adbproxy 0.1.0__py3-none-any.whl

adbproxy/runtime/sockets.py

@@ -0,0 +1,14 @@
+import socket
+
+
+def close_sockets(s1, s2):
+    """安全关闭 Socket，避免 Errno 9"""
+    for s in (s1, s2):
+        try:
+            s.shutdown(socket.SHUT_RDWR)
+        except Exception:
+            pass
+        try:
+            s.close()
+        except Exception:
+            pass

adbproxy/server/__init__.py

@@ -0,0 +1 @@
+"""ADB client 到 server 的透明代理。"""

adbproxy/server/app.py

@@ -0,0 +1,221 @@
+"""ADB smart-socket 代理应用生命周期。"""
+
+import argparse
+import datetime
+import os
+import signal
+import socket
+import sys
+import threading
+
+from adbproxy.config import FILES_DIR, LOG_DIR, PROXY_PORT, REAL_ADB_PORT
+from adbproxy.runtime.adb_process import AdbServerLease
+from adbproxy.runtime.logging import DebugHexLogger, FileLogger
+from adbproxy.server.connection import Connection
+
+
+class AdbProxy:
+    def __init__(self, argv):
+        parser = argparse.ArgumentParser(
+            description="ADB MITM 代理：转发并解析 adb 协议数据包"
+        )
+        parser.add_argument(
+            "--no-capture",
+            action="store_true",
+            help="禁用 sync 文件传输落盘到 files/，仅打印摘要",
+        )
+        parser.add_argument(
+            "--debug",
+            action="store_true",
+            help="每 recv 块原始 hex 落盘到 logs/debug-{date}.log，旁路不改转发",
+        )
+        args = parser.parse_args(argv)
+        self.capture_enabled = not args.no_capture
+        try:
+            os.makedirs(LOG_DIR, exist_ok=True)
+        except OSError:
+            pass
+        if self.capture_enabled:
+            try:
+                os.makedirs(FILES_DIR, exist_ok=True)
+            except OSError:
+                self.capture_enabled = False
+        now = datetime.datetime.now()
+        fname = (
+            now.strftime("%Y-%m-%d-%H:%M:%S-") + f"{now.microsecond // 1000:03d}.log"
+        )
+        self.log_path = os.path.join(LOG_DIR, fname)
+        self.file_logger = FileLogger(self.log_path)
+        # P0: --debug 开启时每 recv 一块写一行 hex 到独立 debug 文件，旁路不改转发字节
+        self.debug_enabled = args.debug
+        if self.debug_enabled:
+            debug_fname = (
+                now.strftime("%Y-%m-%d-%H:%M:%S-")
+                + f"{now.microsecond // 1000:03d}-debug.log"
+            )
+            self.debug_path = os.path.join(LOG_DIR, debug_fname)
+            self.debug_logger = DebugHexLogger(self.debug_path)
+        else:
+            self.debug_path = None
+            self.debug_logger = None
+        self._conn_counter = 0
+        self._counter_lock = threading.Lock()
+        self._connections_lock = threading.Lock()
+        self._connections = {}
+        self._cleanup_lock = threading.Lock()
+        self._cleaned = False
+        self.proxy_sock = None
+        self._stop = False  # 信号处理器置位，serve() 超时轮询据此退出 accept 循环
+        self.adb_server_lease = AdbServerLease(
+            managed_port=REAL_ADB_PORT,
+            restore_port=PROXY_PORT,
+            log=self._glog,
+        )
+
+    def _glog(self, msg):
+        try:
+            print(msg)
+        except Exception:
+            pass
+        self.file_logger.write(msg)
+
+    def _signal_handler(self, signum, frame):
+        # 置标志位 + 日志；close proxy_sock 唤醒 accept 抛 OSError 立即跳出（#5）
+        self._stop = True
+        self._glog(f"\n[*] 接收到信号 {signum}，正在清理...")
