3

I am trying to recompile the kernel for the Redmi Note 4 (MTK). I have successfully obtained a copy of the stock, pre-compiled kernel, and a variant of sources that seems to coincide quite well with the device's functionality. The kernel sources come from another device for which MediaTek has released the configuration (or rather, a configuration), but despite compiling the default provided configuration (which is presumably incompatible with my device), it will not boot with the newly compiled kernel. From the behavior, it seems that it raises a kernel panic and reboots.

Unfortunately, I do not have a UART connection to the device, so I'm trying to do this blind. My question is, what would be the best approach to attempting to reverse engineer the configuration used for my device?

The steps I've considered include:

  1. Import the current kernel compiled in Ghidra and use the sources to identify the functions, and by comparing the "output" I can manually figure out the configuration used.
  2. Write a static binary that opens the framebuffer (which is available!) and outputs the kernel ring buffer log to it. Change the kernel options until I get at least a screen, and see why it reboots. I have started development on this particular idea, but it seems inefficient and improbable to work.

While I am familiar with C and Linux, it is my first adventure of this kind.

EDIT: The stock kernel seems to be monolithic, as the OS is Android 6.0, and according to this link, it is not a requirement to support modules pre-Android 8.0. I could also not find any evidence of modules in the storage of the device.

EDIT: Among the experiments I've done,

  • I have compiled a busybox initramfs, with the initial binary being /bin/sh, for the correct architecture.
  • And used that image to boot the stock kernel. As expected, the device hung and did not reboot.
  • I have concluded that the shell did indeed launch, despite the screen not being initialized.
  • I then proceeded to boot the compiled kernel as well, which with the busybox image did reboot.
  • This confirms the assumption that the kernel panics.
2
  • 1
    Maybe the variant of the sources is not close enough, a panic is likely a missing driver, possibly for storage. Is the compiled kernel modular or monolithic? .. in any case, trying to determine which drivers it includes would be my first stop. Feb 20, 2023 at 8:17
  • That might be a possibility, indeed. It looks like the pre-compiled kernel is monolithic, as I couldn't find any evidence of modules, and that the stock OS runs a pre-Android 8.0 OS (Android 6 to be exact), which is not mandatory to support modules, according to source.android.com/docs/core/architecture/kernel/… The kernel I compiled is monolithic as well. I just remembered some details about the experiments I've done, I'll edit the question; Feb 20, 2023 at 8:57

1 Answer 1

2

You could try to compare the symbol tables for the custom kernel and the official kernel either by looking at the system.map file or get it from the running system via /proc/kallsyms (might need to disable some restrictions for reading that file as root).

This won't give you a config file directly, but you could maybe indirectly figure out the required config options. But as mentioned in the comments there could even be a difference beyond that, since e.g. source code for drivers will simply be different between those devices. So maybe you'll never get a working kernel without the correct source.

If the kernel was compiled with a specific option (seems to be the case at least for some Android devices) you could extract the config file with this script:

https://github.com/torvalds/linux/blob/master/scripts/extract-ikconfig

1
  • This is definitely a good approach; Unfortunately, the kernel doesn't have ikconfig enabled, but comparing the symbols is brilliant - I will give this a try in the upcoming days and report back. Feb 22, 2023 at 10:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.