Can't find the zImage after building the kernel

[Alb]

Dear all,

I have followed the steps on the TaintDroid page, but I'm stuck.. I
can't find the zImage file that's needed to launch the emulator. I am
trying to launch TaintDroid in the AVD and not in a NexusOne.

I have followed the steps described here :
http://groups.google.com/group/taintdroid/browse_thread/thread/3410ef12f3b11f9f
But I must have missed something, because I just don't have anything
in here : arch/arm/boot/zImage

Any idea what I could have missed or where I could get one ?

Thank you very much

[William Enck]

Was there an error when you compiled the kernel? (the kernel compile is separate from the Android build process).

-Will

--
William Enck
PhD Researcher
Department of Computer Science and Engineering
The Pennsylvania State University
en...@cse.psu.edu

[Alb]

Hi William and thank you,

No, I did not notice any error during the kernel compilation. I'll try
again the kernel part then, I have maybe chose some wrong options
during the build ? (I have just hit enter to all the options, but
YAFFS ones. Did I need to type anything there ?)

Thank you very much

On Mar 16, 3:52 pm, William Enck <e...@cse.psu.edu> wrote:
> Was there an error when you compiled the kernel? (the kernel compile is separate from the Android build process).
>
> -Will
>
> On Mar 15, 2011, at 4:24 AM, Alb wrote:
>
> > Dear all,
>
> > I have followed the steps on the TaintDroid page, but I'm stuck.. I
> > can't find the zImage file that's needed to launch the emulator. I am
> > trying to launch TaintDroid in the AVD and not in a NexusOne.
>
> > I have followed the steps described here :

> >http://groups.google.com/group/taintdroid/browse_thread/thread/3410ef...

> > But I must have missed something, because I just don't have anything
> > in here : arch/arm/boot/zImage
>
> > Any idea what I could have missed or where I could get one ?
>
> > Thank you very much
>
> --
> William Enck
> PhD Researcher
> Department of Computer Science and Engineering
> The Pennsylvania State University

> e...@cse.psu.edu

[dh]

Hi,

just one observation. A few weeks back I successfully build TaintDroid
for the emulator. I pretty much followed the process outlined in the
link provided above with one exception being that I did not extract
the kernel configuration from an AVD image but simply used a make
defconfig. I can't remeber setting any kernel configuration options
except the yaffs2 related ones.

> cd ~/tdroid/tdroid-2.1_r2.1p/common
> make goldfish_defconfig
> make menuconfig
> make

Good luck and best regards
Daniel

[Alb]

Hi and thank you both,

I have tried again to build the kernel, and no errors made the build
stop... It finishes like that :

CC [M] net/xfrm/xfrm_ipcomp.o
LD [M] net/x25/x25.o
LD net/xfrm/built-in.o
LD net/built-in.o
alban@Alb:~/tdroid/tdroid-2.1_r2.1p/common$ cd arch/arm/boot/
alban@Alb:~/tdroid/tdroid-2.1_r2.1p/common/arch/arm/boot$ ls
bootp compressed install.sh Makefile

No zImage in here ?! I really don't get it, as I have followed the
steps... How can I clean the kernel ? I've made "make clean", and then
tried again. The goldfish_defconfig does not work and show an error
during the build, so I have used "make mrproper" to clean it, and
build it again.

But I don't get why, without any error, I can't find the zImage... :(

[William Enck]

Try making the kernel with only one process (i.e., remove the -j option). I have a feeling there is an error, but you just aren't seeing it because parallel processes are finishing up.

-Will

en...@cse.psu.edu

[Alb]

Thank you very much, it must have been that because I tried again with
one core, using the make goldfish_defconfig, and it worked like a
charm to build the kernel.

But while using it... No way to launch Android. I must have missed a
step somewhere, but I'm pretty sure of what I have done. Before
sending all my commands, does this error mean anything to you ?

