重读Magisk内部实现细节

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

(base)  ✘ 大慈大悲观世音菩萨  ~/Projects/Android_boot_image_editor   master  as
selene:/ $ ps -efZ|grep miui
u:r:miuibooster:s0             root            943      1 0 17:43:34 ?     00:00:00 miuibooster
u:r:platform_app:s0:c512,c768  u0_a122        1597    611 0 17:43:43 ?     00:00:01 com.miui.miwallpaper
u:r:platform_app:s0:c512,c768  u0_a102        1950    610 0 17:43:44 ?     00:00:06 com.miui.home
u:r:untrusted_app:s0:c234,c256,c512,c768 u0_a234 2212 610 0 17:43:45 ?     00:00:00 com.miui.weather2
u:r:platform_app:s0:c512,c768  u0_a163        2572    611 0 17:43:49 ?     00:00:00 com.miui.voiceassist
u:r:system_app:s0              system         2616    610 0 17:43:49 ?     00:00:00 com.miui.contentcatcher
u:r:system_app:s0              system         2667    610 0 17:43:49 ?     00:00:02 com.miui.daemon
u:r:system_app:s0              system         2794    610 0 17:43:49 ?     00:00:00 com.miui.face
u:r:untrusted_app:s0:c512,c768 u0_a78         2902    610 0 17:43:50 ?     00:00:00 com.miui.personalassistant
u:r:system_app:s0              system         2971    610 0 17:43:50 ?     00:00:00 com.miui.notification:remote

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

// com/topjohnwu/magisk/ui/install/InstallFragment.kt
// 对应layout
class InstallFragment : BaseUIFragment<InstallViewModel, FragmentInstallMd2Binding>() {
    override val layoutRes = R.layout.fragment_install_md2
    override val viewModel by viewModel<InstallViewModel>()
    ......
}
// layout/fragment_install_md2.xml
// layout中的开始按钮，对应的方法是InstallViewModel中的install方法
<Button
    style="@style/WidgetFoundation.Button.Text"
    gone="@{viewModel.step != 1}"
    isEnabled="@{viewModel.method == @id/method_patch ? viewModel.data != null : viewModel.method != -1}"
    android:layout_width="wrap_content"
    android:layout_height="wrap_content"
    android:onClick="@{() -> viewModel.install()}"
    android:text="@string/install_start"
    app:icon="@drawable/ic_forth_md2"
    app:iconGravity="textEnd" />
// com/topjohnwu/magisk/ui/install/InstallViewModel.kt
// 引导出FlashFragment
fun install() {
    when (method) {
        R.id.method_patch -> FlashFragment.patch(data!!).navigate()
        R.id.method_direct -> FlashFragment.flash(false).navigate()
        R.id.method_inactive_slot -> FlashFragment.flash(true).navigate()
        else -> error("Unknown value")
    }
    state = State.LOADING
}
// com/topjohnwu/magisk/ui/flash/FlashFragment.kt
// 类似onCreate方法，触发startFlashing
override fun onViewCreated(view: View, savedInstanceState: Bundle?) {
    super.onViewCreated(view, savedInstanceState)
    defaultOrientation = activity.requestedOrientation
    activity.requestedOrientation = ActivityInfo.SCREEN_ORIENTATION_NOSENSOR
    viewModel.startFlashing()
}
// com/topjohnwu/magisk/ui/flash/FlashViewModel.kt
Const.Value.PATCH_FILE -> {
    uri ?: return@launch
    showReboot = false
    MagiskInstaller.Patch(uri, outItems, logItems).exec()
}
// com/topjohnwu/magisk/core/tasks/MagiskInstaller.kt
// patchFile也就是传入的原生boot.img
protected fun doPatchFile(patchFile: Uri) = extractFiles() && handleFile(patchFile)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54

private fun extractFiles(): Boolean {
    ......
    // 创建/data/data/package_name/install目录
    installDir = File(context.filesDir.parent, "install")
    installDir.deleteRecursively()
    installDir.mkdirs()

