Run `drozer [COMMAND] --help` for more usage information.
Commands: console start the drozer Console module manage drozer modules server start a drozer Server ssl manage drozer SSL key material exploit generate an exploit to deploy drozer agent create custom drozer Agents payload generate payloads to deploy drozer
Starts a new drozer Console to interact with an Agent.
The drozer Console connects to an Agent and allows you to interact with the system from the context of the agent application on the device. The console can connect directly to an agent, if its embedded server is enabled, or through a drozer Server that the agent is connected to.
positional arguments: command the command to execute device the unique identifier of the Agent to connect to
optional arguments: -h, --help show this help message and exit --server HOST[:PORT] specify the address and port of the drozer server --ssl connect with SSL --accept-certificate accept any SSL certificate with a valid trust chain --debug enable debug mode --no-color disable syntax highlighting in drozer output --password the agent requires a password -c ONECMD, --command ONECMD specify a single command to run in the session -f [FILE [FILE ...]], --file [FILE [FILE ...]] source file
available commands: commands shows a list of all console commands connect starts a new session with a device devices lists all devices bound to the drozer server disconnect disconnects a drozer session version display the installed drozer version
dz> list app.activity.forintent Find activities that can handle the given intent app.activity.info Gets information about exported activities. app.activity.start Start an Activity app.broadcast.info Get information about broadcast receivers app.broadcast.send Send broadcast using an intent app.broadcast.sniff Register a broadcast receiver that can sniff particular intents app.package.attacksurface Get attack surface of package app.package.backup Lists packages that use the backup API (returns true on FLAG_ALLOW_BACKUP) app.package.debuggable Find debuggable packages app.package.info Get information about installed packages app.package.launchintent Get launch intent of package app.package.list List Packages app.package.manifest Get AndroidManifest.xml of package app.package.native Find Native libraries embedded in the application. app.package.shareduid Look for packages with shared UIDs app.provider.columns List columns in content provider app.provider.delete Delete from a content provider app.provider.download Download a file from a content provider that supports files app.provider.finduri Find referenced content URIs in a package app.provider.info Get information about exported content providers app.provider.insert Insert into a Content Provider app.provider.query Query a content provider app.provider.read Read from a content provider that supports files app.provider.update Update a record in a content provider app.service.info Get information about exported services app.service.send Send a Message to a service, and display the reply app.service.start Start Service app.service.stop Stop Service auxiliary.webcontentresolver Start a web service interface to content providers. exploit.jdwp.check Open @jdwp-control and see which apps connect exploit.pilfer.general.apnprovider Reads APN content provider exploit.pilfer.general.settingsprovider Reads Settings content provider information.datetime Print Date/Time information.deviceinfo Get verbose device information information.permissions Get a list of all permissions used by packages on the device scanner.activity.browsable Get all BROWSABLE activities that can be invoked from the web browser scanner.misc.native Find native components included in packages scanner.misc.readablefiles Find world-readable files in the given folder scanner.misc.secretcodes Search for secret codes that can be used from the dialer scanner.misc.sflagbinaries Find suid/sgid binaries in the given folder (default is /system). scanner.misc.writablefiles Find world-writable files in the given folder scanner.provider.finduris Search for content providers that can be queried from our context. scanner.provider.injection Test content providers for SQL injection vulnerabilities. scanner.provider.sqltables Find tables accessible through SQL injection vulnerabilities. scanner.provider.traversal Test content providers for basic directory traversal vulnerabilities. shell.exec Execute a single Linux command. shell.send Send an ASH shell to a remote listener. shell.start Enter into an interactive Linux shell. tools.file.download Download a File tools.file.md5sum Get md5 Checksum of file tools.file.size Get size of file tools.file.upload Upload a File tools.setup.busybox Install Busybox. tools.setup.minimalsu Prepare 'minimal-su' binary installation on the device.
shell 进入Drozer Agent App的shell交互界面
1 2
dz> shell u0_a343@g3:/data/data/com.mwr.dz $
5.5 工具功能
5.5.1 列出模拟器设备中所有已经安装的App包列表
run app.package.list
5.5.2 列举APP的详细信息：
在文章第一部分我们安装了新浪微博，这里便以微博为例： 利用关键词“weibo”进行搜索得出包名：
1 2 3
dz> run app.package.list -f weibo com.sina.weibo (微博) dz>
Apply Changes使配置生效，账户输入密码后便开始下载语言文件： 
下载完成后把Chines拖到第一项（位于English前一位），把中文作为系统语言首选项。重启系统后，配置生效。也可以通过下面的步骤修改系统配置文件把中文作为首选项：
