内容整理自肉丝姐的安卓入门课
nexus 5x 刷机指北，其它手机类似

image.png image.png

环境搭建

首先下载肉丝姐提供的kali系统
https://github.com/r0ysue/AndroidSecurityStudy/blob/master/FART/kali-linux-2019-4-vmware-amd64-zip.torrent

账号：root
密码：toor

修改时区

dpkg-reconfigure tzdata

选择Asia→Shanghai

安装软件

apt install xfonts-intl-chinese
apt install ttf-wqy-microhei
apt install tmux jnettop

下载Android Studio

wget https://redirector.gvt1.com/edgedl/android/studio/ide-zips/4.0.1.0/android-studio-ide-193.6626763-linux.tar.gz

解压并运行，一路默认即可，不要设置代理，最后会下载一些依赖sdk等
要是下载的慢，可以用手机流量开热点下载

添加adb

vim ~/.bashrc

PATH=$PATH:/root/Android/Sdk/platform-tools

source ~/.bashrc

安卓镜像

wget https://dl.google.com/dl/android/aosp/bullhead-opm1.171019.011-factory-3be6fd1c.zip

7z x bullhead-opm1.171019.011-factory-3be6fd1c.zip

开始刷机

关机状态同时按住“音量减”和“电源”直到手机开机，进入 bootloader
确保 adb 和 fastboot 存在, 将手机连接到虚拟机内，把那个不在询问勾上，确保手机连接的是虚拟机而不是物理机，否则虚拟机可能会卡死

确保手机已解锁，未解锁输入 fastboot oem unlock 解锁,

root@kali:~/Downloads# cd bullhead-opm1.171019.011/
root@kali:~/Downloads/bullhead-opm1.171019.011# ls
bootloader-bullhead-bhz31a.img  flash-all.sh   image-bullhead-opm1.171019.011.zip
flash-all.bat                   flash-base.sh  radio-bullhead-m8994f-2.6.40.4.04.img
root@kali:~/Downloads/bullhead-opm1.171019.011# ./flash-all.sh 
Sending 'bootloader' (4620 KB)                     OKAY [  0.625s]
Writing 'bootloader'                               OKAY [  0.182s]
Finished. Total time: 0.849s
Rebooting into bootloader                          OKAY [  0.010s]
Finished. Total time: 0.061s
Sending 'radio' (56630 KB)                         OKAY [  6.872s]
Writing 'radio'                                    OKAY [  0.974s]
Finished. Total time: 7.889s
Rebooting into bootloader                          OKAY [  0.013s]
Finished. Total time: 0.068s
--------------------------------------------
Bootloader Version...: BHZ31a
Baseband Version.....: M8994F-2.6.40.4.04
Serial Number........: 0215f2aa23abaee8
--------------------------------------------
extracting android-info.txt (0 MB) to RAM...
Checking 'product'                                 OKAY [  0.018s]
Checking 'version-bootloader'                      OKAY [  0.020s]
Checking 'version-baseband'                        OKAY [  0.020s]
extracting boot.img (11 MB) to disk... took 0.029s
archive does not contain 'boot.sig'
Sending 'boot' (11785 KB)                          OKAY [  1.439s]
Writing 'boot'                                     OKAY [  0.204s]
archive does not contain 'dtbo.img'
archive does not contain 'dt.img'
extracting recovery.img (17 MB) to disk... took 0.036s
archive does not contain 'recovery.sig'
Sending 'recovery' (17429 KB)                      OKAY [  2.083s]
Writing 'recovery'                                 OKAY [  0.323s]
archive does not contain 'vbmeta.img'
archive does not contain 'vbmeta_system.img'
archive does not contain 'vendor_boot.img'
archive does not contain 'super_empty.img'
archive does not contain 'odm.img'
archive does not contain 'product.img'
extracting system.img (1909 MB) to disk... took 15.022s
archive does not contain 'system.sig'
Sending sparse 'system' 1/4 (512608 KB)            OKAY [ 63.256s]
Writing 'system'                                   OKAY [  9.505s]
Sending sparse 'system' 2/4 (523962 KB)            OKAY [ 62.638s]
Writing 'system'                                   OKAY [  9.653s]
Sending sparse 'system' 3/4 (494953 KB)            OKAY [ 60.435s]
Writing 'system'                                   OKAY [  9.762s]
Sending sparse 'system' 4/4 (423449 KB)            OKAY [ 50.828s]
Writing 'system'                                   OKAY [  7.702s]
archive does not contain 'system_ext.img'
extracting vendor.img (185 MB) to disk... took 1.232s
archive does not contain 'vendor.sig'
Sending 'vendor' (190300 KB)                       OKAY [ 22.550s]
Writing 'vendor'                                   OKAY [  3.885s]
archive does not contain 'vendor_dlkm.img'
Erasing 'userdata'                                 OKAY [  0.522s]
mke2fs 1.45.4 (23-Sep-2019)
Creating filesystem with 2874363 4k blocks and 719488 inodes
Filesystem UUID: 7ee79fef-b58e-48fb-95d0-2b7e5f13fa9c
Superblock backups stored on blocks: 
        32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208

