Giter Club home page Giter Club logo

android-syscall-logger's Introduction

Android-Syscall-Logger

โ€‹ A kernel module that hook some of your system call on your Android Device by rewriting syscall table.

Prerequisite

  • pixel 1
  • android-8.1.0_r1 == OPM1.171019.011
  • Root Access
  • Set CONFIG_DEBUG_RODATA to false so you are allowable to rewrite the syscall table.

Environment

  • I personly recommend you use Kali Linux as I do, since it look way damn good than Ubuntu

Reconfig Your kernel first

  • Change Directory to your kernel(suppose you kernel folder is located like this ~/aosp810r1/kernel/msm/), then use the following command below. Wrap them inside a script if you prefer.

  • export ARCH=arm64 &&
  • export PATH=~/aosp810r1/prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.9/bin:$PATH &&
  • export CROSS_COMPILE=aarch64-linux-android- &&
  • make menuconfig

  • A Gui based menu will pop up on you screen.
  • 5
  • I recommend you use the following setings as I do.
  • CONFIG_MODULES=Y
  • CONFIG_STRICT_MEMORY_RWX=N / CONFIG_DEBUG_RODATA=N
  • CONFIG_DEVMEM=Y
  • CONFIG_DEVKMEM=Y
  • CONFIG_KALLSYMS=Y
  • CONFIG_KALLSYMS_ALL=Y
  • CONFIG_HAVE_KPROBES=Y
  • CONFIG_HAVE_KRETPROBES=Y
  • CONFIG_HAVE_FUNCTION_TRACER=Y
  • CONFIG_HAVE_FUNCTION_GRAPH_TRACER=Y
  • CONFIG_TRACING=Y
  • CONFIG_FTRACE=Y

  • You might ask how to find each of these settings? Tab / , and you shall see a search bar upcoming. Copy it, paste it, and find it.
  • 8
  • 9
  • Once you finish your editing, run make command again which would create a kernel Image and then flash it to your device.
  • 10
  • Like this:
  • 11
  • Check if your kernel is modified.
  • 13

Compile & Usage

  1. Excellent, I suppose you have reconfigured your kernel already. We can finally launch our missile~
  2. First of all, let take a little adjustment on your Makefile
  3. 1
  4. Reset your sys_call_table address by reading /proc/kallsyms, if it shows 0 to you. [echo 0 > /proc/sys/kernel/kptr_restrict] should reveal their true address instead of 0.
  5. 6
  6. Run make to compile the code. Which it should create a file that ends with .ko, that's your kernel module.
  7. push kernel module to a certain directory at your phone.
  8. 2
  9. Initialize your module immediately by using [insmod xxxx.ko]
  10. 3
  11. Starting monitoring your log from kernel by using [dmesg -w | grep "myLog"]
  12. 4
  13. Enjoy your pleasure.
  14. 5

FAQ

  • Collecting

Credits

android-syscall-logger's People

Contributors

katana-o avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.