+        try:
+            if self.proxy_sock:
+                self.proxy_sock.close()
+        except Exception:
+            pass
+
+    def _kill_default_server(self):
+        """先检查 5038 未被占用，再按 lease 证据停止需恢复的 5037。"""
+        return self.adb_server_lease.prepare_takeover()
+
+    def init_adb_server(self):
+        """启动并验证 5038；只有 start 成功且 post-probe 就绪才获得所有权。"""
+        return self.adb_server_lease.start_owned()
+
+    def serve(self):
+        # #4+#7+#顺序修正: kill 默认 5037 → bind 5037 → 起 5038。
+        # 必须先 kill：此时 5037 是真 adb server，adb kill-server 连真 server 不会连到 proxy 自身 backlog
+        # 被队列吞并转发 host:kill 去杀 5038。bind 前移根治竞态，bind 失败先 cleanup 再退出不留孤儿 5038。
+        if not self._kill_default_server():
+            self._glog("[!] adb server lease 预检失败，未修改现有实例")
+            self.cleanup()
+            sys.exit(1)
+        self.proxy_sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        self.proxy_sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        try:
+            self.proxy_sock.bind(("127.0.0.1", PROXY_PORT))
+            self.proxy_sock.listen(5)
+        except OSError as e:
+            self._glog(f"[!] 端口绑定失败: {e}")
+            self.cleanup()
+            sys.exit(1)
+        # bind 成功后起 5038 真实 server
+        if not self.init_adb_server():
+            self._glog("[!] 5038 未就绪，清理退出")
+            self.cleanup()
+            sys.exit(1)
+        self._glog(
+            f"[*] ADB Proxy 运行中。正在监听 {PROXY_PORT}，转发至 {REAL_ADB_PORT}..."
+        )
+        self._glog(f"[*] 日志文件: {self.log_path}")
+        if self.debug_logger:
+            self._glog(f"[*] debug hex 日志: {self.debug_path}")
+        else:
+            self._glog("[*] debug hex 日志: <off>（--debug 可开启）")
+        # Step 6: 落盘 banner
+        if self.capture_enabled:
+            self._glog(
+                f"[*] 文件传输捕获已开启，落盘目录: {FILES_DIR} （--no-capture 可禁用）"
+            )
+        else:
+            self._glog("[*] 文件传输捕获已禁用（--no-capture），仅打印 sync 摘要不落盘")
+        # 装信号处理器 + accept 超时轮询，让 SIGINT/SIGTERM 可靠触发 cleanup。
+        # 原因：主线程阻塞在 C 级 accept()，Python SIGINT 只在字节码间检查、不打断阻塞；
+        # 超时轮询让标志位 _stop 在每次 accept 超时后被检查，从而可靠退出。
+        signal.signal(signal.SIGINT, self._signal_handler)
+        signal.signal(signal.SIGTERM, self._signal_handler)
+        self.proxy_sock.settimeout(0.5)
+        try:
+            while not self._stop:
+                try:
+                    client, _ = self.proxy_sock.accept()
+                except socket.timeout:
+                    continue
+                except OSError:
+                    break
+                with self._counter_lock:
+                    self._conn_counter += 1
+                    conn_id = self._conn_counter
+                conn = Connection(
+                    conn_id,
+                    client,
+                    self.file_logger,
+                    self.capture_enabled,
+                    self.debug_logger,
+                )
+                thread = threading.Thread(
+                    target=self._connection_worker, args=(conn,), daemon=True
+                )
+                with self._connections_lock:
+                    self._connections[conn] = thread
+                thread.start()
+        except KeyboardInterrupt:
+            self._glog("\n[*] 接收到中断信号，正在清理环境并退出...")
+        finally:
+            self.cleanup()
+
+    def _connection_worker(self, conn):
+        try:
+            conn.run()
+            conn.wait()
+        finally:
+            with self._connections_lock:
+                self._connections.pop(conn, None)
+
+    def _drain_connections(self):
+        with self._connections_lock:
+            connections = list(self._connections.items())
+        for conn, _thread in connections:
+            conn.stop()
+        current = threading.current_thread()
+        for conn, thread in connections:
+            conn.wait(timeout=5)
+            if thread is not current:
+                thread.join(timeout=5)
+
+    def cleanup(self):
+        cleanup_lock = getattr(self, "_cleanup_lock", None)
+        if cleanup_lock is None:
+            cleanup_lock = threading.Lock()
+            self._cleanup_lock = cleanup_lock
+        with cleanup_lock:
+            if getattr(self, "_cleaned", False):
+                return
+            self._cleaned = True
+        # 1. 关闭 Proxy Socket，释放 5037，打断 accept
+        try:
+            if self.proxy_sock:
+                self.proxy_sock.close()
+        except Exception:
+            pass
+        # 2. 先停活动连接并等待 relay/observer 收尾，再处理共享进程和日志。
+        self._drain_connections()
+        # 3. 仅撤销 lease action ledger 中由本进程完成的 stop/start。
+        lease = getattr(self, "adb_server_lease", None)
+        lease_complete = True
+        if lease is not None:
+            if lease.cleanup() is False:
+                lease_complete = False
+                self._glog("[!] adb server 清理未完成；已保留 lease 状态供后续重试")
+        self.file_logger.close()
+        if self.debug_logger:
+            self.debug_logger.close()
+        if not lease_complete:
+            with cleanup_lock:
+                self._cleaned = False
+        return lease_complete

adbproxy/server/connection.py

@@ -0,0 +1,378 @@
+"""ADB 客户端到服务端的代理连接。"""
+
+import socket
+import threading
+
+from adbproxy.config import REAL_ADB_PORT
+from adbproxy.observers.stream import StreamBuffer
+from adbproxy.protocols.adb import AdbProtocol
+from adbproxy.protocols.smart_socket.conversation import SmartSocketConversation
+from adbproxy.runtime.sockets import close_sockets
+
+
+class Connection:
+    def __init__(
+        self, conn_id, client_sock, file_logger, capture_enabled=True, debug_logger=None
+    ):
+        self.conn_id = conn_id
+        self.client = client_sock
+        self.file_logger = file_logger
+        self.debug_logger = (
+            debug_logger  # P0: None 或 DebugHexLogger 实例，sendall 后旁路落盘 hex
+        )
+        self.sb = StreamBuffer(conn_id, file_logger, capture_enabled)
+        self.server = None
+        self.svc = None  # client 首帧 service 串，供 server 侧 host-length-gating 查
+        self.shell_okay_consumed = (
+            False  # shell 服务的 OKAY/FAIL 是否已剥除（仅 server 线程读写）
+        )
+        self.sync_okay_consumed = (
+            False  # sync 服务的 OKAY/FAIL 是否已剥除（仅 server 线程读写）
+        )
+        # pure smart-socket conversation (request/response policy); no I/O
+        self.conversation = SmartSocketConversation()
+        # 兼容测试与内部状态：暴露 conversation 缓冲/相位字段
+        self._service_request_buf = self.conversation._service_request_buf
+        self._shell_first_response = self.conversation._shell_first_response
+        self._sync_first_response = self.conversation._sync_first_response
+        self.host_phase = self.conversation.host_phase
+        self.host_status_buf = self.conversation.host_status_buf
+        self.host_hex_buf = self.conversation.host_hex_buf
+        self.host_payload_remaining = self.conversation.host_payload_remaining
+        self.host_fixed_remaining = self.conversation.host_fixed_remaining
+        self.host_track_active = self.conversation.host_track_active
+        self._last_host_svc = self.conversation._last_host_svc
+        self._finished = threading.Event()
+        self._finish_lock = threading.Lock()
+        self._relay_threads = []
+        # 不变量：self.svc 在 client sendall 之前写入，server recv 在收到该 sendall 之后
+        # —— TCP 顺序天然 happens-before，无需额外锁
+
+    def _sync_host_view(self):
+        """Mirror conversation host SM fields onto Connection for tests/debug."""
