Условно Безопасные Смартфоны

D2

D2

Администратор
Регистрация
19 Фев 2025
Сообщения
4,380
Реакции
0
Введение

Какие устройства можно рассматривать как условно безопасные?
​
- Те устройства где можно после установки кастомной прошивки заблокировать bootloader.
- Где защищен стек, куча, память
- Где есть firewall с правилами для каждого процесса или приложения и
есть возможность запретить обращение к конкретному домену конкретному процессу
И так далее...


Спойлер: Как выглядит нормальный firewall
blocker_home.png

blocker_report.png

blocker_stream.png

blocker_map.png

blocker_lists.png

blocker_blocked.png

blocker_details_host.png

Спойлер: Список устройств
Google pixel 3-8
OnePlus 6, 6t
Razer phone 2

В хорошей прошивке у нас должен быть firewall, не такой о котором говорят представители GrapheneOS и другие, они нам говорят что нормальный firewall невозможно реализовать, где есть логирование (пример логирование соединений приложений в IOS)

Что мы можем со всем этим сделать?
Конечно же собрать свою прошивку на основе их и добавить все нужные функции!
Берем за основу DivestOS и iodeOS

Теперь нужно подготовить железо и окружение к сборке:
Спойлер: Характеристики сервера сборок
Код: Скопировать в буфер обмена
Код: 
For builds under 3 hours you'll want to have at least a powerful quad core processor, 32GB of RAM, and a 7200RPM drive.
For builds under an hour you'll want to have a processor that gets a score of 30k+ or higher on Passmark, 64GB of RAM, and a large SSD.
Note: CFI enabled kernels will fail to compile with less than 64GB of RAM.
It may be possible to get by with 16GB + zram, regardless zram is recommended in all cases.
If you plan on building in a virtual machine, in terms of performance: KVM > Hyper-V > VMWare > VirtualBox
You'll need a lot of available free space on your drives
- Source Code: 200GB + ~5GB per device
- ~100GB per device for building
- ~10GB per device for optional ccache
- ~4GB for each resulting build
- ~10GB for two target-files for a device to optionally generate incremental updates
- Cheap: ~$60 2TB 7200RPM HDD (non-SMR)
- Fast: ~$150 2TB SSD (MLC/"enterprise" preferred)
- If you plan on having multiple versions available btrfs+zstd:1+duperemove is strongly recommended.

Настройка окружения
Спойлер: Fedora
Bash: Скопировать в буфер обмена
Код: 
sudo dnf install @development-tools android-tools automake bc bison bzip2 bzip2-libs ccache curl dpkg-dev flex gcc gcc-c++ git git-lfs glibc-devel.{x86_64,i686} gnupg gperf ImageMagick ImageMagick-c++-devel ImageMagick-devel java-1.8.0-openjdk java-1.8.0-openjdk-devel libgcc.{x86_64,i686} libstdc++.{x86_64,i686} libX11-devel.{x86_64,i686} libxml2-devel libXrandr.{x86_64,i686} libXrender.{x86_64,i686} libxslt lz4-libs lzop make maven mesa-libGL-devel.{x86_64,i686} ncurses ncurses-compat-libs ncurses-devel.{x86_64,i686} ninja-build openssl-devel optipng jpegoptim perl perl-Digest-MD5-File perl-Switch pngcrush python python2 python3-virtualenv python3 python3-mako python-mako python-markdown python-networkx readline-devel.{x86_64,i686} rsync schedtool SDL squashfs-tools syslinux-devel unzip wxGTK xml2 xz-lzma-compat zip zlib zlib-devel.{x86_64,i686} vim-common vboot-utils mozilla-fira-mono-fonts mozilla-fira-sans-fonts openssl nano htop wget;

sudo curl https://storage.googleapis.com/git-repo-downloads/repo >> /usr/bin/repo;
sudo chmod a+x /usr/bin/repo;

umask 0022;
git config --global user.name "Tr3Kzzz";
git config --global user.email "Tr3Kzzz@protonmail.com";
#Clone
git clone https://codeberg.org/divested-mobile/divestos-build.git DivestOS;
cd DivestOS;

