[Android Software/Hacking General [Developers Only]] Twin0ne:
Do you want to activate the screen wirelessly, or play some music at your phone over SSH because you don't know where you left it?

THIS IS YOUR PLACE!!!

This tutorial will show you how to create a file, that simulates a keypress, swipe, button press.

You can even draw something, save a file of data, and then replay it so android draws the same something.

You can simulate somebody writing text with the default android keyboard, over SSH, etc.

The options are unlimited!

Let's start by the beginning: I will add a zip package with my working directory at my phone, all tools are included there.

The dropbear ssh server is included because it's practical because it can be turned on with your android terminal. You can also access the other tools using another ssh server.

The media player control is a very simple script that takes an argument and then translates it to the android "input keyevent" command.

And the low level screen events is what i'm going to talk about most.

From here on, this will be a tutorial that will focus on screen events

I will cover the following topics:

1) Understanding and getting screen events.

2) Simulating keypressess, creating and sending screen events.

3) Automating the tasks.

​

UNDERSTANDING AND GETTING SCREEN EVENTS

Android provides two commandline tools for managing screen events: getevent and sendevent.

These commands are kinda cryptic:

We'll take a look at the "getevent" command. This command outputs all events of a given device (or all if no device is given)

What i'll do is open a SSH session, and run the commands from my PC, so that it does not interfere with my fingers pressing the keyboard.

I just use getevent (hint, press Control+C to terminate the command and stop getting events):

root@android:/ # getevent
add device 1: /dev/input/event8
name: "compass_sensor"
add device 2: /dev/input/event7
name: "sec_touchkey"
add device 3: /dev/input/event6
name: "gyro_sensor"
add device 4: /dev/input/event5
name: "light_sensor"
add device 5: /dev/input/event4
name: "proximity_sensor"
add device 6: /dev/input/event3
name: "sii9234_rcp"
add device 7: /dev/input/event2
name: "sec_touchscreen"
could not get driver version for /dev/input/mice, Not a typewriter
add device 8: /dev/input/event1
name: "gpio-keys"
add device 9: /dev/input/event0
name: "max8997-muic"

You may notice the "add device X" number is not matching the /dev/input/eventX number. I will use the latter to refer to an event, as we will use this command a lot, believe me.

I will be only talking about devices 1, 2 and 7, i don't care about the rest.

/dev/input/event1 (gpio-keys): This are the hardware keys.

On my Samsung Galaxy SII, these keys are POWER, HOME, VOLUP, and VOLDOWN keys.

/dev/input/event2 (sec_touchscreen): is the touch-screen (they're not very creative at android developing department)

My galaxy has a screen of 480x800 (XY), this is important!.

/dev/input/event7 (sec_touckey): The touch keys.

On my Galaxy, i have the MENU and BACK buttons as touchkeys. This touchkeys are not part of the touchscreen, thats why its another device.

Note though that the touch_screen and the touck_keys devices ARE connected, i'll later have you remember this line.

The numbers of the devices may change from device to device, as not all phones have touchkeys, or a touch screen.

Well, now you know how to list the devices.

The next step is to see how each device works:

Device 1: HWKEYS

I recommend following these steps on your device, and comment any changes at this thread, thank you.

Let's try out short-pressing just the POWER button of our phone (or unlock button)

When i refer to short-pressing, i mean pressing and immediately releasing the button. You'll soon understand why.

Use getevent, press the key, and finish with Control + C.

root@android:/ # getevent /dev/input/event1
0001 0074 00000001
0000 0000 00000000
0001 0074 00000000
0000 0000 00000000
^C
130|root@android:/

WTF is this?! Yes, i said that too when i first saw this, (and you havent seen a swipe with 4 fingers yet, haha)

Well, let's go line by line:

0001 0074 00000001

This is a KEYDOWN line (sorry for using my own syntax here)

What can we observe? There are 3 fields, and all numbers.

The first field will always be 1 except in separator lines (see the second line)

The second field is the identifier for the POWER key.

The third field is a boolean value, it will be 1 when the key is pressed and 0 when it is released.

0000 0000 00000000

This is a simple separator, it it means android just processed everything ultil here.

0001 0074 00000000

This is a KEYUP line, as you can see, the identifier field is 1, the keycode field is 74, and the third boolean field is set to 0, what indicates the key is released.

