[DEV][AARCH64][ARM64] BASH 5 for Andorid API 28 - Android Software/Hacking General [Developers Only]

I have cross-compiled BASH with source from http://ftp.gnu.org/gnu/bash/bash-5.0.tar.gz using Android NDK r20 on the Ubuntu 16.
Note that it is compiled using aarch64-linux-android-clang with target API level 28 (Android 9, Pie). I have tested it working on my POCO F1 as root user. Not tested on earlier devices.
Statically Linked : So, it can work as a standalone executable without creating any dependency problems. It helps me to run bash5 as root user in Termux.
Striped: to reduce executable binary size and increase performance.
A sample .bashrc is included. You may need to customize according to your environment.
Some informational outputs:
Code:
[email protected] home # which bash
/system/xbin/bash
[email protected] home # /system/xbin/bash --version
GNU bash, version 5.0.0(2)-release (aarch64-unknown-linux-android)
Copyright (C) 2019 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
[email protected] home # file /system/xbin/bash
/system/xbin/bash: ELF executable, 64-bit LSB arm64, static, for Android 28, built by NDK r20 (5594570), stripped
# Shellshock test
[email protected] home # x='() { :;}; echo VULNERABLE' bash -c :

Related

Got agcc, got Android source compiled, got Hello, World to work. How to do bash?

How do I port bash? DO I just export CC=~/bin/agcc and run make?
Is this the same with any console application I wish to port onto Android?
Where I'm at:
I got Hello, world! to work. The a.out binary gave this output warning during ld linkage - but the a.out binary ran on my Android phone under console emulation for sure!
Code:
[email protected]:~/mydroid/xdev$ cat hello.c
#include <stdio.h>
int main() {
printf("Hello, world!\n");
}
[email protected]:~/mydroid/xdev$ agcc hello.c
/home/kinesis/mydroid/prebuilt/linux-x86/toolchain/arm-eabi-4.4.0/bin/../lib/gcc/arm-eabi/4.4.0/../../../../arm-eabi/bin/ld: warning: /tmp/ccpQIsji.o uses variable-size enums yet the output is to use 32-bit enums; use of enum values across objects may fail
[email protected]:~/mydroid/xdev$ file a.out
a.out: ELF 32-bit LSB executable, ARM, version 1 (SYSV), dynamically linked (uses shared libs), not stripped
[email protected]:~/mydroid/xdev$
I can confirm that bash will work using this guide and the CodeSourcery G++ toolkit.
http://www.kbrandt.com/2009/06/how-to-cross-compile-the-bash-shell-for-android-15.html
The joy one feels after executing their own ARM bash binary is priceless.

samba compile issue

I'm compiling samba-3.6.22 for android with the sourcery arm-2010q1 compiler. The compile itself goes fine, but when I copy smbd to my device it's not recognized as a binary. I get the error
Code:
sh: ./smbd: No such file or directory
file under linux tells me:
Code:
smbd: ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.16, not stripped
What am I overlooking?

Static binaries will be bypass PIE in lollipod

Hi,
After researching why one binary is working in both systems (5.0 and 2.3.5) ive found that (is logic i know) static compiled binaries will be work in both versions.
The problem is that the binary will be increased in size a lot, but you don´t need to touch your application and just compile your c code and put in assets folder.
So all the static compiled binaries still will be working in both versions of Android
With the "file" command you can see if is statically compiled:
ELF 32-bit LSB executable, ARM, version 1 (SYSV), statically linked, not stripped
This binary will work in any version of android and you have to compile with the static flag:
arm-linux-androideabi-gcc -static yourcode.c -o youbinary
I said the binary increase the size dramatically but for small binaries maybe its ok.
Regards,
Sylkat

