frida读取java的field或者说member variables

源代码

public final class DeviceUtil {
    private static final String TAG = "DeviceUtil";
...

js读取代码

        var DeviceUtil = Java.use('im.softs.util.DeviceUtil');      
        console.log("DeviceUtil TAG: " + DeviceUtil.TAG.value);

也就是要加上.value

菲律宾Globe卡

发表评论

1/4 Welcome to China! Great stories are waiting so travla with data romaing for as low as P99/day! Choose from Viber, Instangram, Facebook with Messenger or

2/4 all-access data roaming packs. Take your pick from promos that you can use for 1,3 or 5 days! Dial *143# and select Roaming and Intl to register.Please

3/4 ensure you’re connected to China Unicom and your phone’s APN is set to internet.globe.com.ph. For assistance, call +6327301212 toll-free using your Globe

4/4 phone.

============

1/4 Maligayang pagdating sa China! Pwede mo nang i-share ang experience mo abroad with data roaming for as low as P99/day! Pwede mong pagilian and FB w/

2/4 Messenger, Instagram, Viber o all-access data roaming packs. I-dial ang *143# at piliin ang Roaming para mag-register. Siguraduhing naka-connect ka sa

3/4 China Unicom GSM at ang APN setting ng iyong phone ay internet.globe.com.ph. Maaari ding tumawag sa +6327301212 toll-free gamit ang iyong TM phone for

4/4 more info.

充值卡使用方法：

手机拨打*143#，选择MyAccount(选择对应的数字，按回复)
选择 Load Call Card
先输入10位的call card number，再输入6位的PIN
充值成功后会有短信通知

菲律宾globe电话卡可以在中国大陆使用，漫游后的服务商为中国联通

无月租费，不使用不要钱．接收短信免费。充值后有效期为一年，充值10P可延长一年。当手机卡内余额多于60P时，在国内才可以被拨通；当余额多于120P时才可以拨出电话。

手机拨打*143#，选择MyAccount(选择对应的数字，按回复)，然后再回复2，继续回复1即可查询本机号码余额及有效期

手机卡背面”9″开头的10位数字就是电话号码，也可以插卡后查本机号码。

现在拨打 *143# 可以直接显示余额

查有效期，只能去Globe One App

联通卡写入移动数据后

发表评论

6FD9(EHPLMN) 64F010FFFFFFFFFFFFFFFFFF => 64F000FFFFFFFFFFFFFFFFFF
6F7B(FPLMN) 64F00064F02064F04064F07064F08064F03064F011FFFFFF =>
64F01064F06064F09064F03064F011FFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

6F62(HPLMNwact) 64F010400064F090400064F010800064F0908000FFFFFF0000FFFFFF0000FFFFFF0000FFFFFF0000 =>

6F61(OPLMNwact) 64F010400064F090400064F010800064F0908000FFFFFF0000

FFFFFF0000FFFFFF0000FFFFFF0000FFFFFF0000FFFFFF0000FFFFFF0000FFFFFF0000FFFFFF0000FFFFFF0000

FFFFFF0000FFFFFF0000FFFFFF0000

FFFFFF0000FFFFFF0000FFFFFF0000FFFFFF0000FFFFFF0000FFFFFF0000FFFFFF0000FFFFFF0000FFFFFF0000FFFFFF0000

       改成   64F000400064F020400064F000800064F0208000FFFFFF0000

6F60 (PLMNwact) 64F010400064F090400064F010800064F0908000FFFFFF0000FFFFFF0000FFFFFF0000FFFFFF0000

          改成 64F000400064F020400064F000800064F0208000FFFFFF0000FFFFFF0000FFFFFF0000FFFFFF0000

7F20_6F30 64F010FFFFFFFFFFFFFFFFFFFFFFFFFF

FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

FFFFFFFFFFFFFFFFFFFFFFFFFF

FFFFFFFFFFFFFFFFFFFFFFFFFFFFF
改成 64F000FFFFF

lycamobile的USSD代码

发表评论

查询本机号码

*613#

查询余额

*611#

关闭语音邮箱 (查询呼叫转移状态)

*#21#

取消无条件转接

##21#

*611*PIN#

mtk Helio A22音频驱动

发表评论

Helio A22

/dev/snd

pcmC0D10p pcmC0D14p pcmC0D17p pcmC0D1c  pcmC0D23p pcmC0D26c pcmC0D28p pcmC0D30c pcmC0D32c pcmC0D5c pcmC0D7p sequencer  
pcmC0D11p pcmC0D15c pcmC0D18c pcmC0D20p pcmC0D24p pcmC0D26p pcmC0D29p pcmC0D30p pcmC0D3c  pcmC0D5p pcmC0D8p sequencer2 
controlC0 pcmC0D12c pcmC0D16c pcmC0D18p pcmC0D21p pcmC0D25c pcmC0D27c pcmC0D2c  pcmC0D31c pcmC0D3p  pcmC0D6c pcmC0D9c timer      
pcmC0D0p  pcmC0D13c pcmC0D17c pcmC0D19p pcmC0D22c pcmC0D25p pcmC0D28c pcmC0D2p  pcmC0D31p pcmC0D4p  pcmC0D6p seq

/vendor/lib/hw/audio.primary.mt6765.so
setBGSDlMute
setBGSUlMute

platform/common/hardware/audio/V3/aud_drv/AudioALSAHardware.cpp

...
// Set BGS Mute
static String8 keySet_BGS_DL_Mute = String8("Set_BGS_DL_Mute");
static String8 keySet_BGS_UL_Mute    = String8("Set_BGS_UL_Mute");
// Set Phone Call Mute
static String8 keySet_SpeechCall_DL_Mute = String8("Set_SpeechCall_DL_Mute");
static String8 keySet_SpeechCall_UL_Mute = String8("Set_SpeechCall_UL_Mute");

...


    // Set BGS DL Mute (true) / Unmute(false)
    if (param.getInt(keySet_BGS_DL_Mute, value) == NO_ERROR)
    {
        param.remove(keySet_BGS_DL_Mute);
        ALOGD("%s(), %s", __FUNCTION__, keyValuePairs.string());
        mStreamManager->setBGSDlMute((bool)value);
    }

    // Set BGS UL Mute (true) / Unmute(false)
    if (param.getInt(keySet_BGS_UL_Mute, value) == NO_ERROR)
    {
        param.remove(keySet_BGS_UL_Mute);
        ALOGD("%s(), %s", __FUNCTION__, keyValuePairs.string());
        mStreamManager->setBGSUlMute((bool)value);
    }

    // Set SpeechCall DL Mute (true) / Unmute(false)
    if (param.getInt(keySet_SpeechCall_DL_Mute, value) == NO_ERROR)
    {
        param.remove(keySet_SpeechCall_DL_Mute);
        ALOGD("%s(), %s", __FUNCTION__, keyValuePairs.string());
        mSpeechPhoneCallController->setDlMute((bool)value);
    }

    // Set SpeechCall UL Mute (true) / Unmute(false)
    if (param.getInt(keySet_SpeechCall_UL_Mute, value) == NO_ERROR)
    {
        param.remove(keySet_SpeechCall_UL_Mute);
        ALOGD("%s(), %s", __FUNCTION__, keyValuePairs.string());
        mSpeechPhoneCallController->setUlMute((bool)value);
    }

platform/mt6735/hardware/audio/aud_drv/AudioALSAStreamOut.cpp

开启通话背景音：
　　Set_BGS_UL_Mute=0 关闭背景音上行的静音, 也就是让对方能听到
　　Set_SpeechCall_UL_Mute=1　打开mic上行的静音，　也就是让对方听不到这边mic的声音
　　Set_BGS_DL_Mute=1 开启背景音下行静音，　让自己听不到背景音

platform/mt6735/hardware/audio/aud_drv/AudioALSAStreamManager.cpp


AudioALSAStreamManager::AudioALSAStreamManager() :
    mStreamOutIndex(0),
    mStreamInIndex(0),
    mPlaybackHandlerIndex(0),
    mCaptureHandlerIndex(0),
    mSpeechPhoneCallController(AudioALSASpeechPhoneCallController::getInstance()),
    mFMController(AudioALSAFMController::getInstance()),
    mAudioALSAVolumeController(AudioVolumeFactory::CreateAudioVolumeController()),
    mSpeechDriverFactory(SpeechDriverFactory::GetInstance()),
    mAudioSpeechEnhanceInfoInstance(AudioSpeechEnhanceInfo::getInstance()),
    mMicMute(false),
    mAudioMode(AUDIO_MODE_NORMAL),
    mFilterManagerNumber(0),
    mBesLoudnessStatus(false),
    mBesLoudnessControlCallback(NULL),
//#ifdef MTK_VOW_SUPPORT  
    mAudioALSAVoiceWakeUpController(AudioALSAVoiceWakeUpController::getInstance()),
//#endif   
    mVoiceWakeUpNeedOn(false),
    mForceDisableVoiceWakeUpForSetMode(false),
    mBypassPostProcessDL(false),
    mHeadsetChange(false),
    mBGSDlGain(0xFF),
    mBGSUlGain(0),
    mBypassDualMICProcessUL(false)
{

