首先下载 repo 工具:
# mkdir ~/bin # PATH=~/bin:$PATH # curl https://storage.googleapis.com/git-repo-downloads/repo > ~/bin/repo // 如果上述 URL 不可访问,可以用下面的: // curl -sSL 'https://gerrit-googlesource.proxy.ustclug.org/git-repo/+/master/repo?format=TEXT' |base64 -d > ~/bin/repo # chmod a+x ~/bin/repo
# wget https://mirrors.tuna.tsinghua.edu.cn/aosp-monthly/aosp-latest.tar // 下载初始化包 # tar xf aosp-latest.tar // 解压 # cd aosp // 解压得到的 AOSP 工程目录 // 这时 ls 的话什么也看不到,因为只有一个隐藏的 .repo 目录
# repo init -u git://mirrors.ustc.edu.cn/aosp/platform/manifest // 如果提示无法连接到 gerrit.googlesource.com,可以编辑 ~/bin/repo,把 REPO_URL 一行替换成下面的: // REPO_URL = 'https://gerrit-googlesource.proxy.ustclug.org/git-repo' // 如果需要指定版本 // N2G48C android-7.1.2_r28 # repo init -u git://mirrors.ustc.edu.cn/aosp/platform/manifest -b android-7.1.2_r28
# repo sync
# mkdir WORKING_DIRECTORY # cd WORKING_DIRECTORY
// 清华 # git clone https://aosp.tuna.tsinghua.edu.cn/android/kernel/msm.git // 谷歌 # git clone https://android.googlesource.com/kernel/msm.git # cd msm //进入msm工程目录
# git branch -a | grep angler
# cat /proc/version Linux version 3.10.73-g5547b00553a (android-build@vped9.mtv.corp.google.com) (gcc version 4.9.x-google 20140827 (prerelease) (GCC) ) #1 SMP PREEMPT Fri May 19 23:01:51 UTC 2017
# git checkout 3.10.73-g5547b00553a // 也可以选择这个版本 同步分支 # git checkout -b android-msm-angler-3.10-nougat-mr2 origin/android-msm-angler-3.10-nougat-mr2
要修改的文件涉及到两个
msm/fs/proc/base.c (278行)
static int proc_pid_wchan(struct task_struct *task, char *buffer) { unsigned long wchan; char symname[KSYM_NAME_LEN]; wchan = get_wchan(task); if (lookup_symbol_name(wchan, symname) < 0) if (!ptrace_may_access(task, PTRACE_MODE_READ)) return 0; else return sprintf(buffer, "%lu", wchan); // else // return sprintf(buffer, "%s", symname); else { if (strstr(symname, "trace")) { return sprintf(buffer, "%s", "sys_epoll_wait"); } return sprintf(buffer, "%s", symname); } }
static const char * const task_state_array[] = { "R (running)", /* 0 */ "S (sleeping)", /* 1 */ "D (disk sleep)", /* 2 */ "T (stopped)", /* 4 */ // "t (tracing stop)", /* 8 */ "S (sleeping)", /* 8 */ "Z (zombie)", /* 16 */ "X (dead)", /* 32 */ "x (dead)", /* 64 */ "K (wakekill)", /* 128 */ "W (waking)", /* 256 */ "P (parked)", /* 512 */ };
seq_printf(m, "State:\t%s\n" "Tgid:\t%d\n" "Pid:\t%d\n" "PPid:\t%d\n" "TracerPid:\t%d\n" "Uid:\t%d\t%d\t%d\t%d\n" "Gid:\t%d\t%d\t%d\t%d\n", get_task_state(p), leader ? task_pid_nr_ns(leader, ns) : 0, pid_nr_ns(pid, ns), ppid,/*tpid*/0,
// 将工具集加入到路径中 # export PATH=$PATH:~/aosp/prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.9/bin // 设置目标架构 # export ARCH=arm64 // 设置编联合编译方式,不要漏了最后边的“-” # CROSS_COMPILE=aarch64-linux-android- // 编译 # make angler_defconfig # make
// 换 # ARCH=arm64 CROSS_COMPILE=aarch64-linux-android- make
// 进入Android 源码目录 # cd ~/asop/ // 设置刚刚编译完成 Image.gz-dtb 文件变量 # export TARGET_PREBUILT_KERNEL=~/aosp/k/msm/arch/arm64/boot/Image.gz-dtb # . build/envsetup.sh # lunch <angler>
// 开始编译内核 # make bootimage
// 手机进入fastboot模式 # fastboot.exe flash boot boot.img
[课程]Android-CTF解题方法汇总!