解决Android模拟器中修改IMSI后无法上网问题

发表于 | 分类于 | 425
字数统计 3.3k | 阅读时长 18

0x00 前言

百度百科中对IMSI的介绍如下：

国际移动用户识别码（IMSI：International Mobile Subscriber Identification Number）是区别移动用户的标志，储存在SIM卡中，可用于区别移动用户的有效信息。其总长度不超过15位，同样使用0~9的数字。其中MCC是移动用户所属国家代号，占3位数字，中国的MCC规定为460；MNC是移动网号码，由两位或者三位数字组成，中国移动的移动网络编码（MNC）为00；用于识别移动用户所归属的移动通信网；MSIN是移动用户识别码，用以识别某一移动通信网中的移动用户。

通过IMSI可以知道移动用户所在的国家。在Android中可以通过以下方法获取设备的IMSI号：

  1. TelephonyManager telephonyManager= (TelephonyManager)getSystemService(Context.TELEPHONY_SERVICE);
  2. String android_imsi = telephonyManager.getSubscriberId();
  COPY

Android模拟器中默认使用的IMSI是：310260000000000。其中，310代表美国，260代表T-Mobile US。事实上，我们期望在模拟器上获取的IMSI应当以460开头（460代表中国）。

0x01 问题定位

但是，这串数字是硬编码在模拟器中的，路径是external/qemu/android/telephony/modem.c，只能通过修改模拟器源码来实现。

  1. #define  OPERATOR_HOME_MCC   310
  2. #define  OPERATOR_HOME_MNC   260
  3. #define  OPERATOR_HOME_MCCMNC  STRINGIFY(OPERATOR_HOME_MCC) \
  4.                                STRINGIFY(OPERATOR_HOME_MNC)
  5. { "+CIMI", OPERATOR_HOME_MCCMNC "0000000000", NULL },   /* request internation subscriber identification number */
  COPY

将以上代码改为：

  1. #define  OPERATOR_HOME_MCC   460 //中国
  2. #define  OPERATOR_HOME_MNC   00  //移动
  3. #define  OPERATOR_HOME_MCCMNC  STRINGIFY(OPERATOR_HOME_MCC) \
  4.                                STRINGIFY(OPERATOR_HOME_MNC)
  5. { "+CIMI", OPERATOR_HOME_MCCMNC "00000000000", NULL }
  COPY

重新编译，运行，使用getSubscriberId获取的值的确变成了我们期望的值：460000000000000
，但是出现了新的问题：模拟器不能上网了。一番Google之后，发现也有别人遇到了这个问题，但是也没有找到好的解决方法。