+        c = self.conversation
+        self.host_phase = c.host_phase
+        self.host_status_buf = c.host_status_buf
+        self.host_hex_buf = c.host_hex_buf
+        self.host_payload_remaining = c.host_payload_remaining
+        self.host_fixed_remaining = c.host_fixed_remaining
+        self.host_track_active = c.host_track_active
+        self._last_host_svc = c._last_host_svc
+        self._service_request_buf = c._service_request_buf
+        self._shell_first_response = c._shell_first_response
+        self._sync_first_response = c._sync_first_response
+
+    def run(self):
+        try:
+            self.server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+            self.server.connect(("127.0.0.1", REAL_ADB_PORT))
+        except Exception as e:
+            self.sb.logger.event(f"[!] 连接真实 ADB Server 失败: {e}")
+            try:
+                self.client.close()
+            except Exception:
+                pass
+            self._finish()  # #9: 早退路径过收尾，保证 sb.close 幂等、timer 不残留
+            return
+        t_c = threading.Thread(target=self._client_to_server, daemon=True)
+        t_s = threading.Thread(target=self._server_to_client, daemon=True)
+        self._relay_threads = [t_c, t_s]
+        t_c.start()
+        t_s.start()
+        # 不 join：任一方 EOF 即在 _finish 里 close_sockets 双向，立即解阻塞对端 recv。
+        # 否则 server EOF 后 run 卡在 t_c.join 等 client 线程，而 client 卡在 recv 等
+        # 代理关闭发 EOF —— 死锁。
+
+    def _finish(self):
+        """任一方结束时关闭双向 socket 解阻塞对端；once-guard 保证 sb.close 只调一次。"""
+        with self._finish_lock:
+            if self._finished.is_set():
+                return
+            close_sockets(self.client, self.server)
+            try:
+                self.sb.close()
+            except Exception:
+                pass
+            self._finished.set()
+
+    def stop(self):
+        self._finish()
+
+    def wait(self, timeout=None):
+        done = self._finished.wait(timeout)
+        if not done:
+            return False
+        current = threading.current_thread()
+        for thread in list(self._relay_threads):
+            if thread is not current:
+                thread.join(timeout)
+        return True
+
+    def _client_to_server(self):
+        # 用"shell/sync/install 是否已激活"驱动解析，而非首帧布尔。
+        # adb -s <serial> shell ls /data 在同一 TCP 连接发两帧：
+        #   帧1 host:tport:serial:<serial>（host 服务 → shell_mode=None）
+        #   帧2 0029shell,v2,...:ls /data\x04（真正的 shell 服务）
+        # 故只要 shell/sync/install 未激活，每个 recv 都尝试解析 service 帧。
+        # A2: 仅未激活时 feed_request（守卫）；解析单源 conversation；activate 副作用留 connection。
+        try:
+            while True:
+                data = self.client.recv(65536)  # #11: 64KB recv
+                if not data:
+                    break
+                # Phase A — pre-sendall classify / set_mode / activate (I2, S1–S4)
+                leftover = b""
+                parsed = None
+                try:
+                    if (
+                        not self.sb.shell.active
+                        and not self.sb.sync.active
+                        and not self.sb.install.active
+                    ):
+                        for ev in self.conversation.feed_request(data):
+                            if ev.kind != "service_request" or not ev.svc:
+                                continue
+                            svc = ev.svc
+                            leftover = ev.leftover or b""
+                            parsed = (svc, leftover)
+                            self.svc = svc
+                            self.conversation.svc = svc
+                            self.sb.logger.event("========")
+                            self.sb.logger.event(f"📥 [User Command]: {svc}")
+                            self.sb.shell.set_mode_from_service(svc)
+                            if AdbProtocol.is_sync_service(svc):
+                                self.sb.sync.activate()
+                            if AdbProtocol.is_install_stream_service(svc):
+                                size = AdbProtocol.parse_install_size(svc)
+                                if size is not None:
+                                    self.sb.install.activate(size, svc)
+                                    cap = (
+                                        self.sb.install.capture_path
+                                        if (
+                                            self.sb.install.capture_enabled
+                                            and self.sb.install.capture_path
+                                        )
+                                        else "<disabled>"
