Remote control your (now) headless Android phone

ADB Shell

Last night a terrible thing happened, I dropped my Razr Maxx and shattered the screen. In its defense, I have dropped it on many occasions, including (accidentaly) throwing it across a concrete garage (face down), and kicking it into a wall (from bed). Without even a scratch on the screen, it has withstood my abuse like a champ, but last night it just couldn’t handle the sharp jagged rocks that broke the screen.

Sometimes people get lucky, and even though the screen is shattered, its still usable, (albeit, touch sensitivity probably sucks after that). If that was my case… I wouldn’t have anything to write about. No… my screen no longer turned on. So now what?

Remote control it! It is an android after all (pun intended).
Heres what we need:

First thing I did was start up the Android Screencast java program. This little program detected my plugged in phone and immediately brought up my screen. Apparently  if you have a rooted device, you can also send clicks from the program. Unfortunately, my device was not rooted.

In order to send commands to your phone, you are gonna need to use the Android SDK. Once you have it installed, find the platform-tools folder, cd into it, and run:

 ./adb shell

That should bring you into a shell command to which you can send commands to your phone.

ADB Shell

ADB Shell

1
2
3
4
5
6
shell@cdma_spyder:/ $ input
usage: input ...
       input text <string>
       input keyevent <key code number or name>
       input tap <x> <y>
       input swipe <x1> <y1> <x2> <y2>

My first challenge was getting past my lock screen. I have a PIN number, which I was easily able to enter using the command:

input text 1234

Then, came the more challenging part: hitting the submit button. In order to submit my PIN, I had to guess/determine the X Y coordinates of the enter button, and send a tap via:

input tap 350 750

Remember that the Android coordinates screen starts at the top left. So, (0,0) is the top left, (MaxX, 0) is the top right, (0, MaxY) is the bottom left, and (MaxX, MaxY) is the bottom right.

In order to get the Notification Window, I had to swipe down:

input swipe 350 0 350 700

Another neat trick is sending KEYCODES via the

input keyevent

command. You can find a list of KEYCODES here. I particularly found

input keyevent 3

useful, which is the Home button.

Backing up my SMS messages

Backing up my SMS messages

Luckily, I was able to navigate through Android, launch my SMS Backup program, and backup everything I needed, eventually transfering them all to my computer.

Comments

  1. Alex says:

    Hi, can this be done when usb debugging is disabled?

    • Bryan Marty says:

      Unless you have already rooted your device, USB Debugging must be enabled to use the ADB. It may be possible to auto-enable USB Debugging by launching the phone in Recovery Mode, though I have never tried it. Depending on your model, there may be some key presses at startup that will launch the phone into recovery mode. You would want to search on Google for how to do it for your specific phone (or it might be in the User Manual).

  2. Brian says:

    Thanks for the tips here Bryan. I had a similar thing happen to my Samsung Galaxy S3.

    Unfortunately, I did not have Debugging enabled on my device :(

    I was lucky enough to stumble across this SO http://stackoverflow.com/questions/13326806/enable-usb-debugging-through-clockworkmod-with-adb/13332721#13332721 that gave me the clue on how to enable it by updating the /system/build.prop file. But, as we know, we need to mount /system as rw in order to do so.

    I was able to figure out the three button combo to get me to recovery mode, and used Google’s image search to try to determine the volume up and down keystrokes to get me to mounting the /system directory. After much trial and error, I had success! Then I issued this command in the adb shell in recovery mode:

    echo “persist.service.adb.enable=1” >> /system/build.prop

    This enables debugging mode … yay! Rebooting the device allowed me to access adb while booted normally. I was able to use androidscreencast and using your tips on adb input, some logic and guesstamation, I was able to unlock and access my device remotely successfully. I am taking a backup at this moment, hoping to be able to restore it to my new replacement phone.

    Thanks again for your tips!

    Brian

  3. Tilley says:

    Hello,
    I forgot the Screen lock PIN # to my Motorola DEFY XT running Android 2.3.7 . Unfortunately I know that this phone has Android-debugging turned off. Is there any-way to retrieve the PIN # code without erasing the data on the phone? I know it will require somehow turning ADB on, but I’m not sure about the technique. Please advise. I tried booting in Recovery mode to see if ADB would be enabled. Unfortunately it is not.

    Thanks,
    Tilley

Trackbacks

  1. […] shell access to the phone via USB. And the shell has commands to simulate key presses and touch events. Touch events require the exact screen coordinates as numbers, so as a standalone solution […]

Speak Your Mind

*

one × five =

Privacy Policy