于是，决定自己寻找原因，从TelephonyManager一路翻下去，最终到ril层，也没有看出问题出在哪儿。但是，直觉告诉我，问题应当出在APN上。

Android系统中APN的配置信息是在/system/etc/apns-conf.xml中。下面是模拟器中默认的APN配置。

  1. <!-- use empty string to specify no proxy or port -->
  2. <!-- This version must agree with that in apps/common/res/apns.xml -->
  3. <apns version="8">
  4.     <apn carrier="T-Mobile US"
  5.          mcc="310"
  6.          mnc="260"
  7.          apn="epc.tmobile.com"
  8.          user="none"
  9.          server="*"
  10.          password="none"
  11.          mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
  12.     />
  14.     <apn carrier="T-Mobile US 250"
  15.          mcc="310"
  16.          mnc="250"
  17.          apn="epc.tmobile.com"
  18.          user="none"
  19.          server="*"
  20.          password="none"
  21.          mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
  22.             />
  24.     <apn carrier="T-Mobile US 660"
  25.          mcc="310"
  26.          mnc="660"
  27.          apn="epc.tmobile.com"
  28.          user="none"
  29.          server="*"
  30.          password="none"
  31.          mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
  32.             />
  34.     <apn carrier="T-Mobile US 230"
  35.          mcc="310"
  36.          mnc="230"
  37.          apn="epc.tmobile.com"
  38.          user="none"
  39.          server="*"
  40.          password="none"
  41.          mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
  42.             />
  44.     <apn carrier="T-Mobile US 310"
  45.          mcc="310"
  46.          mnc="310"
  47.          apn="epc.tmobile.com"
  48.          user="none"
  49.          server="*"
  50.          password="none"
  51.          mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
  52.             />
  54.     <apn carrier="T-Mobile US 580"
  55.          mcc="310"
  56.          mnc="580"
  57.          apn="epc.tmobile.com"
  58.          user="none"
  59.          server="*"
  60.          password="none"
  61.          mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
  62.             />
  64.     <apn carrier="T-Mobile US 240"
  65.          mcc="310"
  66.          mnc="240"
  67.          apn="epc.tmobile.com"
  68.          user="none"
  69.          server="*"
  70.          password="none"
  71.          mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
  72.             />
  74.     <apn carrier="T-Mobile US 800"
  75.          mcc="310"
  76.          mnc="800"
  77.          apn="epc.tmobile.com"
  78.          user="none"
  79.          server="*"
  80.          password="none"
  81.          mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
  82.             />
  84.     <apn carrier="T-Mobile US 210"
  85.          mcc="310"
  86.          mnc="210"
  87.          apn="epc.tmobile.com"
  88.          user="none"
  89.          server="*"
  90.          password="none"
  91.          mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
  92.             />
  94.     <apn carrier="T-Mobile US 160"
  95.          mcc="310"
  96.          mnc="160"
  97.          apn="epc.tmobile.com"
  98.          user="none"
  99.          server="*"
  100.          password="none"
  101.          mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
  102.             />
  104.     <apn carrier="T-Mobile US 270"
  105.          mcc="310"
  106.          mnc="270"
  107.          apn="epc.tmobile.com"
  108.          user="none"
  109.          server="*"
  110.          password="none"
  111.          mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
  112.             />
  114.     <apn carrier="T-Mobile US 200"
  115.          mcc="310"
  116.          mnc="200"
  117.          apn="epc.tmobile.com"
  118.          user="none"
  119.          server="*"
  120.          password="none"
  121.          mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
  122.             />
  124.     <apn carrier="T-Mobile US 220"
  125.          mcc="310"
  126.          mnc="220"
  127.          apn="epc.tmobile.com"
  128.          user="none"
  129.          server="*"
  130.          password="none"
  131.          mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
  132.             />
  134.     <apn carrier="T-Mobile US 490"
  135.          mcc="310"
  136.          mnc="490"
  137.          apn="epc.tmobile.com"
  138.          user="none"
  139.          server="*"
  140.          password="none"
  141.          mmsc="http://mms.msg.eng.t-mobile.com/mms/wapenc"
  142.             />
  144.     <!-- T-Mobile Europe -->
  145.     <apn carrier="T-Mobile UK"
  146.          mcc="234"
  147.          mnc="30"
  148.          apn="general.t-mobile.uk"
  149.          user="t-mobile"
  150.          password="tm"
  151.          server="*"
  152.          mmsproxy="149.254.201.135"
  153.          mmsport="8080"
  154.          mmsc="http://mmsc.t-mobile.co.uk:8002"
  155.     />
  157.     <apn carrier="T-Mobile D"
  158.          mcc="262"
  159.          mnc="01"
  160.          apn="internet.t-mobile"
  161.          user="t-mobile"
  162.          password="tm"
  163.          server="*"
  164.          mmsproxy="172.028.023.131"
  165.          mmsport="8008"
  166.          mmsc="http://mms.t-mobile.de/servlets/mms"
  167.     />
  169.     <apn carrier="T-Mobile A"
  170.          mcc="232"
  171.          mnc="03"
  172.          apn="gprsinternet"
  173.          user="t-mobile"
  174.          password="tm"
  175.          server="*"
  176.          mmsproxy="010.012.000.020"
  177.          mmsport="80"
  178.          mmsc="http://mmsc.t-mobile.at/servlets/mms"
  179.          type="default,supl"
  180.     />
  182.     <apn carrier="T-Mobile A MMS"
  183.          mcc="232"
  184.          mnc="03"
  185.          apn="gprsmms"
  186.          user="t-mobile"
  187.          password="tm"
  188.          server="*"
  189.          mmsproxy="010.012.000.020"
  190.          mmsport="80"
  191.          mmsc="http://mmsc.t-mobile.at/servlets/mms"
  192.          type="mms"
  193.     />
  195.     <apn carrier="T-Mobile CZ"
  196.          mcc="230"
  197.          mnc="01"
  198.          apn="internet.t-mobile.cz"
  199.          user="wap"
  200.          password="wap"
  201.          server="*"
  202.          mmsproxy="010.000.000.010"
  203.          mmsport="80"
  204.          mmsc="http://mms"
  205.          type="default,supl"
  206.     />
  208.     <apn carrier="T-Mobile CZ MMS"
  209.          mcc="230"
  210.          mnc="01"
  211.          apn="mms.t-mobile.cz"
  212.          user="mms"
  213.          password="mms"
  214.          server="*"
  215.          mmsproxy="010.000.000.010"
  216.          mmsport="80"
  217.          mmsc="http://mms"
  218.          type="mms"
  219.     />
  221.     <apn carrier="T-Mobile NL"
  222.          mcc="204"
  223.          mnc="16"
  224.          apn="internet"
  225.          user="*"
  226.          password="*"
  227.          server="*"
  228.          mmsproxy="010.010.010.011"
  229.          mmsport="8080"
  230.          mmsc="http://t-mobilemms"
  231.          type="default,supl"
  232.     />
  234.     <apn carrier="T-Mobile NL MMS"
  235.          mcc="204"
  236.          mnc="16"
  237.          apn="mms"
  238.          user="tmobilemms"
  239.          password="tmobilemms"
  240.          server="*"
  241.          mmsproxy="010.010.010.011"
  242.          mmsport="8080"
  243.          mmsc="http://t-mobilemms"
  244.          type="mms"
  245.     />
  246. </apns>
  COPY

