Learning About AVB Android Verified Boot (Boot.img dtb.img, vbmeta.img, and the "staging blob")

[jenneh]

@Renate thank you so much for taking the time. I will read and re-read every thing you have said now and again tomorrow after some sleep. Just Thank You Thank You you've saved me days of banging my head against the wall and really provided a clear path forward. Haha and I love the humor you add in these teachings. "It could be the first 1000 digits of pi" hahaha "Behave yourself!" !

 

[jenneh]

Hi @Renate! I am reading about objdump now and it talks a lot about "displaying information" and "dissembly to view", but is it able to make edits? Is this the program You use? Or which decompiler do You prefer to make patches or mods with? I would like to focus on learning the tools you know because you know all the things I want to know!

I am trying to play with Ghidra now

I feel like i am not looking at the right view haha! but I am trying! I have watched so many videos on this I want to be able to do it so bad x.x disassembly has just never "clicked" for me yet

What I am watching now

Spoiler: SHOW

John shows how to open the defined strings window in that video

OHH and Renate! Should I be using arm for the decompiler or should I be using x86? Like is it asking for the file I am using or the computer I am using??

 

[Renate]

You have an ELF file. The disassembler should know already that it's AARCH64.
You should be looking at "Disassembled view".
Maybe you can click on "ADB_EXTERNAL_STORAGE" and select "where referenced" or some such thing.

Your disassembler program might have the ability of assembling single instructions and modifying.
If not you have to use an online assembler to come up with the codes.
Fortunately, most of the instructions you'd want to do are simple, load zero into this register, nop or branch.
When you know the offset and what you want to write you can use any hex editor.

 

[jenneh]

Gosh, thanks Renate! I had no idea there was Online Assemblers as well, goodness you are opening up a new world here! I finally found a very good beginner video by a man with a very pleasantly calm voice

So maybe I can stop trying to fly before I have took lessons >.> Thank you so much for helping me. I Will figure out what you mean by this Today

" load zero into this register, nop or branch." without having to ask! Haha!

 

[Renate]

It helps to know what all the instructions do.
This is a pretty good step-by-step: https://developer.arm.com/documentation/102374/latest/
When you want to manually assemble instructions yourself you need to know what all the bits do: https://developer.arm.com/documentation/ddi0596/latest

 

[jenneh]

I'm so happy I'm crying haha THANK YOU RENATE!!!! This, This is what I needed!!! Oh goodness! Idk why it never occurred to me to look up anything on the arm architecture specifically x.x that makes so much sense to do in hind sight. I made it to the register bits and yeah, the lights are starting to come on. YAYYYY.

Spoiler: NOTES

What is a processor register?

Processor register - Wikipedia

en.wikipedia.org

What is a stack pointer?

What is a stack pointer used for in microprocessors?

I am preparing for a microprocessor exam. If the use of a program counter is to hold the address of the next instruction, what is use of stack pointer?

stackoverflow.com

What is a link register?

Link register - Wikipedia

en.wikipedia.org

What is a program counter?

Program counter - Wikipedia

en.wikipedia.org

What actually is computer memory?

Computer memory - Wikipedia

en.wikipedia.org

 

[jenneh]

I was able to figure out how to search for the local port disabled string, but it doesn't seem to pull up any functions like the example here did https://harrisonsand.com/posts/patching-adb-root/ the minijails do though

 

[Renate]

Let's start with the basics. How big is your adbd file?
adbd used to be static linked and was around 1MB.
Later Google made it use a fistful of libs and it was less than 50kB.

In any case look for where "ADB_EXTERNAL_STORAGE" is used.
That's the start of where you want to modify.

 

[jenneh]

Hi @Renate thank you for the guidance! I had put that up so I could try to read it more while I was out. This is the size of my adbd!

This is what came up when I searched for " "ADB_EXTERNAL_STORAGE"

Renate, how did you know to go to the external storage? Is this because you have done this many times or something? I am blown away how you know everything!

