Alternative way to obtain Android screenshot in shell?

Question

Ok, so first, I realized that one of my screen capturing apps on an Android 7 tablet, did not work (gave me a black screen capture), and then I realized this app not have the "Screen capture" permission; then I looked for this permission in Settings, but couldn't find it; then I realized, the app crashes Android causing reboot at times when you ask it to capture.

(EDIT: strangely, - in the context of the problems in this post listed later on, - when I tried taking a screenshot with press of "power button and the volume-down button", it worked fine).

So, I managed to log in to the device, where I can get root, and wanted to issue a screencap command, and it ended like this:

# screencap -p out.png
stack corruption detected
Aborted

Tried the same as a normal user, there it reported:

$ screencap -p out.png
Segmentation fault

Crap, eh? In addition I tried:

# screenrecord out.mp4

... and this crashed Android, and rebooted it.

So, getting to why screencap does not work, does not look like a trivial problem - but the device otherwise works, screen is shown, etc.

So I was wondering - is there some alternative way to grab a screen capture in this context (have root in shell on Android 7, screen is rendered and shown fine, everything apparently works, apart from screencap itself)?

( Maybe some /dev/... device node file, which when you cat, gives you the current screen contents pixel by pixel (which I imagine will require some decoding before it is viewable, but not a problem, I can use tftp to transfer files out of the device)? )

EDIT: Here is the related snippet of logcat when the screencap crash happens:

02-12 17:05:01.285 22745 22745 D AndroidRuntime: >>>>>> START com.android.internal.os.RuntimeInit uid 0 <<<<<<
02-12 17:05:01.322 22745 22745 D AndroidRuntime: CheckJNI is OFF
02-12 17:05:01.551 22745 22745 D ICU     : No timezone override file found: /data/misc/zoneinfo/current/icu/icu_tzdata.dat
02-12 17:05:01.718 22745 22745 W System  : ClassLoader referenced unknown path: /vendor/lib64
02-12 17:05:01.719 22745 22745 W System  : ClassLoader referenced unknown path: /system/lib64
02-12 17:05:01.930 22745 22745 E memtrack: Couldn't load memtrack module (No such file or directory)
02-12 17:05:01.930 22745 22745 E android.os.Debug: failed to load memtrack module: -2
02-12 17:05:01.951 22745 22745 I Radio-JNI: register_android_hardware_Radio DONE
02-12 17:05:02.092 22745 22745 D AndroidRuntime: Calling main entry com.android.commands.am.Am
02-12 17:05:02.228 22745 22745 D AndroidRuntime: Shutting down VM
02-12 17:05:02.358 18887 22754 I OpenGLRenderer: Initialized EGL, version 1.4
02-12 17:05:02.358 18887 22754 D OpenGLRenderer: Properties::enablePartialUpdates 1
02-12 17:05:02.359 18887 22754 D OpenGLRenderer: Properties::useBufferAge 1
02-12 17:05:02.359 18887 22754 D OpenGLRenderer: Default swap behavior 0
02-12 17:05:02.359 18887 22754 D OpenGLRenderer: Swap behavior 0
02-12 17:05:04.259 16803 16803 W WindowManager: Attempted to remove non-existing token: android.os.Binder@73bede4
02-12 17:05:10.741 22761 22761 D AndroidRuntime: >>>>>> START com.android.internal.os.RuntimeInit uid 0 <<<<<<
02-12 17:05:10.756 22761 22761 D AndroidRuntime: CheckJNI is OFF
02-12 17:05:10.890 22761 22761 D ICU     : No timezone override file found: /data/misc/zoneinfo/current/icu/icu_tzdata.dat
02-12 17:05:11.019 22761 22761 E memtrack: Couldn't load memtrack module (No such file or directory)
02-12 17:05:11.019 22761 22761 E android.os.Debug: failed to load memtrack module: -2
02-12 17:05:11.024 22761 22761 I Radio-JNI: register_android_hardware_Radio DONE
02-12 17:05:11.080 16562 16562 I main    : type=1400 audit(0.0:613): avc: denied { read } for path="/dev/socket/zygote" scontext=u:r:zygote:s0 tcontext=u:r:init:s0 tclass=unix_stream_socket permissive=1
02-12 17:05:11.080 16562 16562 I main    : type=1400 audit(0.0:614): avc: denied { getattr } for path="socket:[201098]" dev=sockfs ino=201098 scontext=u:r:zygote:s0 tcontext=u:r:init:s0 tclass=unix_stream_socket permissive=1
02-12 17:05:11.081 22761 22761 D AndroidRuntime: Calling main entry com.android.commands.am.Am
02-12 17:05:11.100 16562 16562 I main    : type=1400 audit(0.0:615): avc: denied { write } for path="/dev/socket/zygote" scontext=u:r:zygote:s0 tcontext=u:r:init:s0 tclass=unix_stream_socket permissive=1
02-12 17:05:11.118 16803 16855 I ActivityManager: Start proc 22770:android.process.media/u0a10 for broadcast com.android.providers.media/.MediaScannerReceiver
02-12 17:05:11.189 22770 22770 W System  : ClassLoader referenced unknown path: /system/priv-app/MediaProvider/lib/arm
02-12 17:05:11.293 22770 22783 D libEGL  : loaded /vendor/lib/egl/libEGL_tegra.so
02-12 17:05:11.306 22770 22783 D libEGL  : loaded /vendor/lib/egl/libGLESv1_CM_tegra.so
02-12 17:05:11.310 22770 22770 W System  : ClassLoader referenced unknown path: /system/priv-app/DownloadProvider/lib/arm
02-12 17:05:11.312 22770 22770 D ApplicationLoaders: ignored Vulkan layer search path /system/priv-app/DownloadProvider/lib/arm:/system/priv-app/DownloadProvider/DownloadProvider.apk!/lib/armeabi-v7a:/system/lib:/vendor/lib for namespace 0xa8751090
02-12 17:05:11.479 22770 22783 D libEGL  : loaded /vendor/lib/egl/libGLESv2_tegra.so
02-12 17:05:11.560 22770 22770 D MediaScannerReceiver: action: android.intent.action.MEDIA_SCANNER_SCAN_FILE path: /
02-12 17:05:11.562 16803 16852 I ActivityManager: Killing 19204:com.android.packageinstaller/u0a17 (adj 906): empty #17
02-12 17:05:11.564 22761 22761 D AndroidRuntime: Shutting down VM
02-12 17:05:11.579 16803 17333 D GraphicsStats: Buffer count: 7
02-12 17:05:11.580 16803 17283 D ActivityManager: cleanUpApplicationRecord -- 19204
02-12 17:05:11.603 22757 22757 F libc    : stack corruption detected
02-12 17:05:11.603 22757 22757 F libc    : Fatal signal 6 (SIGABRT), code -6 in tid 22757 (screencap)
02-12 17:05:11.604   127   127 W         : debuggerd: handling request: pid=22757 uid=0 gid=0 tid=22757
02-12 17:05:11.662 22787 22787 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
02-12 17:05:11.663 22787 22787 F DEBUG   : Build fingerprint: 'samsung/GT-P7500/GT-P7500:4.0.4/IMM76D/XXLQ8:user/release-keys'
02-12 17:05:11.663 22787 22787 F DEBUG   : Revision: '14'
02-12 17:05:11.663 22787 22787 F DEBUG   : ABI: 'arm'
02-12 17:05:11.664 22787 22787 F DEBUG   : pid: 22757, tid: 22757, name: screencap  >>> screencap <<<
02-12 17:05:11.664 22787 22787 F DEBUG   : signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr --------
02-12 17:05:11.683 22787 22787 F DEBUG   : Abort message: 'stack corruption detected'
02-12 17:05:11.683 22787 22787 F DEBUG   :     r0 00000000  r1 000058e5  r2 00000006  r3 00000008
02-12 17:05:11.683 22787 22787 F DEBUG   :     r4 a9bb957c  r5 00000006  r6 a9bb9524  r7 0000010c
02-12 17:05:11.683 22787 22787 F DEBUG   :     r8 beb7ba33  r9 00000001  sl 00000500  fp 00000005
02-12 17:05:11.683 22787 22787 F DEBUG   :     ip 00000016  sp beb7b760  lr a8f2b477  pc a8f2dccc  cpsr 000f0010
02-12 17:05:11.705 22787 22787 F DEBUG   : 
02-12 17:05:11.705 22787 22787 F DEBUG   : backtrace:
02-12 17:05:11.705 22787 22787 F DEBUG   :     #00 pc 0004cccc  /system/lib/libc.so (tgkill+12)
02-12 17:05:11.705 22787 22787 F DEBUG   :     #01 pc 0004a473  /system/lib/libc.so (pthread_kill+34)
02-12 17:05:11.705 22787 22787 F DEBUG   :     #02 pc 0001c649  /system/lib/libc.so (raise+10)
02-12 17:05:11.705 22787 22787 F DEBUG   :     #03 pc 00018169  /system/lib/libc.so (__libc_android_abort+34)
02-12 17:05:11.705 22787 22787 F DEBUG   :     #04 pc 00016910  /system/lib/libc.so (abort+4)
02-12 17:05:11.705 22787 22787 F DEBUG   :     #05 pc 0001a627  /system/lib/libc.so (__libc_fatal+22)
02-12 17:05:11.705 22787 22787 F DEBUG   :     #06 pc 0004b183  /system/lib/libc.so (__stack_chk_fail+6)
02-12 17:05:11.705 22787 22787 F DEBUG   :     #07 pc 00001765  /system/bin/screencap
02-12 17:05:11.705 22787 22787 F DEBUG   :     #08 pc 00016061  /system/lib/libc.so (__libc_init+48)
02-12 17:05:11.705 22787 22787 F DEBUG   :     #09 pc 00001344  /system/bin/screencap
02-12 17:05:11.767 16803 16921 W NativeCrashListener: Couldn't find ProcessRecord for pid 22757
02-12 17:05:11.767 22787 22787 E         : AM data write failed: Broken pipe
02-12 17:05:11.769   127   127 W         : debuggerd: resuming target 22757
02-12 17:05:11.771 16803 16859 I BootReceiver: Copying /data/tombstones/tombstone_05 to DropBox (SYSTEM_TOMBSTONE)

