Develop Reference

Install directory of Android service

I am analyzing a custom Android device. I tried to enumerate services running in the system (adb shell service list) and I found out that there is a service (let's call it MyService) that I would like to analyze more in depth. It might be a privileged (system) service, if that is a relevant information.
When I run adb shell service list | grep MyService, it returns something like aaa.bbb.ccc.ddd.MyService. I would like to get the code/binary/APK of this service. However, when I run adb shell pm path aaa.bbb.ccc.ddd.MyService, it returns error code 1 and doesn't print any path. The same situation occurs when I execute adb shell pm list packages | grep -i XXX, where XXX is any of aaa,bbb,ccc,ddd or MyService (for the record, aaa and bbb return some packages, but they do not have anything in common with the specific service).
My question is: How can I extract the code/binary/APK/... of the service? How do I find where it is installed?
If root access is needed, that shouldn't be a problem.

I'm new to this problem as well, and had some fun exploring the Android internals. Eventually, I was only able to find the process id that provides the service, and any information associated with that, through /proc and /sys VFS.
Here are my findings:
My first discovery was that, dumpsys <SERVICE_SHORT_NAME> can connect to any service, and ask it to dump its internal state. But this doesn't always include the package name or install directory for that service. I decided to trace system calls from this dumpsys program, using strace. But it turns out that IPC happens through a non-standard /dev/binder device that strace doesn't understand:
$ su
# strace -f -y dumpsys telephony_ims | grep binder | tail
openat(AT_FDCWD, "/dev/binder", O_RDWR|O_CLOEXEC) = 3</dev/binder>
ioctl(3</dev/binder>, BINDER_VERSION, 0x7fd88906b4) = 0
ioctl(3</dev/binder>, BINDER_SET_MAX_THREADS, 0x7fd88906a8) = 0
mmap(NULL, 1040384, PROT_READ, MAP_PRIVATE|MAP_NORESERVE, 3</dev/binder>, 0) = 0x7990b83000
ioctl(3</dev/binder>, BINDER_WRITE_READ, 0x7fd8890460) = 0
ioctl(3</dev/binder>, BINDER_WRITE_READ, 0x7fd8890110) = 0
[pid 15836] ioctl(3</dev/binder>, BINDER_WRITE_READ, 0x7990b7e8a0) = 0
[pid 15836] ioctl(3</dev/binder>, BINDER_WRITE_READ <unfinished ...>
[pid 15836] ioctl(3</dev/binder>, BINDER_THREAD_EXIT, 0) = 0
Luckily, there is still a method to trace what happens inside this binder device. With the help from this other Stack Overflow page, I was able to find the pid running any service.
I will examine the service telephony_ims as an example.
Please run the following commands as root.
First, we need to set up Android Binder Tracing, using commands from the other Stack Overflow page.
cd /sys/kernel/debug/tracing; echo > set_event; echo 1 > events/binder/enable; echo 1 > tracing_on
Then, we must run dumpsys, and immediately afterwards, read the trace logs.
Prerequisite: I used less command, which isn't available on all android devices. If your bash cannot find less, then you could dump the results to a file on SD Card, and open it using a text viewer.
Run (cat /proc/uptime; dumpsys telephony_ims >/dev/null & echo $!; cat /proc/uptime; cat /sys/kernel/debug/trace | tail -n 1000) | less
Look at the resulting output
The first three lines are
16682.46 92635.05
20823
16682.47 92635.12
Search for 20823 from the second line, which is the PID of dumpsys. (The first and third lines are start time timestamp, and end time timestamp, respectively)
Found out that dumpsys is talking with servicemanager:
dumpsys-20823 [006] .... 16682.479173: binder_transaction: transaction=10738057 dest_node=1 dest_proc=563 # more content afterwards, ignored. pid 563 is "servicemanager"
# ... more lines ...
servicemanager-563 [003] .... 16682.479283: binder_transaction: transaction=10738058 dest_node=0 dest_proc=20823 # more content afterwards, ignored.
Then, it turns out that dumpsys-20823 started a child process, 20827:
dumpsys-20823 [004] .... 16682.479808: binder_return: cmd=0x7206 BR_TRANSACTION_COMPLETE
dumpsys-20823 [004] .... 16682.479810: binder_transaction_received: transaction=10738061
dumpsys-20823 [004] .... 16682.479811: binder_return: cmd=0x80407203 BR_REPLY
dumpsys-20823 [004] .... 16682.479812: binder_read_done: ret=0
dumpsys-20823 [004] .... 16682.479813: binder_ioctl_done: ret=0
dumpsys-20827 [006] .... 16682.480058: binder_ioctl: cmd=0xc0306201 arg=0x780a5668a0
dumpsys-20827 [006] .... 16682.480060: binder_command: cmd=0x40406300 BC_TRANSACTION
dumpsys-20827 [006] .... 16682.480077: binder_transaction: transaction=10738063 dest_node=29113 dest_proc=2574 dest_thread=0 reply=0 flags=0x10 code=0x5f444d50
Eventually, it's this child process who gave away the PID of the service ("dest_proc=2574"):
dumpsys-20827 [006] .... 16682.480077: binder_transaction: transaction=10738063 dest_node=29113 dest_proc=2574 dest_thread=0 reply=0 flags=0x10 code=0x5f444d50
Look into this process for its package name / related jars and apks
$ ps -A | grep 2574
radio 2574 875 14414052 120280 SyS_epoll_wait 0 S com.android.phone
$ ls -l /proc/2574/fd | egrep 'apk|jar' | head
lr-x------ 1 root root 64 2020-12-15 13:42 10 -> /apex/com.android.art/javalib/bouncycastle.jar
lr-x------ 1 root root 64 2020-12-15 13:42 102 -> /system/app/Stk/Stk.apk
lr-x------ 1 root root 64 2020-12-15 13:42 11 -> /apex/com.android.art/javalib/apache-xml.jar
lr-x------ 1 root root 64 2020-12-15 13:42 12 -> /system/framework/framework.jar
lr-x------ 1 root root 64 2020-12-15 13:42 13 -> /system/framework/ext.jar
lr-x------ 1 root root 64 2020-12-15 13:42 14 -> /system/framework/telephony-common.jar
lr-x------ 1 root root 64 2020-12-15 13:42 15 -> /system/framework/voip-common.jar
lr-x------ 1 root root 64 2020-12-15 13:42 16 -> /system/framework/ims-common.jar
lr-x------ 1 root root 64 2020-12-15 13:42 18 -> /system/framework/framework-atb-backward-compatibility.jar
lr-x------ 1 root root 64 2020-12-15 13:42 19 -> /apex/com.android.conscrypt/javalib/conscrypt.jar

