Java中执行shell笔记

提示：扫一扫查出行
【扫一扫了解最新限行尾号】
复制提示

在java中执行shell有好几种方式：第一种（exec）方式一

public
static
synchronized
void runshell2()
{
File superuser = new File("/system/bin/superuser");
if (superuser.exists())
{
// return device to original state
Process process;
try
{
process = Runtime.getRuntime().exec("superuser");
DataOutputStream os = new DataOutputStream(process.getOutputStream());
os.writeBytes("mount -oremount,rw /dev/block/mtdblock3 /system\n");
os.writeBytes("busybox cp /system/bin/superuser /system/bin/su\n");
os.writeBytes("busybox chown 0:0 /system/bin/su\n");
os.writeBytes("chmod 4755 /system/bin/su\n");
os.writeBytes("rm /system/bin/superuser\n");
os.writeBytes("/system/bin/monkey -v 100\n");
os.writeBytes("exit\n");
os.flush();
} catch (Exception e)
{
// TODO Auto-generated catch block
e.printStackTrace();
}
}
}

第一种（exec）方式二：

public
static
synchronized
void runshell3()
{
String cmd = "sendkey 3 2\n";
try
{
Process exeEcho = Runtime.getRuntime().exec("su");
exeEcho.getOutputStream().write(cmd.getBytes());
exeEcho.getOutputStream().flush();
} catch (IOException e)
{
//showMessage("Excute exception: " + e.getMessage());
e.printStackTrace();
}
}

第二种方式一：

public
static
synchronized
void runShell() {
ProcessBuilder pb = new ProcessBuilder("/system/bin/sh");
// java.lang.ProcessBuilder: Creates operating system processes.
pb.directory(new File("/system/bin"));// 设置shell的当前目录。
try {
Process proc = pb.start();
// 获取输入流，可以通过它获取SHELL的输出。
BufferedReader in = new BufferedReader(new InputStreamReader(proc.getInputStream()));
BufferedReader err = new BufferedReader(new InputStreamReader(proc.getErrorStream()));
// 获取输出流，可以通过它向SHELL发送命令。
PrintWriter out = new PrintWriter(new BufferedWriter(new OutputStreamWriter(proc.getOutputStream())), true);
out.println("pwd");
out.println("su root");// 执行这一句时会弹出对话框（以下程序要求授予最高权限...），要求用户确认。
// out.println("cat /proc/version");
// out.println("monkey -v 500");
// out.println("cd /data/data");//这个目录在系统中要求有root权限才可以访问的。
// out.println("ls -l");//这个命令如果能列出当前安装的APK的数据文件存放目录，就说明我们有了ROOT权限。
out.println("exit");
// proc.waitFor();
String line;
while ((line = in.readLine()) != null) {
System.out.println(line); // 打印输出结果
}
while ((line = err.readLine()) != null) {
System.out.println(line); // 打印错误输出结果
}
in.close();
out.close();
proc.destroy();
} catch (Exception e) {
System.out.println("exception:" + e);
}
}

第二种方式二：

/**
* 执行一个shell命令，并返回字符串值
*
* @param cmd
* 命令名称&参数组成的数组（例如：{"/system/bin/cat", "/proc/version"}）
* @param workdirectory
* 命令执行路径（例如："system/bin/"）
* @return 执行结果组成的字符串
* @throws IOException
*/
public
static
synchronized String run(String[] cmd, String workdirectory) {
StringBuffer result = new StringBuffer();
try {
ProcessBuilder builder = new ProcessBuilder(cmd);
InputStream in = null;
// 设置一个路径（绝对路径了就不一定需要）
if (workdirectory != null) {
// 设置工作目录（同上）
builder.directory(new File(workdirectory));
// 合并标准错误和标准输出
builder.redirectErrorStream(true);
// 启动一个新进程
Process process = builder.start();
// 读取进程标准输出流
in = process.getInputStream();
byte[] re = new
byte[1024];
while (in.read(re) != -1) {
result = result.append(new String(re));
}
}
// 关闭输入流
if (in != null) {
in.close();
}
} catch (Exception ex) {
ex.printStackTrace();
}
return result.toString();
}

