Magisk/native/jni/utils/files.hpp

133 lines
3.9 KiB
C++
Raw Normal View History

2019-07-02 05:58:19 +00:00
#pragma once
2019-12-13 05:37:06 +00:00
#include <sys/mman.h>
#include <sys/stat.h>
2019-11-23 22:18:55 +00:00
#include <mntent.h>
2019-11-19 07:04:47 +00:00
#include <functional>
#include <string_view>
Introduce new boot flow to handle SAR 2SI The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
2020-04-01 11:39:28 +00:00
#include <string>
#include <vector>
2019-11-19 07:04:47 +00:00
2020-03-09 08:50:30 +00:00
#include "xwrap.hpp"
2019-12-13 05:37:06 +00:00
2019-07-02 05:58:19 +00:00
#define do_align(p, a) (((p) + (a) - 1) / (a) * (a))
#define align_off(p, a) (do_align(p, a) - (p))
struct file_attr {
struct stat st;
char con[128];
2019-07-02 05:58:19 +00:00
};
Introduce new boot flow to handle SAR 2SI The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
2020-04-01 11:39:28 +00:00
struct raw_file {
std::string path;
file_attr attr;
uint8_t *buf;
size_t sz;
raw_file() : attr({}), buf(nullptr), sz(0) {}
raw_file(const raw_file&) = delete;
raw_file(raw_file &&o);
~raw_file();
Introduce new boot flow to handle SAR 2SI The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
2020-04-01 11:39:28 +00:00
};
2019-07-02 05:58:19 +00:00
ssize_t fd_path(int fd, char *path, size_t size);
int fd_pathat(int dirfd, const char *name, char *path, size_t size);
2021-09-15 08:59:43 +00:00
int mkdirs(std::string_view path, mode_t mode);
2019-07-02 05:58:19 +00:00
void rm_rf(const char *path);
2020-04-02 09:17:45 +00:00
void mv_path(const char *src, const char *dest);
2019-07-02 05:58:19 +00:00
void mv_dir(int src, int dest);
2020-04-02 09:17:45 +00:00
void cp_afc(const char *src, const char *dest);
void link_path(const char *src, const char *dest);
2019-07-02 05:58:19 +00:00
void link_dir(int src, int dest);
2020-04-02 09:17:45 +00:00
int getattr(const char *path, file_attr *a);
int getattrat(int dirfd, const char *name, file_attr *a);
int fgetattr(int fd, file_attr *a);
int setattr(const char *path, file_attr *a);
int setattrat(int dirfd, const char *name, file_attr *a);
int fsetattr(int fd, file_attr *a);
void fclone_attr(int src, int dest);
void clone_attr(const char *src, const char *dest);
2019-07-02 05:58:19 +00:00
void fd_full_read(int fd, void **buf, size_t *size);
void full_read(const char *filename, void **buf, size_t *size);
2020-04-26 06:19:36 +00:00
std::string fd_full_read(int fd);
std::string full_read(const char *filename);
2019-07-02 05:58:19 +00:00
void write_zero(int fd, size_t size);
2019-12-13 05:37:06 +00:00
void file_readline(bool trim, const char *file, const std::function<bool(std::string_view)> &fn);
static inline void file_readline(const char *file,
const std::function<bool(std::string_view)> &fn) {
file_readline(false, file, fn);
2019-12-13 05:37:06 +00:00
}
void parse_prop_file(const char *file,
const std::function<bool(std::string_view, std::string_view)> &fn);
2019-07-02 05:58:19 +00:00
void *__mmap(const char *filename, size_t *size, bool rw);
2020-04-02 06:37:11 +00:00
void frm_rf(int dirfd);
2020-04-02 09:17:45 +00:00
void clone_dir(int src, int dest);
2019-11-23 22:18:55 +00:00
void parse_mnt(const char *file, const std::function<bool(mntent*)> &fn);
Introduce new boot flow to handle SAR 2SI The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
2020-04-01 11:39:28 +00:00
void backup_folder(const char *dir, std::vector<raw_file> &files);
void restore_folder(const char *dir, std::vector<raw_file> &files);
2019-07-02 05:58:19 +00:00
2019-07-16 08:08:28 +00:00
template <typename T>
void full_read(const char *filename, T &buf, size_t &size) {
static_assert(std::is_pointer<T>::value);