How to parse "adb shell top" to display only CPU or memory usage?

I have the output result from "adb shell top" in a .txt file. I want to get only the CPU usage for my testing app and display it as a table:
Time cpu %
1 18
2 20
3 15
4 19
I have tried cat top.txt | grep Cpu | nl > cpu.txt (followed the instructions from here link), but the file is empty.
Do you have any idea how can I start? I have never used regex and not sure will it help. Please, looking forward hearing any tips :)
User 23%, System 5%, IOW 0%, IRQ 0%
User 434 + Nice 0 + Sys 106 + Idle 1273 + IOW 10 + IRQ 0 + SIRQ 3 = 1826
PID PR CPU% S #THR VSS RSS PCY UID Name
1868 1 20% S 50 1394620K 175176K fg u0_a174 com.test.app
1841 6 2% S 11 1897824K 48632K fg shell uiautomator
4794 1 1% S 148 2334708K 130924K fg system system_server
447 1 1% S 14 422152K 17476K fg system /system/bin/surfaceflinger
29195 1 1% S 21 369676K 20040K fg media

Given your top.txt sample, I would do the following, step by step:
First, select only the lines for your app com.test.app with grep:
grep com.test.app top.txt
Take the third field (delimited by spaces, so this is the CPU usage) by piping into awk:
grep com.test.app top.txt | awk '{ print $3; }'
Add line numbering by piping into nl (the -nln is for left justification):
grep com.test.app top.txt | awk '{ print $3; }' | nl -nln
Finally, just prepend your header with echo (-e and double quotes are needed for newline \n):
echo -e "Time cpu %\n" && grep com.test.app top.txt | awk '{ print $3; }' | nl -nln
This will give you for the sample top.txt:
Time cpu %
1 20%