笔记：

今天使用第一种，发现了以下问题：

/**
* 执行shell
*
* @return 0:成功，其它为失败。
*/
public
static
synchronized
int runShellCmd() {
BufferedReader input = null;
PrintWriter output = null;
Process pro = null;
try {
pro = Runtime.getRuntime().exec("adb shell ");
input = new BufferedReader(new InputStreamReader(pro.getInputStream()));
pro.getOutputStream().write("pidof mediaserver\r\n".getBytes());
pro.getOutputStream().flush();
String line = input.readLine();
int pid = 0;
/**
* 按道理说直接执行命令打印是这样的：
* root@android:/ # adb shell
* root@android:/ # pidof mediaserver
* 7114
* 也就是说第三行就应该是我取到的pid值，但是实际上却是5行？
*/
for (int i = 0; i < 6; i++) {
Log.e(TAG , i + " line is " + line);
pid = toInt(line, 0);
if (pid > 0)
break;
line = input.readLine();
}
Log.e(TAG, "pid:" + pid);
/**
* 实际打印如下：
* E/MainActivity( 7036): 0 line is pidof mediaserver
* E/MainActivity( 7036): 1 line is
* E/MainActivity( 7036): 2 line is root@android:/ # pidof mediaserver
* E/MainActivity( 7036): 3 line is
* E/MainActivity( 7036): 4 line is 6946
* E/MainActivity( 7036): pid:6946
* 为什么会多出2个空行？？
*/
if (pid == 0) {
throw
new IOException("not find mediaserver process!");
}
String killCmd = String.format("kill -9 %d\r\n", pid);
/**
* 直接这么使用不行的，不知道什么原因，执行结果死活不对。
*/
pro.getOutputStream().write(killCmd.getBytes());
pro.getOutputStream().flush();
/**
* 再一次这么重开就ok了，谁能告诉我原因？
*/
pro.destroy();
pro = null;
pro = Runtime.getRuntime().exec("adb shell ");
pro.getOutputStream().write(killCmd.getBytes());
pro.getOutputStream().flush();
} catch (IOException ex) {
ex.printStackTrace();
return -1;
} finally {
try {
if (input != null) {
input.close();
}
if (output != null) {
output.close();
}
} catch (IOException e) {
e.printStackTrace();
}
if (pro != null) {
pro.destroy();
pro = null;
}
}
return 0;
}

我去看看源码是怎么样的！

Runtime的exec最终调用的是ProcessManager,代码如下所示：

/**
* Executes the specified command and its arguments in a separate native
* process. The new process uses the environment provided in {@code envp}
* and the working directory specified by {@code directory}.
*
* @param progArray
* the array containing the program to execute as well as any
* arguments to the program.
* @param envp
* the array containing the environment to start the new process
* in.
* @param directory
* the directory in which to execute the program. If {@code null},
* execute if in the same directory as the parent process.
* @return the new {@code Process} object that represents the native
* process.
* @throws IOException
* if the requested program can not be executed.
* @throws SecurityException
* if the current {@code SecurityManager} disallows program
* execution.
* @see SecurityManager#checkExec
* @since Android 1.0
*/
public Process exec(String[] progArray, String[] envp, File directory) throws IOException {
// BEGIN android-changed: push responsibility for argument checking into ProcessManager
return ProcessManager.getInstance().exec(progArray, envp, directory, false);
// END android-changed
}