[Tool][bin] Official Toybox for android

What is toybox?​
Toybox combines many common Linux command line utilities together into a single BSD-licensed executable. It's simple, small, fast, and reasonably standards-compliant.
Toybox's main goal is to make Android self-hosting by improving Android's command line utilities so it can build an installable Android Open Source Project image entirely from source under a stock Android system. After a talk at the 2013 Embedded Linux Conference explaining this plan (outline, video), Google merged toybox into AOSP and began shipping toybox in Android Mashmallow.
Toybox aims to provide one quarter of a theoretical "minimal native development environment", which is the simplest Linux system capable of rebuilding itself from source code and then building Linux From Scratch and the Android Open Source Project under the result. In theory, this should only require four packages:
1) Set of posix-ish command line utilities
2) Compiler
3) C library
4) Kernel.
This provides a reproducible and auditable base system, which with the addition of a few conveniences (vi, top, shell command line history...) can provide a usable interactive experience rather than just a headless build server.
Why is toybox?​
The 2015 toybox talk starts with links to three previous talks on the history and motivation of the project: "Why Toybox", "Why Public Domain", and "Why did I do Aboriginal Linux (which led me here)?". If you're really bored, there's even a half-finished a history page.
The toybox maintainer's earlier minimal self-hosting system project, Aboriginal Linux, got its minimal native development environment down to seven packages in its 1.0 release (busybox, uClibc, gcc, binutils, make, bash, and linux) and built Linux From Scratch under the result. That project was the reason toybox's maintainer became busybox maintainer, having done so much work to extend busybox to replace all the gnu tools in a Linux From Scratch build that the previous maintainer handed over the project (to spend more time on buildroot).
Despite the maintainer's history with busybox, toybox is a fresh from-scratch implementation under an android-compatible license. Busybox predates Android, but has never shipped with Android due to the license. As long as we're starting over anyway, we can do a better job.
These days, toybox is replacing busybox in Aboriginal Linux one command at a time, and each toybox release is regression tested by building Aboriginal Linux with it, then building Linux From Scratch under the result with the new toybox commands. The list of commands remaining is tracked in the roadmap, and the replacing busybox in Aboriginal Linux is one of the main goals for toybox' 1.0 release.
Building LFS requres fewer commands than building AOSP, which has a lot more build prerequisites. In theory some of those can be built from source as external packages (we're clearly not including our own java implementation), but some early prerequisites may need to be added to bootstrap AOSP far enough to build them (such as a read-only version of "git": how does repo download the AOSP source otherwise?)
Source: http://www.landley.net/toybox/about.html
Downloads:
http://www.landley.net/toybox/bin/
GitHub:
https://github.com/landley/toybox
In case
Busybox vs toybox, who's the best?
Armv7 build?
Inviato dal mio Nexus 4 con Tapatalk 2
Waiting armv7 build. Thanks
Very interesting project!!:good: I've been doing as much of my development that I can on Android, but this will be a way to keep it all localized! This is exactly what we need:victory:. Great development!!:good::highfive:
What's the time frame for a Armv7 build? (no rush, just anxious with anticipation)
