yhnu / op7t Goto Github PK

oneplus 7t 自定义内核(for 安卓逆向/外挂分析)

Makefile 0.28% Lex 0.01% Shell 0.08% C 98.03% Assembly 1.33% Perl 0.12% C++ 0.04% Awk 0.01% Python 0.07% GDB 0.01% sed 0.01% Yacc 0.02% UnrealScript 0.01% SmPL 0.01% Gherkin 0.01% XS 0.01% Raku 0.01% Roff 0.01% Clojure 0.01% M4 0.01%

op7t's Introduction

op7t

oneplus 7t 自定义内核

手机环境

a. oneplus 7t

b. 对应Android版本为Hydrogen OS 10.0.7.HD65

c. 对应版本全量包

OnePlus7THydrogen_14.H.09_OTA_009_all_2001030048_d935aae55ac_1007.zip //一加手机论坛下载

Linux编译环境

操作系统ubuntu20

➜  /share cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=20.04
DISTRIB_CODENAME=focal
DISTRIB_DESCRIPTION="Ubuntu 20.04 LTS"

依赖安装

sudo apt-get install git-core gnupg flex bison build-essential zip curl zlib1g-dev gcc-multilib g++-multilib libc6-dev-i386 libncurses5-dev lib32ncurses5-dev x11proto-core-dev libx11-dev lib32z1-dev libgl1-mesa-dev libxml2-utils xsltproc unzip fontconfig

sudo apt-get install libssl-dev
sudo apt-get install dos2unix
sudo apt-get install libncurses5

编译源码

为了简单方便及稳定,我们基于第三方内核进行修改, https://github.com/engstk/op7/tree/r70

cd /share/op7t/blu7t
just c
source env.config
source proxy.config
just make
just j16

打包image

just image

boot.img提取

curl -L -O https://github.com/yhnu/op7t/releases/download/v1.0/payload_dumper-win64.zip
curl -L -O https://otafsc.h2os.com/patch/CHN/OnePlus7THydrogen/OnePlus7THydrogen_14.H.09_009_2001030048/OnePlus7THydrogen_14.H.09_OTA_009_all_2001030048_d935aae55ac.zip
unzip -q OnePlus7THydrogen_14.H.09_009_2001030048/OnePlus7THydrogen_14.H.09_OTA_009_all_2001030048_d935aae55ac.zip
# 然后参考payload_dumper的使用说明即可

拯救OnePlus7t

开发的路上难免磕磕碰碰, 手机就启动不了, 做好防身技能

curl -L -O https://otafsc.h2os.com/patch/CHN/OnePlus7THydrogen/OnePlus7THydrogen_14.H.09_009_2001030048/OnePlus7THydrogen_14.H.09_OTA_009_all_2001030048_d935aae55ac.zip
curl -L -O https://github.com/yhnu/op7t/releases/download/v1.0/recovery-oneplus7t-3.4.2-10.0-b26.img
fastboot set_active a #is a or b
fastboot erase recovery
fastboot.exe flash recovery recovery-oneplus7t-3.4.2-10.0-b26.img 
fastboot.exe reboot recovery
adb sideload F:\F2021-07\one7t_kernel\OnePlus7THydrogen_14.H.09_OTA_009_all_2001030048_d935aae55ac.zip

QA

wx: yhnu2023

op7t's People

Contributors

Stargazers

Watchers

Forkers

azhan1998 junmo2 crackercat ckandroidproject newhasaki zbx911 buyersystem 26597925 huaerxiela guroto luyu344 rainbowxie losenineai shuixi2013 awenousaku sanqudui8ban fklearn fengjixuchui bb33bb netstu tiansin acbocai heartfilia xtftbwvfp shadowce kingking888 undefinedidentifier breathleas zhuer456789 bincrack666 angrykobe xiajun325 sofool sliverbullet5563 sengeiou xyxdaily jasonxgw guguji12345 stickycookie ssageparuders d34d633f fuck-app-code gmh5225 lllliiillll katana-o abcz1114 dxcyber409 liner0211 wangcheng711 tututu-patch ptr-ptr apachecn junknet wdnmd-rushb anriku kozoro xxoo2995 stonedio kiyomijin xzzvsxd xbyl1234 beyondmark amirulandalib yujack008 cduang weiunli lllllllllllll5796 394999482 df13954 changchang700 minghaolin2000 woowooxxx gamesec lvyitian yfw123 china1949cl 9540611855 yuknight npc2000 xdcs100 re100io daoyihuc xiaotujinbnb

op7t's Issues

__init_begin符号找不到

我这边测试了krhook代码，运行发现__init_begin符号值为0，/proc/kallsyms 里面也找不到，环境是Linux version 4.19.81

URL is 404

hello, there some url cann found,
https://github.com/yhnu/op7t/tree/dev/krhook
https://github.com/yhnu/op7t/tree/dev/kr_offline
https://github.com/yhnu/note/tree/master/kernel/01_7t_install.md

hide_inject_so没有加入到源码吗

在看雪上看到你的贴子，下载了源码，搜索了一下源码，好像没有加入hide_inject_so，是这个不能用吗？

Debugger ideas

If you want to make a debugger that can be used in practice, the hardware breakpoint can only be used as an auxiliary means, not as the main means (the hardware breakpoint is used only when it is absolutely necessary, and the cost is very high, and a specific model is required). Hardware breakpoint source code, you can refer to my project. I suggest the correct idea is: hook ptrace, so that it will not be detected. Even if it is a last resort, don't be detected too fast. Wait at least half an hour. The stability of this idea is guaranteed and the workload is small. In the later stage, it can be directly connected to debuggers such as IDA. I also know the mystery of the non universal Ko driver file of each model. I can implement a Ko driver file to run in the Linux kernel of different models. At the same time, I do not recommend compiling the kernel source code directly, because many official features and functions, such as more power-saving scheduling, cannot be used.

arm32 App堆栈打印失败

大佬你好，请教一下！

我按照您的方式，c9af4cd 加上了用户层堆栈输出，在64位App上可以正常回溯堆栈；但是在32位App上，回溯会不正常，我发现无论是32位还是64位app，都会调用到arch/arm64/kernel/stacktrace.c（32位不会调用到 arch/arm/kernel/stacktrace.c（修改成arm32堆栈回溯）），因此这里回溯的fp是arm64的fp X29。

所以想请教一下，对于arm32在arm64内核上的堆栈回溯，应该怎么改呢，或者大佬有什么思路或方向吗？感谢！（我使用的pixel 2 Android 10 内核版本 4.4.177）

能实现下硬件断点，然后用户层栈回溯的功能吗

如题，希望大佬支持下