Android arm64位内核文件提取与ida反编译内核 rom设置

1、提取boot.img

高通
/dev/block/platform/soc/1d84000.ufshc/by-name # ls -la |grep boot
lrwxrwxrwx 1 root root   16 1970-04-28 07:24 boot_a -> /dev/block/sde11
lrwxrwxrwx 1 root root   16 1970-04-28 07:24 boot_b -> /dev/block/sde31


dd if=/dev/block/sde11 of=/sdcard/boot.img

 2、解包boot.img  

abootimg -x boot.img

a@sys:~/elf$ sudo binwalk boot.img
[sudo] password for a: 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Android bootimg, kernel size: 13936423 bytes, kernel addr: 0x8000, ramdisk size: 6914506 bytes, ramdisk addr: 0x1000000, product name: ""
4096          0x1000          gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)
11278366      0xAC181E        Flattened device tree, size: 425462 bytes, version: 17

a@sys:~/elf/bootimg$ abootimg -x boot.img
writing boot image config in bootimg.cfg
extracting kernel in zImage
extracting ramdisk in initrd.img
a@sys:~/elf/bootimg$ ls
boot.img  bootimg.cfg  initrd.img  zImage
a@sys:~/elf/bootimg$ ls -la
total 85916
drwxrwxr-x 2 a a     4096 Jan 20 22:04 .
drwxrwxr-x 6 a a     4096 Jan 20 22:04 ..
-rwxrw-r-- 1 a a 67108864 Jan 20 22:04 boot.img
-rw-rw-r-- 1 a a      523 Jan 20 22:04 bootimg.cfg
-rw-rw-r-- 1 a a  6914506 Jan 20 22:04 initrd.img
-rw-rw-r-- 1 a a 13936423 Jan 20 22:04 zImage
 

a@sys:~/elf/bootimg$ file zImage
zImage: gzip compressed data, max compression, from Unix
 

dmesg

[    0.000000] Virtual kernel memory layout:
[    0.000000] modules : 0xffffff8000000000 - 0xffffff8008000000   (   128 MB)
[    0.000000] vmalloc : 0xffffff8008000000 - 0xffffffbebfff0000   (   250 GB)
[    0.000000] .text : 0xffffff9bb9a80000 - 0xffffff9bbaa00000   ( 15872 KB)
[    0.000000] .rodata : 0xffffff9bbaa00000 - 0xffffff9bbb400000   ( 10240 KB)
[    0.000000] .init : 0xffffff9bbb400000 - 0xffffff9bbb800000   (  4096 KB)
[    0.000000] .data : 0xffffff9bbb800000 - 0xffffff9bbb9dc008   (  1905 KB)
[    0.000000] .bss : 0xffffff9bbb9dc008 - 0xffffff9bbbdbe4c0   (  3978 KB)
[    0.000000] fixed   : 0xffffffbefe7fb000 - 0xffffffbefec00000   (  4116 KB)
[    0.000000] PCI I/O : 0xffffffbefee00000 - 0xffffffbeffe00000   (    16 MB)
[    0.000000] vmemmap : 0xffffffbf00000000 - 0xffffffc000000000   (     4 GB maximum)
[    0.000000] 0xffffffbfb7000000 - 0xffffffbfbcf4e800   (    95 MB actual)
[    0.000000] memory  : 0xffffffedc0000000 - 0xffffffef3d3a0000   (  6099 MB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=8, Nodes=1
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000] \x09RCU dyntick-idle grace-period acceleration is enabled.

adb shell:

dmesg >dmesg.txt
echo 0 > /proc/sys/kernel/kptr_restrict
cat /proc/kallsyms >kallsyms.txt

ksyms = open("d:\kallsyms.txt")

i = 0

for line in ksyms:

i += 1

addr = int(line[0:16],16)

name = line[19:-1]

idaapi.set_debug_name(addr,name)

MakeNameEx(addr,name,SN_NOWARN)

add_func(addr)

if i % 100 == 0:

Message("cur: %d\n" % i)

# Message("%08X:%sn"%(addr,name))

注意点：

1、ida打开rom时，文件偏移量一般是0x1000或0x800，具体需要打开二进制文件看一下偏移量。

2、如果没有自动出现函数，需要按c键。