[Android Software/Hacking General [Developers Only]] mcfist:
Hello all,

I'd like to braindump how I managed to make android emulator v30 work with mitm, hope that helps someone.

Since it was not possible to neither write nor make writable the /system partition, I decided to roll my own system.img and that actually worked. I'm not going to upload a script because I might not remember 100%, but I'll going to descibe the steps in full, even though they exist elsewhere. The commands might not be exact, too, so if there's a typo you'll need to figure it out yourself.

Also, it will be a bit confusing because I shall refer to 2 files named system.img, one is the 2G file that comes with android, the other is 700M or something file that you will be creating in the process. I'll refer them as #1 and #2.

1. What is needed: android studio and emulator, linux, xattr, https://github.com/LonelyFool/lpunpack_and_lpmake , https://github.com/tytso/e2fsprogs, mitmproxy, parted. Build these github projects, you'll need their binaries in the process.

also, 'mkdir build' somewhere.

2. Find system.img (#1) in your android studio installation, then extract the system partition:

$ losetup -f system.img

$ losetup -a | grep system.img

/dev/loop5

$ partprobe /dev/loop5

$ ls /dev/loop5p*

/dev/loop5p1 /dev/loop5p2

$ lpunpack_and_lpmake/bin/lpunpack /dev/loop5p2 build

$ ls build

system.img system-ext.img product.img vendor.img

$ losetup -d /dev/loop5

3. Make system.img (#2) writable and usable. This is ext4 crunched with feature shared_blocks, which makes it not really writable even in theory, as it deduplicates identical blocks in the filesystem. You'll need to convert that to a normal ext4, but, there's not enough space to do that operation. So you'll need to expand the partition to accomodate for this. How much? Empirically, I added 30M to a 700M partition:

$ ls -l system.img

700000000 # for example

$ e2fsprogs/resize/resize2fs system.img 730M

$ ls -l system.img

730000000 # for example

$ e2fsprogs/e2fsck/e2fsck -f system.img

$ e2fsprogs/e2fsck/e2fsck -E unshared_blocks system.img

$ e2fsprogs/e2fsck/e2fsck -f system.img

4. Modify the now writable partiton to your heart's content (we're still with system.img #2 here). I needed to add just one file, mitmproxy-ca-cert.cer . According to the mitmproxy docs, the name must be the hash of the certificate:

$ losetup -f system.img

$ losetup -a | grep system.img

/dev/loop6

$ mount /dev/loop6 /mnt

$ hashed_name=`openssl x509 -inform PEM -subject_hash_old -in mitmproxy-ca-cert.cer | head -1

$ echo $hashed_name

c8750f0d

$ cp mitmproxy-ca-cert.cer /mnt/system/ext/security/cacerts/$hashed_name.0

$ cd /mnt/system/ext/security/cacerts/

$ chmod 644 $hashed_name.0

Now check if your android has extra attributes in these certificate files. Mine does:

$ xattr 00abcde.0 # some random certificate

security.selinux

$ xattr -p security.selinux 00abcde.0

u:object_r:system_security_cacerts_file:s0

if yes, you'll need it on this file too:

$ xattr -w security.selinux u:object_r:system_security_cacerts_file:s0 $hashed_name.0

and be done with the partition

$ umount /mnt

$ losetup -d /dev/loop6

5. Create new super-partition, the one we used as /dev/loop5p2. You'll need the file sizes of your .img partitions, and your command to create a super.img file will look like this:

$ cat repack

#!/bin/sh

P=/android/super/1

~/src/lpunpack_and_lpmake/bin/lpmake --metadata-size 65536 --super-name super --metadata-slots 2 --device super:2496462848 --group main:2647101440 \

--partition system:readonly:786432000:main --image system=$P/system.img \

--partition system_ext:readonly:131952640:main --image system_ext=$P/system_ext.img \

--partition product:readonly:1468575744:main --image product=$P/product.img \

--partition vendor:readonly:102739968:main --image vendor=$P/vendor.img \

--output $P/super2.img

the interesting numbers are the corresponding partition sizes (in --partition), and, if f ex you increased the system.img #2 to 30M in the step 3, the number in --device:super should be the size of /dev/loop5p2 in bytes plus at least these 30M (but also okay if a bit more).

6. Finally, create a new system.img #1 . Create a backup copy of it, and then append some 30M there, and fix the partition

$ dd if=/dev/zero of=system-new.img flags=append bs=1M size=30

$ losetup -f system-new.img

$ losetup -a | grep system-new.img

/dev/loop7

$ parted /dev/loop7

GNU Parted 3.3

Using /dev/loop7

Welcome to GNU Parted! Type 'help' to view a list of commands.

(parted) p

Model: Loopback device (loopback)

Disk /dev/loop7: 2444MB

Sector size (logical/physical): 512B/512B

Partition Table: gpt

Disk Flags:

Number Start End Size File system Name Flags

1 1049kB 2097kB 1049kB vbmeta

2 2097kB 2443MB 2441MB super

you will need to expand the partion 2 to the max (plus minus same 30M). If is fails fix the number and retry:

(parted) resizepart 2 24460MB

Error: The location 24460MB is outside of the device /dev/loop7.

and finally copy data back:

$ partprobe /dev/loop7

$ dd if=super.img of=/dev/loop7p2 bs=1M

$ losetup -d /dev/loop7

and that's it. After that, rename system-new.img to system.img, and hopefully the emulator could run this new image.

Also, to check that the certificate is there and recognized, go to the setting/certificates/trusted certificates, the mitmproxy one should be in the list.

Hopefully this will be helpful.

Cheers!

/dk