Allocating group tables: done                            
Writing inode tables: done                            
Creating journal (16384 blocks): done
Writing superblocks and filesystem accounting information: done 

Sending 'userdata' (124 KB)                        OKAY [  0.111s]
Writing 'userdata'                                 OKAY [  0.018s]
Erasing 'cache'                                    OKAY [  0.082s]
mke2fs 1.45.4 (23-Sep-2019)
Creating filesystem with 24576 4k blocks and 24576 inodes

Allocating group tables: done                            
Writing inode tables: done                            
Creating journal (1024 blocks): done
Writing superblocks and filesystem accounting information: done

Sending 'cache' (44 KB)                            OKAY [  0.082s]
Writing 'cache'                                    OKAY [  0.014s]
Rebooting                                          OKAY [  0.020s]
Finished. Total time: 323.028s
root@kali:~/Downloads/bullhead-opm1.171019.011# 

刷完了之后手机会自动重启, 刷机已经完成

TWRP

在物理机上下载，然后拖到虚拟机里面
https://eu.dl.twrp.me/bullhead/twrp-3.3.1-0-bullhead.img

手机再次进入 bootloader 模式

root@kali:~/Downloads# ls -al
total 1937804
drwxr-xr-x  4 root root       4096 Aug 30 16:11 .
drwxr-xr-x 20 root root       4096 Aug 30 15:31 ..
drwxrwxr-x  7 root root       4096 Jun 29 18:40 android-studio
-rw-r--r--  1 root root  907569312 Jul 15 01:00 android-studio-ide-193.6626763-linux.tar.gz
drwxr-x---  2 root root       4096 Nov 28  2017 bullhead-opm1.171019.011
-rw-r--r--  1 root root 1059996441 Feb 19  2020 bullhead-opm1.171019.011-factory-3be6fd1c.zip
-rwxrw-rw-  1 root root   16713004 Aug 30 16:10 twrp-3.3.1-0-bullhead.img
root@kali:~/Downloads# adb reboot bootloader
root@kali:~/Downloads# fastboot flash recovery twrp-3.3.1-0-bullhead.img 
Sending 'recovery' (16321 KB)                      OKAY [  2.222s]
Writing 'recovery'                                 OKAY [  0.291s]
Finished. Total time: 2.559s
root@kali:~/Downloads# 

按两下音量减进入 recovery 模式
下面的划动条划到最右边显示所有的选项

Magisk

root@kali:~/Downloads# wget https://github.com/topjohnwu/Magisk/releases/download/v20.4/Magisk-v20.4.zip

root@kali:~/Downloads# ls
android-studio                               bullhead-opm1.171019.011-factory-3be6fd1c.zip
android-studio-ide-193.6626763-linux.tar.gz  Magisk-v20.4.zip
bullhead-opm1.171019.011                     twrp-3.3.1-0-bullhead.img
root@kali:~/Downloads# adb push Magisk-v20.4.zip /sdcard/
adb: error: failed to get feature set: no devices/emulators found
root@kali:~/Downloads# adb push Magisk-v20.4.zip /sdcard/
Magisk-v20.4.zip: 1 file pushed, 0 skipped. 1.2 MB/s (5942417 bytes in 4.825s)

frida-server

root@kali:~/Downloads# wget https://github.com/frida/frida/releases/download/12.11.11/frida-server-12.11.11-android-arm64.xz
root@kali:~/Downloads# 7z x frida-server-12.11.11-android-arm64.xz 
root@kali:~/Downloads# ls -al
total 1996216
drwxr-xr-x  4 root root       4096 Aug 30 16:43 .
drwxr-xr-x 20 root root       4096 Aug 30 16:41 ..
drwxrwxr-x  7 root root       4096 Jun 29 18:40 android-studio
-rw-r--r--  1 root root  907569312 Jul 15 01:00 android-studio-ide-193.6626763-linux.tar.gz
drwxr-x---  2 root root       4096 Nov 28  2017 bullhead-opm1.171019.011
-rw-r--r--  1 root root 1059996441 Feb 19  2020 bullhead-opm1.171019.011-factory-3be6fd1c.zip
-rw-r--r--  1 root root   41023080 Aug 26 02:29 frida-server-12.11.11-android-arm64
-rw-r--r--  1 root root   12843976 Aug 26 02:29 frida-server-12.11.11-android-arm64.xz
-rwxrw-rw-  1 root root    5942417 Aug 30 16:24 Magisk-v20.4.zip
-rwxrw-rw-  1 root root   16713004 Aug 30 16:10 twrp-3.3.1-0-bullhead.img
root@kali:~/Downloads# adb root
adbd is already running as root
root@kali:~/Downloads# adb push frida-server-12.11.11-android-arm64 /data/local/tmp/
frida-server-12.11.11-android-arm64: 1 file pu... skipped. 0.7 MB/s (41023080 bytes in 58.544s)
root@kali:~/Downloads# 

install

进入 bootloader, 进入 recovery 模式，
手机上点击 install， 找到 Magisk-v20.4.zip，
点击该文件，划到最右边安装，安装完成之后重启手机即可

完成

---

第二套

刷 Kali NetHunter

下载

wget https://images.kali.org/nethunter/nethunter-2020.3-bullhead-oreo-kalifs-full.zip
wget https://download.chainfire.eu/1220/SuperSU/SR5-SuperSU-v2.82-SR5-20171001224502.zip?retrieve_file=1

root@kali:~/Downloads# adb reboot bootloader
root@kali:~/Downloads# fastboot flash recovery twrp-3.3.1-0-bullhead.img
Sending 'recovery' (16321 KB)                      OKAY [  2.139s]
Writing 'recovery'                                 OKAY [  0.283s]
Finished. Total time: 2.465s
root@kali:~/Downloads# ls -al
total 3290304
drwxr-xr-x  4 root root       4096 Aug 30 17:51 .
drwxr-xr-x 20 root root       4096 Aug 30 16:41 ..
drwxrwxr-x  7 root root       4096 Jun 29 18:40 android-studio
-rw-r--r--  1 root root  907569312 Jul 15 01:00 android-studio-ide-193.6626763-linux.tar.gz
drwxr-x---  2 root root       4096 Nov 28  2017 bullhead-opm1.171019.011
-rw-r--r--  1 root root 1059996441 Feb 19  2020 bullhead-opm1.171019.011-factory-3be6fd1c.zip
-rw-r--r--  1 root root   41023080 Aug 26 02:29 frida-server-12.11.11-android-arm64
-rw-r--r--  1 root root   12843976 Aug 26 02:29 frida-server-12.11.11-android-arm64.xz
-rwxrw-rw-  1 root root    5942417 Aug 30 16:24 Magisk-v20.4.zip
-rwxrw-rw-  1 root root 1318256428 Aug 30 17:43 nethunter-2020.3-bullhead-oreo-kalifs-full.zip
-rw-r--r--  1 root root    6882992 Oct  2  2017 SR5-SuperSU-v2.82-SR5-20171001224502.zip
-rwxrw-rw-  1 root root   16713004 Aug 30 16:10 twrp-3.3.1-0-bullhead.img
root@kali:~/Downloads# adb push SR5-SuperSU-v2.82-SR5-20171001224502.zip /sdcard/SR5-SuperSU-v2.82-SR5-20171001224502.zip: 1 fil..., 0 skipped. 1.0 MB/s (6882992 bytes in 6.279s)
root@kali:~/Downloads# adb push nethunter-2020.3-bullhead-oreo-kalifs-full.zip /sdcard/
nethunter-2020.3-bullhead-oreo-kalifs-full.zip:...ipped. 0.7 MB/s (1318256428 bytes in 1883.874s)
root@kali:~/Downloads# 

install

进入 bootloader, 进入 recovery 模式，
手机上点击 install， 找到 需要安装的模块，
点击该文件，划到最右边安装，安装完成之后重启手机即可

完成