How to implement an Android Emulator target? about avatar2 HOT 7 OPEN

Thanks for working on this and sharing your results !
Maybe @mariusmue or @rawsample could give more details there, I didn't look at this since long time.
In the meantime you can maybe also look at the avatar-qemu or the panda repo and the examples in avatar-examples.
It would be nice if you could do a PR with this (even as a draft), I guess this would be an interesting feature to have at some point.

from avatar2.

Hi!

The avatar-changes related to qemu are mostly self-contained. Most of them are in the hw/avatar subdirectory, where the important bit is the configurable machine.

Besides this, you'll need to adjust at least target/arm/cpu.h to include the avatar configurable machine ([link]).
Generally speaking, I think the avatar2 patchset should be relatively easy to transfer to a new version of qemu.

That being said, I predicting to issues for the android-emulator-target:

• for emulating android, we will likely need an aarch64 avatar2 architecture. There have been some attempts for this around, but nothing was mainlined yet. I think @AndrewFasano may have had a working draft at some point in time - maybe it's time for me to pick this up. :)
• Android supports virtual memory. The configurable machine of avatar2, and its design, pretty much assumes a flat memory space. Support for the MMU may be a major effort.

I hope that helps!

Best,
Marius

from avatar2.

We started building an aarch64 avatar2 configurable machine on this PANDA branch from about 4 years ago. I have no idea if it was working, but we never merged it. The changes we created were pretty simple.

from avatar2.

Hi thanks for your interest. That would be nice to have, but I'm not aware or any such plans so far and I'm not sure how much work would be needed.
Maybe check the book "The book Fuzzing Against the Machine"? Although I think it only mentions the baseband side with Avatar (FirmWire), not the Android side.

It would be nice to update the QEMU to the most recent, I think last time @rawsample did it?

from avatar2.

@aurelf thanks for the tip with the book. I just got access to the book via my university library and the content answers some of my questions. I will read it in the next weeks. Hopefully, that gives me some idea of about how feasible it is to build an Android emulator target and how much time I would need to spend.

from avatar2.

Great, let us know how ot goes!

from avatar2.

@aurelf

I finished implementing the Python code for a new Android emulator target. This was kind of straightforward as it is very similar to the QemuTarget and works nearly out of the box. The Python code more or less allows me to start the Android emulator via avatar2, and I can connect GDB, QMP, and the QEMU monitor protocols. Naturally, it does not allow me to modify the memory, as I need to adjust the emulator QEMU version to be able to talk to avatar2.

I will progress with making the necessary adjustments to the Android emulator QEMU version, which seems to be more challenging because I'm unsure how the communication between avatar2 and QEMU works in detail. According to the avatar2 paper, mainly two modifications have been made to the original QEMU (v.6.2):

1. Adding the new emulation machine ("configurable machine").
2. Adding a set of dedicated avatar peripherals.

I guess no blog post exists that explains how to modify QEMU for avatar2. It would be nice to have some guidance, but lucky me we have a git history. So I will go through all the commits starting from (3034630) and check which files I can copy into the Android version of QEMU.

from avatar2.