+                                    )
+                                    self.sb.logger.event(
+                                        f"📤 [install push]: remote={svc} size={size} local_capture={cap}"
+                                    )
+                        self._sync_host_view()
+                except Exception:
+                    parsed = None
+                    leftover = b""
+                # Phase B — 原样透传 (I1)；观察失败不得跳过
+                self.server.sendall(data)
+                if self.debug_logger is not None:
+                    try:
+                        ln = self.debug_logger.write_hex(self.conn_id, "c", data)
+                        self.sb.logger.event(
+                            f"📥 [debug]: written to {self.debug_logger.file.name} L{ln} ({len(data)}B, client→server)"
+                        )
+                    except Exception:
+                        pass
+                # Phase C — post-sendall payload observe (I3 fail-open)
+                try:
+                    if self.sb.shell.active:
+                        if parsed is not None:
+                            if leftover:
+                                self.sb.add_client(leftover)
+                        else:
+                            self.sb.add_client(data)
+                    elif self.sb.sync.active:
+                        if parsed is not None:
+                            if leftover:
+                                self.sb.add_client(leftover)
+                        else:
+                            self.sb.add_client(data)
+                    else:
+                        if leftover:
+                            self.sb.add_client(leftover)
+                        elif parsed is None:
+                            self.sb.add_client(data)
+                except Exception:
+                    pass
+        except OSError:
+            pass
+        finally:
+            self._finish()
+
+    def _try_parse_service_frame(self, data):
+        """兼容包装：委托 conversation.feed_request / try_parse 单源。"""
+        result = self.conversation.try_parse_service_frame(data)
+        self._sync_host_view()
+        return result
+
+    def _apply_response_events(self, events, complete):
+        """Log status/fail, drain host _status_events, update okay flags, feed payloads."""
+        for ev in events:
+            if ev.kind == "status" and ev.status is not None:
+                self.sb.logger.event(f"📤 [Status]: {ev.status}")
+            elif ev.kind == "fail_reason" and ev.reason is not None:
+                self.sb.logger.event(
+                    f"📤 [FAIL]: {ev.reason.decode('utf-8', errors='replace')}"
+                )
+        # S5: drain side-channel even if already mirrored into events
+        for st in self.conversation._status_events:
+            # avoid double-log when feed_response already emitted status events
+            if not any(
+                ev.kind == "status" and ev.status == st for ev in events
+            ):
+                self.sb.logger.event(f"📤 [Status]: {st}")
+        self.conversation._status_events = []
+
+        if self.sb.shell.active and not self.shell_okay_consumed and complete:
+            self.shell_okay_consumed = True
+        if self.sb.sync.active and not self.sync_okay_consumed and complete:
+            self.sync_okay_consumed = True
+
+        for ev in events:
+            if ev.kind == "payload" and ev.data:
+                self.sb.add_server(ev.data)
+        self._sync_host_view()
+
+    def _server_to_client(self):
+        # sendall 先于 feed_response（I1/I3）；okay_consumed 仅 server 线程写。
+        try:
+            while True:
+                data = self.server.recv(65536)
+                if not data:
+                    break
+                self.client.sendall(data)
+                if self.debug_logger is not None:
+                    try:
+                        ln = self.debug_logger.write_hex(self.conn_id, "s", data)
+                        self.sb.logger.event(
+                            f"📤 [debug]: written to {self.debug_logger.file.name} L{ln} ({len(data)}B, server→client)"
+                        )
+                    except Exception:
+                        pass
+                try:
+                    events, complete = self.conversation.feed_response(
+                        data,
+                        shell_active=self.sb.shell.active,
+                        shell_okay_consumed=self.shell_okay_consumed,
+                        sync_active=self.sb.sync.active,
+                        sync_okay_consumed=self.sync_okay_consumed,
+                        svc=self.svc,
