Android裝置啟動過程

安卓裝置的啟動過程始於SoC（單晶片系統）通電，在見到主介面或進入恢復及快速啟動等特殊模式時結束。^[a]安卓裝置的啟動過程受到SoC製造商所設計的韌體影響。

背景

截至2018年，Android裝置上90%的SoC由高通、三星或聯發科供應。^[1]其他供應商包括瑞芯微電子、美滿電子科技、輝達及之前的德州儀器。

歷史

Android KitKat（Android 4.4）引入了啟動驗證，啟動驗證是載入引導程式時的安全措施。^[2]

啟動階段

主引導程式

引導過程的第一階是啟動主引導程式（PBL），其儲存在引導ROM（Boot ROM）^[3]中，由晶片組製造商編寫代碼。^[4]

使用主引導程式來驗證下一階段引導程式的可靠性。

在三星智慧型手機上，引導ROM使用三星安全啟動金鑰（SSBK）來驗證下一階段。^[5]

在高通的SoC上，可以從主引導程式進入高通緊急下載模式。

如果載入並驗證次級引導程式時失敗，則會進入EDL。^[6]^{[需要較佳來源]}

次級引導程式

由於引導ROM中的儲存空間有限，因此使用嵌入式多媒體卡（eMMC）或eUFS來載入次級引導程式。^[7] 次級引導程式初始化TrustZone（信任區）。^[7]^[8]

例如高通MSM8960，次級引導程式1載入次級引導程式2。次級引導程式2會載入TrustZone和次級引導程式3。^[9]

次級引導程式現在被高通稱為XBL（可延伸引導程式），並使用統一可延伸韌體介面（UEFI）來進行交叉相容，以便在第二階段啟動除Android以外的作業系統。

高通使用LK（Little Kernel）或XBL（eXtenable Bootloader），聯發科使用Das U-Boot。^[10] Little Kernel是一個用於嵌入式裝置的微核心，經過高通的修改後可以用作次級引導程式。^[11]

Android引導程式

Android Bootloader（Aboot），它實現了fastboot介面（三星裝置中沒有fastboot）。Aboot用於驗證引導程式和恢復分割區的可靠性。 ^[12]通過在手機上按下特定的組合鍵，裝置還可以在恢復模式下啟動。接著Aboot將控制權轉移到Linux核心。

Android核心和initramfs（初始RAM檔案系統）

initramfs是一個經過Gzip壓縮的Cpio檔案，其中包含一個小型根檔案系統。它包含了被執行的init程式。Android核心是由Linux核心修改後的版本。Init程式掛載了分割區。dm-verity用於驗證fstab檔案中指定分割區的完整性。dm-verity是由Google從Android 4.4開始引入的 Linux核心模組。現今實現了基於塊的驗證，三星已增加對該檔案的支援。 ^[13]

Zygote行程

Zygote行程由init行程衍生，負責啟動Android應用程式和服務。它將那些經常使用的類載入並初始化到堆中。例如庫的dex資料結構。Zygote行程啟動後，它會監聽通訊端上的命令。當要啟動新應用程式時，會向Zygote行程傳送命令，Zygote行程會執行fork系統呼叫。^{[需要參照]}

分割區布局

Android系統被劃分在不同的分割區中。 ^[14]

高通平台利用了GUID分割區表。此規範是UEFI規範的一部分，但不依賴於UEFI韌體。^[15]

