Determine Kernel Version and Model
The EAN/UPC code (off barcode on box):
8806071669526 which relates to Samsung Galaxy Nexus I9250.
Model: GT-19250 (taken from sticker under battery)
On the phone check the
kernel details:
Settings > About
Phone > Kernel version and Model Number
In my instance I have:
Model Number: Full AOSP
on Maguro
Kernel: 3.0.31-g6fb96c9
This shows the phone is
the maguro device which relates to the omap kernel (see
To match up the Kernel
version look at the branches on
https://android.googlesource.com/kernel/omap/
and indentify the Makefile which has the matching VERSION and
SUBLEVEL:
VERSION = 3
SUBLEVEL = 31
The
branch android-omap-tuna-3.0 appeared to match so I have used this in
this example.
Setting up the environment
I used an Ubuntu 12.04
x64 within VMWare as my build environment.
Install Java6
sudo
add-apt-repository ppa:webupd8team/java
sudo apt-get update
sudo apt-get install oracle-java6-installer
javac -version
sudo apt-get update
sudo apt-get install oracle-java6-installer
javac -version
Java version should be
1.6
Install Packages
sudo
apt-get install ia32-libs
(N.B. This bypasses
following error received on x64 Ubuntu 12.04 LTS)
The
following packages have unmet dependencies:
libgl1-mesa-glx:i386 : Depends: libglapi-mesa:i386 (= 8.0.4-0ubuntu0.6)
libgl1-mesa-glx:i386 : Depends: libglapi-mesa:i386 (= 8.0.4-0ubuntu0.6)
Install the rest of the
required packages:
sudo
apt-get
install git gnupg flex bison gperf build-essential
\
zip curl libc6-dev libncurses5-dev:i386 x11proto-core-dev \
libx11-dev:i386 libreadline6-dev:i386 libgl1-mesa-glx:i386 \
libgl1-mesa-dev g++-multilib mingw32 tofrodos \
python-markdown libxml2-utils xsltproc zlib1g-dev:i386 subversion
zip curl libc6-dev libncurses5-dev:i386 x11proto-core-dev \
libx11-dev:i386 libreadline6-dev:i386 libgl1-mesa-glx:i386 \
libgl1-mesa-dev g++-multilib mingw32 tofrodos \
python-markdown libxml2-utils xsltproc zlib1g-dev:i386 subversion
Download Android Source and Tools
mkdir
~/bin
PATH=~/bin:$PATH
curl http://commondatastorage.googleapis.com/git-repo-downloads/repo > ~/bin/repo
chmod a+x ~/bin/repo
mkdir android-source
cd android-source
repo init -u https://android.googlesource.com/platform/manifest
repo sync
PATH=~/bin:$PATH
curl http://commondatastorage.googleapis.com/git-repo-downloads/repo > ~/bin/repo
chmod a+x ~/bin/repo
mkdir android-source
cd android-source
repo init -u https://android.googlesource.com/platform/manifest
repo sync
Configure Environment
source
build/envsetup.sh
lunch
full_maguro-eng
NB we don’t have to
make we are just using the build environment configuration and prebuilt toolchains...
Download Kernel Source
git
clone https://android.googlesource.com/kernel/omap.git
Configure and Compile Kernel Source
export
ARCH=arm
export SUBARCH=arm
export CROSS_COMPILE=arm-eabi-
cd omap
git checkout -t remotes/origin/android-omap-tuna-3.0 -b tuna
export SUBARCH=arm
export CROSS_COMPILE=arm-eabi-
cd omap
git checkout -t remotes/origin/android-omap-tuna-3.0 -b tuna
make
tuna_defconfig
vi Makefile
vi Makefile
Change EXTRAVERSION to
the following:
EXTRAVERSION
= -g6fb96c9
Modify the
setversionlocal script (http://neosysforensics.blogspot.co.uk/2012/09/creando-volcados-de-memoria-en-android.html):
vi
scripts/setversionlocal
Add ‘exit’ around
line 31. We do this so that it uses our EXTRAVERSION details rather
than trying to generate this value itself.
usage
fi
+exit
scm_version()
fi
+exit
scm_version()
make
If this works you
should have a new arch/arm/boot/zImage file.
Download LiME
svn checkout
http://lime-forensics.googlecode.com/svn/trunk/ ~/lime-forensics
Configure LiME
cd lime-forensics/src
vi Makefile
Add green lines, remove
red:
+KDIR
:= ~/omap
+CCPATH := ~/android-source/prebuilt/linux-x86/toolchain/arm-eabi-4.4.3/bin
- $(MAKE) -C /lib/modules/$(KVER)/build M=$(PWD) modules
- strip --strip-unneeded lime.ko
- mv lime.ko lime-$(KVER).ko
+ $(MAKE) ARCH=arm CROSS_COMPILE=$(CCPATH)/$(CROSS_COMPILE) -C $(KDIR) EXTRA_CFLAGS=-fno-pic M=$(PWD) modules
+CCPATH := ~/android-source/prebuilt/linux-x86/toolchain/arm-eabi-4.4.3/bin
- $(MAKE) -C /lib/modules/$(KVER)/build M=$(PWD) modules
- strip --strip-unneeded lime.ko
- mv lime.ko lime-$(KVER).ko
+ $(MAKE) ARCH=arm CROSS_COMPILE=$(CCPATH)/$(CROSS_COMPILE) -C $(KDIR) EXTRA_CFLAGS=-fno-pic M=$(PWD) modules
Compile LiME
make
Configure USB Access
sudo vi
/etc/udev/rules.d/51-anroid.rules
Replace <username>
with your username
#
adb protocol on passion (Nexus One)
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="4e12", MODE="0600", OWNER="<username>"
# fastboot protocol on passion (Nexus One)
SUBSYSTEM=="usb", ATTR{idVendor}=="0bb4", ATTR{idProduct}=="0fff", MODE="0600", OWNER="<username>"
# adb protocol on crespo/crespo4g (Nexus S)
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="4e22", MODE="0600", OWNER="<username>"
# fastboot protocol on crespo/crespo4g (Nexus S)
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="4e20", MODE="0600", OWNER="<username>"
# adb protocol on stingray/wingray (Xoom)
SUBSYSTEM=="usb", ATTR{idVendor}=="22b8", ATTR{idProduct}=="70a9", MODE="0600", OWNER="<username>"
# fastboot protocol on stingray/wingray (Xoom)
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="708c", MODE="0600", OWNER="<username>"
# adb protocol on maguro/toro (Galaxy Nexus)
SUBSYSTEM=="usb", ATTR{idVendor}=="04e8", ATTR{idProduct}=="6860", MODE="0600", OWNER="<username>"
# fastboot protocol on maguro/toro (Galaxy Nexus)
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="4e30", MODE="0600", OWNER="<username>"
# adb protocol on panda (PandaBoard)
SUBSYSTEM=="usb", ATTR{idVendor}=="0451", ATTR{idProduct}=="d101", MODE="0600", OWNER="<username>"
# adb protocol on panda (PandaBoard ES)
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="d002", MODE="0600", OWNER="<username>"
# fastboot protocol on panda (PandaBoard)
SUBSYSTEM=="usb", ATTR{idVendor}=="0451", ATTR{idProduct}=="d022", MODE="0600", OWNER="<username>"
# usbboot protocol on panda (PandaBoard)
SUBSYSTEM=="usb", ATTR{idVendor}=="0451", ATTR{idProduct}=="d00f", MODE="0600", OWNER="<username>"
# usbboot protocol on panda (PandaBoard ES)
SUBSYSTEM=="usb", ATTR{idVendor}=="0451", ATTR{idProduct}=="d010", MODE="0600", OWNER="<username>"
# adb protocol on grouper/tilapia (Nexus 7)
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="4e42", MODE="0600", OWNER="<username>"
# fastboot protocol on grouper/tilapia (Nexus 7)
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="4e40", MODE="0600", OWNER="<username>"
# adb protocol on manta (Nexus 10)
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="4ee2", MODE="0600", OWNER="<username>"
# fastboot protocol on manta (Nexus 10)
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="4ee0", MODE="0600", OWNER="<username>"
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="4e12", MODE="0600", OWNER="<username>"
# fastboot protocol on passion (Nexus One)
SUBSYSTEM=="usb", ATTR{idVendor}=="0bb4", ATTR{idProduct}=="0fff", MODE="0600", OWNER="<username>"
# adb protocol on crespo/crespo4g (Nexus S)
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="4e22", MODE="0600", OWNER="<username>"
# fastboot protocol on crespo/crespo4g (Nexus S)
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="4e20", MODE="0600", OWNER="<username>"
# adb protocol on stingray/wingray (Xoom)
SUBSYSTEM=="usb", ATTR{idVendor}=="22b8", ATTR{idProduct}=="70a9", MODE="0600", OWNER="<username>"
# fastboot protocol on stingray/wingray (Xoom)
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="708c", MODE="0600", OWNER="<username>"
# adb protocol on maguro/toro (Galaxy Nexus)
SUBSYSTEM=="usb", ATTR{idVendor}=="04e8", ATTR{idProduct}=="6860", MODE="0600", OWNER="<username>"
# fastboot protocol on maguro/toro (Galaxy Nexus)
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="4e30", MODE="0600", OWNER="<username>"
# adb protocol on panda (PandaBoard)
SUBSYSTEM=="usb", ATTR{idVendor}=="0451", ATTR{idProduct}=="d101", MODE="0600", OWNER="<username>"
# adb protocol on panda (PandaBoard ES)
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="d002", MODE="0600", OWNER="<username>"
# fastboot protocol on panda (PandaBoard)
SUBSYSTEM=="usb", ATTR{idVendor}=="0451", ATTR{idProduct}=="d022", MODE="0600", OWNER="<username>"
# usbboot protocol on panda (PandaBoard)
SUBSYSTEM=="usb", ATTR{idVendor}=="0451", ATTR{idProduct}=="d00f", MODE="0600", OWNER="<username>"
# usbboot protocol on panda (PandaBoard ES)
SUBSYSTEM=="usb", ATTR{idVendor}=="0451", ATTR{idProduct}=="d010", MODE="0600", OWNER="<username>"
# adb protocol on grouper/tilapia (Nexus 7)
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="4e42", MODE="0600", OWNER="<username>"
# fastboot protocol on grouper/tilapia (Nexus 7)
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="4e40", MODE="0600", OWNER="<username>"
# adb protocol on manta (Nexus 10)
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="4ee2", MODE="0600", OWNER="<username>"
# fastboot protocol on manta (Nexus 10)
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", ATTR{idProduct}=="4ee0", MODE="0600", OWNER="<username>"
Download android-sdk
The android SDK is
required for the Android Debug Bridge (adb) tool to upload and run a
shell on the target device. USB Debugging is required for this.
wget
http://dl.google.com/android/android-sdk_r22.3-linux.tgz
tar xvzf
android-sdk_r22.3-linux.tgz
mv
android-sdk_r22.3-linux android-sdk
Dumping the Actual Memory
We use the ADB tool to
push the kernel module and then load the module which opens a TCP
connection. We then use netcat to connect to the TCP server and
redirect the output to a file.
cd
~/android-sdk/platform-tools
./adb devices
List of devices
attached
01498B2B06001012 device
01498B2B06001012 device
./adb push
~/lime-forensics/src/lime.ko /sdcard/lime.ko
953 KB/s (454855
bytes in 0.466s)
./adb forward tcp:4444
tcp:4444
./adb shell
su
cd /sdcard
insmod lime.ko
"path=tcp:4444 format=lime"
On host:
nc localhost 4444 >
lime.dump
This may take a few
minutes but insmod and nc should gracefully exit when they are done.
ls -lh lime.dump
-rw-rw-r-- 1 ben
ben 713M Nov 8 06:08 lime.dump
We can verify this
worked by running strings on the memory dump looking for strings we
know to exist (e.g. maradonna was typed into the search box):
',1,5) END) AS
snippet FROM search_index WHERE search_index MATCH
'content:maradonna* OR name:3F2749272D43414127* OR tokens:maradonna*'
AND snippet_contact_id IN default_directory) ON
(_id=snippet_contact_id) LIMIT 50
