Android设备启动过程

安卓设备的启动过程始于SoC（单片系统）通电，在见到主界面或进入恢复及快速启动等特殊模式时结束。^[a]安卓设备的启动过程受到SoC制造商所设计的固件影响。

背景

截至2018年，Android设备上90%的SoC由高通、三星或联发科供应。^[1]其他供应商包括瑞芯微电子、美满电子科技、英伟达及之前的德州仪器。

历史

Android KitKat（Android 4.4）引入了启动验证，启动验证是加载引导程序时的安全措施。^[2]

启动阶段

主引导程序

引导过程的第一阶是启动主引导程序（PBL），其存储在引导ROM（Boot ROM）^[3]中，由芯片组制造商编写代码。^[4]

使用主引导程序来验证下一阶段引导程序的可靠性。

在三星智能手机上，引导ROM使用三星安全启动密钥（SSBK）来验证下一阶段。^[5]

在高通的SoC上，可以从主引导程序进入高通紧急下载模式。

如果加载并验证次级引导程序时失败，则会进入EDL。^[6]^{[需要较佳来源]}

次级引导程序

由于引导ROM中的储存空间有限，因此使用嵌入式多媒体卡（eMMC）或eUFS来加载次级引导程序。^[7] 次级引导程序初始化TrustZone（信任区）。^[7]^[8]

例如高通MSM8960，次级引导程序1加载次级引导程序2。次级引导程序2会加载TrustZone和次级引导程序3。^[9]

次级引导程序现在被高通称为XBL（可扩展引导程序），并使用统一可扩展固件接口（UEFI）来进行交叉兼容，以便在第二阶段启动除Android以外的操作系统。

高通使用LK（Little Kernel）或XBL（eXtenable Bootloader），联发科使用Das U-Boot。^[10] Little Kernel是一个用于嵌入式设备的微内核，经过高通的修改后可以用作次级引导程序。^[11]

Android引导程序

Android Bootloader（Aboot），它实现了fastboot接口（三星设备中没有fastboot）。Aboot用于验证引导程序和恢复分区的可靠性。 ^[12]通过在手机上按下特定的组合键，设备还可以在恢复模式下启动。接着Aboot将控制权转移到Linux内核。

Android内核和initramfs（初始RAM文件系统）

initramfs是一个经过Gzip压缩的Cpio档案，其中包含一个小型根文件系统。它包含了被执行的init程序。Android内核是由Linux内核修改后的版本。Init程序挂载了分区。dm-verity用于验证fstab文件中指定分区的完整性。dm-verity是由Google从Android 4.4开始引入的 Linux内核模块。现今实现了基于块的验证，三星已增加对该文件的支持。 ^[13]

Zygote进程

Zygote进程由init进程派生，负责启动Android应用程序和服务。它将那些经常使用的类加载并初始化到堆中。例如库的dex数据结构。Zygote进程启动后，它会监听套接字上的命令。当要启动新应用程序时，会向Zygote进程发送命令，Zygote进程会执行fork系统调用。^{[需要引用]}

分区布局

Android系统被划分在不同的分区中。 ^[14]

高通平台利用了GUID分区表。此规范是UEFI规范的一部分，但不依赖于UEFI固件。^[15]