+                    )
+                    self._apply_response_events(events, complete)
+                except Exception:
+                    pass
+        except OSError:
+            pass
+        finally:
+            self._finish()
+
+    def _parse_shell_status(self, data):
+        """增量消费 shell 的首个 OKAY/FAIL，返回 (完成, payload)。"""
+        events, complete = self.conversation.feed_response(
+            data,
+            shell_active=True,
+            shell_okay_consumed=False,
+            sync_active=False,
+            sync_okay_consumed=True,
+            svc=self.svc,
+        )
+        leftover = b""
+        for ev in events:
+            if ev.kind == "status" and ev.status is not None:
+                self.sb.logger.event(f"📤 [Status]: {ev.status}")
+            elif ev.kind == "fail_reason" and ev.reason is not None:
+                self.sb.logger.event(
+                    f"📤 [FAIL]: {ev.reason.decode('utf-8', errors='replace')}"
+                )
+            elif ev.kind == "payload" and ev.data:
+                leftover = ev.data
+        self._sync_host_view()
+        return complete, leftover
+
+    def _parse_sync_okay(self, data):
+        """增量消费 sync 的首个 OKAY/FAIL，返回 (完成, payload)。"""
+        events, complete = self.conversation.feed_response(
+            data,
+            shell_active=False,
+            shell_okay_consumed=True,
+            sync_active=True,
+            sync_okay_consumed=False,
+            svc=self.svc,
+        )
+        leftover = b""
+        for ev in events:
+            if ev.kind == "status" and ev.status is not None:
+                self.sb.logger.event(f"📤 [Status]: {ev.status}")
+            elif ev.kind == "fail_reason" and ev.reason is not None:
+                self.sb.logger.event(
+                    f"📤 [FAIL]: {ev.reason.decode('utf-8', errors='replace')}"
+                )
+            elif ev.kind == "payload" and ev.data:
+                leftover = ev.data
+        self._sync_host_view()
+        return complete, leftover
+
+    @staticmethod
+    def _new_first_response_state():
+        """创建仅供 server 线程使用的首响应重组状态。"""
+        return SmartSocketConversation._new_first_response_state()
+
+    def _consume_first_response(self, data, state):
+        """兼容包装：委托 conversation.consume_first_response。"""
+        events = []
+        complete, leftover = self.conversation.consume_first_response(
+            data, state, emit=events
+        )
+        for ev in events:
+            if ev.kind == "status" and ev.status is not None:
+                self.sb.logger.event(f"📤 [Status]: {ev.status}")
+            elif ev.kind == "fail_reason" and ev.reason is not None:
+                self.sb.logger.event(
+                    f"📤 [FAIL]: {ev.reason.decode('utf-8', errors='replace')}"
+                )
+        self._sync_host_view()
+        return complete, leftover
+
+    def _parse_server_first(self, data):
+        """非 host 服务的状态剥除（stateless 兜底）；经 feed_response 单源。"""
+        events, _complete = self.conversation.feed_response(
+            data,
+            shell_active=False,
+            shell_okay_consumed=True,
+            sync_active=False,
+            sync_okay_consumed=True,
+            svc=self.svc,
+        )
+        leftover = b""
+        for ev in events:
+            if ev.kind == "status" and ev.status is not None:
+                self.sb.logger.event(f"📤 [Status]: {ev.status}")
+            elif ev.kind == "payload" and ev.data:
+                leftover = ev.data
+        self._sync_host_view()
+        return leftover
+
+    def _parse_host_response(self, data):
+        """按 service wire shape 增量消费 host 响应，返回纯 payload bytes。"""
+        events, _complete = self.conversation.feed_response(
+            data,
+            shell_active=False,
+            shell_okay_consumed=True,
+            sync_active=False,
+            sync_okay_consumed=True,
+            svc=self.svc,
+        )
+        leftover = b""
+        seen_status = set()
+        for ev in events:
+            if ev.kind == "status" and ev.status is not None:
+                self.sb.logger.event(f"📤 [Status]: {ev.status}")
+                seen_status.add(ev.status)
+            elif ev.kind == "payload" and ev.data:
+                leftover = (
+                    leftover + ev.data if leftover else ev.data
+                )
+        for st in self.conversation._status_events:
+            if st not in seen_status:
+                self.sb.logger.event(f"📤 [Status]: {st}")
+        self.conversation._status_events = []
+        self._sync_host_view()
+        return leftover