#Submodules
sed -i 's|git@gitlab.com:|https://gitlab.com/|' .git/config .gitmodules;
git submodule update --init --recursive;

#Basic directories
mkdir -p Build/LineageOS-20.0/.repo/local_manifests Builds Signing_Keys .Signing_Keys;

#Encrypted key storage
gocryptfs -init .Signing_Keys; #Create the vault
gocryptfs .Signing_Keys/ Signing_Keys/; #Mount the vault

#Update settings
nano Scripts/Generate_Signing_Keys.sh; #Update description
cd Build/LineageOS-20.0;

#Add the initial manifest
cat ../../Manifests/Manifest_LAOS-20.0.xml > .repo/local_manifests/local_manifest.xml;
nano .repo/local_manifests/local_manifest.xml;


Теперь нужно подробно рассмотреть пункт:

nano .repo/local_manifests/local_manifest.xml

Манифест содержит список ресурсов которые будут синхронизироваться из реп (деревья девайсов, разный софт и зависимости)
Чтобы не тащить лишние ресурсы давайте приведем его вот к такому виду:


Спойлер: local_manifest.xml
XML: Скопировать в буфер обмена
Код: 
<?xml version="1.0" encoding="UTF-8"?>
<manifest>

    <remote name="gitlab" fetch="https://gitlab.com/" />
    <remote name="angry" fetch="https://gitea.angry.im/" />
    <remote name="iode" fetch="https://gitlab.com/iode/os/public" revision="v4.10" />

<!-- START OF UNNECESSARY REPO REMOVAL -->
    <remove-project name="LineageOS/android_external_ant-wireless_ant_native" />
    <remove-project name="LineageOS/android_external_ant-wireless_ant_service" />
    <remove-project name="LineageOS/android_external_bash" />
    <remove-project name="LineageOS/android_external_htop" />
    <remove-project name="LineageOS/android_external_libncurses" />
    <remove-project name="LineageOS/android_external_nano" />
    <remove-project name="LineageOS/android_external_openssh" />
    <remove-project name="LineageOS/android_external_rsync" />
    <remove-project name="LineageOS/android_external_unrar" />
    <remove-project name="LineageOS/android_external_vim" />
    <remove-project name="LineageOS/android_packages_apps_Eleven" />
    <remove-project name="LineageOS/android_packages_apps_Jelly" />
    <!--<remove-project name="LineageOS/android_packages_apps_Stk" />-->
    <remove-project name="LineageOS/charter" />
    <remove-project name="LineageOS/cm_crowdin" />
    <remove-project name="LineageOS/contributors-cloud-generator" />
    <remove-project name="LineageOS/hudson" />
    <remove-project name="LineageOS/lineage_wiki" />
    <remove-project name="LineageOS/mirror" />
    <remove-project name="LineageOS/www" />
    <remove-project name="platform/packages/apps/Browser2" />
    <remove-project name="platform/packages/apps/Music" />
    <remove-project name="platform/packages/apps/MusicFX" />
    <remove-project name="platform/packages/apps/QuickSearchBox" />
    <remove-project name="platform/packages/apps/SampleLocationAttribution" />
    <!--<remove-project name="platform/packages/modules/AdServices" />-->
    <remove-project name="platform/prebuilts/clang/host/darwin-x86" />
    <remove-project name="platform/prebuilts/go/darwin-x86" />
<!-- END OF UNNECESSARY REPO REMOVAL -->

<!-- START OF BRANCH SWITCHING -->
    <!--<remove-project name="platform/external/swiftshader" />
    <project path="external/swiftshader" name="google/swiftshader" remote="github" revision="master" />-->

