tnakamur

# First time building A12
Open terminal and run:

sudo bash
mkdir /mnt/ccache
exit
sudo mount --bind /home/ubuntu/.ccache /mnt/ccache
export USE_CCACHE=1 && export CCACHE_EXEC=/usr/bin/ccache && ccache -M 20G && export CCACHE_DIR=/mnt/ccache

(set ccache -M with the maximum of GB of your disk you wanna set available for ccache, and home/masemoel with home/ and your username on your Linux environment).

tnakamur

============================================
PLATFORM_VERSION_CODENAME=REL
PLATFORM_VERSION=10
TARGET_PRODUCT=omni_sunfish
TARGET_BUILD_VARIANT=eng
TARGET_BUILD_TYPE=release
TARGET_ARCH=arm64
TARGET_ARCH_VARIANT=armv8-a
TARGET_CPU_VARIANT=generic
TARGET_2ND_ARCH=arm

tnakamur

###
### Sample Wget initialization file .wgetrc
###

## You can use this file to change the default behaviour of wget or to
## avoid having to type many many command-line options. This file does
## not contain a comprehensive list of commands -- look at the manual
## to find out what you can put into this file. You can find this here:
##   $ info wget.info 'Startup File'
## Or online here:

tnakamur

# ~/.bashrc: executed by bash(1) for non-login shells.
# see /usr/share/doc/bash/examples/startup-files (in the package bash-doc)
# for examples

# If not running interactively, don't do anything
case $- in
    *i*) ;;
      *) return;;
esac

tnakamur

MAIN: detected kernel version 3
MAIN: starting exploit for devices with waitqueue at 0x98
PARENT: soon will be calling WRITEV
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: initial portion length 0x12000
CHILD: task_struct_ptr = 0x0
PARENT: writev() returns 0x13008
PARENT: Reading leaked data
CHILD: task_struct_ptr = 0x0

tnakamur

CVE-2017-8890 exploit. cpu_num : 8
main(), getpid : 6330, gettid() : 6330
I'm child : 0
I'm child : 2
I'm child : 3
[+] init_fake_obj(), fake_sock : 0xc00011f
[+] init_fake_obj(), (char*)fake_sock + 0x28  : 0xc000147
[+] init_fake_obj(), *(size_t*)(char*)fake_sock + 0x28  : 0xc00021f
[+] init_fake_obj(), (char*)fake_sock + 0x168  : 0xc000287
[+] init_fake_obj(), *(size_t*)(char*)fake_sock + 0x168  : 0xffffffc0007087f4

tnakamur

[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 3.18.14-gae863d6150e7-dirty (takahiro@ubuntu) (gcc version 4.9.x 20150123 (prerelease) (GCC) ) #1 SMP PREEMPT Fri Apr 12 22:29:26 JST 2019
[    0.000000] CPU: AArch64 Processor [410fd034] revision 4
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] alternative: enabling workaround for ARM erratum 845719
[    0.000000] [ECT] Address 90000000, Size 14000\x08
[    0.000000] dsim: --- Parse LCD TYPE ---
[    0.000000] dsim: LCDTYPE : 00c10002
[    0.000000] Reserved memory: initialized node gnss_if, compatible id exynos7870,gnss_if

tnakamur

[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 3.18.14-ge2f386e16f1b (takahiro@ubuntu) (gcc version 4.9.x 20150123 (prerelease) (GCC) ) #1 SMP PREEMPT Wed Apr 3 22:54:57 JST 2019
[    0.000000] CPU: AArch64 Processor [410fd034] revision 4
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] alternative: enabling workaround for ARM erratum 845719
[    0.000000] [ECT] Address 90000000, Size 14000\x08
[    0.000000] dsim: --- Parse LCD TYPE ---
[    0.000000] dsim: LCDTYPE : 00c10002
[    0.000000] val = 49

tnakamur

total 180880
-rw-rw-r--  1 takahiro takahiro       14 Feb 28 21:21 android-info.txt
-rw-rw-r--  1 takahiro takahiro 37924880 Feb 28 22:07 boot.img
-rw-rw-r--  1 takahiro takahiro       80 Feb 28 21:18 build_fingerprint.txt
-rw-rw-r--  1 takahiro takahiro       65 Feb 28 21:18 build_thumbprint.txt
-rw-rw-r--  1 takahiro takahiro    85622 Feb 28 21:18 clean_steps.mk
-rw-r--r--  1 takahiro takahiro  5124096 Feb 28 22:07 dt.img
drwxrwxr-x  2 takahiro takahiro     4096 Feb 28 21:58 fake_packages
-rwxrwxr-x  1 takahiro takahiro 31017472 Feb 28 22:07 kernel
drwxrwxr-x 12 takahiro takahiro     4096 Feb 28 21:51 obj

tnakamur

crosstool-ngをビルドする。
最新のソースを取得する。
git clone https://github.com/crosstool-ng/crosstool-ng

取得したソースディレクトリで以下を実行
./bootstrap

./configure LDFLAGS="-lintl" --prefix=PATH_TO_INSTALL_DIR
LDFLAGSに-lintlがないとビルドがこける。