Read IMSI information via ADB on Android 12

Issue

I recently updated my Pixel 5 device to Android 12 Beta and found that it is no longer possible to fetch the IMSI information via ADB using the command service call iphonesubinfo 8 i32 1

It now shows the following information when executed via ADB:

redfin:/ $ service call iphonesubinfo 8 i32 1
   Result: Parcel(
    0x00000000: ffffffff 00000042 00650067 00530074 '....B...g.e.t.S.'
    0x00000010: 00620075 00630073 00690072 00650062 'u.b.s.c.r.i.b.e.'
    0x00000020: 00490072 00460064 0072006f 00750053 'r.I.d.F.o.r.S.u.'
    0x00000030: 00730062 00720063 00620069 00720065 'b.s.c.r.i.b.e.r.'
    0x00000040: 0020003a 00610050 006b0063 00670061 ':. .P.a.c.k.a.g.'
    0x00000050: 00200065 0075006e 006c006c 00640020 'e. .n.u.l.l. .d.'
    0x00000060: 0065006f 00200073 006f006e 00200074 'o.e.s. .n.o.t. .'
    0x00000070: 00650062 006f006c 0067006e 00740020 'b.e.l.o.n.g. .t.'
    0x00000080: 0020006f 00300032 00300030 00000000 'o. .2.0.0.0.....'
    0x00000090: 00000000                            '....            ')

Running the above command on the same Pixel 5 but with the latest Android 11 version installed, it will show me the IMSI in the same format as above, so it is apparent that this is not hardware related, but an update to the user security layer on Android 12.

I have not tested with root as this was not necessary on any device running with Android 10-11.

This was to my knowledge the only way of reading IMSI information on newer devices, since the READ_PHONE_STATE permission was changed and the ability to read IMSI information was moved to the READ_PRIVILEGED_PHONE_STATE permission; only available for system and vendor applications.

Is this a lost cause or is there any other consistent way of reading the IMSI information on newer Android devices?

Solution

If your apk's targetsdk <30, you can get IMSI by the following method without any permission in android 11.

Uri uri = Uri.parse("content://telephony/siminfo");
Cursor cursor = null;
ContentResolver contentResolver = getApplicationContext().getContentResolver();
cursor = contentResolver.query(uri,
        new String[]{"_id", "sim_id", "imsi","icc_id","number","display_name"}, "0=0",
        new String[]{}, null);
if (null != cursor) {
    while (cursor.moveToNext()) {
        String icc_id = cursor.getString(cursor.getColumnIndex("icc_id"));
        String imsi_id = cursor.getString(cursor.getColumnIndex("imsi"));
        String phone_num = cursor.getString(cursor.getColumnIndex("number"));
        String display_name = cursor.getString(cursor.getColumnIndex("display_name"));
        int sim_id = cursor.getInt(cursor.getColumnIndex("sim_id"));
        int _id = cursor.getInt(cursor.getColumnIndex("_id"));
        Log.d("Q_M", "icc_id-->" + icc_id);
        Log.d("Q_M", "imsi_id-->" + imsi_id);
        Log.d("Q_M", "phone_num-->" + phone_num);
        Log.d("Q_M", "sim_id-->" + sim_id);
        Log.d("Q_M", "display_name-->" + display_name);
    }
}

Answered By - James Chen