可以看出，这里是没有国内运营商的配置的。我从小米手机中提取出的国内运营商配置。

  1. <apn carrier="中国移动 (China Mobile) GPRS"
  2.     mcc="460"
  3.     mnc="00"
  4.     apn="cmnet"
  5.     type="default,supl"
  6. />
  8. <apn carrier="中国移动 (China Mobile) WAP"
  9.     mcc="460"
  10.     mnc="00"
  11.     apn="cmwap"
  12.     port="80"
  13.     proxy="10.0.0.172"
  14.     type="default,supl"
  15. />
  17. <apn carrier="中国移动彩信 (China Mobile)"
  18.     mcc="460"
  19.     mnc="00"
  20.     apn="cmwap"
  21.     mmsc="http://mmsc.monternet.com"
  22.     mmsport="80"
  23.     mmsproxy="10.0.0.172"
  24.     port="80"
  25.     proxy="10.0.0.172"
  26.     type="mms"
  27. />
  29. <apn carrier="沃3G连接互联网 (China Unicom)"
  30.     mcc="460"
  31.     mnc="01"
  32.     apn="3gnet"
  33.     type="default,supl"
  34. />
  36. <apn carrier="沃3G手机上网 (China Unicom)"
  37.     mcc="460"
  38.     mnc="01"
  39.     apn="3gwap"
  40.     port="80"
  41.     proxy="10.0.0.172"
  42.     type="default,supl"
  43. />
  45. <apn carrier="联通彩信 (China Unicom)"
  46.     mcc="460"
  47.     mnc="01"
  48.     apn="3gwap"
  49.     mmsc="http://mmsc.myuni.com.cn"
  50.     mmsport="80"
  51.     mmsproxy="10.0.0.172"
  52.     type="mms"
  53. />
  55. <apn carrier="中国移动 (China Mobile) GPRS"
  56.     mcc="460"
  57.     mnc="02"
  58.     apn="cmnet"
  59.     type="default,supl"
  60. />
  62. <apn carrier="中国移动 (China Mobile) WAP"
  63.     mcc="460"
  64.     mnc="02"
  65.     apn="cmwap"
  66.     port="80"
  67.     proxy="10.0.0.172"
  68.     type="default,supl"
  69. />
  71. <apn carrier="中国移动彩信 (China Mobile)"
  72.     mcc="460"
  73.     mnc="02"
  74.     apn="cmwap"
  75.     mmsc="http://mmsc.monternet.com"
  76.     mmsport="80"
  77.     mmsproxy="10.0.0.172"
  78.     port="80"
  79.     proxy="10.0.0.172"
  80.     type="mms"
  81. />
  COPY

添加到apns-conf.xml中，重启模拟器，能识别出“中国移动”了，但依然不能上网。

此时，我想到通过对比默认情况和修改后的radio日志，来分析原因。

使用

adb logcat -b radio

命令可以查查看ril相关的日志。接着，就发现了如下两条日志：

D/DCT ( 1739): [0]createAllApnList: selection=numeric = ‘460000’
D/DCT ( 1739): [0]createAllApnList: No APN found for carrier: 460000

注意到这里的460000，正确的应该是46000，多了一个0。由于美国的MNC是3个字符，而中国的MNC是2个字符，所以导致这里多了一个字符。来看下源码在这里是怎么实现的。

/frameworks/opt/telephony/src/java/com/android/internal/telephony/dataconnection/DcTracker.java