 

[Renate]

Renate, how did you know to go to the external storage?

You can look at your disassembler side-by-side with the Andoid source code.
You have to find the correct version, but things change slowly.
Also Google restructures the source code tree all the time and it's hard to find stuff.
Here's adbd daemon/main.cpp for Android 10: https://android.googlesource.com/platform/system/core/+/refs/heads/android10-dev/adb/daemon/main.cpp
It looks like we just want to eliminate line #230, drop_privileges(server_port)
BUT... drop_privileges() is actually a static function.
That means it's like all the code in drop_privileges() is copy/pasted into adbd_main().
There is no "bl" (branch and link) instruction going to an actual drop_privileges().

 

[jenneh]

@Renate Brilliant! THANK YOU for linking the Source Code! I have heard these guys talking about loading the source code separately while they are in ghidra (i listen to this stuff at work) and in my mind I always pictured they were reading it from HxD. Which is silly now that I think about it. I've probably watched it too but it's easier to understand when you are working on something yourself.

Now to the Questions!!

So the version of android I am working with is android 9, with this adbd, does that matter? Interestingly, for this device Nvidia Skipped android 10 and went straight to 11 lol. No idea why!

I tried searching for any strings related to this
"It looks like we just want to eliminate line #230, drop_privileges(server_port)"

but got no results.

I am super sorry, but what specifically do you all mean when you say to look at the disassembler side by side with the source code? Like now I understand the source code part, and can look for the 9 version if that matters, but, when I start adbd in ghidra, should I be looking at the listing window or should I be looking at some other view? I really apologize for the Im sure super basic questions to you, but I really appreciate you helping me to understand

 

[Renate]

An ELF file has many sections. What your last screenshot is showing is just the blah-blah-blah of every ELF file.
Line #230 is in that link to main.cpp from above.
Compare it to what you were showing in the last screenshot here

 

[jenneh]

OHHHH thank You sorry I think too much some times!! I will do that now /facepalm

this window . and reviewing now!

 

[jenneh]

Okay @Renate so I was able to look at some of the Source codes for android 9 and none of them are matching up with what I have got going on. Like this one for instance: https://android.googlesource.com/pl...fs/tags/android-9.0.0_r61/adb/daemon/main.cpp

I will continue reading mine and I will link it here in case you have any idea if I did the right thing or not. I do see where there is talk of the minijail! Looking for drop_privledge now

Spoiler: SHOW

/* WARNING: Could not reconcile some variable overlaps */
/* adbd_main(int) */

undefined8 adbd_main(int param_1)

{
  undefined **ppuVar1;
  ulong uVar2;
  undefined4 uVar3;
  long lVar4;
  uint uVar5;
  int iVar6;
  int iVar7;
  char *pcVar8;
  long lVar9;
  undefined8 *puVar10;
  undefined4 *puVar11;
  basic_ostream *pbVar12;
  int *piVar13;
  long lVar14;
  code *pcVar15;
  ulong uVar16;
  ulong local_118;
  undefined8 uStack_110;
  void *local_108;
  basic_string local_100;
  undefined7 uStack_ff;
  undefined uStack_f8;
  undefined7 uStack_f7;
  undefined local_f0;
  undefined4 uStack_ef;
  undefined uStack_eb;
  undefined2 uStack_ea;
  ulong local_e0;
  ulong uStack_d8;
  undefined **local_d0;
  code *pcStack_c8;
  undefined ***local_b0;
  basic_string local_a0;
  undefined7 uStack_9f;
  undefined uStack_98;
  undefined7 uStack_97;
  undefined local_90;
  undefined4 uStack_8f;
  undefined uStack_8b;
  undefined2 uStack_8a;
  undefined4 uStack_88;
  undefined4 local_84;
  undefined4 uStack_80;
  undefined8 uStack_7c;
 