Can anyone suggest me which one to download for moto x play
hello i have toybox on my marshmallow(low end device) , i want to how to make swapfile on the SD card(VRAM),(RAM runout fast) all apps for VRAM use busybox so they wont work
so ive tried ot use terminal shell with "swapon" but i guess i missing something, i searched all over the net didnt found to much on toybox
what command\string i need?
sorry if i am on the wrong thread and sorry for my bad English
PS
i can adjust my ZRAM but its zram its swapfile on the RAM also its limited to 0-200MB and i need more
thanks
I obtain this toybox from my Xperia m, cm 13 rom, from this path /sbin/toybox and this is for armv7 arch.
https://mega.nz/#!toURVICL!M7048C6RhYlhuZcoxXzvF5Zm7ALvZIql93asmysJas0
Any updates for this?
Sent from my ? LG G4 H811 ???
Deleted
ToyBox:
https://forum.xda-developers.com/android/software-hacking/tool-official-toybox-android-t3290884
BusyBox + ToyBox:
https://forum.xda-developers.com/an...zip-busybox-v1-26-2-flashable-binary-t3581875
download modif, BB 1.28.3, TB Armv7 build:
https://drive.google.com/file/d/1jM4CMB3sF_wRvUaLv5n8hVkLA65glbZj/view?usp=drivesdk
use Terminal Emulator:
typing: busybox (enter)
typing: toybox (enter)
@Paget96
toybox does not require a separate dev developed binary for android devices like busybox does?
like meefik, stericson, osm0sis ones....!
Edit:- answer is here https://github.com/landley/toybox/issues/122
HemanthJabalpuri said:
@Paget96
toybox does not require a separate dev developed binary for android devices like busybox does?
like meefik, stericson, osm0sis ones....!
Click to expand...
Click to collapse
Nope
Sent from my WAS-LX1 using Tapatalk
usage is sometimes different between toybox and busybox. since twrp has started replacing busybox with toybox some scripts won't work properly anymore. this mean sometimes it is necessary to port flashable zip (for example when awk is used). for those who want to test shell scripts on pc i share my little wrapper shell script for quick testing applets syntax
Code:
acpi arch ascii base64 basename blkid blockdev bunzip2 bzcat cal cat
catv chattr chgrp chmod chown chroot chrt chvt cksum clear cmp comm
count cp cpio crc32 cut date devmem df dirname dmesg dnsdomainname
dos2unix du echo egrep eject env expand factor fallocate false fgrep
file find flock fmt free freeramdisk fsfreeze fstype fsync ftpget
ftpput getconf grep groups gunzip halt head help hexedit hostname
hwclock i2cdetect i2cdump i2cget i2cset iconv id ifconfig inotifyd
insmod install ionice iorenice iotop kill killall killall5 link ln
logger login logname losetup ls lsattr lsmod lspci lsusb makedevs
mcookie md5sum microcom mix mkdir mkfifo mknod mkpasswd mkswap mktemp
modinfo mount mountpoint mv nbd-client nc netcat netstat nice nl nohup
nproc nsenter od oneit partprobe passwd paste patch pgrep pidof ping
ping6 pivot_root pkill pmap poweroff printenv printf prlimit ps pwd
pwdx readahead readlink realpath reboot renice reset rev rfkill rm
rmdir rmmod sed seq setfattr setsid sha1sum shred sleep sntp sort
split stat strings su swapoff swapon switch_root sync sysctl tac tail
tar taskset tee test time timeout top touch true truncate tty tunctl
ulimit umount uname uniq unix2dos unlink unshare uptime usleep uudecode
uuencode uuidgen vconfig vmstat w watch wc which who whoami xargs
xxd yes zcat
Do you plan to add dd and gzip?
Painfully they are missing.
posix [dd] Partially implemented
lsb <gzip> Not started yet
http://www.landley.net/toybox/status.html
Very usefult. It helps me.
Thank you very much
I have two Xiaomi phones with A11.
Both have /sytem/bin/toybox installed
Is it common that toybox is pre-installed by default?

