💚 Android : Send SMS through ADB

readme.md

(Android 5)

Run :

adb shell service call isms 9 s16 "com.android.mms" s16 "123456789" s16 "null" s16 "MESSAGEBODY" s16 "null" s16 "null"

The method is :

// link : https://github.com/aosp-mirror/platform_frameworks_base/blob/lollipop-release/telephony/java/com/android/internal/telephony/ISms.aidl

void sendText(String callingPkg, in String destAddr, in String scAddr, in String text,
            in PendingIntent sentIntent, in PendingIntent deliveryIntent);

• callingPkg : SMS Package name -> "com.android.mms"

• destAddr : Receiver Number

• scAddr : Number of SMS service center --> we don't care so we put "null" to set it to default value.

• text : Message Body

• sentIntent : we don't care so we put "null" to set it to default value.

• deliveryIntent : we don't care so we put "null" to set it to default value.

---

---

(Android 6)

Run :

adb shell service call isms 7 i32 1 s16 "com.android.mms" s16 "123456789" s16 "null" s16 "MESSAGEBODY" s16 "null" s16 "null"

The method is :

// link : https://github.com/aosp-mirror/platform_frameworks_base/blob/marshmallow-release/telephony/java/com/android/internal/telephony/ISms.aidl

 void sendTextForSubscriberWithSelfPermissions(in int subId, String callingPkg,
            in String destAddr, in String scAddr, in String text, in PendingIntent sentIntent,
            in PendingIntent deliveryIntent);

• subId : SIM index ( 1 or 2 ) Not 0 and 1 !!

• callingPkg : SMS Package name -> "com.android.mms"

• destAddr : Receiver Number

• scAddr : Number of SMS service center --> we don't care so we put "null" to set it to default value.

• text : Message Body

• sentIntent : we don't care so we put "null" to set it to default value.

• deliveryIntent : we don't care so we put "null" to set it to default value.

---

---

(Android 7)

Run :

adb shell service call isms 7 i32 1 s16 "com.android.mms" s16 "123456789" s16 "null" s16 "MESSAGEBODY" s16 "null" s16 "null"

The method is :

// Line 185
// link : https://github.com/aosp-mirror/platform_frameworks_base/blob/nougat-release/telephony/java/com/android/internal/telephony/ISms.aidl

void sendTextForSubscriberWithSelfPermissions(in int subId, String callingPkg,
            in String destAddr, in String scAddr, in String text, in PendingIntent sentIntent,
            in PendingIntent deliveryIntent);

• subId : SIM index ( 1 or 2 ) Not 0 and 1 !!

• callingPkg : SMS Package name -> "com.android.mms"

• destAddr : Receiver Number

• scAddr : Number of SMS service center --> we don't care so we put "null" to set it to default value.

• text : Message Body

• sentIntent : we don't care so we put "null" to set it to default value.

• deliveryIntent : we don't care so we put "null" to set it to default value.

---

---

(Android 8)

Run :

adb shell service call isms 7 i32 0 s16 "com.android.mms.service" s16 "123456789" s16 "null" s16 "MESSAGEBODY" s16 "null" s16 "null"

The method is :

// Line 185
// link : https://github.com/aosp-mirror/platform_frameworks_base/blob/oreo-release/telephony/java/com/android/internal/telephony/ISms.aidl

void sendTextForSubscriberWithSelfPermissions(in int subId, String callingPkg,
            in String destAddr, in String scAddr, in String text, in PendingIntent sentIntent,
            in PendingIntent deliveryIntent);

• subId : SIM index ( 0 or 1 ) Not 1 and 2 !!

• callingPkg : SMS Package name -> "com.android.mms.service"

• destAddr : Receiver Number

• scAddr : Number of SMS service center --> we don't care so we put "null" to set it to default value.

• text : Message Body

• sentIntent : we don't care so we put "null" to set it to default value.

• deliveryIntent : we don't care so we put "null" to set it to default value.

---

---

Note

for other versions of android, follow this instructions:

1. find ISms.aidl for your android version from link below (change the branch - select android version): Click Here

2. find the method that sends the message : for older versions, the names are :

Android 7 : sendTextForSubscriberWithSelfPermissions(...)

Android 6 : sendTextForSubscriberWithSelfPermissions(...)

Android 5 : sendText(...)

... And so on ...

3. if you find the method, the option to send sms is the index of the method.. for example we have :

interface X {
            method_1()
            method_2()
            method_3()
            method_4()
            sendtext()
            method_5()
}

the index of sendtext() is 5. we will use number 5 in our command

adb shell service call isms 5 bla bla bla ...

also, in method params, we have 2 types : int => i32 and string => s16

for example :

void sendText(String callingPkg, in String destAddr, in String scAddr, in String text,
            in PendingIntent sentIntent, in PendingIntent deliveryIntent);

callingPkg is a string, we will use s16

adb shell service call isms 5 s16 "com.android.mms" bla bla bla ...

Another thing, if you want to use null as param, write s16 "null"

That's all..