....

mBGSDlGain 下行增益，　影响到　自己这边听到的声音大小，　最大值是0xFF(256),
mBGSUlGain 上行增益，　影响到　对方听到的声音大小，　最小值是0

所以，默认设置是　自己听得到，　对方听不到

status_t AudioALSAStreamManager::setBGSDlMute(const bool mute_on)
{
    if (mute_on)
    {
        mBGSDlGain = 0;
    }
    else
    {
        mBGSDlGain = 0xFF;
    }
    ALOGD("%s(), mute_on: %d, mBGSDlGain=0x%x", __FUNCTION__, mute_on, mBGSDlGain);

    return NO_ERROR;
}

．．．

status_t AudioALSAStreamManager::setBGSUlMute(const bool mute_on)
{
    if (mute_on)
    {
        mBGSUlGain = 0;
    }
    else
    {
        mBGSUlGain = 0xFF;
    }
    ALOGD("%s(), mute_on: %d, mBGSUlGain=0x%x", __FUNCTION__, mute_on, mBGSUlGain);

    return NO_ERROR;
}

可以通过　setBGSDlMute 函数来设置　mBGSDlGain变量的大小

hardware/audio/speech_driver/AudioALSASpeechPhoneCallController.cpp


void AudioALSASpeechPhoneCallController::setDlMute(const bool mute_on)
{

    ALOGD("%s(), new mute_on = %d, old mDlMute = %d", __FUNCTION__, mute_on, mDlMute);
    AudioAutoTimeoutLock _l(mLock);

    mSpeechDriverFactory->GetSpeechDriver()->SetDownlinkMute(mute_on);

    property_set(PROPERTY_KEY_DL_MUTE_ON, (mute_on == false) ? "0" : "1");
    mDlMute = mute_on;
}

void AudioALSASpeechPhoneCallController::setUlMute(const bool mute_on)
{
    ALOGD("+%s(), new mute_on = %d, old mULMute = %d", __FUNCTION__, mute_on, mUlMute);
    AudioAutoTimeoutLock _l(mLock);

    mSpeechDriverFactory->GetSpeechDriver()->SetUplinkSourceMute(mute_on);

    property_set(PROPERTY_KEY_UL_MUTE_ON, (mute_on == false) ? "0" : "1");
    mUlMute = mute_on;
}

platform/common/hardware/audio/V3/aud_drv/AudioALSAPlaybackHandlerVoice.cpp


...
status_t AudioALSAPlaybackHandlerVoice::open()
{
    ALOGD("+%s(), audio_mode = %d, u8BGSUlGain = %d, u8BGSDlGain = %d", __FUNCTION__, mStreamAttributeSource->audio_mode, mStreamAttributeSource->u8BGSUlGain, mStreamAttributeSource->u8BGSDlGain);

    ALOGD("%s() mStreamAttributeSource->audio_format =%d", __FUNCTION__,mStreamAttributeSource->audio_format);

    // debug pcm dump
    OpenPCMDump(LOG_TAG);


    // HW attribute config // TODO(Harvey): query this
    mStreamAttributeTarget.audio_format = AUDIO_FORMAT_PCM_16_BIT;
    mStreamAttributeTarget.audio_channel_mask = mStreamAttributeSource->audio_channel_mask; // same as source stream
    mStreamAttributeTarget.num_channels = android_audio_legacy::AudioSystem::popCount(mStreamAttributeTarget.audio_channel_mask);
    mStreamAttributeTarget.sample_rate = ChooseTargetSampleRate(mStreamAttributeSource->sample_rate); // same as source stream
    ALOGD("mStreamAttributeTarget sample_rate = %d mStreamAttributeSource sample_rate = %d",mStreamAttributeTarget.sample_rate,mStreamAttributeSource->sample_rate);
    mStreamAttributeTarget.u8BGSDlGain = mStreamAttributeSource->u8BGSDlGain;
    mStreamAttributeTarget.u8BGSUlGain = mStreamAttributeSource->u8BGSUlGain;

    // bit conversion
    initBitConverter();


    // open background sound
    mBGSPlayer->mBGSMutex.lock();

    if (mStreamAttributeTarget.num_channels > 2)
    {
        mBGSPlayer->CreateBGSPlayBuffer(
            mStreamAttributeTarget.sample_rate,
            2,
            mStreamAttributeTarget.audio_format);

    }
    else
    {
        mBGSPlayer->CreateBGSPlayBuffer(
            mStreamAttributeTarget.sample_rate,
            mStreamAttributeTarget.num_channels,
            mStreamAttributeTarget.audio_format);
    }
    mBGSPlayer->Open(SpeechDriverFactory::GetInstance()->GetSpeechDriver(), mStreamAttributeTarget.u8BGSUlGain, mStreamAttributeTarget.u8BGSDlGain);

    mBGSPlayer->mBGSMutex.unlock();

    ALOGD("-%s()", __FUNCTION__);
    return NO_ERROR;
}
....