Using dd to change a hex value in Android script

What I am doing is trying to build a script that can be flashed in a custom android recovery like TWRP or ClockWorkMod.
The beginning: So using this command at a ADB shell prompt will modify the partition in which the locked or unlocked flag lives for the bootloader on many HTC devices-
echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p3 bs=1 seek=33796
I am trying to be able to do the same thing from recovery (Aroma script, but shouldn't matter)
The issue is that while CWM recovery can use these 2 simple lines to complete it:
echo -ne "\000\000\000\000" > /tmp/data_new
dd if=/tmp/data_new of=/dev/block/mmcblk0p3 bs=1 seek=33796 conv=notrunc
TWRP environment cannot. The issue seems to be with the quotes and/or the backslashes in the echo.
To get around this I have tried to package a file called data_new with the output of the echo (which is just 4 nul bytes) and then use the DD command, but it doesn't read the data_new correctly because I get 0+0 records in and 0+0 records out. I have also tried writing a shell script to execute the commands, but same issue in TWRP.
To add a layer of complexity the commands in the aroma script are quoted like this:
run_program("/sbin/busybox", "dd", "if=/tmp/data_new", "of=/dev/block/mmcblk0p3" etc
I have tried many combinations of single and double quotes and leading backticks but still fails.
Bottom line - Is there a different way of expressing 4 zeroed out hex values?
The reverse is not a problem because it's echo to Lock is this: (no backticks and quotes on HTCU don't come into play, since echo output is the same with or without)
echo -ne "HTCU" | dd of=/dev/block/mmcblk0p3 bs=1 seek=33796
The issue is in getting a DD command to change the HTCU values to 4 zeroes without using backticks in the echo.
Can anyone help?
PS - I think that this could be done by pulling the partition with DD to /tmp and then find the HTCU string (48 54 43 55) and replace with 00 00 00 00, but the partition is large with only a small amount of data actually in it so the process would take a while and the script would be more complicated than I think I could write, as yes I am a noob to coding.
Thanks
EDIT: I tried using /dev/null as that seems like a good idea and a way to avoid echo altogether. However that fails as well. Same result as using a preloaded 4 nul byte file. I know it is not the recovery as the /dev/null method produced the same failure in a ADB shell.
0+0 records in
0+0 records out
0 bytes copied
Here is the full string of code:
run_program("/sbin/busybox", "dd", "if=/dev/null", "of=/dev/block/mmcblk0p3", "bs=1", "count=4", "seek=33796", "conv=notrunc")
After dd, what might be the best alternate way to do a quick hex edit?
This is my requirement:
writting into parttion mmcblk0p3 at offset 0x8404. HTCU for unlocked, HTCL for relocked or 0x00000000 for locked
Thanks again

Could you not read directly from /dev/null reading 4 bytes; I believe the syntax is:
dd if=/dev/null of=/dev/block/mmcblk0p3 bs=1 count=4 seek=33796 conv=notrunc
Please double check the above code, I've not used dd in a while.
Update
After playing around with dd I managed to get it to write 4 null bytes to a position I specified within a file:
Firstly create the example file:
$ dd if=/dev/urandom of=randomfile bs=64 count=1
1+0 records in
1+0 records out
64 bytes (64 B) copied, 4.5401e-05 s, 1.4 MB/s
$ od -b randomfile
0000000 105 342 131 116 213 371 352 344 217 236 320 106 010 154 074 375
0000020 360 215 014 203 030 357 144 053 302 265 012 310 217 362 236 303
0000040 156 033 266 035 303 061 262 055 253 102 222 037 372 105 230 321
0000060 117 277 322 277 166 174 316 176 010 202 302 151 120 045 120 334
0000100
Then zeroing 4 bytes, skipping the first two bytes:
$ dd if=/dev/zero of=randomfile seek=2 bs=1 count=4 conv=notrunc
4+0 records in
4+0 records out
4 bytes (4 B) copied, 4.4779e-05 s, 89.3 kB/s
$ od -b randomfile
0000000 105 342 000 000 000 000 352 344 217 236 320 106 010 154 074 375
0000020 360 215 014 203 030 357 144 053 302 265 012 310 217 362 236 303
0000040 156 033 266 035 303 061 262 055 253 102 222 037 372 105 230 321
0000060 117 277 322 277 166 174 316 176 010 202 302 151 120 045 120 334
0000100
This should extend to your larger file.

dd if=/dev/null of=/dev/block/mmcblk2p3 bs=1 count=4 seek=33796 conv=notrunc
This above Ans worked for me... Thanks for the Ans.
dd if=/dev/null of=/dev/block/mmcblk2p3 bs=1 count=4 seek=33796
without conv=notrunc argument it used to give
dd: ftruncate: Invalid argument error.

