为pixel手机编译aosp源码

HackPE 收录于类别逆向分析

2021-01-09 约 1075 字预计阅读 3 分钟次阅读条评论

/images/safar-safarov-MSN8TFhJ0is-unsplash.jpg

1 目的

修改调试标志
打印native动态注册地址
改机
脱壳(fart)

摘要

编译android 7源码。分两个步骤：

下载android源码到硬盘，大概有100G左右
使用docker进行编译

注意

所有操作都在docker中进行

2 一、构建docker环境

参考资料

https://mirrors.tuna.tsinghua.edu.cn/help/AOSP/

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63


FROM ubuntu:16.04

# aliyun sources
COPY sources.list /etc/apt/sources.list
RUN apt-get clean
RUN apt-get update

WORKDIR /root/

ENV USER root

ENV PATH="/android_build/bin:${PATH}"

RUN apt-get update

#install essential build
RUN apt-get install -y bsdmainutils openjdk-8-jdk git-core gnupg flex bison gperf build-essential zip curl zlib1g-dev gcc-multilib g++-multilib libc6-dev-i386 lib32ncurses5-dev x11proto-core-dev libx11-dev lib32z-dev libgl1-mesa-dev libxml2-utils xsltproc unzip python python3 bc libc6

#install repo
RUN mkdir -p /android_build/bin && curl https://mirrors.tuna.tsinghua.edu.cn/git/git-repo > /android_build/bin/repo && chmod a+x /android_build/bin/repo

RUN rm -rf /var/cache/apt && rm -rf /var/lib/apt/lists

#install gcc 4.4
RUN mkdir -p /android_build/gcc

RUN curl http://archive.ubuntu.com/ubuntu/pool/universe/g/gcc-4.4/cpp-4.4_4.4.7-8ubuntu1_amd64.deb > /android_build/gcc/cpp-4.4_4.4.7-8ubuntu1_amd64.deb
RUN curl http://archive.ubuntu.com/ubuntu/pool/universe/g/gcc-4.4/gcc-4.4-base_4.4.7-8ubuntu1_amd64.deb > /android_build/gcc/gcc-4.4-base_4.4.7-8ubuntu1_amd64.deb
RUN curl http://archive.ubuntu.com/ubuntu/pool/universe/g/gcc-4.4/gcc-4.4_4.4.7-8ubuntu1_amd64.deb > /android_build/gcc/gcc-4.4_4.4.7-8ubuntu1_amd64.deb
RUN curl http://archive.ubuntu.com/ubuntu/pool/universe/g/gcc-4.4/gcc-4.4-multilib_4.4.7-8ubuntu1_amd64.deb > /android_build/gcc/gcc-4.4-multilib_4.4.7-8ubuntu1_amd64.deb

RUN dpkg -i /android_build/gcc/cpp-4.4_4.4.7-8ubuntu1_amd64.deb /android_build/gcc/gcc-4.4-base_4.4.7-8ubuntu1_amd64.deb /android_build/gcc/gcc-4.4_4.4.7-8ubuntu1_amd64.deb /android_build/gcc/gcc-4.4-multilib_4.4.7-8ubuntu1_amd64.deb

#install g++ 4.4
RUN mkdir -p /android_build/g++

RUN curl http://archive.ubuntu.com/ubuntu/pool/universe/g/gcc-4.4/g++-4.4_4.4.7-8ubuntu1_amd64.deb > /android_build/g++/g++-4.4_4.4.7-8ubuntu1_amd64.deb
RUN curl http://archive.ubuntu.com/ubuntu/pool/universe/g/gcc-4.4/libstdc++6-4.4-dev_4.4.7-8ubuntu1_amd64.deb > /android_build/g++/libstdc++6-4.4-dev_4.4.7-8ubuntu1_amd64.deb
RUN curl http://archive.ubuntu.com/ubuntu/pool/universe/g/gcc-4.4/g++-4.4-multilib_4.4.7-8ubuntu1_amd64.deb > /android_build/g++/g++-4.4-multilib_4.4.7-8ubuntu1_amd64.deb