    <!-- Switch to the Mulch WebView -->
    <remove-project name="LineageOS/android_external_chromium-webview_patches" />
    <remove-project name="LineageOS/android_external_chromium-webview_prebuilt_arm" />
    <remove-project name="LineageOS/android_external_chromium-webview_prebuilt_arm64" />
    <remove-project name="LineageOS/android_external_chromium-webview_prebuilt_x86" />
    <remove-project name="LineageOS/android_external_chromium-webview_prebuilt_x86_64" />
    <project path="external/chromium-webview" name="divested-mobile/mulch" groups="pdk" clone-depth="1" remote="gitlab" revision="master" />
<!-- END OF BRANCH SWITCHING -->

<!-- START OF ADDITIONAL REPOS -->
    <!-- GrapheneOS -->
    <project path="external/hardened_malloc" name="GrapheneOS/hardened_malloc" remote="github" revision="8d5c63122499169df5fd9ed6e91fb116512a4745" />

    <!-- OpenEUICC -->
    <project path="packages/apps/OpenEUICC" name="PeterCxy/OpenEUICC" remote="angry" revision="6add8c89ac141f177cd8d124a0a955232f4222f9" />
    <project path="prebuilts/openeuicc-deps" name="PeterCxy/android_prebuilts_openeuicc-deps" remote="angry" revision="55f3e2c7ab26484f7478b26540fa14392d0c2cd7" />
<!-- END OF ADDITIONAL REPOS -->

<!-- START OF DEVICE REPOS -->
    <!-- Common -->
    <project path="system/qcom" name="LineageOS/android_system_qcom" remote="github" revision="lineage-20" />
    <project path="external/bson" name="LineageOS/android_external_bson" remote="github" revision="lineage-20" />
    <project path="hardware/sony/macaddrsetup" name="LineageOS/android_hardware_sony_macaddrsetup" remote="github" revision="lineage-20" />
    <project path="hardware/sony/simdetect" name="LineageOS/android_hardware_sony_simdetect" remote="github" revision="lineage-20" />
    <project path="hardware/sony/SonyOpenTelephony" name="LineageOS/android_hardware_sony_SonyOpenTelephony" remote="github" revision="lineage-20" />
    <project path="hardware/sony/timekeep" remote="github" name="LineageOS/android_hardware_sony_timekeep" revision="lineage-20" />
    <project path="packages/apps/ElmyraService" name="LineageOS/android_packages_apps_ElmyraService" remote="github" />

    <!-- Google Pixel 3 (crosshatch/blueline) -->
    <project path="device/google/crosshatch" name="LineageOS/android_device_google_crosshatch" remote="github" revision="lineage-20" />
    <project path="device/google/blueline" name="LineageOS/android_device_google_blueline" remote="github" revision="lineage-20" />
    <project path="kernel/google/msm-4.9" name="LineageOS/android_kernel_google_msm-4.9" remote="github" revision="lineage-20" />

    <!-- Google Pixel 3a (bonito/sargo) -->
    <project path="device/google/bonito" name="LineageOS/android_device_google_bonito" remote="github" revision="lineage-20" />
    <project path="device/google/sargo" name="LineageOS/android_device_google_sargo" remote="github" revision="lineage-20" />
    <!-- uses google/msm-4.9 kernel -->

    <!-- Google Pixel 4 (coral/flame) -->
    <project path="device/google/coral" name="LineageOS/android_device_google_coral" remote="github" revision="lineage-20" />
    <project path="device/google/flame" name="LineageOS/android_device_google_flame" remote="github" revision="lineage-20" />
    <project path="kernel/google/msm-4.14" name="LineageOS/android_kernel_google_msm-4.14" remote="github" revision="lineage-20" />

    <!-- Google Pixel 4a (sunfish) -->
    <project path="device/google/sunfish" name="LineageOS/android_device_google_sunfish" remote="github" revision="lineage-20" />
    <!-- uses google/msm-4.14 kernel -->

    <!-- Google Pixel 4a 5G (bramble) -->
    <project path="device/google/bramble" name="LineageOS/android_device_google_bramble" remote="github" revision="lineage-20" />
    <project path="device/google/redbull" name="LineageOS/android_device_google_redbull" remote="github" revision="lineage-20" />
    <project path="kernel/google/redbull" name="LineageOS/android_kernel_google_redbull" remote="github" revision="lineage-20" />