full_read(filename, reinterpret_cast<void**>(&buf), &size);
2019-07-16 08:08:28 +00:00
}
template <typename T>
void fd_full_read(int fd, T &buf, size_t &size) {
static_assert(std::is_pointer<T>::value);
fd_full_read(fd, reinterpret_cast<void**>(&buf), &size);
2019-07-16 08:08:28 +00:00
}
2019-07-02 05:58:19 +00:00
template <typename B>
void mmap_ro(const char *filename, B &buf, size_t &sz) {
buf = (B) __mmap(filename, &sz, false);
2019-07-02 05:58:19 +00:00
}
template <typename B, typename L>
void mmap_ro(const char *filename, B &buf, L &sz) {
size_t __sz;
buf = (B) __mmap(filename, &__sz, false);
sz = __sz;
2019-07-02 05:58:19 +00:00
}
template <typename B>
void mmap_rw(const char *filename, B &buf, size_t &sz) {
buf = (B) __mmap(filename, &sz, true);
2019-07-02 05:58:19 +00:00
}
template <typename B, typename L>
void mmap_rw(const char *filename, B &buf, L &sz) {
size_t __sz;
buf = (B) __mmap(filename, &__sz, true);
sz = __sz;
2019-07-02 05:58:19 +00:00
}
2019-12-13 05:37:06 +00:00
using sFILE = std::unique_ptr<FILE, decltype(&fclose)>;
using sDIR = std::unique_ptr<DIR, decltype(&closedir)>;
2020-12-04 04:15:18 +00:00
sDIR make_dir(DIR *dp);
sFILE make_file(FILE *fp);
2019-12-13 05:37:06 +00:00
static inline sDIR open_dir(const char *path) {
return make_dir(opendir(path));
2019-12-13 05:37:06 +00:00
}
static inline sDIR xopen_dir(const char *path) {
return make_dir(xopendir(path));
2019-12-13 05:37:06 +00:00
}
Introduce new boot flow to handle SAR 2SI The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
2020-04-01 11:39:28 +00:00
static inline sDIR xopen_dir(int dirfd) {
return make_dir(xfdopendir(dirfd));
Introduce new boot flow to handle SAR 2SI The existing method for handling legacy SAR is: 1. Mount /sbin tmpfs overlay 2. Dump all patched/new files into /sbin 3. Magic mount root dir and re-exec patched stock init With Android 11 removing the /sbin folder, it is quite obvious that things completely break down right in step 1. To overcome this issue, we have to find a way to swap out the init binary AFTER we re-exec stock init. This is where 2SI comes to rescue! 2SI normal boot procedure is: 1st stage -> Load sepolicy -> 2nd stage -> boot continue... 2SI Magisk boot procedure is: MagiskInit 1st stage -> Stock 1st stage -> MagiskInit 2nd Stage -> -> Stock init load sepolicy -> Stock 2nd stage -> boot continue... As you can see, the trick is to make stock 1st stage init re-exec back into MagiskInit so we can do our setup. This is possible by manipulating some ramdisk files on initramfs based 2SI devices (old ass non SAR devices AND super modern devices like Pixel 3/4), but not possible on device that are stuck using legacy SAR (device that are not that modern but not too old, like Pixel 1/2. Fucking Google logic!!) This commit introduces a new way to intercept stock init re-exec flow: ptrace init with forked tracer, monitor PTRACE_EVENT_EXEC, then swap out the init file with bind mounts right before execv returns! Going through this flow however will lose some necessary backup files, so some bookkeeping has to be done by making the tracer hold these files in memory and act as a daemon. 2nd stage MagiskInit will ack the daemon to release these files at the correct time. It just works™ ¯\_(ツ)_/¯
2020-04-01 11:39:28 +00:00
}
2019-12-13 05:37:06 +00:00
static inline sFILE open_file(const char *path, const char *mode) {
return make_file(fopen(path, mode));
2019-12-13 05:37:06 +00:00
}
static inline sFILE xopen_file(const char *path, const char *mode) {
return make_file(xfopen(path, mode));
2019-12-13 05:37:06 +00:00
}
static inline sFILE xopen_file(int fd, const char *mode) {
return make_file(xfdopen(fd, mode));
}