    try {
        // Extract binaries
        // 从stub或者full中获取so文件
        if (isRunningAsStub) {
            val zf = ZipFile(DynAPK.current(context))
            zf.entries().asSequence().filter {
                !it.isDirectory && it.name.startsWith("lib/${Const.CPU_ABI_32}/")
            }.forEach {
                val n = it.name.substring(it.name.lastIndexOf('/') + 1)
                val name = n.substring(3, n.length - 3)
                val dest = File(installDir, name)
                zf.getInputStream(it).writeTo(dest)
            }
        } else {
            // 获取lib库中的so文件
            val libs = Const.NATIVE_LIB_DIR.listFiles { _, name ->
                name.startsWith("lib") && name.endsWith(".so")
            } ?: emptyArray()
            for (lib in libs) {
                // 重命名so文件并做软链，例如libmagiskboot.so->magiskboot
                // 并软链到/data/data/package_name/install/magiskboot
                val name = lib.name.substring(3, lib.name.length - 3)
                Os.symlink(lib.path, "$installDir/$name")
            }
        }

        // Extract scripts
        // 从asset目录中抽出三个shell脚本
        for (script in listOf("util_functions.sh", "boot_patch.sh", "addon.d.sh")) {
            val dest = File(installDir, script)
            context.assets.open(script).writeTo(dest)
        }
        // Extract chromeos tools
        // 同理
        File(installDir, "chromeos").mkdir()
        for (file in listOf("futility", "kernel_data_key.vbprivk", "kernel.keyblock")) {
            val name = "chromeos/$file"
            val dest = File(installDir, name)
            context.assets.open(name).writeTo(dest)
        }
    } catch (e: Exception) {
        console.add("! Unable to extract files")
        Timber.e(e)
        return false
    }
    ......
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

(base)  大慈大悲观世音菩萨  ~/Downloads/Magisk-v23.0 (1)  ll assets
total 88
-rw-rw-rw-@ 1 tcc0lin  staff   3.4K  1  1  1981 addon.d.sh
-rw-rw-rw-@ 1 tcc0lin  staff   5.3K  1  1  1981 boot_patch.sh
drwxr-xr-x@ 5 tcc0lin  staff   160B  5 31 09:08 chromeos
-rw-rw-rw-@ 1 tcc0lin  staff   4.6K  1  1  1981 uninstaller.sh
-rw-rw-rw-@ 1 tcc0lin  staff    22K  1  1  1981 util_functions.sh
(base)  大慈大悲观世音菩萨  ~/Downloads/Magisk-v23.0 (1)  ll lib/armeabi-v7a
total 4472
-rw-rw-rw-@ 1 tcc0lin  staff   1.4M  1  1  1981 libbusybox.so
-rw-rw-rw-@ 1 tcc0lin  staff   102K  1  1  1981 libmagisk32.so
-rw-rw-rw-@ 1 tcc0lin  staff   166K  1  1  1981 libmagisk64.so
-rw-rw-rw-@ 1 tcc0lin  staff   272K  1  1  1981 libmagiskboot.so
-rw-rw-rw-@ 1 tcc0lin  staff   302K  1  1  1981 libmagiskinit.so

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109

private fun handleFile(uri: Uri): Boolean {
    val outStream: OutputStream
    var outFile: MediaStoreUtils.UriFile? = null

    // Process input file
    try {
        uri.inputStream().buffered().use { src ->
            src.mark(500)
            ......
            // 随机给新boot起名
            val alpha = "abcdefghijklmnopqrstuvwxyz"
            val alphaNum = "$alpha${alpha.toUpperCase(Locale.ROOT)}0123456789"
            val random = SecureRandom()
            val filename = StringBuilder("magisk_patched-${BuildConfig.VERSION_CODE}_").run {
                for (i in 1..5) {
                    append(alphaNum[random.nextInt(alphaNum.length)])
                }
                toString()
            }

            outStream = if (magic.contentEquals("ustar".toByteArray())) {
                // tar file
                outFile = MediaStoreUtils.getFile("$filename.tar", true)
                processTar(src, outFile!!.uri.outputStream())
            } else {
                // raw image
                // 以处理boot.img为例
                srcBoot = installDirFile("boot.img")
                console.add("- Copying image to cache")
                src.cleanPump(SuFileOutputStream.open(srcBoot))
                outFile = MediaStoreUtils.getFile("$filename.img", true)
                outFile!!.uri.outputStream()
            }
        }
    } catch (e: IOException) {
        console.add("! Process error")
        outFile?.delete()
        Timber.e(e)
        return false
    }