I've started my emulator like this :

emulator -kernel ~/tdroid/zImage -system ~/tdroid/tdroid-2.1_r2.1p/
out/target/product/generic/system.img -data ~/tdroid/tdroid-2.1_r2.1p/
out/target/product/generic/userdata.img -ramdisk ~/tdroid/
tdroid-2.1_r2.1p/out/target/product/generic/ramdisk.img -verbose -no-
boot-anim -show-kernel

An it keeps looping with the 2 last lines (the pid increases).

affs: passed flags ""
yaffs: Attempting MTD mount on 31.2, "mtdblock2"
yaffs_read_super: isCheckpointed 0
init: cannot find '/system/bin/playmp3', disabling 'bootsound'
init: cannot find '/system/etc/install-recovery.sh', disabling
'flash_recovery'
sh: can't access tty; job control turned off
# eth0: link up
warning: `rild' uses 32-bit capabilities (legacy support in use)
request_suspend_state: wakeup (3->0) at 5543308754 (2011-03-23
13:29:34.057334556 UTC)
init: untracked pid 32 exited
request_suspend_state: wakeup (0->0) at 8639846445 (2011-03-23
13:29:37.153891244 UTC)
init: untracked pid 57 exited
request_suspend_state: wakeup (0->0) at 13776352941 (2011-03-23
13:29:42.290400812 UTC)
init: untracked pid 63 exited


Thanks a lot,

> e...@cse.psu.edu

[dh]

try switching Dalvik VM into portable mode:

adb shell setprop dalvik.vm.execution-mode int:portable

This resolved my booting problems with the emulator.

Best regards,
Daniel

[Alb]

Hi dh,

I have tried already, but doesn't the device need to be booted
first ?

If I do it without booting, I have got that :

alban@Alb:~$ cd /home/alban/tdroid/tdroid-2.1_r2.1p/
alban@Alb:~/tdroid/tdroid-2.1_r2.1p$ . ./build/envsetup.sh
alban@Alb:~/tdroid/tdroid-2.1_r2.1p$ lunch 1

============================================
PLATFORM_VERSION_CODENAME=REL
PLATFORM_VERSION=2.1-update1
TARGET_PRODUCT=generic
TARGET_BUILD_VARIANT=eng
TARGET_SIMULATOR=false
TARGET_BUILD_TYPE=release
TARGET_ARCH=arm
HOST_ARCH=x86
HOST_OS=linux
HOST_BUILD_TYPE=release
BUILD_ID=EPE54B
============================================

alban@Alb:~/tdroid/tdroid-2.1_r2.1p$ adb shell setprop
dalvik.vm.execution-mode int:portable
* daemon not running. starting it now *
* daemon started successfully *
error: device not found

And if I do it right after launching the emulator, while I've got my
loop going on, I face a :

alban@Alb:~/tdroid/tdroid-2.1_r2.1p$ adb shell setprop
dalvik.vm.execution-mode int:portable
error: device offline

I have tried to add a -Xint:portable command also, the emulator
doesn't recognize the command. I'm a bit lost here :(

Thank you,

[Alb]

Hm, never mind, I spoke a bit too fast here !

Afetr waiting a few loops, it worked... I did not try that before, and
I don't get why, but it seems to work. Thanks a lot for making me
trying again !

Regards,

Alban

On 24 mar, 08:36, dh <danielmh...@gmail.com> wrote:

[Alb]

I am sorry for the spam ! But I have now the exact same problem as
this thread (that has unfortunately no answer) :
http://groups.google.com/group/taintdroid/browse_thread/thread/3410ef12f3b11f9f

When I hit "Start", nothing happens. How do I know if it works or
not ? Or might it be an error in the configuration ?

Thanks a lot,

Regards,

Alban

[dh]

Your configuration is probably right, but as far as I know TaintDroid
only becomes active if it detects a policy violation. A reliable way
to test TaintDroid is to write a simple application that violates
TaintDroid policy, e.g. sending the IMEI over a network port and then
monitoring the log output with 'adb logcat' for TaintDroid messages.

Regards,
Daniel

On Mar 24, 9:51 am, Alb <alban.dumoui...@gmail.com> wrote:
> I am sorry for the spam ! But I have now the exact same problem as

> this thread (that has unfortunately no answer) :http://groups.google.com/group/taintdroid/browse_thread/thread/3410ef...

> > > > > >  LD      net/xfrm/built-in.o> > > > >  LD      net/built-in.o> >alban@Alb:~/tdroid/tdroid-2.1_r2.1p/common$cdarch/arm/boot/> >alban@Alb:~/tdroid/tdroid-2.1_r2.1p/common/arch/arm/boot$ls

[Alb]

Hi and thank you,

I've been trying with several apps that are known to send info, but
they crash on launch...
But what alarms me is that nothing happens in the logcat when I hit
start ?!

Does anyone know what should happen ?

Thank you

[Alb]

Hi, it's me again.