How to get higher precision of "CPU%" than that from TOP command?

When I use TOP command, I could get the following info:
shell#android:/ $ top -n 1
User 31%, System 10%, IOW 0%, IRQ 0%
User 346 + Nice 10 + Sys 120 + Idle 637 + IOW 6 + IRQ 0 + SIRQ 2 = 1121
PID PR CPU% S #THR VSS RSS PCY UID Name
481 1 26% S 89 762832K 81688K fg system system_server
1699 0 5% S 27 676472K 39092K fg u0_a72 wm.cs.systemmonitor
11243 0 3% S 28 673140K 29796K bg u0_a111 com.weather.Weather
13327 2 1% S 23 680472K 35844K bg u0_a83 com.rhmsoft.fm
659 0 1% S 17 663044K 33136K bg u0_a13 android.process.media
20260 1 0% R 1 1208K 508K shell top
We can see the CPU% is round to integer, is there any way I could get a process's CPU% with higher precision?
-- Clarifications on the bounty -- Alex
The question refers to Android system, and preferably to a non-rooted device. While Android provides advanced profiling techniques for Java applications, tools for native code (C++) are limited. top command on Android allows to show the statistics for all threads running in the system, both Java threads and C++ threads. I am looking for an answer that will help with the following quest:
My app uses 2% CPU when it is inactive in background, while it should be below 0.1%. If I run top -t, I get 0% for all 15 threads that belong to my process (some threads are Java threads, e.g. the Main, UI thread; others are pthreads that never attach to JVM). How can I guess which thread eats the battery?
I would be glad to get even more details about this unexpected activity, and Android provides great helpers like TraceView for Java threads. Any insight regarding tools for native code will be highly appreciated.

You didn't mention it in your post, but in the comment you said that you really need CPU utilization per thread, not per process.
If you can't find a tool that's accurate enough, you can look directly in /proc/[pid]/task/[ThreadName] as described in the man page for /proc. This gives total CPU time consumed in "clock ticks" since execution began. Getting better resolution than this is probably difficult or impossible.
Edit
From the OP's comment, a command that lists the relevant information is:
adb shell cat /proc/${pid}/task/*/stat | awk -F\ '{print $1, $14}'
This just cats the correct /proc files to the debugging host, which runs a tiny awk program to print the columns for pid and user time. You could also easily use cut -d " " -f1,14 or something similar in perl to get the columns if awk isn't available.

Try this:
ps -eo pcpu,pid,user,args | sort -r -k1 | less
%CPU PID USER COMMAND
9.0 2721 user bash
1.4 956 root ...
0.5 2212 user ...
EDIT:
You can use adb shell and busybox (http://www.busybox.net/downloads/BusyBox.html)
adb shell busybox top
c:\ adb push busybox /system/bin
c:\ adb shell
# busybox top
CPU: 2.3% usr 3.1% sys 3.9% nic 90.5% idle 0.0% io 0.0% irq 0.0% sirq
Load average: 1.06 1.66 10.63 1/589 8048
←[7m PID PPID USER STAT VSZ %MEM CPU %CPU COMMAND←[0m
31619 2180 10112 S 217m 67.0 0 3.8 com.mgeek.android.DolphinBrowser.B
2232 2180 1000 S 551m169.6 0 2.6 system_server
8038 8037 0 R 2068 0.6 0 0.8 busybox top
2178 1 0 S 11092 3.3 0 0.6 /system/bin/drexe
6812 2180 10104 S 199m 61.2 0 0.5 android.tether
2291 2180 1001 S 324m 99.8 0 0.3 com.android.phone
2308 2180 10006 S 325m100.0 0 0.1 com.sec.android.app.dialertab
2177 1 1001 S 9624 2.8 0 0.1 /system/bin/rild
5 2 0 SW< 0 0.0 0 0.1 [events/0]
30087 2180 10022 S 358m110.4 0 0.0 com.samsung.vvm
2304 2180 10006 S 311m 96.0 0 0.0 com.sec.android.app.twlauncher
16110 2180 10006 S 296m 91.3 0 0.0 android.process.acore
2445 2180 10006 S 272m 83.8 0 0.0 com.sec.android.provider.logsprovi
8064 2180 10002 S 238m 73.4 0 0.0 com.google.process.gapps
31537 2180 10037 S 227m 69.9 0 0.0 com.google.android.gm
2288 2180 10048 S 221m 68.1 0 0.0 com.swype.android.inputmethod
2285 2180 10013 S 215m 66.3 0 0.0 com.tat.livewallpaper.aurora
30664 2180 10011 S 213m 65.8 0 0.0 com.android.email
31191 2180 10099 S 209m 64.4 0 0.0 com.sirma.mobile.bible.android
2377 2180 10087 S 207m 63.9 0 0.0 android.tts
(Taken from here)

