Kprobes for Google Nexus 4, 5, 7, …

Would you like to run your Android kernel with kprobes? I prepared boot images—at least for the Nexus devices I own(ed)—that let you do so:

I will probably add more boot images in the future. However, if your device (and Android version) isn’t listed (yet) in the table above, you can still build your own (which is not too difficult), following my detailed recipe.

Why kprobes? You can do pretty cool stuff with it. It is the kernel’s debugging mechanism, so even while your device is running you can intercept basically any function and its arguments in your kernel to see what is happening. In a nutshell, just write a kernel module with handler methods that get invoked when the functions are executed that you’d like to intercept.

I used kprobes for MonitorMe, which let’s you watch almost any system event (or method call) that an app causes on your Android platform.

How to boot the boot image? Download the one for you device in the table above (or use your custom-built one) and (while your phone/tablet has USB debugging mode enabled in Settings -> Developer options and is connected via USB) run on your Linux shell:

DISCLAIMER: I take no responsibility if something happens to your device using my custom boot images. If you are ever in doubt STOP reading here!

# install Android Debug Bridge (ADB), and Fastboot
sudo apt-get install android-tools-adb android-tools-fastboot
$ adb reboot bootloader
# Only works if your device is rooted
$ sudo fastboot boot <boot-image-with-kprobes.img>

Be careful, only ever boot the image at a first try (never flash, unless you know what you are doing).

For the emulator, add the flag -kernel zImage_goldfish_kprobes to start it with the kprobes kernel.