  1. /**
  2.  * Based on the sim operator numeric, create a list for all possible
  3.  * Data Connections and setup the preferredApn.
  4.  */
  5. private void createAllApnList() {
  6.     mAllApnSettings = new ArrayList<ApnSetting>();
  7.     IccRecords r = mIccRecords.get();
  8.     String operator = (r != null) ? r.getOperatorNumeric() : "";
  9.     if (operator != null) {
  10.         String selection = "numeric = '" + operator + "'";
  11.         // query only enabled apn.
  12.         // carrier_enabled : 1 means enabled apn, 0 disabled apn.
  13.         // selection += " and carrier_enabled = 1";
  14.         if (DBG) log("createAllApnList: selection=" + selection);
  16.         Cursor cursor = mPhone.getContext().getContentResolver().query(
  17.                 Telephony.Carriers.CONTENT_URI, null, selection, null, null);
  19.         if (cursor != null) {
  20.             if (cursor.getCount() > 0) {
  21.                 mAllApnSettings = createApnList(cursor);
  22.             }
  23.             cursor.close();
  24.         }
  25.     }
  27.     addEmergencyApnSetting();
  29.     dedupeApnSettings();
  31.     if (mAllApnSettings.isEmpty()) {
  32.         if (DBG) log("createAllApnList: No APN found for carrier: " + operator);
  33.         mPreferredApn = null;
  34.         // TODO: What is the right behavior?
  35.         //notifyNoData(DataConnection.FailCause.MISSING_UNKNOWN_APN);
  36.     } else {
  37.         mPreferredApn = getPreferredApn();
  38.         if (mPreferredApn != null && !mPreferredApn.numeric.equals(operator)) {
  39.             mPreferredApn = null;
  40.             setPreferredApn(-1);
  41.         }
  42.         if (DBG) log("createAllApnList: mPreferredApn=" + mPreferredApn);
  43.     }
  44.     if (DBG) log("createAllApnList: X mAllApnSettings=" + mAllApnSettings);
  46.     setDataProfilesAsNeeded();
  47. }
  COPY

getOperatorNumeric的实现是在/frameworks/opt/telephony/src/java/com/android/internal/telephony/uicc/SIMRecords.java中。

  1. @Override
  2. public String getOperatorNumeric() {
  3.     if (mImsi == null) {
  4.         log("getOperatorNumeric: IMSI == null");
  5.         return null;
  6.     }
  7.     if (mMncLength == UNINITIALIZED || mMncLength == UNKNOWN) {
  8.         log("getSIMOperatorNumeric: bad mncLength");
  9.         return null;
  10.     }
  12.     // Length = length of MCC + length of MNC
  13.     // length of mcc = 3 (TS 23.003 Section 2.2)
  14.     return mImsi.substring(0, 3 + mMncLength);
  15. }
  COPY

可见，numeric的长度是受mMncLength控制的，而mMncLength的值是从SIM卡中读出来的。

  1. case EVENT_GET_AD_DONE:
  2.     try {
  3.         isRecordLoadResponse = true;
  5.         ar = (AsyncResult)msg.obj;
  6.         data = (byte[])ar.result;
  8.         if (ar.exception != null) {
  9.             break;
  10.         }
  12.         log("EF_AD: " + IccUtils.bytesToHexString(data));
  14.         if (data.length < 3) {
  15.             log("Corrupt AD data on SIM");
  16.             break;
  17.         }
  19.         if (data.length == 3) {
  20.             log("MNC length not present in EF_AD");
  21.             break;
  22.         }
  24.         mMncLength = data[3] & 0xf;
  25.         log("setting4 mMncLength=" + mMncLength);
  27.         if (mMncLength == 0xf) {
  28.             mMncLength = UNKNOWN;
  29.             log("setting5 mMncLength=" + mMncLength);
  30.         }
  31.     }
  COPY

最终定位到模拟器中的external/qemu/android/telephony/sim_card.c中。

  1.     { "+CRSM=192,28589,0,0,15", "+CRSM: 144,0,000000046fad04000aa0aa01020000" },
  2.     { "+CRSM=176,28589,0,0,4",  "+CRSM: 144,0,00000003" },
  COPY

将00000003改成00000002，重新编译，运行，终于可以正常上网了。

0x02 解决更新问题

此时，对于新创建的模拟器已经正常了，但是对于存量模拟器，由于telephony.db数据库中的carriers表中的数据没有更新，因此重启后还是不能上网。

查看carriers表中的内容可以在adb shell中执行命令：
content query --uri content://telephony/carriers

/packages/providers/TelephonyProvider/src/com/android/providers/telephony/TelephonyProvider.java

