Title
#core
Nico

Nico

06/04/2021, 6:07 AM
Hello everyone, Perhaps it could be the right place to ask my questions, even if it deals with an aarch64 issue. I know that several persons already asked about running osquery on Android, and that so far, it has not been planned at all. But still, I want to understand why it is so complicated. Android is based on a linux kernel, but the big difference between GNU/Linux and Android, is that GNU/Linux uses GNU-libC, and Android uses BIONIC. BIONIC is a libC but very light and less complete regarding POSIX standard. For example, pthread_cancel() is not supported by BIONIC. There are other differences, like the communications between processus that could be different to (BINDER for Android). But let's try this : compile a simple helloworld.cpp for a linux/aarch64 machine with static option, the binary will print helloworld on an Android device (after adjusting the permissions). I know this example is too light, but what if we add specific flags (static options) when calling CMake, or modify the CMakelist.txt to make it work? Another way to do it, and perhaps the best way, is to use ndk plateform (android platform developpement for c/c++ code). It has all the tools to generate a binary that can run on Android. The big problem is the CMake configuration which is very different. So what do you think? Is it possible to adjust the tools to make osquery running on Android? Or it is necessary to start from the beginning? And if we would have to start from the beginning, where should we begin? I also know that specific tables for Android will be needed but this is not my point here. I just want to run Osquery on Android.
1:45 PM
Good news : static compilation of osquery provides a binary that actually runs on a Android devices in my case (if the compilation has been done on a aarch64/linux). When the binary runs on Android, it opens a shell, that allows to make request. The request select * FROM uptime; returns a good answser for instance. The requests on sudoers table and shadow table return nothing. But it is totally normal because Android does not provide these files