1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# 设置全局 HTTP 代理
adb shell settings put global http_proxy <PC_IP>:8080

# 查看当前代理设置
adb shell settings get global http_proxy

# 删除全局代理
adb shell settings delete global http_proxy

# 删除代理后重启网络使其生效
adb shell svc wifi disable && adb shell svc wifi enable

1
2
3
4
5
6
7

# 通过 pm path 获取路径后 pull
adb shell pm path com.example.app
# 输出: package:/data/app/com.example.app-xxxx/base.apk
adb pull /data/app/com.example.app-xxxx/base.apk ./app.apk

# 一行命令提取
adb pull $(adb shell pm path com.example.app | sed 's/package://') ./app.apk

1
2
3
4
5
6
7
8
9

# 需要 root 权限
adb pull /data/data/com.example.app/shared_prefs/ ./shared_prefs/
adb pull /data/data/com.example.app/databases/ ./databases/

# 无 root 时使用 run-as（仅限 debuggable 应用）
adb shell run-as com.example.app cat databases/app.db > app.db

# 使用 adb backup（部分应用可能禁止备份）
adb backup -f backup.ab -noapk com.example.app

1
2
3
4

adb shell am set-debug-app -w com.example.app       # 启动时等待调试器附加
adb shell su -c "resetprop ro.debuggable 1"          # 修改属性（需 root + Magisk）
adb shell su -c "stop; start"                        # 重启 zygote 使其生效
adb jdwp                                             # 列出所有可调试进程 PID

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# 需要 root，适用于 Android 7.0+ 抓取 HTTPS 流量
openssl x509 -inform DER -in cacert.der -out cacert.pem
HASH=$(openssl x509 -inform PEM -subject_hash_old -in cacert.pem | head -1)
cp cacert.pem ${HASH}.0

adb push ${HASH}.0 /sdcard/
adb shell su -c "mount -o rw,remount /system"
adb shell su -c "cp /sdcard/${HASH}.0 /system/etc/security/cacerts/"
adb shell su -c "chmod 644 /system/etc/security/cacerts/${HASH}.0"
adb shell su -c "mount -o ro,remount /system"
adb reboot

1
2
3

adb shell dumpsys activity activities | grep mResumedActivity  # 当前前台 Activity
adb shell dumpsys activity top | head -30                      # Activity 完整信息
adb logcat -s ActivityManager:I | grep -E "START|LAUNCH"       # 实时监控启动

1
2
3
4
5
6
7

#!/bin/bash
mkdir -p ./extracted_apks
for pkg in $(adb shell pm list packages -3 | sed 's/package://'); do
    apk_path=$(adb shell pm path "$pkg" | sed 's/package://' | tr -d '\r')
    echo "[*] 提取: $pkg"
    adb pull "$apk_path" "./extracted_apks/${pkg}.apk" 2>/dev/null
done

1
2
3
4
5
6

#!/bin/bash
PKG=${1:?"用法: $0 <包名>"}
adb shell am force-stop "$PKG"
adb shell pm clear "$PKG"
LAUNCHER=$(adb shell cmd package resolve-activity --brief "$PKG" | tail -1 | tr -d '\r')
adb shell am start -n "$LAUNCHER"

1
2
3
4
5
6
7
8
9

#!/bin/bash
PKG=${1:?"用法: $0 <包名> [脚本路径]"}
SCRIPT=${2:-""}
# 启动 frida-server（如果尚未运行）
if ! adb shell "su -c 'ps -A'" | grep -q frida-server; then
    adb shell "su -c '/data/local/tmp/frida-server -D &'" && sleep 2
fi
adb shell am force-stop "$PKG"
[ -n "$SCRIPT" ] && frida -U -f "$PKG" -l "$SCRIPT" --no-pause || frida -U -f "$PKG" --no-pause

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

# 获取当前前台应用包名
adb shell dumpsys activity activities | grep mResumedActivity | awk '{print $4}' | cut -d'/' -f1

# 快速提取当前前台应用的 APK
pkg=$(adb shell dumpsys activity activities | grep mResumedActivity | awk '{print $4}' | cut -d'/' -f1)
adb pull $(adb shell pm path $pkg | sed 's/package://') ./${pkg}.apk

# 获取应用的 UID / 签名信息 / 权限
adb shell dumpsys package com.example.app | grep userId
adb shell dumpsys package com.example.app | grep -A 1 "Signatures"
adb shell dumpsys package com.example.app | grep -A 100 "requested permissions:" | grep "android.permission"

# 查看应用是否可调试
adb shell dumpsys package com.example.app | grep "flags=" | head -1

# 获取设备 WiFi IP 地址
adb shell ip addr show wlan0 | grep "inet " | awk '{print $2}' | cut -d'/' -f1

# 列出设备上所有监听的端口
adb shell su -c "ss -tlnp"