可以看到　上下行增益　怎么传递过来的

mtk通话背景音

发表评论

vendor/mediatek/proprietary/platform/common/hardware/audio/V3/aud_drv/AudioALSAPlaybackHandlerVoice.cpp

vendor/mediatek/proprietary/platform/common/hardware/audio/V3/speech_driver/SpeechMessengerEVDO.cpp

vendor/mediatek/proprietary/platform/common/hardware/audio/V3/speech_driver/SpeechMessengerDSDA.cpp

vendor/mediatek/proprietary/platform/common/hardware/audio/V3/speech_driver/SpeechMessengerECCCI.cpp

vendor/mediatek/proprietary/platform/common/hardware/audio/V2/speech_driver/SpeechMessengerCCCI.cpp

vendor/mediatek/proprietary/platform/common/hardware/audio/V2/speech_driver/SpeechMessengerEEMCS.cpp

vendor/mediatek/proprietary/platform/common/hardware/audio/speech_driver/SpeechBGSPlayer.cpp

vendor/mediatek/proprietary/platform/mt6735/hardware/audio/speech_driver/AudioALSASpeechPhoneCallController.cpp

vendor/mediatek/proprietary/platform/common/hardware/audio/V3/include/SpeechMessengerDSDA.h

vendor/mediatek/proprietary/platform/common/hardware/audio/V3/include/SpeechMessengerECCCI.h

vendor/mediatek/proprietary/platform/common/hardware/audio/V3/include/AudioALSAPlaybackHandlerVoice.h

vendor/mediatek/proprietary/platform/common/hardware/audio/V2/include/SpeechMessengerCCCI.h

vendor/mediatek/proprietary/platform/common/hardware/audio/include/SpeechBGSPlayer.h

vendor/mediatek/proprietary/platform/common/hardware/audio/include/SpeechMessengerInterface.h

———————

vendor/mediatek/proprietary/platform/mt6735/hardware/audio/aud_drv/AudioALSAStreamOut.cpp

status_t AudioALSAStreamOut::setParameters(const String8 &keyValuePairs)

高通音频控制接口

发表评论

https://source.codeaurora.org/quic/la//kernel/msm/tree/sound/soc/msm/msm-pcm-routing.c?id=4c1e76a598cfdd12b050c2e74644c88f2fbaadab

高通的音频驱动，提供了一个ALSA控制借口

Incall_Music Audio Mixer

用来控制 CPU的 DAI　接口 MultiMedia1 和 MultiMedia2 (对应于 ALSA 设备 pcmC0D0p 和 pcmC0D1p).

可以用下面的命令来给电话的对端播放一个音频文件

tinymix 'Incall_Music Audio Mixer MultiMedia1' 1
tinymix 'Voice Tx Device Mute' 1
tinyplay /sdcard/xiao.wav

测试机器：
红米Note3 全网通 (骁龙650)
红米Note5A （骁龙425)
红米4X (骁龙435)

只是

tinymix 'Voice Tx Device Mute' 1

运行会报　　Error: invalid value

参考资料:
https://stackoverflow.com/questions/15204570/inject-uplink-audio-in-call-with-snapdragon-msm8960-soc
https://bbs.pediy.com/thread-223672.htm
https://stackoverflow.com/questions/14432521/background-music-for-call

https://android.googlesource.com/platform/hardware/qcom/audio/+/master/legacy/alsa_sound/AudioHardwareALSA.h

#define INCALLMUSIC_KEY     "incall_music_enabled"

https://android.googlesource.com/platform/hardware/qcom/audio/+/master/hal/voice_extn/voice_extn.h

#ifdef INCALL_MUSIC_ENABLED
int voice_extn_check_and_set_incall_music_usecase(struct audio_device *adev,
                                                  struct stream_out *out);
#else
static int voice_extn_check_and_set_incall_music_usecase(struct audio_device *adev __unused,
                                                         struct stream_out *out __unused)
{
    return -ENOSYS;
}
#endif