ProcessManager的exec代码如下：

/**
* Map from pid to Process. We keep weak references to the Process objects
* and clean up the entries when no more external references are left. The
* process objects themselves don't require much memory, but file
* descriptors (associated with stdin/out/err in this case) can be
* a scarce resource.
*/
private
final Map<Integer, ProcessReference> processReferences
= new HashMap<Integer, ProcessReference>();
/**
* Executes a process and returns an object representing it.
*/
Process exec(String[] taintedCommand, String[] taintedEnvironment, File workingDirectory,
boolean redirectErrorStream) throws IOException {
// Make sure we throw the same exceptions as the RI.
if (taintedCommand == null) {
throw
new NullPointerException();
}
if (taintedCommand.length == 0) {
throw
new IndexOutOfBoundsException();
}
// Handle security and safety by copying mutable inputs and checking them.
String[] command = taintedCommand.clone();
String[] environment = taintedEnvironment != null ? taintedEnvironment.clone() : null;
SecurityManager securityManager = System.getSecurityManager();
if (securityManager != null) {
securityManager.checkExec(command[0]);//权限检查
}
// Check we're not passing null Strings to the native exec.
for (String arg : command) {
if (arg == null) {
throw
new NullPointerException();
}
}
// The environment is allowed to be null or empty, but no element may be null.
if (environment != null) {
for (String env : environment) {
if (env == null) {
throw
new NullPointerException();
}
}
}
FileDescriptor in = new FileDescriptor();
FileDescriptor out = new FileDescriptor();
FileDescriptor err = new FileDescriptor();
String workingPath = (workingDirectory == null)
? null
: workingDirectory.getPath();
// Ensure onExit() doesn't access the process map before we add our
// entry.
synchronized (processReferences) {
int pid;
try {
/**
* 调用exec函数
*/
pid = exec(command, environment, workingPath, in, out, err, redirectErrorStream);
} catch (IOException e) {
IOException wrapper = new IOException("Error running exec()."
+ " Command: " + Arrays.toString(command)
+ " Working Directory: " + workingDirectory
+ " Environment: " + Arrays.toString(environment));
wrapper.initCause(e);
throw wrapper;
}
/**
* 新建一个进程实现。
*/
ProcessImpl process = new ProcessImpl(pid, in, out, err);
/**
* 创建一个进程引用。
*/
ProcessReference processReference
= new ProcessReference(process, referenceQueue);
/**
* 加入到全局进程引用map中。
*/
processReferences.put(pid, processReference);
/*
* This will wake up the child monitor thread in case there
* weren't previously any children to wait on.
*/
processReferences.notifyAll();
return process;
}
}

本地exec的原型：

/**
* Executes a native process. Fills in in, out, and err and returns the
* new process ID upon success.
*/
static
native
int exec(String[] command, String[] environment,
String workingDirectory, FileDescriptor in, FileDescriptor out,
FileDescriptor err, boolean redirectErrorStream) throws IOException;

对应的native文件为：

//Android 4.0.3在
./libcore/luni/src/main/native/java_lang_ProcessManager.cpp
//Android 2.2在
./dalvik/libcore/luni-kernel/src/main/native/java_lang_ProcessManager.cpp
//源码为:
/**
* Converts Java String[] to char** and delegates to executeProcess().
*/
static pid_t java_lang_ProcessManager_exec(
JNIEnv* env, jclass clazz, jobjectArray javaCommands,
jobjectArray javaEnvironment, jstring javaWorkingDirectory,
jobject inDescriptor, jobject outDescriptor, jobject errDescriptor,
jboolean redirectErrorStream) {
// Copy commands into char*[].
char** commands = convertStrings(env, javaCommands);
// Extract working directory string.
const
char* workingDirectory = NULL;
if (javaWorkingDirectory != NULL) {
workingDirectory = env->GetStringUTFChars(javaWorkingDirectory, NULL);
}
// Convert environment array.
char** environment = convertStrings(env, javaEnvironment);
//关键就这一行.
pid_t result = executeProcess(
env, commands, environment, workingDirectory,
inDescriptor, outDescriptor, errDescriptor, redirectErrorStream);
// Temporarily clear exception so we can clean up.
jthrowable exception = env->ExceptionOccurred();
env->ExceptionClear();
freeStrings(env, javaEnvironment, environment);
// Clean up working directory string.
if (javaWorkingDirectory != NULL) {
env->ReleaseStringUTFChars(javaWorkingDirectory, workingDirectory);
}
freeStrings(env, javaCommands, commands);
// Re-throw exception if present.
if (exception != NULL) {
if (env->Throw(exception) < 0) {
LOGE("Error rethrowing exception!");
}
}
return result;
}

