tiann/eadb

eBPF Android Debug Bridge

eadb - eBPF Android Debug Bridge

eadb provides a powerful Linux shell environment where one can run BCC / bpftrace / bpftool on Android device.

Usage

Install the eadb first, please refer Install

Prepare eadb environment on Android device

eadb support two mode to connect the device:

• adb
• ssh

Both of them need the root privilege.

If you want to use adb mode, adb root is required but adb root is disabled in production build, if you doesn't have any userdebug / eng devices, you can try adb_root. But it you don't any experience on Magisk(it may brick your device), it is recommended to use ssh mode.

If you use ssh mode, it is recommended to install Magisk to Root your device and install MagiskSSH to enable ssh.

Download it from github

When you can use adb or ssh to connect to your device, you can prepare the eadb environment:

eadb --ssh root@ip prepare

The command would download a rootfs from Release page and push it to your device, then do some mounts and chroot in to the environment.

Use an existing archive

You can also download or build the rootfs and then prepare it by your rootfs file:

eadb --ssh root@ip prepare -a path/to/archive

Enter the environment

eadb --ssh root@ip shell

You will enter the eadb environment and get a shell by this command, you can use apt update to update the sources and install softwares(such as clang,llvm,bpftrace) by yourself, you can even install Rust / Golang or gcc to do development on this device!

Build the environment by yourself

Only Ubuntu / Debian is supported to build the system image running on Android, you can use docker or podman on macOS and WSL on Windows.

Install qemu-user-static and debootstrap first:

sudo apt update && sudo apt install qemu-user-static debootstrap

And then build the eadb (root is required):

sudo eadb build

After the build, you will get a debianfs-full(mini).tar.gz in your working directory. you can use this image as your environment:

eadb --ssh root@ip prepare -a deb.tar.gz

Install

Binary

Download binaries in Release page

Build from source

1. Install Rust toolchain
2. git clone https://github.com/tiann/eadb
3. cargo build

Cargo

If you have Rust toolchain installed, you can install it with cargo:

cargo install eadb

Credits

All my credits to adeb! eadb is just a rewritten for adeb.

Contact

twsxtd#gmail.com

eadb's Issues

GLIBC_ XXX not found

windows下用rust编译eadb报error[E0425]

$ cargo build
Compiling eadb v0.1.5 (E:\eadb)
error[E0425]: cannot find function getuid in crate libc
--> src\build_image.rs:68:30
|
68 | let uid = unsafe { libc::getuid() };
| ^^^^^^ help: a function with a similar name exists: getpid
|
::: C:\Users.cargo\registry\src\mirrors.ustc.edu.cn-12df342d903acd47\libc-0.2.126\src\windows\mod.rs:474:5
|
474 | pub fn getpid() -> ::c_int;
| --------------------------- similarly named function getpid defined here

For more information about this error, try rustc --explain E0425.
error: could not compile eadb due to previous error

eadb prepare 本地文件逻辑异常

用ssh，必须先把压缩包放到/data/eadb/debian/data/eadb/deb.tar.gz

然后才能

eadb --ssh root@ip prepare -a path/to/archive(本地路径)

然后提示找不到device-*

• eadb/src/cli.rs

  Line 133 in 0832f6e

  op.check_call(&format!("{EADB_DIR}/device-unpack"))?;

这是因为这些文件实际解压到

• /data/eadb/debian/data/eadb/device-unpack

原因是

• eadb/src/cli.rs

  Line 192 in 0832f6e

  op.push(&src_path, EADB_DIR)?;

• eadb/src/ssh.rs

  Line 75 in 68b9592

  to_rootfs_dir(dst)

• eadb/src/constants.rs

  Line 19 in 02be990

  format!("{}{}", EADB_ROOTFS_DIR, dir)

ssh的push这里把路径拼接为{EADB_ROOTFS_DIR}/{EADB_DIR}，但是后面脚本的操作都是基于EADB_DIR，最终导致chmod +x device-*命令异常

[Feature request] 为ssh连接方式添加指定端口选项

有时候受限于PC的网络环境，比如手机和PC在不同的子网下，这个时候在虚拟机中无法连通到手机的ssh（即使手机监听0.0.0.0）

如果这个时候仍然想使用ssh去操作，可以通过adb forward tcp:手机端口 tcp:PC端口进行转发

然后PC可以通过ssh [email protected] -p port的方式连接到手机的ssh

但是adb forward tcp:22 tcp:22怎么都会提示无法绑定端口，但是如果是其他端口却可以成功...