I have tried to download malware applications to test them, but don't
seem to have any notification. Can anyone send me a sample that should
work on TaintDroid ?

And again, nothing happens in logcat when I hit start. William (I
think you are the person that might answer this), is this normal, or
does it show that I have missed something (maybe during the kernel
build ?)

Thank you,

[Alb]

I don't know why when I do the "make oldconfig" step, it doesn't ask
me for the YAFFS extended attributes, I have to put them manually in
the make menuconfig, is it linked ?

And when I do cat .config , I've got that :

#
# File systems
#
# CONFIG_EXT2_FS is not set
# CONFIG_EXT3_FS is not set
# CONFIG_EXT4_FS is not set
# CONFIG_REISERFS_FS is not set
# CONFIG_JFS_FS is not set
# CONFIG_FS_POSIX_ACL is not set
CONFIG_FILE_LOCKING=y
# CONFIG_XFS_FS is not set
# CONFIG_OCFS2_FS is not set
# CONFIG_BTRFS_FS is not set
CONFIG_DNOTIFY=y
CONFIG_INOTIFY=y
CONFIG_INOTIFY_USER=y
# CONFIG_QUOTA is not set
# CONFIG_AUTOFS_FS is not set
# CONFIG_AUTOFS4_FS is not set
# CONFIG_FUSE_FS is not set
#
# Pseudo filesystems
#
CONFIG_PROC_FS=y
CONFIG_PROC_SYSCTL=y
CONFIG_PROC_PAGE_MONITOR=y
CONFIG_SYSFS=y
CONFIG_TMPFS=y
# CONFIG_TMPFS_POSIX_ACL is not set
# CONFIG_HUGETLB_PAGE is not set
# CONFIG_CONFIGFS_FS is not set
CONFIG_MISC_FILESYSTEMS=y
# CONFIG_ADFS_FS is not set
# CONFIG_AFFS_FS is not set
# CONFIG_HFS_FS is not set
# CONFIG_HFSPLUS_FS is not set
# CONFIG_BEFS_FS is not set
# CONFIG_BFS_FS is not set
# CONFIG_EFS_FS is not set
CONFIG_YAFFS_FS=y
CONFIG_YAFFS_YAFFS1=y
CONFIG_YAFFS_XATTR=y
CONFIG_YAFFS_SECURITY=y
# CONFIG_YAFFS_9BYTE_TAGS is not set
# CONFIG_YAFFS_DOES_ECC is not set
CONFIG_YAFFS_YAFFS2=y
CONFIG_YAFFS_AUTO_YAFFS2=y
# CONFIG_YAFFS_DISABLE_LAZY_LOAD is not set
# CONFIG_YAFFS_DISABLE_WIDE_TNODES is not set
# CONFIG_YAFFS_ALWAYS_CHECK_CHUNK_ERASED is not set
CONFIG_YAFFS_SHORT_NAMES_IN_RAM=y
# CONFIG_JFFS2_FS is not set
# CONFIG_CRAMFS is not set
# CONFIG_SQUASHFS is not set
# CONFIG_VXFS_FS is not set
# CONFIG_MINIX_FS is not set
# CONFIG_OMFS_FS is not set

You can see that EXT2 is not set... Is it me that missed something ?!
I wonder if it is linked to the fact that nothing happens in logcat
when I hit Start.
I must say I'm a bit lost here ! :(

Thank you,

[Alb]

I am sorry to spam here, but I'm really trying to make it work :)

I've found this error in my log :

W/dalvikvm( 252): TaintLog: fgetxattr(32): unknown error code 9
E/TaintDroidNotifyService( 252): Could not read a log entry: null

Does this mean that I've missing something during the YAFFS extended
attributes activation ? The patch on the TaintDroid download page did
not work correctly, so I had to do the changes manually, that might be
it...

Thanks a lot

> > > > > > > > > >>>>> I have followed the steps described here :...
>
> read more »

[William Enck]

Hrm. What version of the kernel are you using? I think the patch was built for 2.6.29.

-Will

--

William Enck
PhD Researcher
Department of Computer Science and Engineering
The Pennsylvania State University

en...@cse.psu.edu

[William Enck]

I'm not sure what you mean by "when I hit start". Try writing a simple app that grabs the phone number and sends it to the network. This removes the file system from the loop as well.

-Will

en...@cse.psu.edu

[Alb]

Hi William, and thank you.