    // Patch file
    if (!patchBoot()) {
        outFile!!.delete()
        return false
    }
    ......
}

private fun patchBoot(): Boolean {
    var isSigned = false
    if (srcBoot.let { it !is SuFile || !it.isCharacter }) {
        try {
            SuFileInputStream.open(srcBoot).use {
                // AVB验证检测
                if (SignBoot.verifySignature(it, null)) {
                    isSigned = true
                    console.add("- Boot image is signed with AVB 1.0")
                }
            }
        } catch (e: IOException) {
            console.add("! Unable to check signature")
            Timber.e(e)
            return false
        }
    }

    // 新建new-boot.img
    val newBoot = installDirFile("new-boot.img")
    if (!useRootDir) {
        // Create output files before hand
        newBoot.createNewFile()
        File(installDir, "stock_boot.img").createNewFile()
    }

    // 修补boot的执行脚本
    val cmds = arrayOf(
        "cd $installDir",
        "KEEPFORCEENCRYPT=${Config.keepEnc} " +
        "KEEPVERITY=${Config.keepVerity} " +
        "RECOVERYMODE=${Config.recovery} " +
        "sh boot_patch.sh $srcBoot")

    if (!cmds.sh().isSuccess)
        return false

    // 环境清理
    val job = shell.newJob().add("./magiskboot cleanup", "cd /")

    // boot.img签名
    if (isSigned) {
        console.add("- Signing boot image with verity keys")
        val signed = File.createTempFile("signed", ".img", context.cacheDir)
        try {
            val src = SuFileInputStream.open(newBoot).buffered()
            val out = signed.outputStream().buffered()
            withStreams(src, out) { _, _ ->
                SignBoot.doSignature(null, null, src, out, "/boot")
            }
        } catch (e: IOException) {
            console.add("! Unable to sign image")
            Timber.e(e)
            return false
        }
        job.add("cat $signed > $newBoot", "rm -f $signed")
    }
    job.exec()
    return true
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

// native/jni/magiskboot/magiskboot.hpp
#define HEADER_FILE     "header"
#define KERNEL_FILE     "kernel"
#define RAMDISK_FILE    "ramdisk.cpio"
#define SECOND_FILE     "second"
#define EXTRA_FILE      "extra"
#define KER_DTB_FILE    "kernel_dtb"
#define RECV_DTBO_FILE  "recovery_dtbo"
#define DTB_FILE        "dtb"
#define NEW_BOOT        "new-boot.img"

int unpack(const char *image, bool skip_decomp = false, bool hdr = false);
void repack(const char *src_img, const char *out_img, bool skip_comp = false);
int split_image_dtb(const char *filename);
int hexpatch(const char *image, const char *from, const char *to);
int cpio_commands(int argc, char *argv[]);
int dtb_commands(int argc, char *argv[]);

uint32_t patch_verity(void *buf, uint32_t size);
uint32_t patch_encryption(void *buf, uint32_t size);
bool check_env(const char *name);
// native/jni/magiskboot/main.cpp
int main(int argc, char *argv[]) {
    cmdline_logging();
    umask(0);

    if (argc < 2)
        usage(argv[0]);

    // Skip '--' for backwards compatibility
    string_view action(argv[1]);
    if (str_starts(action, "--"))
        action = argv[1] + 2;

    if (action == "cleanup") {
        ......
    } else if (argc > 2 && action == "repack") {
        if (argv[2] == "-n"sv) {
            if (argc == 3)
                usage(argv[0]);
            repack(argv[3], argv[4] ? argv[4] : NEW_BOOT, true);
        } else {
            repack(argv[2], argv[3] ? argv[3] : NEW_BOOT);
        }
    } else if (argc > 2 && action == "decompress") {
        decompress(argv[2], argv[3]);
    } else if (argc > 2 && str_starts(action, "compress")) {
        compress(action[8] == '=' ? &action[9] : "gzip", argv[2], argv[3]);
    } else if (argc > 4 && action == "hexpatch") {
        return hexpatch(argv[2], argv[3], argv[4]);
    } else if (argc > 2 && action == "cpio"sv) {
        if (cpio_commands(argc - 2, argv + 2))
            usage(argv[0]);
    } else if (argc > 3 && action == "dtb") {
        if (dtb_commands(argc - 2, argv + 2))
            usage(argv[0]);
    } else {
        usage(argv[0]);
    }
    return 0;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