另外补充一点，ssh连的时候，forward的手机端口和PC端口必须一致，不知道为何...

---

所以希望可以增加一个指定端口的选项，另外项目是用的scp传输文件，改的话也需要一并增加

WARNING: linker: Warning: failed to find generated linker configuration from "/linkerconfig/ld.config.txt"

Unpack of rootfs successful!
oriole:/ # /data/eadb/run /data/eadb/debian
WARNING: linker: Warning: failed to find generated linker configuration from "/linkerconfig/ld.config.txt"
/bin/bash[10]: syntax error: unexpected '('
1|oriole:/ #

环境：
pixel6，Android13，内核Linux version 5.10.149-android13-4-gebdbc9fbe2e2-dirty (build-user@build-host) (Android (8508608, based on r450784e) clang version 14.0.7 (https://android.googlesource.com/toolchain/llvm-project 4c603efb0cca074e9238af8b4106c30add4418f6), LLD 14.0.7) #1 SMP PREEMPT Mon Feb 27 10:44:09 UTC 2023

Unable to find kernel headers. Try rebuilding kernel with CONFIG_IKHEADERS=m (module) or installing the kernel development package for your running kernel version.

Unable to find kernel headers. Try rebuilding kernel with CONFIG_IKHEADERS=m (module) or installing the kernel development package for your running kernel version.
chdir(/lib/modules/4.14.243-gff8eae656fe6-ab8007944/build): No such file or directory
Traceback (most recent call last):
File "/usr/share/bcc/tools/opensnoop", line 261, in
b = BPF(text='')
File "/usr/lib/python3/dist-packages/bcc/init.py", line 475, in init
raise Exception("Failed to compile BPF module %s" % (src_file or ""))
Exception: Failed to compile BPF module

Pixel4 运行 opensnoop 提示运行错误

Temporary failure in name resolution

大佬你好，我用了eadbv0.1.4+debianfs-arm64-full.tar.gz 搭了一个环境，在执行eadb shell 的阶段发现网络不能用，使用adb shell可以使用网络。

手机 google pixel3 arm64 内核是4.9.210-gdee0d123b122-ab6570413

设置rootfs

./eadb --ssh [email protected] -p 22225 prepare -a debianfs-arm64-full.tar.gz

安装正常

登录上来

./eadb --ssh [email protected] -p 22225  shell

然后安装工具时网络就不能访问

apt update
Err:1 http://mirrors.ustc.edu.cn/debian bullseye InRelease
  Temporary failure resolving 'mirrors.ustc.edu.cn'
Reading package lists... Done
Building dependency tree... Done
All packages are up to date.
W: Failed to fetch http://mirrors.ustc.edu.cn/debian/dists/bullseye/InRelease  Temporary failure resolving 'mirrors.ustc.edu.cn'
W: Some index files failed to download. They have been ignored, or old ones used instead.

使用ping 后

root@localhost:/# ping baidu.com 
ping: baidu.com: Temporary failure in name resolution

当前使用adb shell 能正常使用手机网络。

blueline:/ # ping baidu.com
PING baidu.com (220.181.38.251) 56(84) bytes of data.
64 bytes from 220.181.38.251: icmp_seq=1 ttl=52 time=42.9 ms
64 bytes from 220.181.38.251: icmp_seq=2 ttl=52 time=59.0 ms

eadb是否有提供由adb shell执行BCC Tools Command方法

现在正尝试使用python script配合adb commands进行实验流程的自动化，想请问eadb是否提供方法可以用command的方式，从adb shell去执行BCC Tools?

/bin/bash: no closing quote

When I try to execute the command "chroot debian/ ..." inside the run script, it always tells me "no closing quote", I tried inserting both single and double quotes, removing them but nothing works, I don't know how I can solve it

eadb shell error chroot: exec /bin/bash

phone : Redmi Note 12 Turbo
kernel version : 5.10

./eadb --ssh root@ip prepare -a debianfs-arm64-full.tar.gz

./eadb --ssh root@ip shell

chroot: exec /bin/bash: No such file or directory

/data/eadb/run /data/eadb/debian

chroot: exec /bin/bash: No such file or directory

supports adb shell "su -c"