    <!-- Google Pixel 5 (redfin) -->
    <project path="device/google/redfin" name="LineageOS/android_device_google_redfin" remote="github" revision="lineage-20" />
    <!-- uses redbull commons -->

    <!-- Google Pixel 5a (barbet) -->
    <project path="device/google/barbet" name="LineageOS/android_device_google_barbet" remote="github" revision="lineage-20" />
    <!-- uses redbull commons -->

    <!-- Google Pixel 6 (oriole/raven) -->
    <project path="device/google/oriole" name="LineageOS/android_device_google_oriole" remote="github" revision="lineage-20" />
    <project path="device/google/raven" name="LineageOS/android_device_google_raven" remote="github" revision="lineage-20" />
    <project path="device/google/raviole" name="LineageOS/android_device_google_raviole" remote="github" revision="lineage-20" />
    <project path="device/google/gs101" name="LineageOS/android_device_google_gs101" remote="github" revision="lineage-20" />
    <project path="kernel/google/gs101/private/gs-google" name="LineageOS/android_kernel_google_gs101" remote="github" revision="lineage-20" />

    <!-- Google Pixel 6a (bluejay) -->
    <project path="device/google/bluejay" name="LineageOS/android_device_google_bluejay" remote="github" revision="lineage-20" />
    <!-- uses gs101 commons -->

    <!-- Google Pixel 7 (panther/cheetah) -->
    <project path="device/google/panther" name="LineageOS/android_device_google_panther" remote="github" revision="lineage-20" />
    <project path="device/google/cheetah" name="LineageOS/android_device_google_cheetah" remote="github" revision="lineage-20" />
    <project path="device/google/pantah" name="LineageOS/android_device_google_pantah" remote="github" revision="lineage-20" />
    <project path="device/google/gs201" name="LineageOS/android_device_google_gs201" remote="github" revision="lineage-20" />
    <project path="kernel/google/gs201/private/gs-google" name="LineageOS/android_kernel_google_gs201" remote="github" revision="lineage-20" />
    <!-- uses gs101 commons -->

    <!-- OnePlus 6 (enchilada) -->
    <project path="hardware/oneplus" name="LineageOS/android_hardware_oneplus" remote="github" revision="lineage-20" />
    <project path="device/oneplus/sdm845-common" name="LineageOS/android_device_oneplus_sdm845-common" remote="github" revision="lineage-20" />
    <project path="device/oneplus/enchilada" name="LineageOS/android_device_oneplus_enchilada" remote="github" revision="lineage-20" />
    <project path="kernel/oneplus/sdm845" name="LineageOS/android_kernel_oneplus_sdm845" remote="github" revision="lineage-20" />

    <!-- OnePlus 6T (fajita) -->
    <project path="device/oneplus/fajita" name="LineageOS/android_device_oneplus_fajita" remote="github" revision="lineage-20" />

    <!-- Razer Phone 2 (aura) -->
    <project path="device/razer/aura" name="LineageOS/android_device_razer_aura" remote="github" revision="lineage-20" />
    <project path="kernel/razer/sdm845" name="LineageOS/android_kernel_razer_sdm845" remote="github" revision="lineage-20" />