  lVar4 = tpidr_el0;
  lVar14 = *(long *)(lVar4 + 0x28);
  __umask_chk(0);
  signal(0xd,(__sighandler_t)0x1);
  init_transport_registration();
  adbd_cloexec_auth_socket();
  adbd_auth_init();
  pcVar8 = getenv("ADB_EXTERNAL_STORAGE");
  if (pcVar8 == (char *)0x0) {
    if (((adb_trace_mask & 1) != 0) &&
       (pcVar8 = (char *)android::base::GetMinimumLogSeverity(), (int)pcVar8 < 2)) {
      puVar11 = (undefined4 *)__errno();
      uVar3 = *puVar11;
      android::base::LogMessage::LogMessage
                ((LogMessage *)&local_a0,"system/core/adb/daemon/main.cpp",199,0,1,(char *)0x0,-1) ;
      pbVar12 = (basic_ostream *)ENGINE_get_RSA_method(&local_a0);
      android::base::StringPrintf
                ("Warning: ADB_EXTERNAL_STORAGE is not set.  Leaving EXTERNAL_STORAGE unchanged.\n" )
      ;
      uVar2 = (ulong)((byte)local_e0 >> 1);
      ppuVar1 = (undefined **)((ulong)&local_e0 | 1);
      if ((local_e0 & 1) != 0) {
        uVar2 = uStack_d8;
        ppuVar1 = local_d0;
      }
      std::__1::__put_character_sequence<char,std::__1::char_traits<char>>
                (pbVar12,(char *)ppuVar1,uVar2);
      if (((byte)local_e0 & 1) != 0) {
        operator.delete(local_d0);
      }
      pcVar8 = (char *)android::base::LogMessage::~LogMessage((LogMessage *)&local_a0);
      *puVar11 = uVar3;
    }
  }
  else {
    uVar5 = setenv("EXTERNAL_STORAGE",pcVar8,1);
    pcVar8 = (char *)(ulong)uVar5;
  }
  lVar9 = minijail_new(pcVar8);
  uStack_7c = 0xbc300000bc1;
  uStack_80 = 0xbbe;
  uStack_88 = 0x404;
  local_84 = 0x3f7;
  local_90 = 0xba;
  uStack_8f = 0xb900000b;
  uStack_8b = 0xb;
  uStack_8a = 0;
  uStack_98 = 0xec;
  uStack_97 = 0xbbb000003;
  local_a0 = (basic_string)0xf3;
  uStack_9f = 0x3ef000003;
  minijail_set_supplementary_gids(lVar9,0xb,&local_a0);
  minijail_use_caps(lVar9,0xc0);
  minijail_change_gid(lVar9,2000);
  minijail_change_uid(lVar9,2000);
  minijail_enter(lVar9);
  local_e0 = cap_get_proc();
  local_d0 = &PTR_debuggerd_fallback_handler_005570b0;
  pcStack_c8 = cap_free;
  local_b0 = &local_d0;
  iVar6 = cap_clear_flag(local_e0,2);
  if ((iVar6 == -1) && (iVar6 = android::base::GetMinimumLogSeverity(), iVar6 < 7)) {
    piVar13 = (int *)__errno();
    iVar6 = *piVar13;
    android::base::LogMessage::LogMessage
              ((LogMessage *)&local_100,"system/core/adb/daemon/main.cpp",0x8b,0,6,(char *)0x0,iVa r6
              );
    pbVar12 = (basic_ostream *)ENGINE_get_RSA_method(&local_100);
    std::__1::__put_character_sequence<char,std::__1::char_traits<char>>
              (pbVar12,"cap_clear_flag(INHERITABLE) failed",0x22);
    android::base::LogMessage::~LogMessage((LogMessage *)&local_100);
    *piVar13 = iVar6;
  }
  iVar6 = cap_clear_flag(local_e0,0);
  if ((iVar6 == -1) && (iVar6 = android::base::GetMinimumLogSeverity(), iVar6 < 7)) {
    piVar13 = (int *)__errno();
    iVar6 = *piVar13;
    android::base::LogMessage::LogMessage
              ((LogMessage *)&local_100,"system/core/adb/daemon/main.cpp",0x8e,0,6,(char *)0x0,iVa r6
