https://github.com/osquery/osquery logo
Title
n

Nico

06/24/2021, 7:51 AM
Hello everyone! I've updated my issue about android here : https://github.com/osquery/osquery/issues/7144#issue-913346308. Feel free to correct what seems to be wrong. I know that my post is a bit long. To sum up: if we want to use Osquery as an app (service or deamon) on Android, it is needed first to compile with the Android NDK (cross-compilation). And one of the biggest issues is that NDK (BIONIC) does not support the pthread_cancel function of gnu-libc. There is a function that BIONIC proposes as replacement (pthread_cleanup_push), but the arguments are differents, so I'm not sure whether it is possible. Thus, right now, the solution that seems to work fine, is to compile from a Linux-arm machine with static option to provide a binary that will run as a deamon in the system layer (will not run in the Java Android layer). I know that it is not functionnal for the user and it could not be a real portage solution, but it works (osqueryi and osqueryd) with some restrictions that I try to enumerate. The next step for me is to make some tables for Android. From now on, I can't go on with the NDK compilation (unless you can help me with this)