        <!-- Proprietary Blobs -->
    <project path="vendor/google/barbet" name="LineageOS/proprietary_vendor_google_barbet" remote="github" revision="lineage-20" />
    <project path="vendor/google/bluejay" name="LineageOS/proprietary_vendor_google_bluejay" remote="gitlab" revision="lineage-20" />
    <project path="vendor/google/blueline" name="LineageOS/proprietary_vendor_google_blueline" remote="github" revision="lineage-20" />
    <project path="vendor/google/bonito" name="LineageOS/proprietary_vendor_google_bonito" remote="github" revision="lineage-20" />
    <project path="vendor/google/bramble" name="LineageOS/proprietary_vendor_google_bramble" remote="github" revision="lineage-20" />
    <project path="vendor/google/cheetah" name="LineageOS/proprietary_vendor_google_cheetah" remote="gitlab" revision="lineage-20" />
    <project path="vendor/google/coral" name="LineageOS/proprietary_vendor_google_coral" remote="github" revision="lineage-20" />
    <project path="vendor/google/crosshatch" name="LineageOS/proprietary_vendor_google_crosshatch" remote="github" revision="lineage-20" />
    <project path="vendor/google/flame" name="LineageOS/proprietary_vendor_google_flame" remote="github" revision="lineage-20" />
    <project path="vendor/google/oriole" name="LineageOS/proprietary_vendor_google_oriole" remote="gitlab" revision="lineage-20" />
    <project path="vendor/google/panther" name="LineageOS/proprietary_vendor_google_panther" remote="gitlab" revision="lineage-20" />
    <project path="vendor/google/raven" name="LineageOS/proprietary_vendor_google_raven" remote="gitlab" revision="lineage-20" />
    <project path="vendor/google/redfin" name="LineageOS/proprietary_vendor_google_redfin" remote="github" revision="lineage-20" />
    <project path="vendor/google/sargo" name="LineageOS/proprietary_vendor_google_sargo" remote="github" revision="lineage-20" />
    <project path="vendor/google/sunfish" name="LineageOS/proprietary_vendor_google_sunfish" remote="github" revision="lineage-20" />

    <project path="vendor/oneplus/enchilada" name="LineageOS/proprietary_vendor_oneplus_enchilada" remote="github" revision="lineage-20" />
    <project path="vendor/oneplus/fajita" name="LineageOS/proprietary_vendor_oneplus_fajita" remote="github" revision="lineage-20" />
    <project path="vendor/oneplus/sdm845-common" name="LineageOS/proprietary_vendor_oneplus_sdm845-common" remote="github" revision="lineage-20" />

    <project path="vendor/razer/aura" name="LineageOS/proprietary_vendor_razer_aura" remote="github" revision="lineage-20" />
  
        <!-- IODE-EXTRA (Firewall) -->[/CENTER]
  <project path="packages/modules/NetworkStack" name="lineage/packages_modules_NetworkStack" groups="pdk-cw-fs,pdk-fs" remote="iode" />
  <project path="packages/modules/Permission" name="lineage/packages_modules_Permission" groups="pdk-cw-fs,pdk-fs" remote="iode" />


[CENTER]    <project path="system/sepolicy" name="lineage/system_sepolicy" groups="pdk" remote="iode" />

    <project path="packages/apps/FDroidPrivilegedExtension" name="lineage/packages_apps_FDroidPrivilegedExtension" remote="iode" />
    <project path="vendor/extra" name="lineage/vendor_extra" remote="iode" />

    <project path="system/iode-snort" name="blocker/iode-snort" remote="iode" />
    <project path="external/libnetfilter_conntrack" name="blocker/external_libnetfilter_conntrack" remote="iode" />
    <project path="external/libnetfilter_queue" name="blocker/external_libnetfilter_queue" remote="iode" />
    <project path="external/libnfnetlink" name="blocker/external_libnfnetlink" remote="iode" />
    <project path="external/libmnl" name="blocker/external_libmnl" remote="iode" />

</manifest>

Далее нам нужно произвести синхронизацию
Спойлер: Синхронизация
Наберитесь терпения процесс не быстрый
Bash: Скопировать в буфер обмена
Код: 
#Download!
repo init -u https://github.com/LineageOS/android.git -b lineage-20.0 --git-lfs;
repo sync -j1;

После синхронизации нужно отредактировать папку vendor/iode
Спойлер: vendor_extra
Bash: Скопировать в буфер обмена
Код: 
rm -rf ./bootanimation
rm -rf ./etc
rm -rf ./overlay
rm -rf ./prebuilts/!(iode)
rm -rf ./product-overlay
rm -rf ./translations

