[q] Getting uncompressed Kernel from zImage?

[OpenSourcererSweg]

Hello!
Device: i535PP
Kernel version: 3.4
Build date: July 22(futex(towelroot) patched)

So, I am trying to get the symbol table or whatever the heck it is.
I do not have root access, that is what I need the symbol table for > read about that here
So I can't do this the easy way of just open /proc/kallsyms

I have the zImage from boot.img.
I have kept reading on google ect that the most common type of compression used by Android kernels is gzip.

I have looked for the gzip magic numbers in a hex editor and also using hexdump/grep and dd.

I tried using binwalk zImage | head and it didn't see any gzip headers in the file, it found lzo and "pcrypt" or something like that but. I found the magic numbers for gzip... I did some googling and. I belive the whole "pcrypt" is because I had my device encrypted, and I had the OTA flash able rom on my and did all the extracting and Shia on my phone. I have since then decrypted the device and reextract everything.


I believe I am supposed to be after piggy.gz...

When I get the offset and use dd to skip to the beginning of the gzip header and save, I do gunzip piggy.gz and it says that it's corrupted. When I use a hex editor it's also corrupted...

Anyone who has done this before, mind helping me out?
I'll upload the zImage if needed.

Just don't go get the addresses yourself and post them here, I want to get some of the experience out of this

I will be more than happy to add to the list of thankyous/credits when it's all done and I test then make a release. I would also be able to port the exploit to other devices too.

 

[OpenSourcererSweg]

I think I know why....

Probably messed it up when I tried going it on a pc I moved it back and forth via ftp... I didnt have a usb cable at the time.

 

[OpenSourcererSweg]

If anyone wants to take a shot at this, please do. I will love you forever.

 

[JustArchi]

No clue what you're trying to do, but my ArchiKitchen should be able to split kernel into zImage and ramdisk, and also unpack the ramdisk, allow you to make changes, and repack it back. You can also replace zImage only if you wish... However, beware, invalid zImage may lead to brick.

You're interested in barebones project. Then you put boot.img in proper folder, restart kitchen, and unpack boot.img.

And if you're interested in decompressing zImage, then sorry, but you're doing it wrong, zImage is compressed binary, and you can't unpack the binary, even if you manage to decompress it.

 

[OpenSourcererSweg]

@JustArchi

Well, thanks for getting me some info about that. But if I understand correctly, zImage is the kernel yes? From what I have read on boot it decompresses itself and copies it into memory. I am not really trying to modify anything, trying to get to the kernel symbols for a device that currently has not working rooting method I am aware of(i535pp on latest build...). Locked boot loader, signature verification of system.img.ext4 so no adding su binary and done. Futex is a no go, kernel compiled July 22. I am trying to port cve 4322 to the device from poc code by retme7 to get a root shell and go from there. If you know how I can go about doing that or point me to a tut, would be great.

Would this help? http://opensource.samsung.com/reception/receptionSub.do?method=sub&sub=F&searchValue=I535pp

 

[JustArchi]

@JustArchi

Well, thanks for getting me some info about that. But if I understand correctly, zImage is the kernel yes? From what I have read on boot it decompresses itself and copies it into memory. I am not really trying to modify anything, trying to get to the kernel symbols for a device that currently has not working rooting method I am aware of(i535pp on latest build...). Locked boot loader, signature verification of system.img.ext4 so no adding su binary and done. Futex is a no go, kernel compiled July 22. I am trying to port cve 4322 to the device from poc code by retme7 to get a root shell and go from there. If you know how I can go about doing that or point me to a tut, would be great.

Would this help? http://opensource.samsung.com/reception/receptionSub.do?method=sub&sub=F&searchValue=I535pp

If device has locked bootloader, you won't be able to flash custom kernel you made anyway.

Otherwise, you just compile kernel from sources, get zImage, and combine it with the ramdisk through my kitchen.

 

[OpenSourcererSweg]

If device has locked bootloader, you won't be able to flash custom kernel you made anyway.

Otherwise, you just compile kernel from sources, get zImage, and combine it with the ramdisk through my kitchen.

I am not trying to make a custom kernel. I am trying to extract information from the kernel required for exploitation. I am not even sure I am going about this correctly. I need to symbol table. I believe I ptmx_fops and perhaps a few other things... I have the src, anything valuable?

 

[JustArchi]

I am not trying to make a custom kernel. I am trying to extract information from the kernel required for exploitation. I am not even sure I am going about this correctly. I need to symbol table. I believe I ptmx_fops and perhaps a few other things...

Stop it, you're talking nonsense. You won't achieve the thing you want in that way.

 

[OpenSourcererSweg]

Stop it, you're talking nonsense. You won't achieve the thing you want in that way.

How do I go about making cve 2014 4322 work on my device?
I have been looking and looking...
You dont understand what not having root does to me....