Pixel修改kernel内核调试

下载内核源码

git clone https://aosp.tuna.tsinghua.edu.cn/kernel/msm.git

准备环境
需要Android源码下的交叉编译器，在Android系统源码下

source build/envsetup.sh
lunch aosp_sailfish-userdebug

修改系统调用
修改syscall open和kill的实现

index 1d33f28..e40deb5 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -41,7 +41,7 @@
 #include <net/genetlink.h>
 #include <linux/kobject.h>
 #include <linux/suspend.h>
-#include <../base/base.h>
+#include "../base/base.h"
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/thermal.h>
diff --git a/fs/open.c b/fs/open.c
index d7e0e1b..000b15c 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -1007,6 +1007,14 @@ long do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode)
  if (IS_ERR(tmp))
   return PTR_ERR(tmp);
 
+ if (tmp != NULL && tmp->name != NULL && !strcmp(tmp->name, "/data/data/com.chinatelecom.bestpayclient/.cache/classes.dve")) {
+ int uid = from_kuid_munged(current_user_ns(), current_uid());
+      if (uid % 2 == 1) {
+           char* file = "/data/data/com.excelliance.demo/gameplugins/com.chinatelecom.bestpayclient/.cache/classes.dve";
+             tmp->name = file;
+      }
+ }
+
  fd = get_unused_fd_flags(flags);
  if (fd >= 0) {
   struct file *f = do_filp_open(dfd, tmp, &op);
diff --git a/kernel/signal.c b/kernel/signal.c
index 453c522..c22b643 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2966,6 +2966,11 @@ SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
  info.si_code = SI_USER;
  info.si_pid = task_tgid_vnr(current);
  info.si_uid = from_kuid_munged(current_user_ns(), current_uid());
+   printk(KERN_INFO "kill pid %d with sig %d: current pid %d, name %s, uid %d\n", pid, sig, info.si_pid, current->comm, info.si_uid);
+ if (info.si_uid % 2 == 1) {
+ dump_stack();
+ return 0;
+ }
  return kill_something_info(sig, &info, pid);
 }

编译内核和boot.img

## build kernel
export ARCH=arm64
export CROSS_COMPILE=aarch64-linux-android-
# make bullhead_defconfig
make marlin_defconfig
make -j4 
cp ~/msm/arch/arm64/boot/Image.lz4-dtb ~/android-q/device/google/marlin-kernel/
## build boot image
cd ~/android-q/
source build/envsetup.sh
lunch 16
## set kernel path
# export TARGET_PREBUILT_KERNEL=~/msm/arch/arm64/boot/Image.gz-dtb
rm out/target/product/sailfish/kernel out/target/product/sailfish/boot.img
make bootimage
scp out/target/product/sailfish/boot.img xiabo@10.0.0.160:~/tool/debug_new/com.chinatelecom.bestpayclient/

重新刷机

sudo fastboot flash boot_a boot.img
sudo fastboot reboot