參見

注釋

^ These modes tend to support a feature to resume regular booting

參考文獻

^ Garri, Khireddine; Kenaza, Tayeb; Aissani, Mohamed. http://dx.doi.org/10.1109/saconet.2018.8585583 |chapterurl=缺少標題 (幫助). A Novel approach for bootkit detection in Android Platform. IEEE. October 2018: 277–282. ISBN 978-1-5386-9493-0. doi:10.1109/saconet.2018.8585583.
^ Android Verified Boot [LWN.net]. LWN.net. [2021-09-25]. （原始內容存檔於2015-04-22）.
^ Yuan, Pengfei; Guo, Yao; Chen, Xiangqun; Mei, Hong. https://ieeexplore.ieee.org/document/8350440 |chapterurl=缺少標題 (幫助). Device-Specific Linux Kernel Optimization for Android Smartphones. March 2018: 65–72. ISBN 978-1-5386-4879-7. doi:10.1109/MobileCloud.2018.00018.
^ Hay, Roee. fastboot oem vuln: android bootloader vulnerabilities in vendor customizations. Proceedings of the 11th USENIX Conference on Offensive Technologies. WOOT'17 (Vancouver, BC, Canada: USENIX Association). 2017-08-14: 22.
^ Alendal, Gunnar; Dyrkolbotn, Geir Olav; Axelsson, Stefan. Forensics acquisition — Analysis and circumvention of samsung secure boot enforced common criteria mode. Digital Investigation. 2018-03-01, 24: S60–S67. ISSN 1742-2876. doi:10.1016/j.diin.2018.01.008. hdl:11250/2723051  （英語）.
^ Exploiting Qualcomm EDL Programmers (1): Gaining Access & PBL Internals. alephsecurity.com. 2018-01-22 [2021-09-13] （英語）.
^ ^7.0 ^7.1 Yuan, Pengfei; Guo, Yao; Chen, Xiangqun; Mei, Hong. http://dx.doi.org/10.1109/mobilecloud.2018.00018 |chapterurl=缺少標題 (幫助). Device-Specific Linux Kernel Optimization for Android Smartphones. IEEE. March 2018: 65–72. ISBN 978-1-5386-4879-7. doi:10.1109/mobilecloud.2018.00018.
^ Kanonov, Uri; Wool, Avishai. http://dx.doi.org/10.1145/2994459.2994470 |chapterurl=缺少標題 (幫助). Secure Containers in Android. SPSM '16. New York, NY, USA: ACM. 2016-10-24: 3–12. ISBN 9781450345644. doi:10.1145/2994459.2994470.
^ Tao, Chen, Yue Zhang, Yulong Wang, Zhi Wei. Downgrade Attack on TrustZone. 2017-07-17. OCLC 1106269801.
^ Garri, Khireddine; Kenaza, Tayeb; Aissani, Mohamed. http://dx.doi.org/10.1109/saconet.2018.8585583 |chapterurl=缺少標題 (幫助). A Novel approach for bootkit detection in Android Platform. IEEE. October 2018: 277–282. ISBN 978-1-5386-9493-0. doi:10.1109/saconet.2018.8585583.
^ Tang, Qinghao. Internet of things security: principles and practice. Fan Du. Singapore. 2021: 166. ISBN 978-981-15-9942-2. OCLC 1236261208.
^ Hay, Roee. fastboot oem vuln: android bootloader vulnerabilities in vendor customizations. Proceedings of the 11th USENIX Conference on Offensive Technologies. WOOT'17 (Vancouver, BC, Canada: USENIX Association). 2017-08-14: 22.
^ Kanonov, Uri; Wool, Avishai. http://dx.doi.org/10.1145/2994459.2994470 |chapterurl=缺少標題 (幫助). Secure Containers in Android. SPSM '16. New York, NY, USA: ACM. 2016-10-24: 3–12. ISBN 9781450345644. doi:10.1145/2994459.2994470.
^ Alendal, Gunnar; Dyrkolbotn, Geir Olav; Axelsson, Stefan. Forensics acquisition — Analysis and circumvention of samsung secure boot enforced common criteria mode. Digital Investigation. March 2018, 24: S60–S67. ISSN 1742-2876. doi:10.1016/j.diin.2018.01.008. hdl:11250/2723051 .
^ Zhao, Longze; Xi, Bin; Wu, Shunxiang; Aizezi, Yasen; Ming, Daodong; Wang, Fulin; Yi, Chao. http://dx.doi.org/10.1145/3207677.3278046 |chapterurl=缺少標題 (幫助). Physical Mirror Extraction on Qualcomm-based Android Mobile Devices. Csae '18. New York, New York, USA: ACM Press. 2018: 1–5. ISBN 9781450365123. doi:10.1145/3207677.3278046.

外部連結

[1] These modes tend to support a feature to resume regular booting

[:2-2] Garri, Khireddine; Kenaza, Tayeb; Aissani, Mohamed. http://dx.doi.org/10.1109/saconet.2018.8585583 |chapterurl=缺少標題 (幫助). A Novel approach for bootkit detection in Android Platform. IEEE. October 2018: 277–282. ISBN 978-1-5386-9493-0. doi:10.1109/saconet.2018.8585583.

[3] Android Verified Boot [LWN.net]. LWN.net. [2021-09-25]. （原始內容存檔於2015-04-22）.