// native/jni/magiskboot/bootimg.cpp
int unpack(const char *image, bool skip_decomp, bool hdr) {
    // 对传入的boot.img镜像转换成boot_img结构体，当生成boot_img结构体后
    // 就可以根据不同类型文件的addr和size来进行文件的dump
    boot_img boot(image);
    // Dump kernel
    dump(boot.kernel, boot.hdr->kernel_size(), KERNEL_FILE);
    // Dump kernel_dtb
    dump(boot.kernel_dtb, boot.hdr->kernel_dt_size, KER_DTB_FILE);
    // Dump ramdisk
    dump(boot.ramdisk, boot.hdr->ramdisk_size(), RAMDISK_FILE);
    // Dump second
    dump(boot.second, boot.hdr->second_size(), SECOND_FILE);
    ......
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

// native/jni/magiskboot/bootimg.cpp
boot_img::boot_img(const char *image) {
    // 将boot.img文件映射到只读内存区域，同时会赋值给map_addr和map_size
    mmap_ro(image, map_addr, map_size);
    fprintf(stderr, "Parsing boot image: [%s]\n", image);
    // 根据不同文件的magic header来区分
    for (uint8_t *addr = map_addr; addr < map_addr + map_size; ++addr) {
        // 检查文件类型
        format_t fmt = check_fmt(addr, map_size);
        switch (fmt) {
        case CHROMEOS:
            // chromeos require external signing
            flags[CHROMEOS_FLAG] = true;
            addr += 65535;
            break;
        case DHTB:
            flags[DHTB_FLAG] = true;
            flags[SEANDROID_FLAG] = true;
            fprintf(stderr, "DHTB_HDR\n");
            addr += sizeof(dhtb_hdr) - 1;
            break;
        case BLOB:
            flags[BLOB_FLAG] = true;
            fprintf(stderr, "TEGRA_BLOB\n");
            addr += sizeof(blob_hdr) - 1;
            break;
        case AOSP:
        case AOSP_VENDOR:
            // AOSP为kernel相关
            parse_image(addr, fmt);
            return;
        default:
            break;
        }
    }
    exit(1);
}
// native/jni/magiskboot/format.cpp
format_t check_fmt(const void *buf, size_t len) {
    if (CHECKED_MATCH(CHROMEOS_MAGIC)) {
        return CHROMEOS;
    } else if (CHECKED_MATCH(BOOT_MAGIC)) {
        return AOSP;
    } else if (CHECKED_MATCH(VENDOR_BOOT_MAGIC)) {
        return AOSP_VENDOR;
    } 
    ......
}
// native/jni/magiskboot/format.hpp
#define BOOT_MAGIC      "ANDROID!"
#define VENDOR_BOOT_MAGIC "VNDRBOOT"
#define CHROMEOS_MAGIC  "CHROMEOS"
#define GZIP1_MAGIC     "\x1f\x8b"
#define GZIP2_MAGIC     "\x1f\x9e"
#define LZOP_MAGIC      "\x89""LZO"
#define XZ_MAGIC        "\xfd""7zXZ"
#define BZIP_MAGIC      "BZh"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

// native/jni/magiskboot/bootimg.cpp
void boot_img::parse_image(uint8_t *addr, format_t type) {
    // 首先获取到boot.img的header结构体
    auto hp = reinterpret_cast<boot_img_hdr*>(addr);
    if (type == AOSP_VENDOR) {
        fprintf(stderr, "VENDOR_BOOT_HDR\n");
        hdr = new dyn_img_vnd_v3(addr);
    } else if (hp->page_size >= 0x02000000) {
        fprintf(stderr, "PXA_BOOT_HDR\n");
        hdr = new dyn_img_pxa(addr);
    } else {
        ......
        // 根据header的版本选择对应的处理方式
        switch (hp->header_version) {
        case 1:
            hdr = new dyn_img_v1(addr);
            break;
        case 2:
            hdr = new dyn_img_v2(addr);
            break;
        case 3:
            hdr = new dyn_img_v3(addr);
            break;
        default:
            hdr = new dyn_img_v0(addr);
            break;
        }
    }
    ......
}

