IDA配套真機ROM修改教程

模擬器調試的缺點：

一、android自帶emulator，基於ARM架構，缺點啓動慢，IDA附加常常下不了斷點，權限不夠等
二、droid4x（中文名海馬玩），基於ARM架構，缺點同上
三、Genymotion，基於X86架構，啓動快，缺點對於不支持x86平臺的apk沒法運行和調試

相信若是搭建過模擬器和IDA調試環境的確定被一些問題折騰的夠嗆，固然IDA附加不上進程，能夠用GDB命令行調試，我的測試過是沒有問題的。

提取boot.img，在/dev/block/platform/目錄下有芯片廠商的名字，而後直接DUMP

1|root@hammerhead:/proc/cpu # ls -l /dev/block/platform/msm_sdcc.1/by-name/
lrwxrwxrwx root     root              1970-01-13 22:44 DDR -> /dev/block/mmcblk0p24
lrwxrwxrwx root     root              1970-01-13 22:44 aboot -> /dev/block/mmcblk0p6
lrwxrwxrwx root     root              1970-01-13 22:44 abootb -> /dev/block/mmcblk0p11
lrwxrwxrwx root     root              1970-01-13 22:44 boot -> /dev/block/mmcblk0p19
lrwxrwxrwx root     root              1970-01-13 22:44 cache -> /dev/block/mmcblk0p27
lrwxrwxrwx root     root              1970-01-13 22:44 crypto -> /dev/block/mmcblk0p26
lrwxrwxrwx root     root              1970-01-13 22:44 fsc -> /dev/block/mmcblk0p22
lrwxrwxrwx root     root              1970-01-13 22:44 fsg -> /dev/block/mmcblk0p21
lrwxrwxrwx root     root              1970-01-13 22:44 grow -> /dev/block/mmcblk0p29
lrwxrwxrwx root     root              1970-01-13 22:44 imgdata -> /dev/block/mmcblk0p17
lrwxrwxrwx root     root              1970-01-13 22:44 laf -> /dev/block/mmcblk0p18
lrwxrwxrwx root     root              1970-01-13 22:44 metadata -> /dev/block/mmcblk0p14
lrwxrwxrwx root     root              1970-01-13 22:44 misc -> /dev/block/mmcblk0p15
lrwxrwxrwx root     root              1970-01-13 22:44 modem -> /dev/block/mmcblk0p1
lrwxrwxrwx root     root              1970-01-13 22:44 modemst1 -> /dev/block/mmcblk0p12
lrwxrwxrwx root     root              1970-01-13 22:44 modemst2 -> /dev/block/mmcblk0p13
lrwxrwxrwx root     root              1970-01-13 22:44 pad -> /dev/block/mmcblk0p7
lrwxrwxrwx root     root              1970-01-13 22:44 persist -> /dev/block/mmcblk0p16
lrwxrwxrwx root     root              1970-01-13 22:44 recovery -> /dev/block/mmcblk0p20
lrwxrwxrwx root     root              1970-01-13 22:44 rpm -> /dev/block/mmcblk0p3
lrwxrwxrwx root     root              1970-01-13 22:44 rpmb -> /dev/block/mmcblk0p10
lrwxrwxrwx root     root              1970-01-13 22:44 sbl1 -> /dev/block/mmcblk0p2
lrwxrwxrwx root     root              1970-01-13 22:44 sbl1b -> /dev/block/mmcblk0p8
lrwxrwxrwx root     root              1970-01-13 22:44 sdi -> /dev/block/mmcblk0p5
lrwxrwxrwx root     root              1970-01-13 22:44 ssd -> /dev/block/mmcblk0p23
lrwxrwxrwx root     root              1970-01-13 22:44 system -> /dev/block/mmcblk0p25
lrwxrwxrwx root     root              1970-01-13 22:44 tz -> /dev/block/mmcblk0p4
lrwxrwxrwx root     root              1970-01-13 22:44 tzb -> /dev/block/mmcblk0p9
lrwxrwxrwx root     root              1970-01-13 22:44 userdata -> /dev/block/mmcblk0p28

dd if=/dev/block/platform/msm_sdcc.1/by-name/recovery of=/storage/sdcard/recovery.img

廢話很少說，仍是真機給力，小菜最近拿到一個三星手機，折騰完能夠任意進程IDA附加！
如下操做在ubuntu 12.04 64位下

一、拆包

$ perl split_bootimg.pl boot.img

 

二、查看img信息

$ unpackbootimg -i boot.img

 

三、解壓

$ mkdir ramdisk
$ cd ramdisk
$ gzip -dc ../boo.img-ramdisk.gz | cpio -i

 

四、修改default.prop

ro.secure=0
ro.allow.mock.location=0
ro.debuggable=1
ro.adb.secure=0

 

 

五、將ramdisk打包，mkbootfs爲32位程序，須要安裝32位庫

$ sudo apt-get install lib32s
$ tools/mkbootfs ./ramdisk | gzip > ramdisk-new.gz

 

六、從新生成boot.img，參數參考步驟2中輸出信息

$ tools/mkbootimg --cmdline 'console=ttyDCC0 androidboot.hardware=xxx' --kernel
$ boot.img-kernel --ramdisk ramdisk-new.gz --base 0x00200000 --pagesize 4096 -o boot-new.img

 

七、將boot.img從新打包加md5校驗

$ tar -cf boot.tar boot.img
$ md5sum -t boot.tar >> boot.tar

 

八、手機關機從新進入挖煤模式後使用odin將boot.tar刷入手機

 

重啓手機後，使用DDMS就能夠看到全部的進程均可以使用Logcat查看，IDA附加能夠看到全部app進程均可以調試了！

順便記錄下nexus5刷機流程：

adb reboot bootloader

fastboot flash boot newboot.img

fastboot reboot