              );
    pbVar12 = (basic_ostream *)ENGINE_get_RSA_method(&local_100);
    std::__1::__put_character_sequence<char,std::__1::char_traits<char>>
              (pbVar12,"cap_clear_flag(PEMITTED) failed",0x1f);
    android::base::LogMessage::~LogMessage((LogMessage *)&local_100);
    *piVar13 = iVar6;
  }
  iVar6 = cap_clear_flag(local_e0,1);
  if ((iVar6 == -1) && (iVar6 = android::base::GetMinimumLogSeverity(), iVar6 < 7)) {
    piVar13 = (int *)__errno();
    iVar6 = *piVar13;
    android::base::LogMessage::LogMessage
              ((LogMessage *)&local_100,"system/core/adb/daemon/main.cpp",0x91,0,6,(char *)0x0,iVa r6
              );
    pbVar12 = (basic_ostream *)ENGINE_get_RSA_method(&local_100);
    std::__1::__put_character_sequence<char,std::__1::char_traits<char>>
              (pbVar12,"cap_clear_flag(PEMITTED) failed",0x1f);
    android::base::LogMessage::~LogMessage((LogMessage *)&local_100);
    *piVar13 = iVar6;
  }
  iVar6 = cap_set_proc(local_e0);
  if ((iVar6 != 0) && (iVar6 = android::base::GetMinimumLogSeverity(), iVar6 < 7)) {
    piVar13 = (int *)__errno();
    iVar6 = *piVar13;
    android::base::LogMessage::LogMessage
              ((LogMessage *)&local_100,"system/core/adb/daemon/main.cpp",0x94,0,6,(char *)0x0,iVa r6
              );
    pbVar12 = (basic_ostream *)ENGINE_get_RSA_method(&local_100);
    std::__1::__put_character_sequence<char,std::__1::char_traits<char>>
              (pbVar12,"cap_set_proc() failed",0x15);
    android::base::LogMessage::~LogMessage((LogMessage *)&local_100);
    *piVar13 = iVar6;
  }
  if (((adb_trace_mask & 1) != 0) && (iVar6 = android::base::GetMinimumLogSeverity(), iVar6 < 2))  {
    puVar11 = (undefined4 *)__errno();
    uVar3 = *puVar11;
    android::base::LogMessage::LogMessage
              ((LogMessage *)&local_118,"system/core/adb/daemon/main.cpp",0x97,0,1,(char *)0x0,-1) ;
    pbVar12 = (basic_ostream *)ENGINE_get_RSA_method(&local_118);
    android::base::StringPrintf("Local port disabled");
    uVar2 = (ulong)((byte)local_100 >> 1);
    pcVar8 = (char *)((ulong)&local_100 | 1);
    if (((byte)local_100 & 1) != 0) {
      uVar2 = CONCAT71(uStack_f7,uStack_f8);
      pcVar8 = (char *)CONCAT26(uStack_ea,CONCAT15(uStack_eb,CONCAT41(uStack_ef,local_f0)));
    }
    std::__1::__put_character_sequence<char,std::__1::char_traits<char>>(pbVar12,pcVar8,uVar2);
    if (((byte)local_100 & 1) != 0) {
      operator.delete((void *)CONCAT26(uStack_ea,CONCAT15(uStack_eb,CONCAT41(uStack_ef,local_f0)) ));
    }
    android::base::LogMessage::~LogMessage((LogMessage *)&local_118);
    *puVar11 = uVar3;
  }
  uVar2 = local_e0;
  local_e0 = 0;
  if (uVar2 != 0) {
    local_100 = SUB81(uVar2,0);
    uStack_ff = (undefined7)(uVar2 >> 8);
    if (local_b0 == (undefined ***)0x0) {
                    /* WARNING: Subroutine does not return */
      abort();
    }
    (*(code *)(*local_b0)[6])(local_b0,&local_100);
  }
  if (&local_d0 == local_b0) {