// Default to hdr v2，代码仿照android原生bootimg.h，也就是根据官方的逻辑来获取size，参考https://android.googlesource.com/platform/system/tools/mkbootimg/+/refs/heads/master/include/bootimg/bootimg.h
using boot_img_hdr = boot_img_hdr_v2;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

// native/jni/magiskboot/magiskboot.hpp
#define HEADER_FILE     "header"
#define KERNEL_FILE     "kernel"
#define RAMDISK_FILE    "ramdisk.cpio"
#define SECOND_FILE     "second"
#define EXTRA_FILE      "extra"
#define KER_DTB_FILE    "kernel_dtb"
#define RECV_DTBO_FILE  "recovery_dtbo"
#define DTB_FILE        "dtb"
#define NEW_BOOT        "new-boot.img"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

./magiskboot cpio ramdisk.cpio \
"add 0750 init magiskinit" \
"mkdir 0750 overlay.d" \
"mkdir 0750 overlay.d/sbin" \
"add 0644 overlay.d/sbin/magisk32.xz magisk32.xz" \
"$SKIP64 add 0644 overlay.d/sbin/magisk64.xz magisk64.xz" \
"patch" \
"backup ramdisk.cpio.orig" \
"mkdir 000 .backup" \
"add 000 .backup/.magisk config"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

if (cmdv[0] == "test"sv) {
    exit(cpio.test());
} else if (cmdv[0] == "restore"sv) {
    cpio.restore();
} else if (cmdv[0] == "sha1"sv) {
    char *sha1 = cpio.sha1();
    if (sha1) printf("%s\n", sha1);
    return 0;
} else if (cmdv[0] == "compress"sv){
    cpio.compress();
} else if (cmdv[0] == "decompress"sv){
    cpio.decompress();
} else if (cmdv[0] == "patch"sv) {
    cpio.patch();
} else if (cmdc == 2 && cmdv[0] == "exists"sv) {
    exit(!cpio.exists(cmdv[1]));
} else if (cmdc == 2 && cmdv[0] == "backup"sv) {
    cpio.backup(cmdv[1]);
} else if (cmdc >= 2 && cmdv[0] == "rm"sv) {
    bool r = cmdc > 2 && cmdv[1] == "-r"sv;
    cpio.rm(cmdv[1 + r], r);
} else if (cmdc == 3 && cmdv[0] == "mv"sv) {
    cpio.mv(cmdv[1], cmdv[2]);
} else if (cmdv[0] == "extract"sv) {
    if (cmdc == 3) {
        return !cpio.extract(cmdv[1], cmdv[2]);
    } else {
        cpio.extract();
        return 0;
    }
} else if (cmdc == 3 && cmdv[0] == "mkdir"sv) {
    cpio.mkdir(strtoul(cmdv[1], nullptr, 8), cmdv[2]);
} else if (cmdc == 3 && cmdv[0] == "ln"sv) {
    cpio.ln(cmdv[1], cmdv[2]);
} else if (cmdc == 4 && cmdv[0] == "add"sv) {
    cpio.add(strtoul(cmdv[1], nullptr, 8), cmdv[2], cmdv[3]);
} else {
    return 1;
}

1
2
3
4
5
6
7
8
9

"add 0750 init magiskinit" \
"mkdir 0750 overlay.d" \
"mkdir 0750 overlay.d/sbin" \
"add 0644 overlay.d/sbin/magisk32.xz magisk32.xz" \
"add 0644 overlay.d/sbin/magisk64.xz magisk64.xz" \
"patch" \
"backup ramdisk.cpio.orig" \
"mkdir 000 .backup" \
"add 000 .backup/.magisk config"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

// native/jni/magiskboot/ramdisk.cpp
char *incpio = argv[0];
++argv;
--argc;

magisk_cpio cpio;
if (access(incpio, R_OK) == 0)
    cpio.load_cpio(incpio);
// native/jni/utils/cpio.cpp
void cpio_rw::load_cpio(const char *file) {
    char *buf;
    size_t sz;
    // 读取ramdisk到只读内存区域
    mmap_ro(file, buf, sz);
    fprintf(stderr, "Loading cpio: [%s]\n", file);
    // 加载
    load_cpio(buf, sz);
    // 释放上面的内存区域
    munmap(buf, sz);
}