Got this information from another thread:
3) Getting CPU info
~$ adb shell dumpsys cpuinfo
Output:
Load: 0.08 / 0.4 / 0.64
CPU usage from 42816ms to 34683ms ago:
system_server: 1% = 1% user + 0% kernel / faults: 16 minor
kdebuglog.sh: 0% = 0% user + 0% kernel / faults: 160 minor
tiwlan_wq: 0% = 0% user + 0% kernel
usb_mass_storag: 0% = 0% user + 0% kernel
pvr_workqueue: 0% = 0% user + 0% kernel
+sleep: 0% = 0% user + 0% kernel
+sleep: 0% = 0% user + 0% kernel
TOTAL: 6% = 1% user + 3% kernel + 0% irq
EDIT:
You can also try this command: echo $(adb shell ps | grep com.android.phone | awk '{ system("adb shell cat /proc/" $2 "/stat");}' | awk '{print $14+$15;}')
Also:
using top : This will show you the cpu stats
top -b -n 1 |grep ^Cpu
using ps: This will show you the % cpu usage for each process.
ps -eo pcpu,pid,user,args | sort -r -k1 | less
EDIT2:
In realtion to your comments and the bounty description (How can I guess which thread eats the battery?) I found an interesting page:
http://ziyang.eecs.umich.edu/projects/powertutor/
As stated there:
You can use PowerTutor to monitor the power consumption of any
application.
Try this for an instance and see if it meets your requirements.
FINAL EDIT:
Check out the Systrace documentation on the developer.android.com site:
http://developer.android.com/tools/debugging/systrace.html
http://developer.android.com/tools/help/systrace.html
I'm sorry if you already tried that, but that's one concrete method to measure the performance.

Use DDMS and method profiling to get a TraceView.
Basically:
Launch your app in debug mode
In DDMS, in the Devices tab, click "Start method profiling"
Do stuff on your device to recreate the conditions you want to monitor
Click "Stop method profiling"
You'll get a fairly detailed graph with each thread's execution that you can drill down into
More details here:
http://developer.android.com/tools/debugging/debugging-tracing.html
Disclaimer: I've only done this with a simple test app so I don't know how much mileage you'll get out of it. It does seem to give a bit more precision than what has been described so far, and does not require root.

Finding usage of resources (CPU and memory) by threads of a process in Android

I have a multi-threaded application(C++,C and pthread library) and I will like to know how much resources(CPU and memory) each thread uses. Is there a way to find out these details on Android?
I have tried
$ adb shell ps -p -t
But, this gives information in the below format,
USER PID PPID VSIZE RSS PRIO NICE RTPRI SCHED WCHAN PC NAME
root 1 0 476 312 20 0 0 0 c037c0e0 000087bc S /init
root 2 0 0 0 20 0 0 0 c031f114 00000000 S kthreadd
root 3 2 0 0 20 0 0 0 c030e5d0 00000000 S ksoftirqd/0
root 4 2 0 0 -100 0 99 1 c033fc50 00000000 S watchdog/0
root 5 2 0 0 20 0 0 0 c031b4b4 00000000 S events/0
root 6 2 0 0 20 0 0 0 c031b4b4 00000000 S khelper
Any way to know which threads are running along with their parent's id will be really helpful.
using
$ adb logcat -v threadtime
prints info about the running process (PID) and the thread (TID).
But, its not enough for my purpose. I want to know how much resources is a particular thread consuming. Any pointers.

ps command in android seems to be very limited compared to linux.
You could try:
ps -t -c APP_NAME
This will show you threads(-t) and the CPU assigned to the thread (-c)
Example:
ps -t -c -p com.whatsapp
-p is thread priority(linux nice value)