    pcVar15 = (code *)(*local_b0)[4];
LAB_00405120:
    (*pcVar15)();
  }
  else if (local_b0 != (undefined ***)0x0) {
    pcVar15 = (code *)(*local_b0)[5];
    goto LAB_00405120;
  }
  if (lVar9 != 0) {
    minijail_destroy(lVar9);
  }
  iVar6 = access("/dev/usb-ffs/adb/ep0",0);
  if (iVar6 == 0) {
    usb_init();
  }
  local_a0 = (basic_string)0x28;
  uStack_8a = 0;
  local_100 = (basic_string)0x0;
  uStack_ff = 0;
  uStack_f8 = 0;
  uStack_f7 = 0;
  uStack_8f = 0x74726f70;
  uStack_97 = 0x7063742e626461;
  local_90 = 0x2e;
  uStack_9f = 0x65636976726573;
  uStack_98 = 0x2e;
  uStack_8b = 0;
  local_f0 = 0;
  uStack_ef = 0;
  uStack_eb = 0;
  uStack_ea = 0;
  android::base::GetProperty(&local_a0,&local_100);
  if (((byte)local_100 & 1) != 0) {
    operator.delete((void *)CONCAT26(uStack_ea,CONCAT15(uStack_eb,CONCAT41(uStack_ef,local_f0)))) ;
  }
  if (((byte)local_a0 & 1) != 0) {
    operator.delete((void *)CONCAT26(uStack_8a,CONCAT15(uStack_8b,CONCAT41(uStack_8f,local_90)))) ;
  }
  uVar16 = (ulong)((byte)local_e0 >> 1);
  uVar2 = uVar16;
  if ((local_e0 & 1) != 0) {
    uVar2 = uStack_d8;
  }
  if (uVar2 == 0) {
    local_100 = (basic_string)0x28;
    uStack_ea = 0;
    local_118 = 0;
    uStack_110 = 0;
    uStack_ef = 0x74726f70;
    uStack_f7 = 0x7063742e626461;
    local_f0 = 0x2e;
    uStack_ff = 0x74736973726570;
    uStack_f8 = 0x2e;
    uStack_eb = 0;
    local_108 = (void *)0x0;
    android::base::GetProperty(&local_100,(basic_string *)&local_118);
    if ((local_e0 & 1) == 0) {
      local_e0 = local_e0 & 0xffffffffffff0000;
    }
    else {
      *(char *)local_d0 = '\0';
      uStack_d8 = 0;
    }
    std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>::reserve
              ((basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>> *)&local_ e0
               ,0);
    local_d0 = (undefined **)CONCAT26(uStack_8a,CONCAT15(uStack_8b,CONCAT41(uStack_8f,local_90))) ;
    uStack_d8 = CONCAT71(uStack_97,uStack_98);
    local_e0 = CONCAT71(uStack_9f,local_a0);
    local_a0 = (basic_string)0x0;
    uStack_9f = 0;
    uStack_98 = 0;
    uStack_97 = 0;
    local_90 = 0;
    uStack_8f = 0;
    uStack_8b = 0;
    uStack_8a = 0;
    if ((local_118 & 1) != 0) {
      operator.delete(local_108);
    }
    if (((byte)local_100 & 1) != 0) {
      operator.delete((void *)CONCAT26(uStack_ea,CONCAT15(uStack_eb,CONCAT41(uStack_ef,local_f0)) ));
    }
    uVar16 = (ulong)((byte)local_e0 >> 1);
  }
  if (((byte)local_e0 & 1) != 0) {
    uVar16 = uStack_d8;
  }
  if (uVar16 == 0) {
    puVar10 = (undefined8 *)operator.new(0x30);
    local_f0 = SUB81(puVar10,0);
    uStack_ef = (undefined4)((ulong)puVar10 >> 8);
    uStack_eb = (undefined)((ulong)puVar10 >> 0x28);
    uStack_ea = (undefined2)((ulong)puVar10 >> 0x30);
    *(undefined *)(puVar10 + 4) = 0;
    puVar10[1] = 0x6e2e726f646e6576;
    *puVar10 = 0x2e74736973726570;
    puVar10[3] = 0x74726f702e706374;
    puVar10[2] = 0x2e6264612e616476;
    local_118 = 0;
    uStack_110 = 0;
