Run the executable file with qemu-user on Android, androidqemu-user

Run the executable file with qemu-user on Android, androidqemu-user

Run the executable file using qemu-user on Android

Author: xunyu @ aliyunju Security

 

 

Preface

QEMU brief introduction:

QEMU can explain executable programs. Since QEMU can explain the execution of executable programs, QEMU can know which commands are executed and track the execution of commands. The results compiled by QEMU are divided into system mode and user mode. The executable file name compiled by QEMU user mode is qemu-user. For more information about QEMU, visit the official website QEMU.

 

For details about how to compile the QEMU user mode executable file, refer to this article: Compile the qemu user mode that can be run on Android.

The source code of the main function of qemu-user is in the file "linux-user/main. c.

 

 

Prerequisites

The QEMU user mode executable files studied in this article run in(Android & arm cpu)The term "device" in the following article refers to the Android arm device. The system of the device is CyanogenMod12.1 ROM, which is based on Android5.1.1.

 

Run qemu-user

Copy the qemu-user to the device, and when you run the executable, the system prompts that the libglib-2.0.so.0 and libgthread-2.0.so.0 libraries cannot be found, if the reader compiles qemu-user successfully according to the article "compile qemu user mode that can be run on Android" referenced above, the two libraries will exist in the Android NDK directory, copy these two directories to the "/system/lib/" directory of the device, and then run the qemu-user program successfully.

 

RUN error solution: FATAL: kernel did not supply AT_SECURE

The error "FATAL: kernel did not supply AT_SECURE" is displayed when I run qemu-user on the device ".

 

Solution 1

(Solution Source: https://gist.github.com/jserv/5019475)

Find the "bionic/linker/linker_environ.cpp" file and modify the file according to the following code:

 

If you have used git and read the above code, you can clearly understand the content displayed after running "git diff" and what changes have been made to the Code. If you have never seen the content displayed by the "git diff" command, do this: Find"-Static void _ init_AT_SECURE (KernelArgumentBlock & args){"This line, starting from this line (including this line), indicates deleting this line starting with a minus sign.

 

After the file is modified, run the following command in the root directory of the Android source code:

. Build/envsetup. sh
Breakfast hammerhead
Mmm <Android source code root directory>/bionic/linker/

 

The mmm command is used to compile the source code under the "<Android source code root directory>/bionic/linker/" directory, after the source code under this directory is compiled, an executable file named "linker" will be generated. The directory for generating the executable file will be displayed on the terminal, overwrite the linker to the "/system/bin/linker" file on the device.

The ROOT permission is required to overwrite the "/system/bin/linker" file on the device ." After the/system/bin/linker file is overwritten, its file permissions are as follows:

-Rwxr-xr-x root 91902 linker

 

That is, linker belongs to the root user and belongs to the root user group. However, the original permissions of linker are as follows:

-Rwxr-xr-x root shell 91902 linker

 

That is, linker belongs to the root user and belongs to the shell user group.

Therefore, after linker overwrites, you need to run the "chgrp shell/system/bin/linker" command to set the linker user group.

_ Init_AT_SECURE: _ linker_init-> _ linker_init_post_relocation-> linker_env_init-> _ init_AT_SECURE

 

Solution 2

Find the "linux-user/elfload. c" file in the qemu source code Directory, which contains the create_elf_tables function. Find this line of code in this function:

 

Add a line of code under this line of code:

 

 

Find this line in the file:

 

Change this line:

 

Solution:

[Translation] getauxval () and the auw.iary vector as described in this article, the fs/binfmt_elf.c file contains the kernel's ELF binary loader source code, and there is also a create_elf_tables function in this file, the create_elf_tables function in the fs/binfmt_elf.c file has the following line of code:

 

That is, the AT_SECURE item is added to the standard create_elf_tables function. By reading "solution 1", we can infer that the error "FATAL: kernel did not supply AT_SECURE" is generated because the AT_SECURE item cannot be found, solution 2 is to add this item to the create_elf_tables function of qemu.

 

Why is the value of the AT_SECURE item added to the create_elf_tables function of qemu 0? This is because of my convenience. In the standard code, the value of the AT_SECURE item is the return value of the security_bprm_secureexec (bprm) function. I found it troublesome to understand the security_bprm_secureexec function. So why is it 0 instead of other constant values? This is because the following command is entered on the linux terminal:

LD_SHOW_AUXV = 1 ps

 

The value corresponding to AT_SECURE is 0. The "ps" in the above command can be other commands, such as ls. LD_SHOW_AUXV environment variables are described in [translation] getauxval () and the auxiliary vector.

-Loader_exec-> linux-user/elfload. c-load_elf_binary-> linux-user/elfload. c-create_elf_tables

 

 

Author: xunyu @ Alibaba Cloud universal security. For more security technologies and information articles, visit Alibaba Cloud universal security blog.