Android設備抓包及adb shell使用的注意事項

通過adb操作需要先配置下adb工具

將platform-tools.rar（adb工具）下載至本地並解壓

win+r進入敲下cmd 回車 進入DOS窗口

進入platform-tools目錄，開始執行以下步驟，也可像java一樣配置下path環境在執行以下操作

ADB：

adb devices： 失敗時使用下一句查詢5037端口被佔用情況,

netstat -ano | findstr 5037: 然後查看佔用的PID，關閉佔用程序。

被佔用後請執行如下操作

netstat -ano | findstr "5037"
taskkill /f /pid 進程號

如何獲取Android操作日誌

adb logcat -v time > 123123.log 將終端實時日誌寫入當前文件

TCPDUMP抓包：

1. 下載tcpdump http://download.csdn.net/detail/happylisher/8035645

獲取tcpdump.rar解壓即可

3. adb push c:\\wherever_you_put\\tcpdump /data/local/tcpdump 將tcpdump
4. adb shell chmod 6755 /data/local/tcpdump

5, adb shell, su獲得root權限

6， cd /data/local

7， ./tcpdump -i any -p -s 0 -w /sdcard/capture.pcap

命令參數：

# "-i any": listen on any network interface

# "-p": disable promiscuous mode (doesn't work anyway)

# "-s 0": capture the entire packet

# "-w": write packets to a file (rather than printing to stdout)

... do whatever you want to capture, then ^C to stop it ...

8, adb pull /sdcard/capture.pcap d:/

9, 在電腦上用wireshark打開capture.pcap即可分析log

Execute the following if you would like to watch packets go by rather than capturing them to a file (-n skips DNS lookups. -s 0 captures the entire packet rather than just the header):

adb shell tcpdump -n -s 0 

Typical tcpdump options apply. For example, if you want to see HTTP traffic:

只監聽http

adb shell tcpdump -X -n -s 0 port 80

根據以上的信息，寫一個bat去執行（tcpdump文件必須在當前目錄裡）。

開始tcpdump

adb push tcpdump /data/local/tcpdump
adb shell chmod 6755 /data/local/tcpdump
adb shell rm -r /sdcard/capture.pcap
adb shell /data/local/tcpdump -i any -p -s 0 -w /sdcard/capture.pcap
pause

下載tcpdump文件到電腦

adb pull /sdcard/capture.pcap capture.pcap