    uStack_f8 = 0x20;
    uStack_f7 = 0;
    local_100 = (basic_string)0x31;
    uStack_ff = 0;
    local_108 = (void *)0x0;
    android::base::GetProperty(&local_100,(basic_string *)&local_118);
    if ((local_e0 & 1) == 0) {
      local_e0 = local_e0 & 0xffffffffffff0000;
    }
    else {
      *(char *)local_d0 = '\0';
      uStack_d8 = 0;
    }
    std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>::reserve
              ((basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>> *)&local_ e0
               ,0);
    local_d0 = (undefined **)CONCAT26(uStack_8a,CONCAT15(uStack_8b,CONCAT41(uStack_8f,local_90))) ;
    uStack_d8 = CONCAT71(uStack_97,uStack_98);
    local_e0 = CONCAT71(uStack_9f,local_a0);
    local_a0 = (basic_string)0x0;
    uStack_9f = 0;
    uStack_98 = 0;
    uStack_97 = 0;
    local_90 = 0;
    uStack_8f = 0;
    uStack_8b = 0;
    uStack_8a = 0;
    if ((local_118 & 1) != 0) {
      operator.delete(local_108);
    }
    if (((byte)local_100 & 1) != 0) {
      operator.delete((void *)CONCAT26(uStack_ea,CONCAT15(uStack_eb,CONCAT41(uStack_ef,local_f0)) ));
    }
  }
  ppuVar1 = (undefined **)((ulong)&local_e0 | 1);
  if (((byte)local_e0 & 1) != 0) {
    ppuVar1 = local_d0;
  }
  iVar7 = sscanf((char *)ppuVar1,"%d",&local_118);
  if ((iVar7 == 1) && (0 < (int)local_118)) {
    if (((adb_trace_mask & 1) != 0) && (iVar6 = android::base::GetMinimumLogSeverity(), iVar6 < 2) )
    {
      puVar11 = (undefined4 *)__errno();
      uVar3 = *puVar11;
      android::base::LogMessage::LogMessage
                ((LogMessage *)&local_100,"system/core/adb/daemon/main.cpp",0xe0,0,1,(char *)0x0,- 1)
      ;
      pbVar12 = (basic_ostream *)ENGINE_get_RSA_method(&local_100);
      android::base::StringPrintf("using port=%d",local_118 & 0xffffffff);
      uVar2 = (ulong)((byte)local_a0 >> 1);
      pcVar8 = (char *)((ulong)&local_a0 | 1);
      if (((byte)local_a0 & 1) != 0) {
        uVar2 = CONCAT71(uStack_97,uStack_98);
        pcVar8 = (char *)CONCAT26(uStack_8a,CONCAT15(uStack_8b,CONCAT41(uStack_8f,local_90)));
      }
      std::__1::__put_character_sequence<char,std::__1::char_traits<char>>(pbVar12,pcVar8,uVar2);
      if (((byte)local_a0 & 1) != 0) {
        operator.delete((void *)CONCAT26(uStack_8a,CONCAT15(uStack_8b,CONCAT41(uStack_8f,local_90 )))
                       );
      }
      android::base::LogMessage::~LogMessage((LogMessage *)&local_100);
      *puVar11 = uVar3;
    }
    local_init((int)local_118);
  }
  else {
    if (iVar6 == 0) goto LAB_004053b0;
    local_init(0x15b3);
    local_118._0_4_ = 0x15b3;
  }
  setup_mdns((int)local_118);
LAB_004053b0:
  if (((adb_trace_mask & 1) != 0) && (iVar6 = android::base::GetMinimumLogSeverity(), iVar6 < 2))  {
    puVar11 = (undefined4 *)__errno();
    uVar3 = *puVar11;
    android::base::LogMessage::LogMessage
              ((LogMessage *)&local_100,"system/core/adb/daemon/main.cpp",0xe8,0,1,(char *)0x0,-1) ;
    pbVar12 = (basic_ostream *)ENGINE_get_RSA_method(&local_100);
