问题描述
如何在三星手机上以编程方式打开 Android ServiceMode 菜单?
手动，我可以通过拨打 ussd 代码 *#0011# 来完成.
How to open the Android ServiceMode menu programmatically on Samsung Phones ?
Manually, I can do it by dialing the ussd code *#0011#.
推荐答案
这是一个挑战，我花了几个小时寻找解决方案.但恐怕我没有好消息.
This was a challenge and I've been a few hours looking for a solution. But i am afraid i don't have good news.
1.第一次尝试，Intent.ACTION_DIAL
确实，一开始可以直接从应用程序调用 USSD 代码(使用 Intent.ACTION_DIAL 意图)，甚至可以从网站调用，只需使用tel:"模式即可.这将打开拨号器，输入所需的号码.当您输入最后一个 # 时，代码会自动发送，这对用户来说几乎是透明的，不需要用户进行交互.但这实际上被认为是系统的一个漏洞，因为有人可以编写恶意软件，甚至更多，在网站中插入恶意代码，甚至可以擦除您的手机或阻止 SIM 卡.您可以阅读相关内容，例如在此链接中截至 2012 年 9 月，三星似乎终于修复了该漏洞 例如，您的 S3 无法做到这一点.在这一点上，很难找到任何仍然易受攻击的设备.
Is true that in the beginning, it was possible to directly call USSD codes from an app (using the intent Intent.ACTION_DIAL), and even from a website, just using the "tel:" schema. That opens the dialer, an puts the desired number. As when you put the last #, the code get send automatically, it was almost transparent to the user, whose interaction wasn't required. But that was actually considered a vulnerability of the system, since somebody could write malicious software, or even more, insert malicious code in a website that could even wipe your phone or block the sim card. You can read about this, for example in this linkAs of September 2012, it seems that Samsung finally fixed that vulnerability so for instance your S3 is not capable of that. At this point it will be hard to find any device still vulnerable.
2.第二次尝试，解决方法
好吧，Android 中的一切都是一个应用程序，甚至手机本身也是一个应用程序.那么，为什么我们不能尝试复制它的代码呢?实际上，当用户手动发送 ussd 时会发生什么?有太多可能的答案:
Ok everything in Android is an app, even the phone itself is an app. So, why couldn't we try to replicate its code? And actually, what happens when the user manually sends a ussd?There was too possible answers:
- 手机将代码发送给提供商并等待响应，或者
- 手机在本地做一些事情
易于测试:我将手机置于飞行模式，所以如果它必须发送代码，希望它不会发送.正如我所料:我拨了代码，ServiceMode 屏幕出现了！而且它是空的，所以我们可以说拨号器打开了一个系统应用程序，这个应用程序调用了提供者.很容易找出哪个是这个应用程序.在三星设备中，至少在 S4 中，它的名称是 ServiceMode.您可以在 Settings > 中找到它.应用程序管理器全部.因此，我们可以尝试通过以下方式之一了解它是如何启动的:
Easy to test: I put my phone in flight mode, so if it has to send a code, hopefully it wont be able to. It was as i expected: i dialed the code, and the ServiceMode screen appeared! And it was empty, so we can say that the dialer opens a system application, and this application calls the provider.Its easy to find out which is this application. In Samsung devices, at least in S4, its name is ServiceMode. You can find it at Settings > Application manager > All. So we can try to find out how it is launched more by means of one of this:
2.1.读取手机应用代码
我试过了，但一开始很混乱，所以我去了选项 2
I tried, but it was pretty confusing at the beginning, so i went to option 2
2.2.检查服务模式应用
我打开了 ES 文件浏览器 > 应用管理器.连接了手机，在手机/备份/应用程序中，我有 servicestatus apk.几分钟后或逆向工程之后，我得到了清单文件，就像以前一样具有启发性.在那里我可以看到一堆活动，还有一些广播接收器.我不知道我更害怕什么.
I opened ES file explorer > app manager.connected the phone, and in phone/backups/apps i had the servicestatus apk.a few minutes or inverse engineering after, i had the manifest file, as revealing as it uses to be. There i could see a bunch of activities, and also a few broadcast receivers. I didn't know what i was more afraid of.
2.2.1 让我们尝试活动.
既然我们知道我们可以从另一个应用程序打开一个特定的应用程序，我将尝试编写一个简单的应用程序，打开其中一个活动.这很简单:
Since we know we can open an specific application from another, i will try to write a simple app, that open one of this activities. This is as simple as:
Intent i= new Intent(Intent.Action_MAIN);
i.setClass( "package name", "class name");
startActivity(i);
由于此应用不打算从启动器图标打开，因此它没有带有意图过滤器的活动，让我们知道它是主要活动.所以我必须至少尝试其中的几个.但无论如何，我看到了我不喜欢的东西.稍后我会告诉你.
Since this app is not meant to be open from a launcher icon, it has not an activity with an intent filter that let us know that it is the main activity. So i have to try at least a few of them. But anyways, i saw something i didn't like. I will tell you later.
我试过了，但正如我所料，我无法打开该活动.我得到一个活动未找到异常.因此，让我们尝试使用接收器.至少这会很有趣.
I tried, but, as i expected, i cannot open that activities. I get an activity not found exception. So, lets try with a receiver. At least this will be fun.
2.2.2 让我们试试接收器.
有几个，但我特别喜欢有这个意图过滤器的一个:
There is a few, but specially i liked one with this intent-filter:
<intent-filter>
<action android:name="android.provider.Telephony.SECRET_CODE" />
...
看起来不错.我去了 Telephony.java，在那里我可以看到:
Looks good. I went yo Telephony.java, and there i could see this:
/**
* Broadcast Action: A "secret code" has been entered in the dialer. Secret codes are
* of the form *#*#<code>#*#*. The intent will have the data URI:</p>
*
* <p><code>android_secret_code://<code></code></p>
*/
public static final String SECRET_CODE_ACTION =
"android.provider.Telephony.SECRET_CODE";
看起来不错，它是一个特定的意图，可能我们需要的架构不是tel:"而是android_secret_code://"，并且代码可能必须采用不同的内部格式.我尝试过，或多或少只是为了好玩，因为我知道我在活动中看到了同样的问题，是这样的:
Looks great, its an specific intent, probably the schema we need is not "tel:" but "android_secret_code://" and probably the codes has to be in a different internal format.I tried, more or less just for fun, since i knew that there is the same problem i saw in the activities, and is this:
<permission android:name="com.sec.android.app.servicemodeapp.permission.KEYSTRING" android:protectionLevel="signatureOrSystem" />
应用声明了这个权限，每个组件都使用它.所以，或者你知道如何声明和设置签名，或者你是一个系统应用程序.否则您根本无法与此应用互动.
当然，您甚至无法考虑创建自己的服务模式应用程序，因为如果不是系统应用程序，您就不会与提供者进行这种通信(因为您必须通过一些固件应用程序，这些应用程序会说悲伤的你以为你是谁")
Of course you couldn't even think about creating your own servicemode app, since you wouldn't perform that kind of communication with the provider without being a system app (since you have to pass through some firmware apps that will say a sad "who do you think you are")
在他看来，我们无能为力，至少对于三星手机，我们可以认为其他手机都是一样的.
There is nothing we can do at his point, at least with a Samsung phone, and we can think every other phone will be the same.
嗯，实际上没有一个很好.但是让我们看看:
Well, actually none really good. But lets see:
替代方案 1. 寻找另一种 ussd 代码
我们知道有两种 USSD.一个是当你拨最后一个#号时自动触发动作，另一个是需要你按下通话键.
We know that there is 2 kind of USSD. The ones that when you dial the last #, the action is automatically triggered, and the other, which require that you press the call button.
如果您尝试使用第三方拨号程序，您可以看到
If you try with a third-party dialer, you can see that
- 当你拨打第一种类型的代码时，根本没有触发任何东西(只有固件拨号器可以触发它们)
- 您可以使用其他类型(输入代码 + 按呼叫).我想这意味着这种代码风险较小，因为它不会更改设备中的任何内容，因此是允许的.
- 当然，如果您输入第一种类型的代码并按调用，则会出现错误，因为该代码不能那样工作.
因此，如果第三方可以发送这种类型的代码，那么每个应用都可以.因此，如果您可以尝试找到在用户按下通话按钮后触发的那种类型的替代 ussd 代码，您就可以实现您的需求.在这种情况下，您应该使用 Intent.ACTION_CALL 意图
So, if a third-party can send that type of codes, every app could. So If you could try to find an alternative ussd code, of that type that are triggered after the usser press the call button, you could achieve your what you need. In that case, you should use an Intent.ACTION_CALL intent
//如果您使用 ACTION_DIAL 意图，它会打开拨号器并将给定的号码放入其中.//同时，如果我们使用ACTION_CALL，应用程序将直接调用.
//if you use the ACTION_DIAL intent, it open the dialer and put the given number in it.//meanwhile, if we use the ACTION_CALL, the app will directly call.
Intent intent = new Intent(Intent.ACTION_CALL);
intent.setData(Uri.parse("tel:"+ "*" + Uri.encode("#") + "0011" + Uri.encode("#"))); //here you woud put your alternative code
startActivity(intent);
您还需要在清单中声明此权限
Also you would need to declare this permission in your manifest
<uses-permission android:name="android.permission.CALL_PHONE"></uses-permission>
也许你可以找到一个替代代码来做到这一点，因为我在互联网上看到了一些，但此时没有人为我工作.你可以试试
Probably you could find an alternative code to do this, since i ve seen a few in the internet, but at this point no one worked for me. You can give it a try
备选方案 2. 等待官方 api 出现
在 coogle 代码处的 android 项目页面中，有一个添加请求USSD API 支持.它有很多订阅者，但它很老(超过5年)，恐怕不是很好.无论如何，这可能会发生，可能 android tem 会考虑准备一个 api，以便应用程序可以声明一些权限，并发出某种代码的请求.但是，我知道，这可能会永远等待.
In the android project page at coogle code, there is a request to Add USSD API support. It has many subscribers, but it is quite old (more than 5 years), i'm afraid that's not really good.Anyways, that could happen, probably the android tem will consider to prepare an api so an app could declare some permissions, and make requests of some kind of codes. But, I know, this can be waiting forever.
所以，该说什么.寻找解决方案或替代您的应用程序会很幸运.很抱歉我的研究没有取得更多成果:(
So, what to say. Would luck looking for a solution, or for an alternative to your app. I'm sorry my research wasn't more fruitful :(
这篇关于在 Android 中以编程方式打开 ServiceMode 菜单的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！