Sending a SMS on Android through ADB

Question

I would like to be able to send a SMS from my Android phone while it's connected to my computer using the following ADB commands

adb shell am start -a android.intent.action.SENDTO -d sms:CCXXXXXXXXXX --es sms_body "SMS BODY GOES HERE" --ez exit_on_sent true
adb shell input keyevent 22
adb shell input keyevent 66

I've got this working however on the phone this will pop up a text message to the recipient with the body filled in and then click the send button and return to where you were. Is there any way to do this completely in the background so it would not interfere with anything happening on the phone?

Answer 1

Short version :

Android 5 and older (here android 4):

adb shell service call isms 5 s16 "com.android.mms" s16 "+01234567890" s16 "+01SMSCNUMBER" s16 "Hello world !" i32 0 i32 0

Android 5 and later (here android 9):

adb shell service call isms 7 i32 0 s16 "com.android.mms.service" s16 "[phone]" s16 "null" s16 "Hey\ you\ !" s16 "null" s16 "null"

Isms method number (5 and 7 above) may change with the android version . Read full explanation to understand it.

---

Full explanation for all android version :

Yes it exists ! but not with this command, because these input events are blocked in sleep mode. This solution depends on your android version, so I'm going to explain you for almost all version ...

1st, check if you have the service isms by running :

adb shell service check isms
Service isms: found

The answer is found, good, keep moving. The service isms have various "options" the syntax is :

service call name_service option args

The service name can be found by typing :

adb shell service list

It will display a lot of services avaible, but the interesting line is :

5       isms: [com.android.internal.telephony.ISms]

You can see com.android.internal.telephony.Isms, so on this link choose your android version (by changing branch), then navigate to : telephony/java/com/android/internal/telephony and open Isms.aidl

For the rest I will take the android Pie (android 9) file (link).

On the line 185 we have :

void sendTextForSubscriberWithSelfPermissions(...)

Note : before android 5 the method is named sendText(...).

It is the 7th declaration in the interface ISMS . So our option to send a sms is the number 7. On the top of the declaration there is the explanation of the arguments. Here a short version:

• subId : after android 5, the SIM card you want to use 0, 1 or 2 depending of your android version (ex 0-1 for android 9 and 1-2 for android 8)
• callingPkg : the name of the package that will send your sms (I explain how to find it later)
• destinationAdress : the phone number of the message recipient
• scAddress : your smsc is only need in android 5 and lower (explained after)
• parts : your message !
• sendIntends and deliveryIntents : you don't care

-> Find your package name : Explore your app file or download Package Name Viewer on google play, find your message application and copy the name (com.android...)

-> Find your smsc : In your application -> settings -> SMSC or Service Center or Message Center etc, copy the number display (DON'T CHANGE IT)

Just before finishing, in services the strings are declared by s16 and integers and PendingIntent with i32.

So for my example we have :

• subId : 0
• callingPkg : com.android.mms
• target number : +01234567890
• SMSC : +01000000000
• My text : Hello world !
• sendIntends and deliveryIntents we don't care so we put 0 to set it to default value.

Finally :

Android 5 and older (here android 4):

adb shell service call isms 5 s16 "com.android.mms" s16 "+01234567890" s16 "+01000000000" s16 "Hello world !" i32 0 i32 0

Android 5 and later (here android 9):

adb shell service call isms 7 i32 0 s16 "com.android.mms.service" s16 "[phone]" s16 "null" s16 "'Hey you !'" s16 "null" s16 "null"

-> An example in a batch file :

The send.bat for android 4 :

echo off
set num=%1
shift
for /f "tokens=1,* delims= " %%a in ("%*") do set ALL_BUT_FIRST=%%b
echo %ALL_BUT_FIRST%
adb shell service call isms 5 s16 "com.android.mms" s16 "%num%" s16 "+01000000000" s16 "%ALL_BUT_FIRST%" i32 0 i32 0

run with :

send.bat +01234567890 Hey you !

Now tell me if it works with your android version :)

Edit : Corrected with information given by Alex P. Edit 2: Corrected with information given by Neil