Skip to content

README.md

Latest commit

 

History

History
98 lines (71 loc) · 3.44 KB

README.md

File metadata and controls

98 lines (71 loc) · 3.44 KB
Raw

Languages: English | 简体中文 | 繁體中文 | 日本語 | 한국어 | Français | Deutsch | Español | Italiano | Русский | العربية

← NeverC Examples

Android Kernel Probe

Interposes an arbitrary instruction inside do_faccessat (not the entry point) using neverc_krt_probe_register. Demonstrates:

  • Arbitrary-address interposing: probe any instruction, not just function entries
  • Full register context: read/write all GPRs via neverc_krt_reg_ctx
  • Auto-chain: multiple handlers on the same address, dispatched by priority
  • Control flow: NEVERC_KRT_CTX_SKIP to abort, NEVERC_KRT_CTX_REDIRECT to redirect

API

int neverc_krt_probe_register(void *addr, neverc_krt_ctx_handler_t handler,
                              int priority, struct neverc_krt_probe_ref *ref);
int neverc_krt_probe_unregister(struct neverc_krt_probe_ref *ref);

Handler signature:

void my_probe(neverc_krt_reg_ctx *ctx);

Build

cd examples/android-kernel-probe
neverc make          # debug: -g (default on the first build)
neverc make release  # release: -O2 --strip
neverc make debug    # switch back to debug

Select another kernel preset with, for example, neverc make KERNEL=612 release. neverc make release selects -O2 --strip. The Makefile records the selected KERNEL and PROFILE in .nvk-build-flags, so later make push, make run, and bare make calls keep using that artifact. Without the stamp, make defaults to debug. make debug or an explicit PROFILE=... replaces the saved profile; make clean removes the stamp, so the next build defaults to debug.

NeverC writes IDA-inspired, non-reserved release names in five classes: functions fn_HEX, executable no-type labels code_HEX, objects obj_HEX, other no-type labels sym_HEX, and absolute symbols abs_HEX. For ordinary allocated definitions, HEX is a deterministic analysis EA derived from the final SHF_ALLOC section layout (abs_HEX instead uses the absolute st_value); it is not a hash, encryption, file offset, ELF virtual address, or runtime kernel address. NeverC stores neither reserved sub_/loc_ forms nor deliberately empty ordinary names.

For exact-name preservation, IDA's synthetic extern view, security boundaries, and finalization-before-signing order, see the release and strip policy.

Deploy & Run

neverc make run

Or manually:

adb push nvk_probe.ko /data/local/tests/
adb shell su -c 'insmod /data/local/tests/nvk_probe.ko'
adb shell su -c 'dmesg | grep neverc_krt_probe_demo'

Kernel log (live)

On the device, cat /proc/kmsg streams the kernel ring buffer in real time — similar to DbgView on Windows. Use it when insmod fails with a vague error or you need the exact kernel rejection reason (vermagic, modversions, section size, and so on).

Terminal 1 (leave running):

adb shell
su
cat /proc/kmsg

Terminal 2:

adb shell su -c 'insmod /data/local/tests/nvk_probe.ko'

New lines appear in terminal 1 as the kernel handles the load. Press Ctrl+C to stop.

Note: stock dmesg -w is missing on some Android builds; /proc/kmsg needs root but follows live kernel output reliably.

Unload

neverc make rmmod