参见

注释

^ These modes tend to support a feature to resume regular booting

参考文献

^ Garri, Khireddine; Kenaza, Tayeb; Aissani, Mohamed. http://dx.doi.org/10.1109/saconet.2018.8585583 |chapterurl=缺少标题 (帮助). A Novel approach for bootkit detection in Android Platform. IEEE. October 2018: 277–282. ISBN 978-1-5386-9493-0. doi:10.1109/saconet.2018.8585583.
^ Android Verified Boot [LWN.net]. LWN.net. [2021-09-25]. （原始内容存档于2015-04-22）.
^ Yuan, Pengfei; Guo, Yao; Chen, Xiangqun; Mei, Hong. https://ieeexplore.ieee.org/document/8350440 |chapterurl=缺少标题 (帮助). Device-Specific Linux Kernel Optimization for Android Smartphones. March 2018: 65–72. ISBN 978-1-5386-4879-7. doi:10.1109/MobileCloud.2018.00018.
^ Hay, Roee. fastboot oem vuln: android bootloader vulnerabilities in vendor customizations. Proceedings of the 11th USENIX Conference on Offensive Technologies. WOOT'17 (Vancouver, BC, Canada: USENIX Association). 2017-08-14: 22.
^ Alendal, Gunnar; Dyrkolbotn, Geir Olav; Axelsson, Stefan. Forensics acquisition — Analysis and circumvention of samsung secure boot enforced common criteria mode. Digital Investigation. 2018-03-01, 24: S60–S67. ISSN 1742-2876. doi:10.1016/j.diin.2018.01.008. hdl:11250/2723051  （英语）.
^ Exploiting Qualcomm EDL Programmers (1): Gaining Access & PBL Internals. alephsecurity.com. 2018-01-22 [2021-09-13] （英语）.
^ ^7.0 ^7.1 Yuan, Pengfei; Guo, Yao; Chen, Xiangqun; Mei, Hong. http://dx.doi.org/10.1109/mobilecloud.2018.00018 |chapterurl=缺少标题 (帮助). Device-Specific Linux Kernel Optimization for Android Smartphones. IEEE. March 2018: 65–72. ISBN 978-1-5386-4879-7. doi:10.1109/mobilecloud.2018.00018.
^ Kanonov, Uri; Wool, Avishai. http://dx.doi.org/10.1145/2994459.2994470 |chapterurl=缺少标题 (帮助). Secure Containers in Android. SPSM '16. New York, NY, USA: ACM. 2016-10-24: 3–12. ISBN 9781450345644. doi:10.1145/2994459.2994470.
^ Tao, Chen, Yue Zhang, Yulong Wang, Zhi Wei. Downgrade Attack on TrustZone. 2017-07-17. OCLC 1106269801.
^ Garri, Khireddine; Kenaza, Tayeb; Aissani, Mohamed. http://dx.doi.org/10.1109/saconet.2018.8585583 |chapterurl=缺少标题 (帮助). A Novel approach for bootkit detection in Android Platform. IEEE. October 2018: 277–282. ISBN 978-1-5386-9493-0. doi:10.1109/saconet.2018.8585583.
^ Tang, Qinghao. Internet of things security: principles and practice. Fan Du. Singapore. 2021: 166. ISBN 978-981-15-9942-2. OCLC 1236261208.
^ Hay, Roee. fastboot oem vuln: android bootloader vulnerabilities in vendor customizations. Proceedings of the 11th USENIX Conference on Offensive Technologies. WOOT'17 (Vancouver, BC, Canada: USENIX Association). 2017-08-14: 22.
^ Kanonov, Uri; Wool, Avishai. http://dx.doi.org/10.1145/2994459.2994470 |chapterurl=缺少标题 (帮助). Secure Containers in Android. SPSM '16. New York, NY, USA: ACM. 2016-10-24: 3–12. ISBN 9781450345644. doi:10.1145/2994459.2994470.
^ Alendal, Gunnar; Dyrkolbotn, Geir Olav; Axelsson, Stefan. Forensics acquisition — Analysis and circumvention of samsung secure boot enforced common criteria mode. Digital Investigation. March 2018, 24: S60–S67. ISSN 1742-2876. doi:10.1016/j.diin.2018.01.008. hdl:11250/2723051 .
^ Zhao, Longze; Xi, Bin; Wu, Shunxiang; Aizezi, Yasen; Ming, Daodong; Wang, Fulin; Yi, Chao. http://dx.doi.org/10.1145/3207677.3278046 |chapterurl=缺少标题 (帮助). Physical Mirror Extraction on Qualcomm-based Android Mobile Devices. Csae '18. New York, New York, USA: ACM Press. 2018: 1–5. ISBN 9781450365123. doi:10.1145/3207677.3278046.

外部链接

[1] These modes tend to support a feature to resume regular booting

[:2-2] Garri, Khireddine; Kenaza, Tayeb; Aissani, Mohamed. http://dx.doi.org/10.1109/saconet.2018.8585583 |chapterurl=缺少标题 (帮助). A Novel approach for bootkit detection in Android Platform. IEEE. October 2018: 277–282. ISBN 978-1-5386-9493-0. doi:10.1109/saconet.2018.8585583.

[3] Android Verified Boot [LWN.net]. LWN.net. [2021-09-25]. （原始内容存档于2015-04-22）.