void cpio_rw::load_cpio(const char *buf, size_t sz) {
    size_t pos = 0;
    const cpio_newc_header *header;
    unique_ptr<cpio_entry> entry;
    while (pos < sz) {
        header = reinterpret_cast<const cpio_newc_header *>(buf + pos);
        entry = make_unique<cpio_entry>(header);
        pos += sizeof(*header);
        string_view name_view(buf + pos);
        pos += x8u(header->namesize);
        pos_align(pos);
        if (name_view == "." || name_view == "..")
            continue;
        if (name_view == "TRAILER!!!")
            break;
        entry->filename = name_view;
        entry->data = xmalloc(entry->filesize);
        memcpy(entry->data, buf + pos, entry->filesize);
        pos += entry->filesize;
        // 这步是关键，等于是将文件都存入数据当中，便于后续来做替换以及插入
        entries[entry->filename] = std::move(entry);
        pos_align(pos);
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

// native/jni/magiskboot/dtb.cpp
static bool dtb_patch(const char *file) {
    bool keep_verity = check_env("KEEPVERITY");

    size_t size;
    uint8_t *dtb;
    fprintf(stderr, "Loading dtbs from [%s]\n", file);
    mmap_rw(file, dtb, size);

    bool patched = false;
    uint8_t * const end = dtb + size;
    for (uint8_t *fdt = dtb; fdt < end;) {
        fdt = static_cast<uint8_t*>(memmem(fdt, end - fdt, DTB_MAGIC, sizeof(fdt32_t)));
        if (fdt == nullptr)
            break;
        if (int fstab = find_fstab(fdt); fstab >= 0) {
            int node;
            fdt_for_each_subnode(node, fdt, fstab) {
                if (!keep_verity) {
                    int len;
                    char *value = (char *) fdt_getprop(fdt, node, "fsmgr_flags", &len);
                    patched |= patch_verity(value, len) != len;
                }
            }
        }
        fdt += fdt_totalsize(fdt);
    }

    munmap(dtb, size);
    return patched;
}

1
2

// native/jni/magiskboot/hexpatch.cpp
// 原理就是根据传入的hex来做替换

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90

- Unpacking boot image
Parsing boot image: [boot.img]
# header版本
HEADER_VER      [2]
KERNEL_SZ       [11561996]
RAMDISK_SZ      [20066474]
SECOND_SZ       [0]
RECOV_DTBO_SZ   [0]
DTB_SZ          [123999]
OS_VERSION      [11.0.0]
OS_PATCH_LEVEL  [2022-02]
PAGESIZE        [2048]
NAME            []
CMDLINE         [bootopt=64S3,32N2,64N2]
CHECKSUM        [1c7765429e25833c9a109589cfe6ead8d89bf819000000000000000000000000]
KERNEL_DTB_SZ   [123999]
KERNEL_FMT      [gzip]
RAMDISK_FMT     [gzip]
VBMETA
- Checking ramdisk status
Loading cpio: [ramdisk.cpio]
- Stock boot image detected
- Patching ramdisk
// ramdisk patch部分
Loading cpio: [ramdisk.cpio]
Add entry [init] (0750)
Create directory [overlay.d] (0750)
Create directory [overlay.d/sbin] (0750)
Add entry [overlay.d/sbin/magisk32.xz] (0644)
Add entry [overlay.d/sbin/magisk64.xz] (0644)
Patch with flag KEEPVERITY=[false] KEEPFORCEENCRYPT=[false]
Found fstab file [first_stage_ramdisk/fstab.mt6768]
Remove pattern [,avb=vbmeta_system]
Remove pattern [,avb_keys=/avb/q-gsi.avbpubkey:/avb/r-gsi.avbpubkey:/avb/s-gsi.avbpubkey]
Remove pattern [,avb]
Remove pattern [,avb]
Remove pattern [,avb=vbmeta]
Remove pattern [,fileencryption=aes-256-xts:aes-256-cts:v2]
Found fstab file [miui.factoryreset.fstab]
Remove pattern [,fsverity]
Remove pattern [,fileencryption=aes-256-xts:aes-256-cts:v2+inlinecrypt_optimized]
Remove [verity_key]
Loading cpio: [ramdisk.cpio.orig]
// backup ramdisk.cpio.orig部分，对未同步的再做一次备份
Backup mismatch entry: [first_stage_ramdisk/fstab.mt6768] -> [.backup/first_stage_ramdisk/fstab.mt6768]
Backup mismatch entry: [init] -> [.backup/init]
Backup mismatch entry: [miui.factoryreset.fstab] -> [.backup/miui.factoryreset.fstab]
Record new entry: [overlay.d] -> [.backup/.rmlist]
Record new entry: [overlay.d/sbin] -> [.backup/.rmlist]
Record new entry: [overlay.d/sbin/magisk32.xz] -> [.backup/.rmlist]
Record new entry: [overlay.d/sbin/magisk64.xz] -> [.backup/.rmlist]
Backup missing entry: [verity_key] -> [.backup/verity_key]
Create directory [.backup] (0000)
Add entry [.backup/.magisk] (0000)
Dump cpio: [ramdisk.cpio]
Loading dtbs from [dtb]
Loading dtbs from [kernel_dtb]
// patch skip_参数
Patch @ 017950F8 [736B69705F696E697472616D667300] -> [77616E745F696E697472616D667300]
- Repacking boot image
Parsing boot image: [boot.img]
HEADER_VER      [2]
KERNEL_SZ       [11561996]
RAMDISK_SZ      [20066474]
SECOND_SZ       [0]
RECOV_DTBO_SZ   [0]
DTB_SZ          [123999]
OS_VERSION      [11.0.0]
OS_PATCH_LEVEL  [2022-02]
PAGESIZE        [2048]
NAME            []
CMDLINE         [bootopt=64S3,32N2,64N2]
CHECKSUM        [1c7765429e25833c9a109589cfe6ead8d89bf819000000000000000000000000]
KERNEL_DTB_SZ   [123999]
KERNEL_FMT      [gzip]
RAMDISK_FMT     [gzip]
VBMETA
Repack to boot image: [new-boot.img]
HEADER_VER      [2]
KERNEL_SZ       [11567292]
RAMDISK_SZ      [23699677]
SECOND_SZ       [0]
RECOV_DTBO_SZ   [0]
DTB_SZ          [123999]
OS_VERSION      [11.0.0]
OS_PATCH_LEVEL  [2022-02]
PAGESIZE        [2048]
NAME            []
CMDLINE         [bootopt=64S3,32N2,64N2]
CHECKSUM        [69cf38b1a7b67f4d26f25b8fe87cbaee29dcf565000000000000000000000000]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