[4] Yuan, Pengfei; Guo, Yao; Chen, Xiangqun; Mei, Hong. https://ieeexplore.ieee.org/document/8350440 |chapterurl=缺少標題 (幫助). Device-Specific Linux Kernel Optimization for Android Smartphones. March 2018: 65–72. ISBN 978-1-5386-4879-7. doi:10.1109/MobileCloud.2018.00018.

[:3-5] Hay, Roee. fastboot oem vuln: android bootloader vulnerabilities in vendor customizations. Proceedings of the 11th USENIX Conference on Offensive Technologies. WOOT'17 (Vancouver, BC, Canada: USENIX Association). 2017-08-14: 22.

[6] Alendal, Gunnar; Dyrkolbotn, Geir Olav; Axelsson, Stefan. Forensics acquisition — Analysis and circumvention of samsung secure boot enforced common criteria mode. Digital Investigation. 2018-03-01, 24: S60–S67. ISSN 1742-2876. doi:10.1016/j.diin.2018.01.008. hdl:11250/2723051  （英語）.

[7] Exploiting Qualcomm EDL Programmers (1): Gaining Access & PBL Internals. alephsecurity.com. 2018-01-22 [2021-09-13] （英語）.

[:1-8] 7.0 ^7.1 Yuan, Pengfei; Guo, Yao; Chen, Xiangqun; Mei, Hong. http://dx.doi.org/10.1109/mobilecloud.2018.00018 |chapterurl=缺少標題 (幫助). Device-Specific Linux Kernel Optimization for Android Smartphones. IEEE. March 2018: 65–72. ISBN 978-1-5386-4879-7. doi:10.1109/mobilecloud.2018.00018.

[:0-9] Kanonov, Uri; Wool, Avishai. http://dx.doi.org/10.1145/2994459.2994470 |chapterurl=缺少標題 (幫助). Secure Containers in Android. SPSM '16. New York, NY, USA: ACM. 2016-10-24: 3–12. ISBN 9781450345644. doi:10.1145/2994459.2994470.

[10] Tao, Chen, Yue Zhang, Yulong Wang, Zhi Wei. Downgrade Attack on TrustZone. 2017-07-17. OCLC 1106269801.

[:22-11] Garri, Khireddine; Kenaza, Tayeb; Aissani, Mohamed. http://dx.doi.org/10.1109/saconet.2018.8585583 |chapterurl=缺少標題 (幫助). A Novel approach for bootkit detection in Android Platform. IEEE. October 2018: 277–282. ISBN 978-1-5386-9493-0. doi:10.1109/saconet.2018.8585583.

[12] Tang, Qinghao. Internet of things security: principles and practice. Fan Du. Singapore. 2021: 166. ISBN 978-981-15-9942-2. OCLC 1236261208.

[:32-13] Hay, Roee. fastboot oem vuln: android bootloader vulnerabilities in vendor customizations. Proceedings of the 11th USENIX Conference on Offensive Technologies. WOOT'17 (Vancouver, BC, Canada: USENIX Association). 2017-08-14: 22.

[:02-14] Kanonov, Uri; Wool, Avishai. http://dx.doi.org/10.1145/2994459.2994470 |chapterurl=缺少標題 (幫助). Secure Containers in Android. SPSM '16. New York, NY, USA: ACM. 2016-10-24: 3–12. ISBN 9781450345644. doi:10.1145/2994459.2994470.

[15] Alendal, Gunnar; Dyrkolbotn, Geir Olav; Axelsson, Stefan. Forensics acquisition — Analysis and circumvention of samsung secure boot enforced common criteria mode. Digital Investigation. March 2018, 24: S60–S67. ISSN 1742-2876. doi:10.1016/j.diin.2018.01.008. hdl:11250/2723051 .

[16] Zhao, Longze; Xi, Bin; Wu, Shunxiang; Aizezi, Yasen; Ming, Daodong; Wang, Fulin; Yi, Chao. http://dx.doi.org/10.1145/3207677.3278046 |chapterurl=缺少標題 (幫助). Physical Mirror Extraction on Qualcomm-based Android Mobile Devices. Csae '18. New York, New York, USA: ACM Press. 2018: 1–5. ISBN 9781450365123. doi:10.1145/3207677.3278046.

[a]

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[11]

[12]

[13]

[14]

[15]

背景

歷史