0000 0000 00000000

And another separator so android process it.

^C

This is the Control+C character, it is used to terminate the running program in linux terminal.

Actually quite simple, isn't it? Lets take a look at the touchkeys device (it's simpler as the screen)

Device 7: MENU and BACK

Yes, android has set up a whole device driver only for 2 stupid keys.

Let's see them in action. I will first press the MENU key, and then the BACK key.

Note that now i use "getevent /dev/input/event7", and not event1.

Oh, i will make some comments on the output so you can see it more clear.

root@android:/ # getevent /dev/input/event7
0001 008b 00000001	[FD] KEYDOWN (8b)
0000 0000 00000000	[S] SEPARATOR
0001 008b 00000000	[FU] KEYUP (8b)
0000 0000 00000000	[S] SEPARATOR
0001 009e 00000001	[FD] KEYDOWN (9e)
0000 0000 00000000	[S] SEPARATOR
0001 009e 00000000	[FU] KEYUP (9e)
0000 0000 00000000	[S] SEPARATOR
^C
130|root@android:/ #

Wow, hex!!, the POWER button we pressed before, was also hex.

Remember that getevents are all in hex.

Explanation:

[FD] Is (in my syntax), a FINGERDOWN event, that means the finger touches the screen.

[FU] FINGERUP event, the finger leaves the screen.

Separator, processess the event.

The parentheses i put after the FU and FD events are the ID of the key.

Remember i told you that the touch_keys and touch_screen devices were connected?

I dont know why but the first fields of the non-separator events are also 1 (same as the HWKEYS)

You'l see that with touchscreen events this is different (it uses number 3 always)

Well, the syntax of the events in the touchkeys are the same as the hardware keys.

Actually, i consider this touch keys to be hardware, with the consideration that they only work when the screen is on.

Device 2: SCREEN TOUCHES AND SWIPES (The interesting part)

Now it's getting really interesting.

Let's get a simple tap somewhere random at the screen:

root@android:/ # getevent /dev/input/event2
0003 0039 0000024f [FD] FingerDown (24f)
0003 0035 00000163 [X] X coordinate
0003 0036 000001dd [Y] Y coordinate

// NOTE LINE

0000 0000 00000000 [S] Separator

0003 0039 ffffffff [FU] FingerUp (24f)
0000 0000 00000000 [S] Separator
^C
130|root@android:/ #

NOTE: At the NOTE LINE you MAY get 2 other events, 0030 and 003a. I have no idea what these two are for.

Besides, to simulate a click we don't need them, so if anyone know what these two events are, you're welcome to comment.

If you enable the Show touches & Pointer location, you see that it has some fields: PRS and SIZE,

Those are for pressure and size, of course, but i don't know if they have something to do with this 0030 and 003a.

Tip for those of you that are debugging: if you increase pressure, your finger's contact area with the device grows, as your sking gets down.

I realised this thinking of somebody pushing his face to a glass surface and somebody watching at the other side.​

NOTE 2: You are recommended to enable Settings -> Developer Options -> Show touches & Pointer location
​

Understanding touchscreen events is more complicated. All buttons from HWKEYS and TOUCHKEYS, were quite simple: they only have a key identifier, and a boolean state: Pressed (1) or not pressed (0).

However, when we use the touchscreen, every single tap has the following elements (events):

[ID] Identifier (ill explain this in the double tap section)

[FD] Finger Down (The finger enters the screen)

NOTE: The third field at the figerdown event, is a sort of simple counter, across different taps, swipes, etc. I dont know yet when it is resetted, but for sure at reboot as this counter will probably reside in ram.​

[X] Number of pixels counted from left side.

[Y] Number of pixels counted from top.

Separator / process trigger.

[FU] Finger Up (The finger exits the screen completely)

Another separator.

Notice that the 0030 and 003a events are not in my list. I've made a tool to simulate keypressess, and those two events are NEVER included, but my script works always. So something tells me these two events are worthless.

Introduction to swipe

With the pointer location enabled in settins, try swiping somewhere random.

As you may notice, you aren't perfect, so you can't draw a straight line.

Everytime your finger changes direction, a new point is added. this means that if you want to make a square, you would need 4 points, imagining all lines are straight.

