Root Pixel2 with Magisk

Root steps

1. head to Google's firmware download page for Pixel devices and select your model from the menu on the right.
2. Unzip the file, original rom
3. Looking for "image-walleye" or "image-taimen"
4. Looking for "boot.img"
5. Put "boot.img" to phone
6. Install Magisk Manager app. Tap "Install" then "Patch boot image File"\
7. Magisk Manager app should generate file "patched_boot.img". Copy file to computer
8. Restart device to boot loader mode "adb reboot bootloader"
9. Refresh boot img by command "fastboot flash boot "PATH_TO_PATCHED_BOOT.IMG"
10. Relaunch device "Fastboot reboot" and magick manager. Should see Magisk SU

Put back factory boot.img for receive system OTA

1. Restart device to boot loader mode
2. Refresh boot img by command "fastboot flash boot "PATH_TO_FACTORY_BOOT.IMG"
3. Relaunch device with "Fastboot reboot" 

Add Stub module on Android studio

1. Create java library module, not Android library.
    apply plugin: 'java'
    Write stub code in this module

2. Add reference Stub in build.gradle in app module

android {

allprojects {
                   gradle.projectsEvaluated {
                     tasks.withType(JavaCompile) {
                       doFirst {
                         options.fork = true
                         options.compilerArgs.add("-Xbootclasspath/p:$project.rootDir/stub/build/libs/stub.jar")
                       }
                     }
                   }
                  }
}
dependencies {
compileOnly project(':stub')
}

system app on Android O+

1. push APK on /system/priv-app/
2. APK needs to target SDK as device
3. chomd +r XXX.apk
4. create permission file on /etc/permissions/
5. permission file name should be "privapp-permissions-PACKAGE_NAMW.xml"
6. permission file content depends APK.  Example:



   

             
 

Run AOSP in Nexus devices

1. Download AOSP 

2. Download driver from Google's Nexus driver page.

3. unzip those drivers and put *.sh to root folder of AOSP

4. run each *.sh. Should get extract files to ./vendor

5.

$ source ./build/envsetup.sh

6. lunch. then choose flavor. (aosp_hammerhead-userdebug)

$ lunch

7. go to root folder of AOSP then make -j4

$ make -j4

8. Device goes to ‘’fast boot” mode. 

$ adb reboot bootloader

9. Go to ./out/target/product/hammerhead

$ cd ./out/target/product/hammerhead

10. flash real devices

$ fastboot -w flashall

AOSP Keys convert to Eclipse KeyStore

 AOSP put keys in build/target/product/security 

testkey -- a generic key for packages that do not otherwise specify a key.
platform -- a test key for packages that are part of the core platform.
shared -- a test key for things that are shared in the home/contacts process.

media -- a test key for packages that are part of the media/download system.

Example of "Platform"

java的keystore(jks)算是pkcs12的部分

但由於jks是sun的proprietary的format

所以openssl沒法處理jks 要先把他轉成pkcs12再用keytool來轉

首先要先把 private key (pkcs8) 從DER format轉成PEM format

#openssl pkcs8 -inform DER -nocrypt -in platform.pk8 -out platform.pem

然後要把private key 跟public key 轉成pkcs12. 輸入之後會跳出提示"輸入密碼"

#openssl pkcs12 -export -in platform.x509.pem -inkey platform.pem -out platform.pkcs12

最後用keytool把他轉成jks. 如不輸入 "srcstorepass"或"deststorepass" 輸入之後會跳出提示"輸入密碼"

#keytool -importkeystore -srckeystore platform.pkcs12 -srcstoretype pkcs12   -destkeystore platform.jks -deststoretype JKS [-srcstorepass PASSWORD -deststorepass PASSWORD]

verify that the key has been added to the keystore.

#keytool -list -v -keystore .keystore

ref: ALLSTART's BLOG

Android setting file

Android launch by default app

/data/system/users/0/package-restrictions.xml

Map Uid and permission

/data/system/package.xml

Android partition backup

Partition info can be found in "/dev/block/...". But it is not readable, most of devices have readable info in "/dev/block/platform/msm_sdcc.1/by-name".

Backup:
dd if=/dev/block/platform/msm_sdcc.1/by-name/recovery of=/sdcard/Backup/recovery-backup.img

Restore:
dd if=/dev/zero of=/dev/block/platform/msm_sdcc.1/by-name/recovery
dd if=/sdcard/Backup/recovery-backup.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery