1

How do I reverse engineer the Android kernel currently running on an Android phone? I'm most interested in seeing/manipulating the call stack. Basically, gdb or something like Ollydgb would be great. I am not looking to build the kernel from source.

Improve this question
2
  • You can't analyze something that does not naturally communicate with you and you can't attach a normal debugger to it, because it's not a process. Possabilities are: You can disassemble your phone and attach a hardwaredebugger, maybe use the Android simulator with some kind of hack, maybe modify your system in a way that it lets you access deeper levels of the system. Or you just build a custom kernel that you modify and lets you examine the callstack of it. It don't see a "easy to go" solution for this, but maybe somebody has a better idea. If you find something share it with us :)
    – SkryptX
    May 20, 2016 at 7:30
  • Waaaay too little info to be a good question. Well Android is a Linux kernel. Do you have superuser on the phone or can you gain it, e.g. by means of ADB or similar? Mainly it's unclear which call stack you want to see (the one inside kernel space, the one inside user space or even the Dalvik call stack). Would strace be of help in any way?
    – 0xC0000022L ♦
    May 20, 2016 at 13:31

1 Answer 1

Reset to default
4

Probably the easiest way to go about it is to find out what firmware image your phone is running and download it, extract the kernel blob (zImage), then fire that up in the android emulator/QEMU and remote kgdb into it.

You could unpack the kernel using unmkbootimg: https://github.com/osm0sis/mkbootimg

There are plenty of tutorials on xda for unpacking the kernel.

Here's a link of some dude debugging an android kernel in the emulator: http://www.informit.com/articles/article.aspx?p=2431417&seqNum=3

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.