/dev/snd 下控制文件

.          comprC0D32 hwC0D104 hwC0D125 hwC0D21 hwC0D30   hwC0D40 hwC0D49 pcmC0D0c  pcmC0D13c pcmC0D1c  pcmC0D26c pcmC0D35c pcmC0D41c pcmC0D49p timer 
..         comprC0D43 hwC0D11  hwC0D126 hwC0D24 hwC0D3017 hwC0D41 hwC0D55 pcmC0D0p  pcmC0D13p pcmC0D1p  pcmC0D27c pcmC0D36p pcmC0D41p pcmC0D4p  
comprC0D15 comprC0D44 hwC0D12  hwC0D13  hwC0D25 hwC0D3033 hwC0D42 hwC0D56 pcmC0D10c pcmC0D14c pcmC0D20c pcmC0D27p pcmC0D37c pcmC0D42c pcmC0D5c  
comprC0D16 comprC0D8  hwC0D120 hwC0D14  hwC0D26 hwC0D32   hwC0D43 hwC0D71 pcmC0D10p pcmC0D17c pcmC0D21c pcmC0D2c  pcmC0D38c pcmC0D42p pcmC0D5p  
comprC0D28 controlC0  hwC0D121 hwC0D15  hwC0D27 hwC0D33   hwC0D44 hwC0D72 pcmC0D11c pcmC0D17p pcmC0D22c pcmC0D2p  pcmC0D39p pcmC0D45p pcmC0D6p  
comprC0D29 hwC0D10    hwC0D122 hwC0D16  hwC0D28 hwC0D35   hwC0D45 hwC0D87 pcmC0D11p pcmC0D18p pcmC0D23c pcmC0D33c pcmC0D3c  pcmC0D46p pcmC0D7c  
comprC0D30 hwC0D1000  hwC0D123 hwC0D2   hwC0D29 hwC0D39   hwC0D46 hwC0D88 pcmC0D12c pcmC0D19c pcmC0D24c pcmC0D33p pcmC0D3p  pcmC0D47p pcmC0D9c  
comprC0D31 hwC0D103   hwC0D124 hwC0D20  hwC0D3  hwC0D4    hwC0D48 hwC0D9  pcmC0D12p pcmC0D19p pcmC0D25c pcmC0D34c pcmC0D40c pcmC0D48p pcmC0D9p

红米6A通话背景音分析

发表评论


2018-11-18 20:08:51.063 358-1704/? D/AudioALSAPlaybackHandlerVoice: open(), audio_mode: 2, u8BGSUlGain: 0, u8BGSDlGain: 0, audio_format: 3 => 1, sample_rate: 48000 => 32000, ch: 2 => 1, buffer_size: (write)2048, (bgs)5128, flag: 0x6, mLatencyUs: 5333

高通手机芯片不支持volte的手机单电信4G数据无法入网

发表评论

比如　
红米Note3 全网通版(高通骁龙650)
一加5T (高通骁龙835)

那些支持VoLTE的手机
　　红米Note 5A ((骁龙425)
红米4X ((骁龙435)
红米Note 4X (骁龙625)
小米Max 2 (骁龙625)
联想Z5 (骁龙636)

都是可以将　电信4G　数据，写入到联通空白卡，　然后接入到　电信的4G网络的

双4G入网

发表评论

Dual Sim Dual Volte

目前移动和联通支持情况最为简单，无论移动+移动、移动+联通、联通+联通都没有任何问题，均可支持双4G网络.

Mix2S 中　唯独电信卡相对比较特殊，理论上全网通5.0电信卡作为副卡时可支持VoLTE，但由于现在中国电信的VoLTE服务还未商用，所以目前电信卡作为副卡，暂时只能停留在CDMA 1x，也就是电信2G网络.

红米Note5双电信一样只有设置为上网卡的才能接入网络，无法自动切换，而且移动+电信、联通+电信的组合中，必须把电信卡设置为上网卡才能4G，否则是2G
(支持电信双卡双待，但是不支持电信双4G)

红米6A 对电信卡删除CSIM，　那么双4G数据网也是可以实现的

软sim卡

基于高通/联发科技/紫光展锐等平台的softsim

frida读取java的field或者说member variables

菲律宾Globe卡

联通卡写入移动数据后

lycamobile的USSD代码

mtk Helio A22音频驱动

mtk通话背景音

高通音频控制接口

红米6A通话背景音分析

高通手机芯片不支持volte的手机单电信4G数据无法入网

双4G入网