  1. @Override
  2. public void onCreate(SQLiteDatabase db) {
  3.     if (DBG) log("dbh.onCreate:+ db=" + db);
  4.     createSimInfoTable(db);
  5.     createCarriersTable(db);
  6.     initDatabase(db);
  7.     if (DBG) log("dbh.onCreate:- db=" + db);
  8. }
  10. private void initDatabase(SQLiteDatabase db) {
  11.     if (VDBG) log("dbh.initDatabase:+ db=" + db);
  12.     // Read internal APNS data
  13.     Resources r = mContext.getResources();
  14.     XmlResourceParser parser = r.getXml(com.android.internal.R.xml.apns);
  15.     int publicversion = -1;
  16.     try {
  17.         XmlUtils.beginDocument(parser, "apns");
  18.         publicversion = Integer.parseInt(parser.getAttributeValue(null, "version"));
  19.         loadApns(db, parser);
  20.     } catch (Exception e) {
  21.         loge("Got exception while loading APN database." + e);
  22.     } finally {
  23.         parser.close();
  24.     }
  26.     // Read external APNS data (partner-provided)
  27.     XmlPullParser confparser = null;
  28.     // Environment.getRootDirectory() is a fancy way of saying ANDROID_ROOT or "/system".
  29.     File confFile = new File(Environment.getRootDirectory(), PARTNER_APNS_PATH);
  30.     File oemConfFile =  new File(Environment.getOemDirectory(), OEM_APNS_PATH);
  31.     if (oemConfFile.exists()) {
  32.         // OEM image exist APN xml, get the timestamp from OEM & System image for comparison
  33.         long oemApnTime = oemConfFile.lastModified();
  34.         long sysApnTime = confFile.lastModified();
  35.         if (DBG) log("APNs Timestamp: oemTime = " + oemApnTime + " sysTime = "
  36.                 + sysApnTime);
  38.         // To get the latest version from OEM or System image
  39.         if (oemApnTime > sysApnTime) {
  40.             if (DBG) log("APNs Timestamp: OEM image is greater than System image");
  41.             confFile = oemConfFile;
  42.         }
  43.     } else {
  44.         // No Apn in OEM image, so load it from system image.
  45.         if (DBG) log("No APNs in OEM image = " + oemConfFile.getPath() +
  46.                 " Load APNs from system image");
  47.     }
  49.     FileReader confreader = null;
  50.     if (DBG) log("confFile = " + confFile);
  51.     try {
  52.         confreader = new FileReader(confFile);
  53.         confparser = Xml.newPullParser();
  54.         confparser.setInput(confreader);
  55.         XmlUtils.beginDocument(confparser, "apns");
  57.         // Sanity check. Force internal version and confidential versions to agree
  58.         int confversion = Integer.parseInt(confparser.getAttributeValue(null, "version"));
  59.         if (publicversion != confversion) {
  60.             throw new IllegalStateException("Internal APNS file version doesn't match "
  61.                     + confFile.getAbsolutePath());
  62.         }
  64.         loadApns(db, confparser);
  65.     } catch (FileNotFoundException e) {
  66.         // It's ok if the file isn't found. It means there isn't a confidential file
  67.         // Log.e(TAG, "File not found: '" + confFile.getAbsolutePath() + "'");
  68.     } catch (Exception e) {
  69.         loge("Exception while parsing '" + confFile.getAbsolutePath() + "'" + e);
  70.     } finally {
  71.         try { if (confreader != null) confreader.close(); } catch (IOException e) { }
  72.     }
  73.     if (VDBG) log("dbh.initDatabase:- db=" + db);
  75. }
  77. private DatabaseHelper mOpenHelper;
  79. private void restoreDefaultAPN(int subId) {
  80.     SQLiteDatabase db = mOpenHelper.getWritableDatabase();
  82.     try {
  83.         db.delete(CARRIERS_TABLE, null, null);
  84.     } catch (SQLException e) {
  85.         loge("got exception when deleting to restore: " + e);
  86.     }
  87.     setPreferredApnId((long)-1, subId);
  88.     mOpenHelper.initDatabase(db);
  89. }
  COPY

可以看出，在restoreDefaultAPN的时候可以重新初始化CARRIERS_TABLE。也就说，只要进入APN界面，点击右上角菜单 => 重置为默认设置，就可以解决存量设备的上网问题了。

0x03 解决方法总结

  1. 修改模拟器源码modem.c中的MCC和MNC
  2. 修改模拟器源码sim_card.c中控制mMncLength的值
  3. 修改Android镜像中的/system/etc/apns-conf.xml，添加国内运营商的配置信息
  4. 存量设备更新APN
分享

Related Issues not found

Please contact @drunkdream to initialize the comment