[4] Yuan, Pengfei; Guo, Yao; Chen, Xiangqun; Mei, Hong. https://ieeexplore.ieee.org/document/8350440 |chapterurl=缺少标题 (帮助). Device-Specific Linux Kernel Optimization for Android Smartphones. March 2018: 65–72. ISBN 978-1-5386-4879-7. doi:10.1109/MobileCloud.2018.00018.

[:3-5] Hay, Roee. fastboot oem vuln: android bootloader vulnerabilities in vendor customizations. Proceedings of the 11th USENIX Conference on Offensive Technologies. WOOT'17 (Vancouver, BC, Canada: USENIX Association). 2017-08-14: 22.

[6] Alendal, Gunnar; Dyrkolbotn, Geir Olav; Axelsson, Stefan. Forensics acquisition — Analysis and circumvention of samsung secure boot enforced common criteria mode. Digital Investigation. 2018-03-01, 24: S60–S67. ISSN 1742-2876. doi:10.1016/j.diin.2018.01.008. hdl:11250/2723051  （英语）.

[7] Exploiting Qualcomm EDL Programmers (1): Gaining Access & PBL Internals. alephsecurity.com. 2018-01-22 [2021-09-13] （英语）.

[:1-8] 7.0 ^7.1 Yuan, Pengfei; Guo, Yao; Chen, Xiangqun; Mei, Hong. http://dx.doi.org/10.1109/mobilecloud.2018.00018 |chapterurl=缺少标题 (帮助). Device-Specific Linux Kernel Optimization for Android Smartphones. IEEE. March 2018: 65–72. ISBN 978-1-5386-4879-7. doi:10.1109/mobilecloud.2018.00018.

[:0-9] Kanonov, Uri; Wool, Avishai. http://dx.doi.org/10.1145/2994459.2994470 |chapterurl=缺少标题 (帮助). Secure Containers in Android. SPSM '16. New York, NY, USA: ACM. 2016-10-24: 3–12. ISBN 9781450345644. doi:10.1145/2994459.2994470.

[10] Tao, Chen, Yue Zhang, Yulong Wang, Zhi Wei. Downgrade Attack on TrustZone. 2017-07-17. OCLC 1106269801.

[:22-11] Garri, Khireddine; Kenaza, Tayeb; Aissani, Mohamed. http://dx.doi.org/10.1109/saconet.2018.8585583 |chapterurl=缺少标题 (帮助). A Novel approach for bootkit detection in Android Platform. IEEE. October 2018: 277–282. ISBN 978-1-5386-9493-0. doi:10.1109/saconet.2018.8585583.

[12] Tang, Qinghao. Internet of things security: principles and practice. Fan Du. Singapore. 2021: 166. ISBN 978-981-15-9942-2. OCLC 1236261208.

[:32-13] Hay, Roee. fastboot oem vuln: android bootloader vulnerabilities in vendor customizations. Proceedings of the 11th USENIX Conference on Offensive Technologies. WOOT'17 (Vancouver, BC, Canada: USENIX Association). 2017-08-14: 22.

[:02-14] Kanonov, Uri; Wool, Avishai. http://dx.doi.org/10.1145/2994459.2994470 |chapterurl=缺少标题 (帮助). Secure Containers in Android. SPSM '16. New York, NY, USA: ACM. 2016-10-24: 3–12. ISBN 9781450345644. doi:10.1145/2994459.2994470.

[15] Alendal, Gunnar; Dyrkolbotn, Geir Olav; Axelsson, Stefan. Forensics acquisition — Analysis and circumvention of samsung secure boot enforced common criteria mode. Digital Investigation. March 2018, 24: S60–S67. ISSN 1742-2876. doi:10.1016/j.diin.2018.01.008. hdl:11250/2723051 .

[16] Zhao, Longze; Xi, Bin; Wu, Shunxiang; Aizezi, Yasen; Ming, Daodong; Wang, Fulin; Yi, Chao. http://dx.doi.org/10.1145/3207677.3278046 |chapterurl=缺少标题 (帮助). Physical Mirror Extraction on Qualcomm-based Android Mobile Devices. Csae '18. New York, New York, USA: ACM Press. 2018: 1–5. ISBN 9781450365123. doi:10.1145/3207677.3278046.

[a]

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[11]

[12]

[13]

[14]

[15]

背景

历史