not sure if related but there is Xposed module DisableFlagSecure which allows me to take screenshots of any screen (even forbidden apps like banking) — alecxs, Feb 12 '22 at 15:38

score 1 · Answer 1 · answered Feb 12 '22 at 16:52

Well, turns out there is a something that can be attempted - copy the device framebuffer - but it still did not result with full device screenshot for me.

Why is the FrameBuffer missing on some Android devices?

in Android it’s /dev/graphics/fbX, usually /dev/graphics/fb0`

for me:

 ls -la /dev/graphics/                                                                   
total 0
drwxr-xr-x  2 root root          80 2022-02-12 13:09 .
drwxr-xr-x 18 root root        2560 2022-02-12 13:10 ..
crw-rw----  1 root graphics 29,   0 2022-02-12 13:09 fb0
crw-rw----  1 root graphics 29,   1 2022-02-12 13:09 fb1

https://www.kernel.org/doc/html/latest/fb/framebuffer.html

The frame buffer devices are also normal memory devices, this means, you can read and write their contents. You can, for example, make a screen snapshot by:
cp /dev/fb0 myfile

And finally https://stackoverflow.com/questions/12456174/how-to-convert-a-raw-rgb-frame-buffer-file-to-a-viewable-format/16936538#16936538 :

To not re-invent the wheel, I tried to re-use existing tool: ...

I called the script from that post get_android_fb_format.sh, you might need to change the main line to this:

    ffmpeg -f rawvideo -pix_fmt $item -s $FB_RESOLUTION -i androidFB $OUTPUT_DIR/$item.png

So, trying from PC:

$ adb pull /dev/graphics/fb0 androidFB
adb: error: failed to copy '/dev/graphics/fb0' to 'androidFB': remote open failed: Permission denied

Cannot - must do as root from device:

# cd /sdcard/Download
# cp /dev/graphics/fb0 androidFB

... that worked; then on PC - adb pull line saves a file called androidFB on device, on which I run the script:

$ adb pull /sdcard/Download/androidFB
$ bash get_android_fb_format.sh

I get a folder fbresult/ created, where different attempts at decoding can be seen. Here's the interesting part:

For me, /dev/graphics/fb0 held the Samsung boot logo (I got the correct decoding, but liked this one):
However, /dev/graphics/fb1 is always blank

So, probably this is not the right thing - to go back to Why is the FrameBuffer missing on some Android devices?:

No android app handles directly /dev/fb0, does it exist or not
...
Not even the Surface Flinger can see the /dev/fb0 directly.

Alternative way to obtain Android screenshot in shell?

1 Answers1