    android::base::StringPrintf("adbd_main(): pre init_jdwp()");
    uVar2 = (ulong)((byte)local_a0 >> 1);
    pcVar8 = (char *)((ulong)&local_a0 | 1);
    if (((byte)local_a0 & 1) != 0) {
      uVar2 = CONCAT71(uStack_97,uStack_98);
      pcVar8 = (char *)CONCAT26(uStack_8a,CONCAT15(uStack_8b,CONCAT41(uStack_8f,local_90)));
    }
    std::__1::__put_character_sequence<char,std::__1::char_traits<char>>(pbVar12,pcVar8,uVar2);
    if (((byte)local_a0 & 1) != 0) {
      operator.delete((void *)CONCAT26(uStack_8a,CONCAT15(uStack_8b,CONCAT41(uStack_8f,local_90)) ));
    }
    android::base::LogMessage::~LogMessage((LogMessage *)&local_100);
    *puVar11 = uVar3;
  }
  init_jdwp();
  if (((adb_trace_mask & 1) != 0) && (iVar6 = android::base::GetMinimumLogSeverity(), iVar6 < 2))  {
    puVar11 = (undefined4 *)__errno();
    uVar3 = *puVar11;
    android::base::LogMessage::LogMessage
              ((LogMessage *)&local_100,"system/core/adb/daemon/main.cpp",0xea,0,1,(char *)0x0,-1) ;
    pbVar12 = (basic_ostream *)ENGINE_get_RSA_method(&local_100);
    android::base::StringPrintf("adbd_main(): post init_jdwp()");
    uVar2 = (ulong)((byte)local_a0 >> 1);
    pcVar8 = (char *)((ulong)&local_a0 | 1);
    if (((byte)local_a0 & 1) != 0) {
      uVar2 = CONCAT71(uStack_97,uStack_98);
      pcVar8 = (char *)CONCAT26(uStack_8a,CONCAT15(uStack_8b,CONCAT41(uStack_8f,local_90)));
    }
    std::__1::__put_character_sequence<char,std::__1::char_traits<char>>(pbVar12,pcVar8,uVar2);
    if (((byte)local_a0 & 1) != 0) {
      operator.delete((void *)CONCAT26(uStack_8a,CONCAT15(uStack_8b,CONCAT41(uStack_8f,local_90)) ));
    }
    android::base::LogMessage::~LogMessage((LogMessage *)&local_100);
    *puVar11 = uVar3;
  }
  if (((adb_trace_mask & 1) != 0) && (iVar6 = android::base::GetMinimumLogSeverity(), iVar6 < 2))  {
    puVar11 = (undefined4 *)__errno();
    uVar3 = *puVar11;
    android::base::LogMessage::LogMessage
              ((LogMessage *)&local_100,"system/core/adb/daemon/main.cpp",0xec,0,1,(char *)0x0,-1) ;
    pbVar12 = (basic_ostream *)ENGINE_get_RSA_method(&local_100);
    android::base::StringPrintf("Event loop starting");
    uVar2 = (ulong)((byte)local_a0 >> 1);
    pcVar8 = (char *)((ulong)&local_a0 | 1);
    if (((byte)local_a0 & 1) != 0) {
      uVar2 = CONCAT71(uStack_97,uStack_98);
      pcVar8 = (char *)CONCAT26(uStack_8a,CONCAT15(uStack_8b,CONCAT41(uStack_8f,local_90)));
    }
    std::__1::__put_character_sequence<char,std::__1::char_traits<char>>(pbVar12,pcVar8,uVar2);
    if (((byte)local_a0 & 1) != 0) {
      operator.delete((void *)CONCAT26(uStack_8a,CONCAT15(uStack_8b,CONCAT41(uStack_8f,local_90)) ));
    }
    android::base::LogMessage::~LogMessage((LogMessage *)&local_100);
    *puVar11 = uVar3;
  }
  fdevent_loop();
  if ((local_e0 & 1) != 0) {
    operator.delete(local_d0);
  }
  if (*(long *)(lVar4 + 0x28) != lVar14) {
                    /* WARNING: Subroutine does not return */
    __stack_chk_fail();
  }
  return 0;
}