I'm using the 2.6.29 kernel, trying to follow the exact steps of the
documentation.
What I say about "hitting start", it was when I launched the
TaintDroidNotifier UI, and hit the "Start" button, nothing happened in
the logcat. I want to try again with modifying some of the kernel
configuration (I'm not sure that I have put the EXT2 extended
attributes at the first place.)

I've tried to re-download everything, to start from scratch, but now
I'm unable to even build TaintDroid... I'm getting a bit desperate.
The make fails on this :

dalvik/vm/mterp/out/InterpC-portdbg.c:3060: warning: implicit
declaration of function 'SET_REGISTER_TAINT_FLOAT'
dalvik/vm/mterp/out/InterpC-portdbg.c:3060: warning: implicit
declaration of function 'GET_REGISTER_TAINT_FLOAT'
dalvik/vm/mterp/out/InterpC-portdbg.c:3072: error: invalid use of void
expression
dalvik/vm/mterp/out/InterpC-portdbg.c:3084: error: invalid use of void
expression
dalvik/vm/mterp/out/InterpC-portdbg.c:3116: error: invalid use of void
expression
make: *** [out/target/product/generic/obj/SHARED_LIBRARIES/
libdvm_intermediates/mterp/out/InterpC-portstd.o] Error 1
make: *** Waiting for unfinished tasks....
make: *** [out/target/product/generic/obj/SHARED_LIBRARIES/
libdvm_intermediates/mterp/out/InterpC-portdbg.o] Error 1


I did not change anything in my environment (maybe an update that I
have unintentionnaly applied...), and the build works fine when it's
just the Android source, without TaintDroid. Any idea where it might
come from ?

Thanks a lot again

> e...@cse.psu.edu

[William Enck]

It looks like you don't have the buildspec.mk specified correctly. Be sure to "make clean" after making changes to the buildspec configuration.

-Will

en...@cse.psu.edu

[Alb]

The buildspec seems all right to me ?

alban@Alb:~/tdroid/tdroid-2.1_r2.1p$ ls
bionic buildspec.mk dalvik frameworks out sdk
bootable common development hardware packages system
build cts external Makefile prebuilt vendor
alban@Alb:~/tdroid/tdroid-2.1_r2.1p$ cat buildspec.mk
# Enable core taint tracking logic (always add this)
WITH_TAINT_TRACKING := true
# Enable taint tracking for ODEX files (always add this)
WITH_TAINT_ODEX := true
# Enable taint tracking in the "fast" (aka ASM) interpreter
(recommended)
WITH_TAINT_FAST := true
# Enable addition output for tracking JNI usage (not recommended)
#TAINT_JNI_LOG := true
alban@Alb:~/tdroid/tdroid-2.1_r2.1p$

And I'm always sing make clean before building.

Thanks !

> ...
>
> plus de détails »

[William Enck]

That looks correct. The errors you were getting were undefined macros, which aren't defined unless the WITH_TAINT_TRACKING compiler directive is used (and that is controlled by buildspec.mk)

-Will

--

[Alb]

I am still getting the same error though... Might it be an issue with
my download of TaintDroid ?

I havent re-compiled the kernel because I have saved my zImage file,
might this be a reason ?

> ...
>
> plus de détails »

[William Enck]

I'm not sure what's causing your compile error. The kernel is compiled separately and shouldn't be causing the issue.

As a side note, TaintDroid will print messages to logs without using the TaintDroidNotifier UI. I've only used TaintDroidNotifiers for demos. Some people have noted stability problems with it. If you're doing analysis, the best way is to work directly from the information in logcat.

-Will

--

[Alb]

Hi William,

It seemed that my error was caused bya clash between exported
variables in my system. (I think!) I have been able to rebuild
TaintDroid, but still can't find any notification, even in the log...
I sometimes have this error when I hit the start and stop buttons
several times in the TaintDroidNotifier UI : E/
TaintDroidNotifyService( 235): Could not read a log entry: null

Can this be an issue with my kernel build ? I just want to make sure :
the only things to control during the "make menuconfig" are the EXT2
extended and security attributes, and the same for YAFFS ?

Thanks again

> >>>>>>>>>>>>>>> tried again. The goldfish_defconfig does not work and show an error...
>
> plus de détails »

[William Enck]

You only need to rebuild the kernel if you want taint tags to be propagated through the file system.

-Will

--