If you take a close look at the screen, the POINTER LOCATION shows a colored dot, everytime you set some coordinates (this means, by a single click, or by a direction change with a swipe, or with a double tap it would make two dots).

I will unlock my screen with my finger, and then analyze the output of getevent:

Lets analize this simple swipe, and quicly move on to the last teorichal part: Multiple taps.

root@android:/ # getevent /dev/input/event2
0003 0039 000002ba [FD]
0003 0035 000000e6 [X]
0003 0036 00000290 [Y]
0003 0030 00000032 [?]
0003 003a 00000003 [?]
0000 0000 00000000 [S]

0003 0035 000000fb [X]
0003 0036 00000296 [Y]
0000 0000 00000000 [S]

0003 0035 00000120 [X]
0003 003a 00000004 [?]
0000 0000 00000000 [S]

0003 0035 00000161 [X]
0003 0036 00000292 [Y]
0003 003a 00000003 [?]
0000 0000 00000000 [S]

0003 0035 000001aa [X]
0003 0036 0000029a [Y]
0003 0030 00000018 [?]
0003 003a 00000001 [?]
0000 0000 00000000 [S]

0003 0039 ffffffff [FU]
0000 0000 00000000 [S]
^C
130|root@android:/ #

Take a look at the above code. You should already get the point, at every separator the events are processed.

You can use a separator to update coordinates (this includes when a finger enters the screen), and to release a finger (at the last coordinates inputted for that finger).

This that the 2nd to 5th block, only update the coordinates of the finger that is pressing the screen.

Multiple taps

Multiple taps introduces something new: Identificators [ID]

For this i will use the following: a thriple tap.

There is a order in which the fingers enter and leave the screen, while one finger is still pressed, another one can get pressed and released.

Lets see some code:

130|root@android:/ # getevent /dev/input/event2
0003 0039 000002c0 [FD]
0003 0035 00000057 [X]
0003 0036 00000129 [Y]
0000 0000 00000000 [S]

0003 002f 00000001 [ID] 1
0003 0039 000002c1 [FD]
0003 0035 00000169 [X]
0003 0036 000001bb [Y]
0000 0000 00000000 [S]

0003 002f 00000002 [ID] 2
0003 0039 000002c2 [FD]
0003 0035 000000de [X]
0003 0036 00000187 [Y]
0000 0000 00000000 [S]

0003 0039 ffffffff [FU] // NOTE 1
0000 0000 00000000 [S]

0003 002f 00000000 [ID] 0 // NOTE 2
0003 0039 ffffffff [FU]
0000 0000 00000000 [S]

0003 002f 00000001 [ID] 1
0003 0039 ffffffff [FU]
0000 0000 00000000 [S]
^C
130|root@android:/ #

Well, its actually quite simple. As there are multiple fingers, android adds ID's to this new fingers.

The default ID = 0, android doesn't know if you're gonna press 1 finger or 200, so it doesnt add a ID to the first.

The first finger's ID is always 0.

When you add a finger, android adds ID=1

If you release a finger, ID=0 is available again.

Important: When an ID is set, all actions that are processed, are affecting the finger of that ID, this means that if you set the coordinates 10 times in a row they will all affect that finger, until you specify another ID event. (You just learned to combine swipe with multiple touches)

Thats why at the line i marked with NOTE 1, there is no ID, because the first finger i released, was finger ID=2 (the last that touched the screen)

Important: When you release a finger, you MUST set an ID, because android only keeps track of the CID (Current ID), but not of the previus.

So if you release a finger, and then set some coordinates, they will affect an ID that is no longer pressed, and it could either do NOTHING, or output some error message :P

SIMULATING KEYPRESSESS, CREATING AND SENDING EVENTS

NOTE: When we use "getevent", we get some hex codes. When we use "sendevent" we have to use decimal values.

Why? I don't know, maybe bothering is the point. Anyway, it's like that, and we'll have to manage, right?

Sendevent takes the EXACT same input that getevent outputs, except that GETEVENT outputs [HEX]adecimal, and Sendevents wants [DEC]imal characters

To simulate the POWER button key, for one single click, it would take this steps:

STEP 1

STEP 2

STEP 3

Edit: I'm currently making the SENDEVENT TUTORIAL part, in about 2 hours it will be done.

Vote for newsworthy if you think it was!!!