This is so much fun!

 

[Renate]

Well, the details are different, but the drift is the same.
Get ADB_EXTERNAL_STORAGE, decide if you want to do anything, Set EXTERNAL_STORAGE.
Then you see minijail_new(), that's what you wnt to avoid.
So you want to replace that instruction (easier to see in disassembler view) with a branch to past all the minijail stuff.
Scroll down until you see the access() call.

 

[jenneh]

Now that I have had some sleep... Time to play more!

Spoiler: just more things for me

documenting my fumbles to help me remember in the future when I am competent enough to write a guide

had to enable the disassembled view from window options and have decompiler in back

Spoiler: notes

useful explainations from the link renate shared

Documentation – Arm Developer

developer.arm.com

adrp: Form PC-relative address to 4KB page. (what is PC-relative?)
cbnz: Compare and Branch on Nonzero.
tbnz: Test bit and Branch if Nonzero

What is this? Is it what is going through and making everything root? I see where it remounts the other partitions too

what about this, what does the s_ mean? in my head right now, I imagine "say" but I know that is wrong. There's so many of these s_ functions, is it a function or what is that blue line actually referred to?

the image from the guide

I switched the adbd main to graph view and goodness its amazing how much is behind the scenes x.x

He says alt left arrow alt right arrow short keys for stepping in and out

Very helpful

More helpful

 

[jenneh]

Hi @Renate! Can we bypass the minijail by changing the arrows in the graph to just run somehow? I feel like I seen some videos of people doing that in IDA on other things, but I don't know

I am really trying to find what you say here
"Scroll down until you see the access() call."
but I am struggling.

I think I found it>?

How to get dark theme on ghidra

Spoiler: SHOW

courtesy of
https://www.reddit.com/r/ghidra/comments/b5z1e8
This is inverted colors with bare metal settings. The trouble for me is I cannot read the tool bar

These settings

Result in:

The "windows" option looks like the bare metal one, hardly able to read the menu or buttons

Windows Classic:

I like this look the best

 

[Renate]

405130 is your destination. That is the setup for the access() call
So you want to replace your minijail_new() with a jump to 405130
You can calculate it or else try values and play with it until the b(ranch) is in the right place.

I can't tell where the minijail_new() is because you're looking in C mode.
It's easier in assembler mode (like your last screen print).
Arrows and graphs are just visualization tools. I'm not sure that you can modify anything from them.

 

[jenneh]

Hi @Renate Thank you again for your answers! Maybe I can make enough sense to gather one last clue before I go to bed. Haha.

"So you want to replace your minijail_new() with a jump to 405130" Erm >.> How would I attempt to try this? So close!!!

I brought it up in two different views because I am dense and idk which is the C one to avoid it. Is the C one the one that says LAB_ blah blah?

 

[Renate]

We want addresses, so don't bother with anything unless it say 00123456 on the left.

I think 404fc8 is the address we want to modify, but you're confusing me by jumping all over the place.
Just show a small chunk (+/- 5 lines) around 404fc8.