Спойлер: product.mk
Makefile: Скопировать в буфер обмена
Код: 
ifneq ($(wildcard certs/releasekey.*),)
PRODUCT_DEFAULT_DEV_CERTIFICATE := certs/releasekey
PRODUCT_OTA_PUBLIC_CERTIFICATES := certs/releasekey
endif

ifneq ($(wildcard certs/sideload.*),)
PRODUCT_EXTRA_RECOVERY_CERTIFICATES := certs/sideload
endif

PRODUCT_BROKEN_VERIFY_USES_LIBRARIES := true


PRODUCT_PACKAGES += \
    iode-snort \
    domains-black \
    domains-white \
    default-apps

PRODUCT_PACKAGES += \
    Iode

PRODUCT_HOST_PACKAGES += \
    host_cross_fastboot \
    host_cross_mke2fs \
    make_f2fs.static \
    host_cross_make_f2fs.static


Далее снова переходим к инициализации окружения
Спойлер
Bash: Скопировать в буфер обмена
Код: 
source ../../Scripts/init.sh;
awk -i inplace '!/enforce-product-packages-exist-internal/' vendor/lineage/config/common.mk;
source build/envsetup.sh && breakfast lineage_sailfish-user && make -j20 generate_verity_key; #Edit device if not available, can be any
sh ../../Scripts/Generate_Signing_Keys.sh $device; #Repeat as needed for other devices
mv -nv $DOS_SIGNING_KEYS/NEW/* "$DOS_SIGNING_KEYS/"; #Move the new keys into place
Спойлер: CCACHE
Bash: Скопировать в буфер обмена
Код: 
mkdir /opt/ccache; # Укажите  свой путь
echo "export USE_CCACHE=1;" >> ~/.bashrc;
echo "export CCACHE_COMPRESS=1;" >> ~/.bashrc;
echo "export CCACHE_COMPRESSLEVEL=1;" >> ~/.bashrc;
echo "export CCACHE_EXEC=/usr/bin/ccache;" >> ~/.bashrc;
echo "export CCACHE_DIR=/opt/ccache;" >> ~/.bashrc; #Укажите  свой путь из первой строки
source ~/.bashrc;
ccache -M 128GB; #Укажите лимит


Приступаем к сборке
Спойлер
Bash: Скопировать в буфер обмена
Код: 
cd Build/LineageOS-20.0;
source ../../Scripts/init.sh;
resetWorkspace;
rm -rf packages/apps/Fennec_DOS-Shim/ vendor/divested/ vendor/fdroid_prebuilt/ packages/apps/SupportDivestOS/; #Remove remenants
rm -rf out;
patchWorkspace;

buildDevice [DEVICE NAME]; #buildDevice fajita как пример

echo $DOS_BUILDS # тут появятся прошиви если всё сделано правильно

Если всё сделано правильно прошивки появятся в папке $DOS_BUILDS
На этом всё!

ЗЫ:
Если вам нужна подобная инфраструктура для своих девайсов, или более изощренная, где не используются vds и сервис доставки обновлений не торчит жопой в интернет, а обновления рассылаются по средствам p2p из-за nat через tox или как то иначе, вы знаете к кому обращаться.
Если и этого мало и хочется противостоять imsicatcher'am, fakeBaseStation, silentsms и триангуляции по средствам предоставления вам возможности подключения к 1 базовой станции а не к 3 через удобный интерфейс в виде карты с точками, милости прошу в торговую тему.
Так же могу сделать так чтобы ваш телефон не сможет загружался без специального стика и помимо FBE будет FDE.

Разработка программно-аппаратных комплексов

Донаты сюда:
Monero -> 47XLGe6UvUGjcFpckozPhKggU4N11Ux6WEA5hSqjZQHeJoCQ9MDgRvnfu3HFwHbm7y2nyp5Sgu4XXgEzjFYawi285cEscia
BTC -> bc1qqqr2k32my2qhuz5s3dr3nnczgl3mkcr0k38gac​
 
Войдите или зарегистрируйтесь для ответа.
Сверху Снизу