Android root file system analysis (2)

 

Today, we will analyze the structure of the/system directory of the android file system.

The/system directory occupies an important position in the android file system. Basically, all the tools and applications are under this directory. In my opinion, it is a real rootfs. It is stored in the mtd3 of NAND flash on the Android phone and is a yaffs2 file system. It is mounted to the root/system directory at startup, including:

# PWD & LS-a-l
/System
Drwxr-XR-x root 208 xbin
Drwxr-XR-x Root modules
Drwxr-XR-x Root 2008-08-01 20:00 framework
Drwxr-XR-x Root 2008-08-01 20:00 Fonts
Drwxr-XR-x Root 2008-08-01 20:00 etc
-RW-r -- root Root 2197 build. Prop
Drwxr-XR-x Root 2008-08-01 20:00 Media
Drwxr-XR-x root shell 2008-08-01 20:00 Bin
Drwxr-XR-x Root 2008-08-01 20:00 USR
Drwxr-XR-x Root 2008-08-01 20:00 app
Drwxr-XR-x Root 2008-09-06 lost + found
Drwxr-XR-x Root 2008-08-01 20:00 lib
Drwxr-XR-x Root 2008-08-01 20:00 SD
-RW-r -- root Root 145 init. RC

 

The following analyzes the directories one by one:

Xbin: Many system management tools are released. These tools are not linked to toolbox, and each tool is an executable program. If you see these commands, you will find that they are not commonly used at all. They are all prepared for the system administrator and are some system management and configuration tools. This folder serves as/sbin in the standard Linux File System. My mobile phone has busybox in this directory. It must have been changed. It should have been added by the attacker.

 

Modules: used to store kernel modules (mainly FS and net) and module configuration files.

 

Framework: a core file of the Java platform. It is a framework file of the Java platform. The files are. jar and. odex files.

Note: What is an odex file? Odex is a optimized Java program file, which is about 4 times the size of. jar. The execution efficiency is higher than. jar.

 

Fonts: Obviously, this is the directory where the library files are stored.

 

ETC: stores almost all the configuration files in the system, and the/etc files in the root directory are linked here.

 

Build. Prop: an attribute file. In Android, The. Prop file is very important and records system settings and changes, similar to files in/etc.

 

Media: It mainly stores system ringtones, which can be classified into icationications())uiui( alalarms( ))and ringtones( ), where all .ogg audio files are contained.

 

Bin: As we all know, it stores commonly used tool programs, most of which are links to Toolbox (similar to busybox in Embedded Linux ). Toolbox should be a simplified Google busybox, which I have not studied in depth.

 

USR: user configuration files, such as keyboard layout, sharing, and time zone files. You can take a look at the cat.

 

APP: As the name implies, it stores Java applications that come with the Android system.

 

Lost + found: inherent in the yaffs file system, similar to the recycle bin folder, only available in the yaffs file system.

 

Lib: stores almost all shared library (. So) files.

 

SD: directory of the ext2 partition in the SD card

 

Init. RC: An initialization script used to mount/system/modules and/system/xbin to cramfs to avoid unintentional damage to the system.

 

 

Well, the structure of the/system directory is simply analyzed here, And the Startup Process of the android file system will be analyzed tomorrow.