// /system/core/init/main.cpp
int main(int argc, char** argv) {
    if (!strcmp(basename(argv[0]), "ueventd")) {
        return ueventd_main(argc, argv);
    }
    if (argc > 1) {
        if (!strcmp(argv[1], "subcontext")) {
            android::base::InitLogging(argv, &android::base::KernelLogger);
            const BuiltinFunctionMap& function_map = GetBuiltinFunctionMap();
 
            return SubcontextMain(argc, argv, &function_map);
        }
 
        if (!strcmp(argv[1], "selinux_setup")) {
            return SetupSelinux(argv);
        }
        if (!strcmp(argv[1], "second_stage")) {
            return SecondStageMain(argc, argv);
        }
    }
    // 在没有任务参数的情况下，会走FirstStageMain方法
    return FirstStageMain(argc, argv);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

int FirstStageMain(int argc, char** argv) {
    // 挂载分区、挂载/dev、/proc、sys/fs/selinux
    ......
    InitKernelLogging(argv);
    DoFirstStageMount();
 
    // 向下引导走
    const char* path = "/system/bin/init";
    const char* args[] = {path, "selinux_setup", nullptr};
    auto fd = open("/dev/kmsg", O_WRONLY | O_CLOEXEC);
    dup2(fd, STDOUT_FILENO);
    dup2(fd, STDERR_FILENO);
    close(fd);
    execv(path, const_cast<char**>(args));
}

int SetupSelinux(char** argv) {
    SetStdioToDevNull(argv);
    InitKernelLogging(argv);
 
    MountMissingSystemPartitions();
 
    // Set up SELinux, loading the SELinux policy.
    SelinuxSetupKernelLogging();
    SelinuxInitialize();
 
 
    if (selinux_android_restorecon("/system/bin/init", 0) == -1) {
        PLOG(FATAL) << "restorecon failed of /system/bin/init failed";
    }
 
    const char* path = "/system/bin/init";
    const char* args[] = {path, "second_stage", nullptr};
    execv(path, const_cast<char**>(args));
 
    return 1;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31