5f1174de27
The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
173 lines
3.2 KiB
C++
173 lines
3.2 KiB
C++
#include <sys/mount.h>
|
|
#include <sys/socket.h>
|
|
#include <sys/un.h>
|
|
#include <unistd.h>
|
|
#include <stdlib.h>
|
|
#include <vector>
|
|
|
|
#include <magisk.hpp>
|
|
|
|
struct cmdline {
|
|
bool skip_initramfs;
|
|
bool force_normal_boot;
|
|
char slot[3];
|
|
char dt_dir[128];
|
|
};
|
|
|
|
struct raw_data {
|
|
uint8_t *buf = nullptr;
|
|
size_t sz = 0;
|
|
|
|
raw_data() = default;
|
|
raw_data(const raw_data&) = delete;
|
|
raw_data(raw_data &&d) {
|
|
buf = d.buf;
|
|
sz = d.sz;
|
|
d.buf = nullptr;
|
|
d.sz = 0;
|
|
}
|
|
~raw_data() {
|
|
free(buf);
|
|
}
|
|
};
|
|
|
|
/* *************
|
|
* Base classes
|
|
* *************/
|
|
|
|
class BaseInit {
|
|
protected:
|
|
cmdline *cmd;
|
|
char **argv;
|
|
std::vector<std::string> mount_list;
|
|
|
|
void exec_init(const char *init = "/init") {
|
|
cleanup();
|
|
execv(init, argv);
|
|
exit(1);
|
|
}
|
|
virtual void cleanup();
|
|
public:
|
|
BaseInit(char *argv[], cmdline *cmd) :
|
|
cmd(cmd), argv(argv), mount_list{"/sys", "/proc"} {}
|
|
virtual ~BaseInit() = default;
|
|
virtual void start() = 0;
|
|
};
|
|
|
|
class MagiskInit : public BaseInit {
|
|
protected:
|
|
raw_data self;
|
|
const char *persist_dir;
|
|
|
|
virtual void early_mount() = 0;
|
|
bool patch_sepolicy(const char *file = "/sepolicy");
|
|
public:
|
|
MagiskInit(char *argv[], cmdline *cmd) : BaseInit(argv, cmd) {};
|
|
};
|
|
|
|
class SARBase : public MagiskInit {
|
|
protected:
|
|
raw_data config;
|
|
std::vector<raw_file> overlays;
|
|
|
|
void backup_files();
|
|
void patch_rootdir();
|
|
void mount_system_root();
|
|
public:
|
|
SARBase(char *argv[], cmdline *cmd) : MagiskInit(argv, cmd) {
|
|
persist_dir = MIRRDIR "/persist/magisk";
|
|
}
|
|
void start() override {
|
|
early_mount();
|
|
patch_rootdir();
|
|
exec_init();
|
|
}
|
|
};
|
|
|
|
/* *************
|
|
* 2 Stage Init
|
|
* *************/
|
|
|
|
class ForcedFirstStageInit : public BaseInit {
|
|
private:
|
|
void prepare();
|
|
public:
|
|
ForcedFirstStageInit(char *argv[], cmdline *cmd) : BaseInit(argv, cmd) {};
|
|
void start() override {
|
|
prepare();
|
|
exec_init("/system/bin/init");
|
|
}
|
|
};
|
|
|
|
class FirstStageInit : public BaseInit {
|
|
private:
|
|
void prepare();
|
|
public:
|
|
FirstStageInit(char *argv[], cmdline *cmd) : BaseInit(argv, cmd) {};
|
|
void start() override {
|
|
prepare();
|
|
exec_init();
|
|
}
|
|
};
|
|
|
|
class SARFirstStageInit : public SARBase {
|
|
private:
|
|
void traced_exec_init();
|
|
protected:
|
|
void early_mount() override;
|
|
public:
|
|
SARFirstStageInit(char *argv[], cmdline *cmd) : SARBase(argv, cmd) {};
|
|
void start() override {
|
|
early_mount();
|
|
traced_exec_init();
|
|
}
|
|
};
|
|
|
|
class SecondStageInit : public SARBase {
|
|
protected:
|
|
void early_mount() override;
|
|
void cleanup() override { /* Do not do any cleanup */ }
|
|
public:
|
|
SecondStageInit(char *argv[]) : SARBase(argv, nullptr) {};
|
|
};
|
|
|
|
/* ***********
|
|
* Legacy SAR
|
|
* ***********/
|
|
|
|
class SARInit : public SARBase {
|
|
protected:
|
|
void early_mount() override;
|
|
public:
|
|
SARInit(char *argv[], cmdline *cmd) : SARBase(argv, cmd) {};
|
|
};
|
|
|
|
/* **********
|
|
* Initramfs
|
|
* **********/
|
|
|
|
class RootFSInit : public MagiskInit {
|
|
private:
|
|
int root = -1;
|
|
void setup_rootfs();
|
|
protected:
|
|
void early_mount() override;
|
|
public:
|
|
RootFSInit(char *argv[], cmdline *cmd) : MagiskInit(argv, cmd) {
|
|
persist_dir = "/dev/mnt/persist/magisk";
|
|
}
|
|
|
|
void start() override {
|
|
early_mount();
|
|
setup_rootfs();
|
|
exec_init();
|
|
}
|
|
};
|
|
|
|
void load_kernel_info(cmdline *cmd);
|
|
int dump_magisk(const char *path, mode_t mode);
|
|
int magisk_proxy_main(int argc, char *argv[]);
|
|
void setup_klog();
|
|
void mount_sbin();
|
|
socklen_t setup_sockaddr(struct sockaddr_un *sun);
|