Android to Arduino: the code

In a follow up to the Android to Arduino post, here's the code used. The code currently takes a command from an Android app (a button press), and sends a value to the Arduino over serial. In the mean time the arduino is sending a "nop" string back to the app every second. Not much, but enough to prove input & output over serial.
Video of it working here
Arduino code:

 #include  String inData;
Servo myservo;
int pos=0;

// the setup routine runs once when you press reset:
void setup() {
  // initialize serial communication at 115200 bits per second:
  Serial.begin(115200);
  myservo.attach(14);
}

// the loop routine runs over and over again forever:
void loop() {
      while (Serial.available() > 0)
    {
        char recieved = Serial.read();
        inData += recieved; 

        // Process message when new line character is recieved
        if (recieved == '\n')
        {
            Serial.print("Arduino Received: ");
            Serial.print(inData);
           
            Serial.print("\n");
            
            inData.trim();
            int dataAsInt=inData.toInt();
            if(dataAsInt>0 && dataAsInt<360 buffer="" clear="" dataasint="" delay="" indata="" myservo.write="" nop="" pre="" recieved="" serial.println="">

The Java app is based on the example from https://github.com/mik3y/usb-serial-for-android/tree/master/UsbSerialExamples but has a button with an onClick function with mSerialIoManager.writeAsync("10\n".getBytes());

Linking Android to Arduino

I've started our latest project (to be unveiled soon). It requires Arduino to receive commands from an Android device. It needs to be as light as possible, so ideally needs to be powered from the USB connection.

I've seen a number of solutions using Android ADK and special Arduinos, but this seems rather unnecessary. The problem seems to be the USB communication on either side, requiring USB sheilds (http://www.freetronics.com/products/usbdroid#.Upz8jx8hG1E). Alternatively there's Bluetooth (http://blog.arduino.cc/2013/07/18/how-to-control-arduino-board-using-an-android-phone/), but that would mean an external power source.

So instead, just use a Serial interface. There are Java libraries that can be used on Android. Everything including examples can be found here: https://github.com/mik3y/usb-serial-for-android

 I've hooked up my arduino Uno to an SIII using an A to B USB cable and OTG cable. It all works nicely. Stay tuned for what we're going to use it for ;-)

How Many Apps are on my phone?

I've seen several people posting about how they have "over a hundred apps" on their phone. I don't think this is accurate. There are a lot of apps installed by default that the user doesn't see (and can't uninstall). Interestingly, I couldn't find a good way to display the total number of packages (apps), installed on a device using the GUI. You can list apps using Settings->Apps but this is incomplete.

Instead using a USB cable and ADB it's possible to get a clearer picture.

So the total number is more like over 300

automated odex to dex script

When grabbing a new Android device, most applications' dex files have been optimised for the device. A few people have written a guide to using smali and baksmali in this situation (http://forum.xda-developers.com/showthread.php?t=1208320), but here's a handy script to do it all. You'll need smali.jar and baksmali.jar in the local directory when you run it.

echo "+------------------------------+"
echo "+                              +"
echo "+       mass de-odexer         +"
echo "+         TROTMASTER           +"
echo "+                              +"
echo "+------------------------------+"

mkdir BOOTCLASSPATH 2>/dev/null
mkdir tobedeodexed 2>/dev/null
mkdir deodexed  2>/dev/null
#clear out the previous contents COMMENT THIS OUT IF YOU ARE USING THE SAME BOOTCLASSPATH etc.
rm BOOTCLASSPATH/* 2>/dev/null
rm tobedeodexed/*  2>/dev/null
rm deodexed/* 2>/dev/null

#get bootclasspath files TODO:get only .jar files
echo "pulling boot class path files..."
adb pull /system/framework/ BOOTCLASSPATH/ > /dev/null 2>&1

#get odexes
echo "pulling .odex files..."
for i in $(adb shell ls /system/app/*.odex | sed -e 's/odex./odex/'); do adb pull $i tobedeodexed/$(echo $i|cut -d"/" -f 4)>/dev/null 2>&1;done

#Now run smali then baksmali to change odex to dex. may need -a to change api level
for i in $(ls tobedeodexed/*.odex);do rm -R out/ 2>/dev/null; echo baksmali-ing $(echo $i|cut -d"/" -f 2);java -Xmx1024m -jar baksmali.jar  -x $i -d BOOTCLASSPATH/; echo smali-ing $(echo $i|cut -d"/" -f 2);java -Xmx1024m -jar smali.jar -o deodexed/$(echo $i| cut -d "/" -f 2).dex out;done

Settting the phone number in an android emulator

So this is another short post to help answer a question that the Internet seems to faff around with:
  "How do I set the phone number in an Android emulator?"

This was important for me as I have been producing a proof of concept app that relies on using the phone number as a way of identifying you. Rather hard if all the emulators are on the same number.

So as a result it appears that the following information can be used:
 - The number of the phone ends in the four digits relating to the port number that the emulator is listening on. So for instance when it's run on port 5554:

To change, you can run ./emulator -avd -port
There doesn't seem to be a way to set the port when using Eclipse's AVD manager, but they will at least start on incrementing ports from 5554 onwards so no chance of a collision.

android adb - daemon still not runningerror: cannot connect to daemon

For people getting:

* daemon not running. starting it now on port 5037 *
* daemon started successfully *
** daemon still not runningerror: cannot connect to daemon

Check your iptables!
if you are whitelisting INPUT on local interface, you'll get this error. You need to allow at least port 5037 through on lo.

Or if you're happy with allowing all input on lo:

sudo iptables -I INPUT -i lo -j ACCEPT

hope that saves you the hour I just wasted :-)

Android webview security loadDataWithBaseURL

A quick lesson in web views in Android. Normally they are a big risky area, be it adding JavaScript interfaces (http://labs.mwrinfosecurity.com/blog/2012/04/30/building-android-javajavascript-bridges/), or just generally enabling javascript and opening yourself up to webkit exploits (which given how little the OEMs update their firmware, is not hard to do).

So another interesting bit to concern yourself with is found on the following page's code:
http://www.androidsnippets.com/webview-with-custom-html-and-local-images

The code is as follows:

/**
 * This code loads a custom HTML from a string which references a local image
 * - for this to work, simply place the image in the directory /assets/
 */
 
public void loadHTML() {
    final String mimeType = "text/html";
    final String encoding = "utf-8";
    final String html = "

Header
Custom HTML



";
    
    WebView wv = (WebView) findViewById(R.id.wv1);
    wv.loadDataWithBaseURL("fake://not/needed", html, mimeType, encoding, "");

The problem is with the loadDataWithBaseURL's first argument. This defines how relative links on the page should be dealt with. Normally setting it to null or "" is enough, although this obviously produces invalid links. A better way is to use "file://android_asset". The problem with "fake:" is that if any other app registers for this custom url scheme, they will receive the link and start one of their activities.

Not a bad issue, unless the url has sensitive data in it right? Well as a malware writer, this is could still be useful. Imagine if this screen is part of the Facebook app and has a relative link on it, or has JavaScript that changes the window.location to a relative page. All the malware needs to do is dress the pop up screen in nice Facebook attire and ask the user to re-enter their creds. It doesn't even require the malware app to request any permissions from the user.

To fix it, just set the baseurl to null, or include a custom webview client (setWebViewClient)