RUN dpkg -i /android_build/g++/g++-4.4_4.4.7-8ubuntu1_amd64.deb /android_build/g++/libstdc++6-4.4-dev_4.4.7-8ubuntu1_amd64.deb /android_build/g++/g++-4.4-multilib_4.4.7-8ubuntu1_amd64.deb

#set gcc 4.4 and g++ 4.4 as default
RUN update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-4.4 44
RUN update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-4.4 44

# install bootimg tools for kernel
RUN git clone https://github.com/pbatard/bootimg-tools.git
RUN cd bootimg-tools && make && cp mkbootimg/mkbootimg /android_build/bin/ && cp mkbootimg/unmkbootimg /android_build/bin/ && cd .. && rm -rf bootimg-tools

#change dash to bash
RUN echo "dash dash/sh boolean false" | debconf-set-selections
RUN DEBIAN_FRONTEND=noninteractive dpkg-reconfigure dash

#copy the entry script into the container

#set volume
VOLUME ["/tmp/ccache", "/aosp"]

ENV USE_CCACHE 1
ENV CCACHE_DIR /tmp/ccache

WORKDIR /aosp

运行命令开始构建：sudo docker build -t xiaoming996/aosp-android-7:1.0.0 .

编写docker-compose.yaml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


version: "3.4"
services:
  aosp:
    container_name: aosp
    image: xiaoming996/aosp-android-7:1.0.0
    volumes:
       - /path/aosp/nougat:/aosp
       - /path/aosp/nougat/tmp/ccache:/tmp/ccache
    network_mode: "bridge"
    tty: true

启动容器:sudo docker-compose up -d

进入容器:sudo docker exec -it aosp bash

3 二、下载源码

源码初始化脚本repo-init-sync.sh

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


#!/bin/bash
#
# 同步源码
#

set -ex

git config --global user.email "thanatos@aosp.local"
git config --global user.name "thanatos"

TEST_BRANCH=${TEST_BRANCH:-android-7.1.2_r33}
TEST_URL=${TEST_URL:-https://mirrors.tuna.tsinghua.edu.cn/git/AOSP/platform/manifest}

repo init --depth 1 -u "$TEST_URL" -b "$TEST_BRANCH"

repo sync

执行命令screen -L ./repo-init-sync.sh, 由于网络的原因，源码可能会不完整，建议多执行几次repo sync，

源码下载完成后还需要下载google pixel硬件支持包。

根据源码分支查看Android分支对应的构建
查找到android-7.1.2_r33对应的Build为NZH54D
然后直接到官网下载驱动包

操作细节如下：

1
2
3
4
5
6


wget https://dl.google.com/dl/android/aosp/qcom-marlin-nzh54d-37c85e51.tgz
wget https://dl.google.com/dl/android/aosp/google_devices-marlin-nzh54d-32d88dd3.tgz
tar -zxvf google_devices-marlin-nzh54d-32d88dd3.tgz
tar -zxvf qcom-marlin-nzh54d-37c85e51.tgz
./extract-google_devices-marlin.sh
./extract-qcom-marlin.sh

4 三、编译源码

源码有了，下面开始编译。为了方便，编写build.sh

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


#!/bin/bash

set -ex

cpus=$(grep ^processor /proc/cpuinfo | wc -l)

prebuilts/misc/linux-x86/ccache/ccache -M 50G

source build/envsetup.sh
lunch aosp_sailfish-eng

threads=$((cpus * 2))
make -j $threads

在源码目录运行：screen -L ./build.sh

出现错误：build/core/ninja.mk:148: recipe for target 'ninja_wrapper' failed。

解决方法：在build/envsetup.sh最后添加export LC_ALL=C

出现错误：Try increasing heap size with java option '-Xmx'.

解决办法：https://2net.co.uk/blog/jack-server.html

5 四、刷机

通过上面的步骤，成功编译了Android源码。接下来将编译好的固件刷入到手机。

先用官方的aosp底包刷：./flash-all

然后刷入编译的镜像：

1
2
3
4
5


fastboot flash boot_a boot.img
fastboot flash boot_b boot.img

fastboot flash system system.img
flash system_<another slot> system_other.img