Android 模拟器运行问题

环境为 AVD 启动的 Android 12.0 Pixel 2，使用 63e6e2e 的 Actions 构建版本。

在 eadb prepare 后执行 eadb shell，产生如下报错后连接被关闭

WARNING: linker: Warning: failed to find generated linker configuration from "/linkerconfig/ld.config.txt"
CANNOT LINK EXECUTABLE "/system/bin/ndk_translation_program_runner_binfmt_misc_arm64": library "libicu.so" not found: needed by /system/lib64/libharfbuzz_ng.so in namespace (default)

run device-uinpach script and report error "/system/bin/sh: ./device-unpack: No such file or directory"

i run the script file, and the script is actually in the file, but here comes an unexpected error "no such file or directory"
the detail of the emulator is:
phone image is Tiramisu(Android 13.0X86_64)
Properties
avd.ini.displayname phone
avd.ini.encoding UTF-8
AvdId phone
disk.dataPartition.size 6442450944
fastboot.chosenSnapshotFile
fastboot.forceChosenSnapshotBoot no
fastboot.forceColdBoot no
fastboot.forceFastBoot yes
hw.accelerometer yes
hw.arc false
hw.audioInput yes
hw.battery yes
hw.camera.back virtualscene
hw.camera.front emulated
hw.cpu.ncore 4
hw.device.hash2 MD5:a8abfd3536f3d35e4ba2041a7b99f40e
hw.device.manufacturer Google
hw.device.name pixel_6_pro
hw.dPad no
hw.gps yes
hw.gpu.enabled yes
hw.gpu.mode auto
hw.initialOrientation Portrait
hw.keyboard yes
hw.lcd.density 560
hw.lcd.height 3120
hw.lcd.width 1440
hw.mainKeys no
hw.ramSize 2048
hw.sdCard yes
hw.sensors.orientation yes
hw.sensors.proximity yes
hw.trackBall no
image.androidVersion.api 33
image.sysdir.1 system-images\android-33\default\x86_64
PlayStore.enabled false
runtime.network.latency none
runtime.network.speed full
showDeviceFrame yes
skin.dynamic yes
tag.display Default Android System Image
tag.id default
vm.heapSize 384

Build static linked executable

Run eadb shell error

eadb shell info:

device info:

eadb v0.1.3 + debianfs-full.tar.gz 环境，编译 bpftrace 报错

维术带佬你好，我跟着教程在手机上用 eadb v0.1.3 + debianfs-full.tar.gz 搭起 linux 环境，想简单体验一下 bpftrace 的效果

apt install bpftrace 后，执行 readme 中的展示命令会报错，参考直播时提到过 bcc 源码中的 tracing 路径问题，猜测应该是 bpftrace 源码里也写死了 /sys/kernel/debug/tracing 导致的，所以 fork 并修改了 bpftrace 的源码并 clone 到回来，尝试在手机上源码编译

目前是在源码编译仅修改 tracing 路径后的 bpftrace 过程中，make -j8 时报错

检查了报错代码中，对应函数的调用如下， 传递了 3 个参数

  init_disassemble_info(&info, stdout, fprintf_nop);

但是从手机 linux 环境的 /usr/include/dis-asm.h 文件中查看导出的 init_disassemble_info 函数有 4 个参数，所以报错了

/* Method to initialize a disassemble_info struct.  This should be
   called by all applications creating such a struct.  */
extern void init_disassemble_info (struct disassemble_info *dinfo, void *stream,
				   fprintf_ftype fprintf_func,
				   fprintf_styled_ftype fprintf_styled_func);

/* For compatibility with existing code.  */
#define INIT_DISASSEMBLE_INFO(INFO, STREAM, FPRINTF_FUNC, FPRINTF_STYLED_FUNC)  \
  init_disassemble_info (&(INFO), (STREAM), (fprintf_ftype) (FPRINTF_FUNC), \
			 (fprintf_styled_ftype) (FPRINTF_STYLED_FUNC))

对这个方向的知识储备比较少，现在不知道该从哪里入手才能正常编译出 bpftrace 了，请 带佬 帮忙解答，非常感谢

pixel6报错chroot: exec /bin/bash: No such file or directory

✘ king@kingdeMacBook-Pro  ~/apks/bpf/ebpf  eadb --ssh [email protected] shell
chroot: exec /bin/bash: No such file or directory
Connection to 192.168.31.179 closed.