emulator connect to/running on the host.
Will fail if there is more than one such device/emulator available.
(Used when neither -s, -d or -e are provided)
host-serial:<serial-number>:<request>
This is a special form of query, where the 'host-serial:<serial-number>:'
prefix can be used to indicate that the client is asking the ADB server
for information related to a specific device. <request> can be in one
of the format described below.
host-usb:<request>
A variant of host-serial used to target the single USB device connected
to the host. This will fail if there is none or more than one.
host-local:<request>
A variant of host-serial used to target the single emulator instance
running on the host. This will fail if there is none or more than one.
host:<request>
When asking for information related to a device, 'host:' can also be
interpreted as 'any single device or emulator connected to/running on
the host'.
<host-prefix>:get-product
XXX
<host-prefix>:get-serialno
Returns the serial number of the corresponding device/emulator.
Note that emulator serial numbers are of the form "emulator-5554"
<host-prefix>:get-devpath
Returns the device path of the corresponding device/emulator.
<host-prefix>:get-state
Returns the state of a given device as a string.
<host-prefix>:forward:<local>;<remote>
Asks the ADB server to forward local connections from <local>
to the <remote> address on a given device.
There, <host-prefix> can be one of the
host-serial/host-usb/host-local/host prefixes as described previously
and indicates which device/emulator to target.
the format of <local> is one of:
tcp:<port> -> TCP connection on localhost:<port>
local:<path> -> Unix local domain socket on <path>
the format of <remote> is one of:
tcp:<port> -> TCP localhost:<port> on device
local:<path> -> Unix local domain socket on device
jdwp:<pid> -> JDWP thread on VM process <pid>
or even any one of the local services described below.
<host-prefix>:forward:norebind:<local>;<remote>
Same as <host-prefix>:forward:<local>;<remote> except that it will
fail it there is already a forward connection from <local>.
Used to implement 'adb forward --no-rebind <local> <remote>'
<host-prefix>:killforward:<local>
Remove any existing forward local connection from <local>.
This is used to implement 'adb forward --remove <local>'
<host-prefix>:killforward-all
Remove all forward network connections.
This is used to implement 'adb forward --remove-all'.
<host-prefix>:list-forward
List all existing forward connections from this server.
This returns something that looks like the following:
<hex4>: The length of the payload, as 4 hexadecimal chars.
<payload>: A series of lines of the following format:
<serial> " " <local> " " <remote> "\n"
Where <serial> is a device serial number.
<local> is the host-specific endpoint (e.g. tcp:9000).
<remote> is the device-specific endpoint.
Used to implement 'adb forward --list'.
LOCAL SERVICES:
All the queries below assumed that you already switched the transport
to a real device, or that you have used a query prefix as described
above.
shell:command arg1 arg2 ...
Run 'command arg1 arg2 ...' in a shell on the device, and return
its output and error streams. Note that arguments must be separated
by spaces. If an argument contains a space, it must be quoted with
double-quotes. Arguments cannot contain double quotes or things
will go very wrong.
Note that this is the non-interactive version of "adb shell"
shell:
Start an interactive shell session on the device. Redirect
stdin/stdout/stderr as appropriate. Note that the ADB server uses
this to implement "adb shell", but will also cook the input before
sending it to the device (see interactive_shell() in commandline.c)
remount:
Ask adbd to remount the device's filesystem in read-write mode,
instead of read-only. This is usually necessary before performing
an "adb sync" or "adb push" request.
This request may not succeed on certain builds which do not allow
that.
dev:<path>
Opens a device file and connects the client directly to it for
read/write purposes. Useful for debugging, but may require special
privileges and thus may not run on all devices. <path> is a full
path from the root of the filesystem.
tcp:<port>
Tries to connect to tcp port <port> on localhost.
tcp:<port>:<server-name>
Tries to connect to tcp port <port> on machine <server-name> from
the device. This can be useful to debug some networking/proxy
issues that can only be revealed on the device itself.
local:<path>
Tries to connect to a Unix domain socket <path> on the device
localreserved:<path>
localabstract:<path>
localfilesystem:<path>
Variants of local:<path> that are used to access other Android
socket namespaces.
framebuffer:
This service is used to send snapshots of the framebuffer to a client.
It requires sufficient privileges but works as follow:
After the OKAY, the service sends 16-byte binary structure
containing the following fields (little-endian format):
depth: uint32_t: framebuffer depth
size: uint32_t: framebuffer size in bytes
width: uint32_t: framebuffer width in pixels
height: uint32_t: framebuffer height in pixels
With the current implementation, depth is always 16, and
size is always width*height*2
Then, each time the client wants a snapshot, it should send
one byte through the channel, which will trigger the service
to send it 'size' bytes of framebuffer data.
If the adbd daemon doesn't have sufficient privileges to open
the framebuffer device, the connection is simply closed immediately.
jdwp:<pid>
Connects to the JDWP thread running in the VM of process <pid>.
track-jdwp
This is used to send the list of JDWP pids periodically to the client.
The format of the returned data is the following:
<hex4>: the length of all content as a 4-char hexadecimal string
<content>: a series of ASCII lines of the following format:
<pid> "\n"
This service is used by DDMS to know which debuggable processes are running
on the device/emulator.
Note that there is no single-shot service to retrieve the list only once.
sync:
This starts the file synchronisation service, used to implement "adb push"
and "adb pull". Since this service is pretty complex, it will be detailed
in a companion document named SYNC.TXT
|