Why can't I compile the msm android kernel?

I've been stuck at this for more than a week, so I'd appreciate any help.
What am I trying to do? (you can skip this part if you want)
I'm trying to do android kernel exploitation. That's not my current problem though. To learn kernel exploitation, I need to be able to get a version of android that is vulnerable to a certain vulnerability. So here's what I'm doing:
1. Going here to select a CVE that I want to learn how to exploit
2. After selecting a CVE, I need to select a build that is vulnerable to that CVE from here
3. Now that I have chosen a build (QQ3A.200805.001 in my case), I note its branch name (android-10.0.0_r41 in my case)
4. Now I need to be able to run this build in the android emulator (qemu) once as a production build, and once with KASAN+KCOV+debugging symbols for gdb
Before I begin, I'm following these guides:
1. https://source.android.com/devices/tech/debug/kasan-kcov
2. https://source.android.com/setup/build/building-kernels-deprecated
3. Google
My Setup:
I did this to download everything I need:
Bash:
git clone https://android.googlesource.com/kernel/msm
cd msm
git fetch --all --tags --prune
git checkout remotes/origin/android-msm-coral-4.14-android10
cd ..
mkdir AOSP
cd AOSP
repo init -u https://android.googlesource.com/platform/manifest
repo sync -j`nproc`
repo init -b android-10.0.0_r41
repo sync -j`nproc`
cd ..
When I went to the AOSP directory and tried compiling with:
Bash:
source ./build/envsetup.sh
lunch aosp_flame-userdebug # For the Pixel 4
m
It compiled in 4 hours, but it worked.
My First Issue:
I then created this bash script in the main folder to try to compile the msm kernel normally (without KASAN/KCOV):
Bash:
###########
# Params: #
###########
ARCH=arm64
CONFIG=cuttlefish_defconfig
###########
# Script: #
###########
read -p "Compile with clang instead of gcc? [y/N] " USE_CLANG
if [ $USE_CLANG == y ] || [ $USE_CLANG == Y ]; then
COMPILER=clang
CC_PATH=$(pwd)/AOSP/prebuilts/clang/host/linux-x86/clang-r346389c/bin/
else
COMPILER=gcc
CC_PATH=$(pwd)/AOSP/prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.9/bin/
export CROSS_COMPILE=aarch64-linux-android-
fi
export ARCH=$ARCH
export PATH=$PATH:$CC_PATH
cd msm
make clean
make distclean
make $CONFIG
make CC=$COMPILER
When I run it with GCC, I get bombarded with depreciation warnings and I get an error:
Code:
Android GCC has been deprecated in favor of Clang, and will be removed from
Android in 2020-01 as per the deprecation plan in:
https://android.googlesource.com/platform/prebuilts/clang/host/linux-x86/+/master/GCC_4_9_DEPRECATION.md
...
Cannot use CONFIG_CC_STACKPROTECTOR_STRONG: -fstack-protector-strong not supported by compiler
When I run it with clang, I also get a ton of warnings and this error:
Code:
./arch/arm64/include/asm/stack_pointer.h:8:51: error: register 'sp' unsuitable for global register variables on this target
register unsigned long current_stack_pointer asm ("sp");
...
In file included from ./include/linux/kvm_host.h:14:
./include/linux/signal.h:81:11: warning: array index 3 is past the end of the array (which contains 1 element) [-Warray-bounds]
return (set->sig[3] | set->sig[2] |
Full outputs for the script can be found here (for gcc) and here (for clang). Basically my first issue is that I don't know why I'm getting these compilation errors. So any suggestions would be greatly appreciated.
My Second Issue:
Now, I am checking out the remotes/origin/android-msm-coral-4.14-android10 branch in the msm repo, but I think this isn't the way to go because I need the kernel version that corresponds to a certain build/branch (QQ3A.200805.001 or android-10.0.0_r41 in my case). I think I need to build the exact version that is precompiled in the AOSP repository.
For example, if I go to the AOSP/device/google/coral directory, and run git log, I get something like this:
Code:
commit 62d311ad7cfc3e76a5278634427596462069b44d (HEAD, tag: android-10.0.0_r41, tag: m/android-10.0.0_r41, aosp/android10-qpr3-release)
Merge: 7b91fff 0657c80
Author: android-build-team Robot <[email protected]>
Date: Wed Jun 10 23:45:11 2020 +0000
Merge cherrypicks of [11827366, 11829660, 11829049, 11829662, 11829647, 11829300, 11826697, 11829719, 11829051, 11829663, 11829664, 11829838, 11829052, 11829472, 11829586] into qt-qpr3-release
Change-Id: Ic126de75c24133f8d43df7c9d8f09059a9ca8089
commit 0657c80f016720f70ed6f9618f928a30e71f2b79
Author: wenchangliu <[email protected]>
Date: Tue Mar 24 18:11:18 2020 +0800
coral: Add seccomp policy for Codec2 process
Add seccomp policy for Codec2 process.
Bug: 149511958
Test: adb shell killall media.hwcodec
Change-Id: Iab64bd42ead0c5a27769a757007282c2dddf911d
(cherry picked from commit 3628a510a808a52c4ebf69958a8343928e5df3f2)
(cherry picked from commit 45a6093f3d085ca2a531c2607bd12dbc1eff6bf9)
commit 7b91fffc14afb41cf14772566272c72b37c36785
Merge: 2e7f1a3 e8c9484
Author: android-build-team Robot <[email protected]>
Date: Wed Jun 10 00:37:23 2020 +0000
...
Link for this exact commit/tag can be found here. However, there is no android-10.0.0_r41 tag in the msm source repo, so I don't know which version of the msm repo corresponds to the prebuilt one in the AOSP directory. And.. I don't know where to start looking tbh.
Any help is greatly appreciated.

Categories

Resources