38 lines
1.7 KiB
Bash
38 lines
1.7 KiB
Bash
#!/usr/bin/env bash
|
||
# 运行时取证：截图、dumpsys、logcat、在 su 可用时扫 Magisk/LSPosed/应用私有目录
|
||
# 用法: adb_runtime_forensics.sh <serial> <OUT_DIR>
|
||
set +e
|
||
S="${1:?serial}"
|
||
OUT="${2:?OUT_DIR}"
|
||
TS="$(date +%Y%m%d_%H%M%S)"
|
||
D="$OUT/runtime_dump_$TS"
|
||
mkdir -p "$D"
|
||
|
||
A() { adb -s "$S" "$@" 2>/dev/null; }
|
||
|
||
echo "runtime forensics -> $D"
|
||
|
||
A exec-out screencap -p >"$D/screen.png" || A shell screencap -p >"$D/screen_alt.png"
|
||
A shell dumpsys package com.lerist.fakelocation >"$D/dumpsys_package_main.txt"
|
||
A shell dumpsys package com.lerist.fakelocation.common.xposed >"$D/dumpsys_package_xposed.txt" || true
|
||
A shell dumpsys meminfo com.lerist.fakelocation >"$D/dumpsys_meminfo_main.txt"
|
||
A logcat -d -t 500 >"$D/logcat_tail.txt"
|
||
A shell dumpsys activity activities 2>&1 | tail -200 >"$D/dumpsys_activity_tail200.txt" || true
|
||
A shell cmd activity top -n 1 >"$D/activity_top.txt" || true
|
||
|
||
# —— 以下需设备 root + su 对 adb shell 放行（或仅记录失败）——
|
||
A shell su -c "id" >"$D/su_id.txt" 2>&1
|
||
A shell su -c "magisk -v" >"$D/magisk_version.txt" 2>&1
|
||
A shell su -c "magisk --path" >"$D/magisk_path.txt" 2>&1
|
||
A shell su -c "ls -la /data/adb" >"$D/data_adb_ls.txt" 2>&1
|
||
A shell su -c "ls -la /data/adb/modules" >"$D/magisk_modules_ls.txt" 2>&1
|
||
A shell su -c "for p in /data/adb/lspd /data/misc/lsposed /data/adb/modules/zygisk_lsposed; do echo ==== \$p ====; ls -la \"\$p\" 2>&1; done" >"$D/lsposed_related_ls.txt" 2>&1
|
||
|
||
for PKG in com.lerist.fakelocation com.lerist.fakelocation.common.xposed; do
|
||
A shell su -c "find /data/data/$PKG -maxdepth 4 -type f 2>/dev/null | head -200" >"$D/find_${PKG//./_}.txt" 2>&1
|
||
A shell su -c "ls -la /data/data/$PKG/databases 2>/dev/null" >"$D/db_ls_${PKG//./_}.txt" 2>&1
|
||
done
|
||
|
||
echo "done $D"
|
||
echo "$D"
|