看看executeProcess接口,其实源码注释写的很清楚。

/** Executes a command in a child process. */
static pid_t executeProcess(JNIEnv* env, char** commands, char** environment,
const
char* workingDirectory, jobject inDescriptor,
jobject outDescriptor, jobject errDescriptor,
jboolean redirectErrorStream) {
int i, result, error;
// Create 4 pipes: stdin, stdout, stderr, and an exec() status pipe.
int pipes[PIPE_COUNT * 2] = { -1, -1, -1, -1, -1, -1, -1, -1 };
for (i = 0; i < PIPE_COUNT; i++) {
if (pipe(pipes + i * 2) == -1) {
jniThrowIOException(env, errno);
closePipes(pipes, -1);
return -1;
}
}
int stdinIn = pipes[0];
int stdinOut = pipes[1];
int stdoutIn = pipes[2];
int stdoutOut = pipes[3];
int stderrIn = pipes[4];
int stderrOut = pipes[5];
int statusIn = pipes[6];
int statusOut = pipes[7];
pid_t childPid = fork();
// If fork() failed...
if (childPid == -1) {
jniThrowIOException(env, errno);
closePipes(pipes, -1);
return -1;
}
// If this is the child process...
if (childPid == 0) {
/*
* Note: We cannot malloc() or free() after this point!
* A no-longer-running thread may be holding on to the heap lock, and
* an attempt to malloc() or free() would result in deadlock.
*/
// Replace stdin, out, and err with pipes.
dup2(stdinIn, 0);
dup2(stdoutOut, 1);
if (redirectErrorStream) {
dup2(stdoutOut, 2);
} else {
dup2(stderrOut, 2);
}
// Close all but statusOut. This saves some work in the next step.
closePipes(pipes, statusOut);
// Make statusOut automatically close if execvp() succeeds.
fcntl(statusOut, F_SETFD, FD_CLOEXEC);
// Close remaining open fds with the exception of statusOut.
closeNonStandardFds(statusOut);
// Switch to working directory.
if (workingDirectory != NULL) {
if (chdir(workingDirectory) == -1) {
goto execFailed;
}
}
// Set up environment.
if (environment != NULL) {
environ = environment;
}
// Execute process. By convention, the first argument in the arg array
// should be the command itself. In fact, I get segfaults when this
// isn't the case.
execvp(commands[0], commands);
// If we got here, execvp() failed or the working dir was invalid.
execFailed:
error = errno;
write(statusOut, &error, sizeof(int));
close(statusOut);
exit(error);
}
// This is the parent process.
// Close child's pipe ends.
close(stdinIn);
close(stdoutOut);
close(stderrOut);
close(statusOut);
// Check status pipe for an error code. If execvp() succeeds, the other
// end of the pipe should automatically close, in which case, we'll read
// nothing.
int count = read(statusIn, &result, sizeof(int));
close(statusIn);
if (count > 0) {
jniThrowIOException(env, result);
close(stdoutIn);
close(stdinOut);
close(stderrIn);
return -1;
}
// Fill in file descriptor wrappers.
jniSetFileDescriptorOfFD(env, inDescriptor, stdoutIn);
jniSetFileDescriptorOfFD(env, outDescriptor, stdinOut);
jniSetFileDescriptorOfFD(env, errDescriptor, stderrIn);
return childPid;
}

至此，Runtime的exec就全部结束了。如果对下面的fork，execvp这2个函数不了解。建议看看APU。

最后来看看ProcessBuilder类的实现：

/**
* Starts a new process based on the current state of this process builder.
*
* @return the new {@code Process} instance.
* @throws NullPointerException
* if any of the elements of {@link #command()} is {@code null}.
* @throws IndexOutOfBoundsException
* if {@link #command()} is empty.
* @throws SecurityException
* if {@link SecurityManager#checkExec(String)} doesn't allow
* process creation.
* @throws IOException
* if an I/O error happens.
*/
public Process start() throws IOException {
// BEGIN android-changed: push responsibility for argument checking into ProcessManager
String[] cmdArray = command.toArray(new String[command.size()]);
String[] envArray = new String[environment.size()];
int i = 0;
for (Map.Entry<String, String> entry : environment.entrySet()) {
envArray[i++] = entry.getKey() + "=" + entry.getValue(); //$NON-NLS-1$
}
//和Runtime.exec的一样。
return ProcessManager.getInstance().exec(cmdArray, envArray, directory, redirectErrorStream);
// END android-changed
}