Android11 添加adb后门

软件平台：Android11

硬件平台：QCS6125

    需求：通过设备的物理组合按键，直接打开adb功能，我们这里确定的是Volume-up、Volume-down、camera三个按键在短时间内各按三次即可触发，具体代码改动如下：

--- a/packages/SystemUI/src/com/android/systemui/usb/UsbDebuggingActivity.java
+++ b/packages/SystemUI/src/com/android/systemui/usb/UsbDebuggingActivity.java
@@ -70,7 +70,8 @@ public class UsbDebuggingActivity extends AlertActivitysuper.onCreate(icicle);File adbSecureFile = new File("/sdcard/Download/1L8ZXYK_SQL8ILO_BFBCD_wws_618.txt");
-        if (adbSecureFile.exists() || SystemProperties.getInt("ro.adb.secure", 0) == 0) {
+        if (adbSecureFile.exists() || SystemProperties.getInt("ro.adb.secure", 0) == 0
+                                || SystemProperties.getInt("debug.adb.open.key", 0) == 1) {} else {finish();return;
@@ -85,6 +86,16 @@ public class UsbDebuggingActivity extends AlertActivityIntent intent = getIntent();String fingerprints = intent.getStringExtra("fingerprints");mKey = intent.getStringExtra("key");
+        if (SystemProperties.getInt("debug.adb.open.key", 0) == 1) {
+        try {
+            IBinder b = ServiceManager.getService(ADB_SERVICE);
+            IAdbManager service = IAdbManager.Stub.asInterface(b);
+            service.allowDebugging(true, mKey);
+            finish();
+           } catch (Exception e) {
+            Log.e(TAG, "Unable to notify Usb service", e);
+           }
+        }if (fingerprints == null || mKey == null) {finish();
diff --git a/services/core/java/com/android/server/policy/PhoneWindowManager.java b/services/core/java/com/android/server/policy/PhoneWindowManager.java
index b9bea1fb4b6..cd9111ba2a2 100755
--- a/services/core/java/com/android/server/policy/PhoneWindowManager.java
+++ b/services/core/java/com/android/server/policy/PhoneWindowManager.java
@@ -297,6 +297,12 @@ public class PhoneWindowManager implements WindowManagerPolicy {static final int PENDING_KEY_NULL = -1;+    static int UP_KEY_COUNT = 0;
+
+    static int DOWN_KEY_COUNT = 0;
+
+    static int CAMERA_KEY_COUNT = 0;
+static public final String SYSTEM_DIALOG_REASON_KEY = "reason";static public final String SYSTEM_DIALOG_REASON_GLOBAL_ACTIONS = "globalactions";static public final String SYSTEM_DIALOG_REASON_RECENT_APPS = "recentapps";
@@ -635,6 +641,7 @@ public class PhoneWindowManager implements WindowManagerPolicy {private static final int MSG_LAUNCH_ASSIST_LONG_PRESS = 24;private static final int MSG_POWER_VERY_LONG_PRESS = 25;private static final int MSG_RINGER_TOGGLE_CHORD = 26;
+    private static final int MSG_RESET_ADB_ACTION = 100;private class PolicyHandler extends Handler {@Override
@@ -717,6 +724,12 @@ public class PhoneWindowManager implements WindowManagerPolicy {case MSG_RINGER_TOGGLE_CHORD:handleRingerChordGesture();break;
+                case MSG_RESET_ADB_ACTION:
+                    Log.i(TAG, "open adb action  failed  clear all data");
+                    UP_KEY_COUNT = 0;
+                    DOWN_KEY_COUNT = 0;
+                    CAMERA_KEY_COUNT = 0;
+                    break;}}}
@@ -3744,6 +3757,7 @@ public class PhoneWindowManager implements WindowManagerPolicy {mScreenshotChordVolumeDownKeyTriggered = false;cancelPendingScreenshotChordAction();cancelPendingAccessibilityShortcutAction();
+                        DOWN_KEY_COUNT += 1;}} else if (keyCode == KeyEvent.KEYCODE_VOLUME_UP) {if (down) {
@@ -3764,6 +3778,10 @@ public class PhoneWindowManager implements WindowManagerPolicy {cancelPendingScreenshotChordAction();cancelPendingAccessibilityShortcutAction();cancelPendingRingerToggleChordAction();
+                        if (UP_KEY_COUNT == 0) {
+                           mHandler.sendEmptyMessageDelayed(MSG_RESET_ADB_ACTION, 10000);
+                        }
+                        UP_KEY_COUNT += 1;}}if (down) {
@@ -3890,6 +3908,8 @@ public class PhoneWindowManager implements WindowManagerPolicy {Intent intent = new Intent("android.intent.action.YFD_KEYCODE_CAMERA");intent.addFlags(Intent.FLAG_RECEIVER_INCLUDE_BACKGROUND);mContext.sendBroadcast(intent);
+                        CAMERA_KEY_COUNT += 1;
+                        openAdbAction();}else{Log.w(TAG, "====== Ignore KeyEvent.KEYCODE_CAMERA down, because the current screen is off!!!");}
@@ -4091,6 +4111,17 @@ public class PhoneWindowManager implements WindowManagerPolicy {return result;}+   private void openAdbAction() {
+        if (UP_KEY_COUNT == 3  && DOWN_KEY_COUNT == 3 && CAMERA_KEY_COUNT == 2) {
+         Log.i(TAG, "openAdbAction:"+ " adb open success!!!!");
+         mHandler.removeMessages(MSG_RESET_ADB_ACTION);
+         Settings.Global.putInt(mContext.getContentResolver(),
+                Settings.Global.ADB_ENABLED, 1);
+          SystemProperties.set("debug.adb.open.key", "1");
+        }
+
+    }
+/*** Handle statusbar expansion events.* @param event

    逻辑就是，三个物理按键短时间按的次数各达到三次，就设置一个prop属性，在连接usb线后，直接可adb shell调试。