💚 Android : Send SMS through ADB

readme.md

(Android 5)

Run :

adb shell service call isms 9 s16 "com.android.mms" s16 "123456789" s16 "null" s16 "MESSAGEBODY" s16 "null" s16 "null"

The method is :

// link : https://github.com/aosp-mirror/platform_frameworks_base/blob/lollipop-release/telephony/java/com/android/internal/telephony/ISms.aidl

void sendText(String callingPkg, in String destAddr, in String scAddr, in String text,
            in PendingIntent sentIntent, in PendingIntent deliveryIntent);

• callingPkg : SMS Package name -> "com.android.mms"

• destAddr : Receiver Number

• scAddr : Number of SMS service center --> we don't care so we put "null" to set it to default value.

• text : Message Body

• sentIntent : we don't care so we put "null" to set it to default value.

• deliveryIntent : we don't care so we put "null" to set it to default value.

---

---

(Android 6)

Run :

adb shell service call isms 7 i32 1 s16 "com.android.mms" s16 "123456789" s16 "null" s16 "MESSAGEBODY" s16 "null" s16 "null"

The method is :

// link : https://github.com/aosp-mirror/platform_frameworks_base/blob/marshmallow-release/telephony/java/com/android/internal/telephony/ISms.aidl

 void sendTextForSubscriberWithSelfPermissions(in int subId, String callingPkg,
            in String destAddr, in String scAddr, in String text, in PendingIntent sentIntent,
            in PendingIntent deliveryIntent);

• subId : SIM index ( 1 or 2 ) Not 0 and 1 !!

• callingPkg : SMS Package name -> "com.android.mms"

• destAddr : Receiver Number

• scAddr : Number of SMS service center --> we don't care so we put "null" to set it to default value.

• text : Message Body

• sentIntent : we don't care so we put "null" to set it to default value.

• deliveryIntent : we don't care so we put "null" to set it to default value.

---

---

(Android 7)

Run :

adb shell service call isms 7 i32 1 s16 "com.android.mms" s16 "123456789" s16 "null" s16 "MESSAGEBODY" s16 "null" s16 "null"

The method is :

// Line 185
// link : https://github.com/aosp-mirror/platform_frameworks_base/blob/nougat-release/telephony/java/com/android/internal/telephony/ISms.aidl

void sendTextForSubscriberWithSelfPermissions(in int subId, String callingPkg,
            in String destAddr, in String scAddr, in String text, in PendingIntent sentIntent,
            in PendingIntent deliveryIntent);

• subId : SIM index ( 1 or 2 ) Not 0 and 1 !!

• callingPkg : SMS Package name -> "com.android.mms"

• destAddr : Receiver Number

• scAddr : Number of SMS service center --> we don't care so we put "null" to set it to default value.

• text : Message Body

• sentIntent : we don't care so we put "null" to set it to default value.

• deliveryIntent : we don't care so we put "null" to set it to default value.

---

---

(Android 8)

Run :

adb shell service call isms 7 i32 0 s16 "com.android.mms.service" s16 "123456789" s16 "null" s16 "MESSAGEBODY" s16 "null" s16 "null"

The method is :

// Line 185
// link : https://github.com/aosp-mirror/platform_frameworks_base/blob/oreo-release/telephony/java/com/android/internal/telephony/ISms.aidl

void sendTextForSubscriberWithSelfPermissions(in int subId, String callingPkg,
            in String destAddr, in String scAddr, in String text, in PendingIntent sentIntent,
            in PendingIntent deliveryIntent);

• subId : SIM index ( 0 or 1 ) Not 1 and 2 !!

• callingPkg : SMS Package name -> "com.android.mms.service"

• destAddr : Receiver Number

• scAddr : Number of SMS service center --> we don't care so we put "null" to set it to default value.

• text : Message Body

• sentIntent : we don't care so we put "null" to set it to default value.

• deliveryIntent : we don't care so we put "null" to set it to default value.

---

---

Note

for other versions of android, follow this instructions:

1. find ISms.aidl for your android version from link below (change the branch - select android version): Click Here

2. find the method that sends the message : for older versions, the names are :

Android 7 : sendTextForSubscriberWithSelfPermissions(...)

Android 6 : sendTextForSubscriberWithSelfPermissions(...)

Android 5 : sendText(...)

... And so on ...

3. if you find the method, the option to send sms is the index of the method.. for example we have :

interface X {
            method_1()
            method_2()
            method_3()
            method_4()
            sendtext()
            method_5()
}

the index of sendtext() is 5. we will use number 5 in our command

adb shell service call isms 5 bla bla bla ...

also, in method params, we have 2 types : int => i32 and string => s16

for example :

void sendText(String callingPkg, in String destAddr, in String scAddr, in String text,
            in PendingIntent sentIntent, in PendingIntent deliveryIntent);

callingPkg is a string, we will use s16

adb shell service call isms 5 s16 "com.android.mms" bla bla bla ...

Another thing, if you want to use null as param, write s16 "null"

That's all..

Needed this feature for android 4.1
I've tried the command below but unfortunately no success was made

adb shell service call isms 5 s16 "com.android.mms" s16 "+14254254254" s16 "06254254254254" s16 "Hello world !" i32 0 i32 0

Note: numbers are actually sample.

After running the command above output was like this:

Result: Parcel(fffffffc ffffffff   '........')

Also checked my SMSC number and I'm sure they're correct. ( I've tried null for SMSC too, still no success)

Any help would be appreciated.

(Android 10)
I am using the following:

adb shell service call isms 7 i32 0 s16 "com.android.mms.service" s16 "%num%" s16 "null" s16 "'%THISMSG%'" s16 "null" s16 "null"

Wondering if there is a limit on the message size. I did some experiments and when I add another word on the message, the sending fails. It seems that the limit is 70 (?) chars. I used just simple characters. Any info available?

Android 13 in Windows CMD, on Unix you may remove the surrounding quotes of message.

adb shell service call isms 5 i32 0 s16 "com.android.mms.service" s16 "null" s16 "PHONE_NUMBER" s16 "null" s16 "'MESSAGE'" s16 "null" s16 "null" i32 0 i64 0

void sendTextForSubscriber(in int subId, String callingPkg, String callingAttributionTag,
            in String destAddr, in String scAddr, in String text, in PendingIntent sentIntent,
            in PendingIntent deliveryIntent, in boolean persistMessageForNonDefaultSmsApp,
            in long messageId);