Nexus 5X 刷机root

前言

本来只是想学frida的,但是后面发现,模拟机很多东西都没有用(有些app安装不了、对root进行检查、禁用frida...)

在网上搜索教程,看到Github上一个dalao的安卓学习,直接跟着他搞了

手机正好有一部,直接开始刷机就完事了

刷机

下载镜像

官方工厂镜像网站来下载Android8.1.0

image-20220812200403670

手机解锁

教程来自贴吧的一个帖子

fastboot oem unlock

安装镜像

unlock状态下,进行镜像安装

但是捏,非常的奇怪,我每次运行flash-all.bat的时候,机器都会闪退一下

搜索一番,找到了思否上的一篇帖子

原来这个机子是异常机器(奇怪

使用他的方法

image-20220812205703871

然后大无语事件来了,我第一次给电脑搞名称的时候用的是中文——木鲸,用户文件夹也就是中文

然后在刷机的最后一部直接给我路径错误,人嘛了

最后的解决方法就是修改环境变量

image-20220812205936568

直接把这两个tmp文件夹的路径改成windows的

最后刷机成功

PS E:\myworks\5x\bullhead-opm7.181205.001-factory-5f189d84\bullhead-opm7.181205.001> fastboot -w update image-bullhead-opm7.181205.001.zip
--------------------------------------------
Bootloader Version...: BHZ32c
Baseband Version.....: M8994F-2.6.42.5.03
Serial Number........: 02584853a77ec5a5
--------------------------------------------
extracting android-info.txt (0 MB) to RAM...
Checking 'product'                                 OKAY [  0.018s]
Checking 'version-bootloader'                      OKAY [  0.013s]
Checking 'version-baseband'                        OKAY [  0.018s]
extracting boot.img (11 MB) to disk... took 0.043s
archive does not contain 'boot.sig'
Sending 'boot' (11781 KB)                          OKAY [  0.341s]
Writing 'boot'                                     OKAY [  0.123s]
archive does not contain 'dtbo.img'
archive does not contain 'dt.img'
archive does not contain 'pvmfw.img'
extracting recovery.img (17 MB) to disk... took 0.025s
archive does not contain 'recovery.sig'
Sending 'recovery' (17425 KB)                      OKAY [  0.466s]
Writing 'recovery'                                 OKAY [  0.188s]
archive does not contain 'vbmeta.img'
archive does not contain 'vbmeta_system.img'
archive does not contain 'vbmeta_vendor.img'
archive does not contain 'vendor_boot.img'
archive does not contain 'super_empty.img'
archive does not contain 'odm.img'
archive does not contain 'odm_dlkm.img'
archive does not contain 'product.img'
extracting system.img (1909 MB) to disk... took 7.741s
archive does not contain 'system.sig'
Sending sparse 'system' 1/4 (508768 KB)            OKAY [ 12.339s]
Writing 'system'                                   OKAY [  6.061s]
Sending sparse 'system' 2/4 (524238 KB)            OKAY [ 12.703s]
Writing 'system'                                   OKAY [  5.933s]
Sending sparse 'system' 3/4 (501061 KB)            OKAY [ 12.713s]
Writing 'system'                                   OKAY [  6.547s]
Sending sparse 'system' 4/4 (421469 KB)            OKAY [ 10.063s]
Writing 'system'                                   OKAY [  4.581s]
archive does not contain 'system_ext.img'
extracting vendor.img (185 MB) to disk... took 0.851s
archive does not contain 'vendor.sig'
Sending 'vendor' (190332 KB)                       OKAY [  4.436s]
Writing 'vendor'                                   OKAY [  2.707s]
archive does not contain 'vendor_dlkm.img'
Erasing 'userdata'                                 OKAY [  0.269s]
mke2fs 1.46.2 (28-Feb-2021)
Creating filesystem with 6661115 4k blocks and 1667904 inodes
Filesystem UUID: 32c55a66-1a3e-11ed-b198-99711d2e12a2
Superblock backups stored on blocks:
        32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
        4096000

Allocating group tables: done
Writing inode tables: done
Creating journal (32768 blocks): done
Writing superblocks and filesystem accounting information: done

Sending 'userdata' (180 KB)                        OKAY [  0.097s]
Writing 'userdata'                                 OKAY [  0.011s]
Erasing 'cache'                                    OKAY [  0.080s]
mke2fs 1.46.2 (28-Feb-2021)
Creating filesystem with 24576 4k blocks and 24576 inodes

Allocating group tables: done
Writing inode tables: done
Creating journal (1024 blocks): done
Writing superblocks and filesystem accounting information: done

Sending 'cache' (44 KB)                            OKAY [  0.069s]
Writing 'cache'                                    OKAY [  0.009s]
Rebooting                                          OKAY [  0.018s]
Finished. Total time: 90.122s

TWRP

很遗憾,我属于异常机器,得使用比较艰难的方法来安装TWRP

国外大佬的帖子

反正就是运行几行代码

搞了挺久,成功了

Magisk

这玩意,如果是正常机器,刷完twrp后很好刷,直接把zip包搞进去刷就行了

但是我这个异常机器非常难搞,总之就是得安装20~22版本的magisk才搞好了

Screenshot_2022-08-12-08-40-33

一样的刷包方式,但是重启后那个Magisk文件时绿色的安卓默认app图标,点击后需要进行下载完整版,下载后安装包又说有问题。

我直接去Github上下载了22版本的apk(高版本或低版本都有问题)

进入后说Magisk的环境异常,我直接点击在线修复,重启一次就好了

最后的效果

IMG_20220812_224929

请求root

image-20220812225021680

Frida

去GitHub上下载frida-server-android,我这里下载的是目前的最新版本15.2.2

解压后,使用adb push放到/data/local/tmp/文件夹中

image-20220813072204340

使用adb shell进入手机shell,su提权后,给frida-server授权,然后运行一下

image-20220813072305724

搞个测试脚本,看看是否成功

import frida

dev = frida.get_usb_device()
print(dev)

front_app = dev.get_frontmost_application()
print(front_app)

process = dev.enumerate_processes()
for i in process:
    print(i)

image-20220813072454730

Fiddler

用户安装

安装fiddler的证书到手机里,方便抓包

首先电脑打开Fiddler,然后手机和电脑连接同一个wifi

使用ipconfig/ifconfig查看电脑的ipv4

手机设置wifi代理,ip是电脑的ip,端口是8888

Screenshot_20220813-073110

然后进入chrome,输入ip:8888,进入到fiddler的主页

下载证书,安装,完事!

Screenshot_20220813-072742

安装后成功抓包:

image-20220813073815575

系统安装

我看这篇博客搞得,证书那部分就不演示了,直接演示将证书放入系统证书中

image-20220813074743318

但是发现adb还是push不进去,没有权限

所以先将证书push到/sdcard

然后adb shell 后 su提权,将证书mv到/system/etc/security/cacerts下

然后chmod 644 证书

Screenshot_20220813-080121