This page looks best with JavaScript enabled

打造安卓调试环境

 ·  ☕ 2 min read · 👀... views

修改内核参数

1
2
3
4
5
$ cat device/motorola/berlin/BoardConfig.mk | grep TARGET_KERNEL_CONFIG
TARGET_KERNEL_CONFIG += vendor/lineage_berlin.config
$ cat device/motorola/sm7325-common/BoardConfigCommon.mk | grep TARGET_KERNEL_CONFIG
TARGET_KERNEL_CONFIG := vendor/lahaina-qgki_defconfig vendor/lineage_moto-lahaina.config
$ vim /mnt/android/lineage/kernel/motorola/sm7325/arch/arm64/configs/vendor/lineage_berlin.config

手动更新内核(Patch commit)

1
2
3
4
5
$ git remote add linux-stable https://mirrors.bfsu.edu.cn/git/linux-stable.git
$ git fetch linux-stable
# 查看哪些分支存在commitID
$ git branch -r --contains 358fdb4
$ git cherry-pick -m 1 358fdb4

修改安卓源码dump dex

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
// libdexfile/dex/dex_file_loader.cc
#include <sys/stat.h>
#include <fcntl.h>
...
std::unique_ptr<DexFile> DexFileLoader::OpenCommon(const uint8_t* base,
                                                   size_t size,
                                                   const uint8_t* data_base,
                                                   size_t data_size,
                                                   const std::string& location,
                                                   uint32_t location_checksum,
                                                   const OatDexFile* oat_dex_file,
                                                   bool verify,
                                                   bool verify_checksum,
                                                   std::string* error_msg,
                                                   std::unique_ptr<DexFileContainer> container,
                                                   VerifyResult* verify_result) {

    ......
  // file
  char buf[256];
  char out[256];
  strcpy(buf, "/data/data/");
  int fd = open("/proc/self/cmdline", O_RDONLY);
  size_t readsize = read(fd,&buf[11],sizeof(buf)-11);
  buf[11+readsize]='\0';
  close(fd);
  strcat(buf, "/ruokeqx");

  if(!access(buf, F_OK)){
    sprintf(out, "%s/%x_dex",buf,*(uint32_t*)(base+8));
    int fd_out = open(out, O_WRONLY | O_CREAT | O_EXCL, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
    readsize = write(fd_out, base, size);
    close(fd_out);
  }
  return dex_file;
}

修改内核反调试标志位

修改State字段和TracerPid字段

将原来状态表中的T和t都修改为S这样就避免了该状态位反映出被监测的状态

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
// fs/proc/array.c
static const char * const task_state_array[] = {
	"R (running)",		/*   0 */
	"S (sleeping)",		/*   1 */
	"D (disk sleep)",	/*   2 */
	// "T (stopped)",		/*   4 */
	"S (sleeping)",		/*   4 */
	// "t (tracing stop)",	/*   8 */
	"S (sleeping)",	/*   8 */
	"X (dead)",		/*  16 */
	"Z (zombie)",		/*  32 */
};
static inline void task_state(struct seq_file *m, struct pid_namespace *ns,
				struct pid *pid, struct task_struct *p)
{
    ...
	seq_put_decimal_ull(m, "\nTgid:\t", tgid);
	seq_put_decimal_ull(m, "\nNgid:\t", ngid);
	seq_put_decimal_ull(m, "\nPid:\t", pid_nr_ns(pid, ns));
	seq_put_decimal_ull(m, "\nPPid:\t", ppid);
	// seq_put_decimal_ull(m, "\nTracerPid:\t", tpid);
	seq_put_decimal_ull(m, "\nTracerPid:\t", 0);
	seq_put_decimal_ull(m, "\nUid:\t", from_kuid_munged(user_ns, cred->uid));
	seq_put_decimal_ull(m, "\t", from_kuid_munged(user_ns, cred->euid));
	seq_put_decimal_ull(m, "\t", from_kuid_munged(user_ns, cred->suid));
	seq_put_decimal_ull(m, "\t", from_kuid_munged(user_ns, cred->fsuid));
	seq_put_decimal_ull(m, "\nGid:\t", from_kgid_munged(user_ns, cred->gid));
	seq_put_decimal_ull(m, "\t", from_kgid_munged(user_ns, cred->egid));
	seq_put_decimal_ull(m, "\t", from_kgid_munged(user_ns, cred->sgid));
	seq_put_decimal_ull(m, "\t", from_kgid_munged(user_ns, cred->fsgid));
	seq_put_decimal_ull(m, "\nFDSize:\t", max_fds);
    ...
}
// fs/proc/base.c
/*
 * Provides a wchan file via kallsyms in a proper one-value-per-file format.
 * Returns the resolved symbol.  If that fails, simply return the address.
 */
static int proc_pid_wchan(struct seq_file *m, struct pid_namespace *ns,
			  struct pid *pid, struct task_struct *task)
{
	unsigned long wchan;
	char symname[KSYM_NAME_LEN];

	wchan = get_wchan(task);

	if (wchan && ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)
			&& !lookup_symbol_name(wchan, symname))
        // symname中有trace就改成sys_epoll_wait
        if (strstr(symname, "trace"))
            seq_printf(m, "%s", "sys_epoll_wait");
		else
            seq_printf(m, "%s", symname);
	else
		seq_putc(m, '0');

	return 0;
}

Ref

https://appuals.com/how-to-update-your-android-kernel-to-latest-linux-stable/
https://github.com/gojue/ecapture/discussions/308
https://www.freebuf.com/articles/terminal/166307.html
https://xz.aliyun.com/t/4897

Share on

ruokeqx
WRITTEN BY
ruokeqx