Skip to content

Instantly share code, notes, and snippets.

@brandon15811
Created April 16, 2014 03:55
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save brandon15811/10804891 to your computer and use it in GitHub Desktop.
Save brandon15811/10804891 to your computer and use it in GitHub Desktop.
Script for easy tcpdump to wireshark on android
#!/bin/bash -xe
nc_running()
{
NC_RUN=$(adb shell busybox ps -w | grep "NCRUN='1'" > /dev/null 2>&1; echo $?)
}
tcpdump_running()
{
TCP_RUN=$(adb shell busybox ps -w | grep -v "NCRUN='1'" | grep 'TCPRUN="1"' > /dev/null 2>&1; echo $?)
}
if [ "$1" == "start" ]; then
nc_running
if [ "$NC_RUN" -eq 0 ]; then
echo "nc and tcpdump are already started"
exit 1
fi
adb shell "NCRUN='1' /data/local/bin/nc -ll -p 11233 -e sh -c 'TCPRUN=\"1\" /data/local/bin/tcpdump -n -s 0 -w - 2>/dev/null'" &
elif [ "$1" == "stop" ]; then
NC_GREP=$(adb shell busybox ps -w | grep "NCRUN='1'" > /dev/null 2>&1; echo $?)
if [ "$NC_GREP" -eq 0 ]; then
NC_PID=$(adb shell busybox ps -w | grep "NCRUN='1'" | cut -d ' ' -f 1)
adb shell kill -9 $NC_PID
else
echo "nc and tcp aren't started"
fi
elif [ "$1" == "wireshark" ]; then
TEMPNAME=/tmp/tmp.$RANDOM-wireand
TEMPFILE=$(mkfifo $TEMPNAME)
adb forward tcp:11233 tcp:11233
nc -d 127.0.0.1 11233 > $TEMPNAME &
TEMP_PID=$!
cat $TEMPNAME | wireshark -k -S -i -
kill $TEMP_PID
rm $TEMPNAME
else
echo "Enter start, stop, or wireshark"
exit 1
fi
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment