Building and Running the Linux Kernel Using Qemu: In a Nutshell

xb@dnxb:~$ sudo apt update
# Install the necessary packages for building the Linux kernel:
xb@dnxb:~$ sudo apt-get install build-essential libncurses5-dev bison flex libssl-dev libelf-dev
# libvirt-bin is now split into libvirt-daemon-system and libvirt-clients.
xb@dnxb:~$ sudo apt install qemu-kvm qemu virt-manager virt-viewer libvirt-daemon-system libvirt-clients 

# To resolve the error "pahole (pahole) is not available" while making the kernel.
xb@dnxb:~$ sudo apt install dwarves
# Test in Ubuntu, not using Linux source at github
xb@dnxb:~$ sudo apt install linux-source
# After the installation, the source is typically located in `/usr/src/`
xb@dnxb:~$ cd /usr/src/
# You'll need to modify the subsequent commands "...5.4.0..." based on the latest version.
xb@dnxb:/usr/src$ cd linux-source-5.4.0 
xb@dnxb:/usr/src/linux-source-5.4.0$ cp linux-source-5.4.0.tar.bz2 ~/Downloads/
xb@dnxb:/usr/src/linux-source-5.4.0$ cd ~/Downloads/

# OR use `pv linux-source-5.4.0.tar.bz2 | tar -xjf-` to monitor the extraction progress.
xb@dnxb:~/Downloads$ tar xjf linux-source-5.4.0.tar.bz2 
# ... If you use Nautilus for extraction, you need to copy it from /usr/src/ to a regular user path before extracting.
# ... However, when using Nautilus, you might need to eliminate any redundant directories that were created by mistake. Eliminate them early, as changes in directory timestamps seem to slow down the remaking process.
# e.g. xb@dnxb:~/Downloads/redundant_folder/linux-source-5.4.0$ 

# To fix `No rule to make target 'debian/canonical-certs.pem', needed by 'certs/x509_certificate_list'.  Stop.` when make kernel from Ubuntu because the .config file contains "debian/" certs:
xb@dnxb:~/Downloads/linux-source-5.4.0$ cp -r /usr/src/linux-source-5.4.0/debian ./
xb@dnxb:~/Downloads/linux-source-5.4.0$ cp -r /usr/src/linux-source-5.4.0/debian.master ./

# As an initial modification trial, add "hello world" after `pr_notice("%s", linux_banner);`:
xb@dnxb:~/Downloads/linux-source-5.4.0$ grep -i hello init/main.c -C 2
        page_address_init();
        pr_notice("%s", linux_banner);
        pr_notice("Hello, World! from the Kernel by hole\n");
        early_security_init();
        setup_arch(&command_line);
xb@dnxb:~/Downloads/linux-source-5.4.0$ 

# ARCH=x86_64 is optional, while the default ARCH=x86 lets you toggle off the 64-bit kernel in the menu.
# Just click <Exit> then [Save]. If re-edit main.c to add print, no need run this:
xb@dnxb:~/Downloads/linux-source-5.4.0$ make menuconfig ARCH=x86_64 
xb@dnxb:~/Downloads/linux-source-5.4.0$ make -j$(nproc) ARCH=x86_64
# If you re-edit main.c to add a print, you don't need to run `make modules`, just `make -j$(nproc) ARCH=x86_64 && make bzImage -j$(nproc) ARCH=x86_64`
# "Section mismatch" warnings can be safely ignored.
# Can type '?' to see details if seeing "[N/m/y/?] (NEW) ?", simply "y"
xb@dnxb:~/Downloads/linux-source-5.4.0$ make modules -j$(nproc) ARCH=x86_64
xb@dnxb:~/Downloads/linux-source-5.4.0$ make bzImage -j$(nproc) ARCH=x86_64

# Despite the ARCH=x86_64 setting, the kernel image path is ./arch/x86/boot/bzImage. 
# The reason is the unified source code for x86 and x86_64 in the Linux kernel. 
# x86 covering both x86 & x86_64 through scripts/subarch.include and .config .
# The x86_64 path is simply a symbolic link to x86.
# Use the x86 path to qemu as it's the real location for the kernel image.
xb@dnxb:~/Downloads/linux-source-5.4.0$ file ./arch/x86_64/boot/bzImage
./arch/x86_64/boot/bzImage: symbolic link to ../../x86/boot/bzImage
xb@dnxb:~/Downloads/linux-source-5.4.0$ realpath ./arch/x86/boot/bzImage
/home/xiaobai/Downloads/linux-source-5.4.0/arch/x86/boot/bzImage
xb@dnxb:~/Downloads/linux-source-5.4.0$ 

# Create an Initramfs:
# For a simple test, you can create a very basic initramfs that only has a /init script. Here's an example:
# replace 'hole' with your preferred directory name
xb@dnxb:~/Downloads/linux-source-5.4.0$ mkdir hole; cd hole/ 
xb@dnxb:~/Downloads/linux-source-5.4.0/hole$ mkdir -p myinitramfs
xb@dnxb:~/Downloads/linux-source-5.4.0/hole$ cd myinitramfs/
xb@dnxb:~/Downloads/linux-source-5.4.0/hole/myinitramfs$ mkdir -p bin sbin etc tmp proc sys usr/bin usr/sbin
xb@dnxb:~/Downloads/linux-source-5.4.0/hole/myinitramfs$ echo -e '#!/bin/sh\nmount -t proc none /proc\nmount -t sysfs none /sys\nexec /bin/sh' > init
xb@dnxb:~/Downloads/linux-source-5.4.0/hole/myinitramfs$ chmod +x init
xb@dnxb:~/Downloads/linux-source-5.4.0/hole/myinitramfs$ cd ..

# You can visit https://busybox.net/downloads/ to get the latest version. You'll need to modify the subsequent commands "...1.36.1..." based on the latest version:
xb@dnxb:~/Downloads/linux-source-5.4.0/hole$ wget https://busybox.net/downloads/busybox-1.36.1.tar.bz2
xb@dnxb:~/Downloads/linux-source-5.4.0/hole$ tar xjf busybox-1.36.1.tar.bz2
xb@dnxb:~/Downloads/linux-source-5.4.0/hole$ cd busybox-1.36.1/
# Load the default configuration:
xb@dnxb:~/Downloads/linux-source-5.4.0/hole/busybox-1.36.1$ make defconfig
# "Settings" -> "Build Options" -> "Build static binary (no shared libs)" and press 'Y' otherwise will get "Kernel panic - not syncing: No working init found." after boot kernel.
xb@dnxb:~/Downloads/linux-source-5.4.0/hole/busybox-1.36.1$ make menuconfig
xb@dnxb:~/Downloads/linux-source-5.4.0/hole/busybox-1.36.1$ make -j$(nproc)

# Now, create the initramfs archive. CPIO is the preferred method because it effectively duplicates a file system, backs it up, and preserves unique file features like hardlinks and FIFOs:
xb@dnxb:~/Downloads/linux-source-5.4.0/hole/busybox-1.36.1$ cd ../myinitramfs
# Use BusyBox as the shell program for initramfs:
xb@dnxb:~/Downloads/linux-source-5.4.0/hole/myinitramfs$ cp ../busybox-1.36.1/busybox bin/
xb@dnxb:~/Downloads/linux-source-5.4.0/hole/myinitramfs$ cd bin/
xb@dnxb:~/Downloads/linux-source-5.4.0/hole/myinitramfs/bin$ ln -s busybox sh
xb@dnxb:~/Downloads/linux-source-5.4.0/hole/myinitramfs/bin$ ln -s busybox mount
xb@dnxb:~/Downloads/linux-source-5.4.0/hole/myinitramfs/bin$ cd ..
xb@dnxb:~/Downloads/linux-source-5.4.0/hole/myinitramfs$ find . | cpio -H newc -o | gzip > ../myinitramfs.cpio.gz
xb@dnxb:~/Downloads/linux-source-5.4.0/hole/myinitramfs$ cd ../..

# Boot the kernel with qemu. You might need to press Enter to access the shell. To exit, use "Ctrl+a", release it, then press "x". If there's an issue, use killall qemu-system-x86_64.
# append "panic=10" will reboot 10 seconds after kernel panic
xb@dnxb:~/Downloads/linux-source-5.4.0$ qemu-system-x86_64 -kernel /home/xiaobai/Downloads/linux-source-5.4.0/arch/x86/boot/bzImage -initrd /home/xiaobai/Downloads/linux-source-5.4.0/myinitramfs.cpio.gz -append "console=ttyS0 earlyprintk=serial,ttyS0,115200 debug" -nographic 
...

Is TikTok listening to my conversation?

My friend invited me to lunch and mentioned the word "cafe", but I didn't go.

After 4 hours, I noticed a post related to cafes in my Facebook news feed:

This post isn't very popular and I haven't heard the word "Cafe" for a long time, I can't even recall the last time. So I realized this post is not a coincidence, not again (something I type in ChatGPT also shows similar ads, either OpenAI or my keyboard is selling my data, as expected~).

So I quickly dumped adb logcat, hoping the relevant logs hadn't disappeared yet. Fortunately, it did retain the 05-16 19:39:17.603 log from the previous night:



The next thing I found is quite intriguing:

Chat bot 不是这样用的 - Celcom

How do scammers obtain TAC by calling your phone

Thought experiment. 😶

How do scammers obtain TAC by calling your phone.

1. A camera in a store, bank, or landlord caught you typing a password, phishing, or an 0 day exploit such as StrandHogg 2.0 (https://promon.co/resources/downloads/strandhogg-2-0-new-serious-android-vulnerability/, https://www.xda-developers.com/strandhogg-2-0-android-vulnerability-explained-developer-mitigation/).

2. The attacker calls you.

3. You pick up the phone and answer it. 

4. The attacker records your voice.

5. The attacker converts your voice to an inaudible form of Hey Google/Siri pattern (Dolphin Attack, https://dl.acm.org/doi/pdf/10.1145/3133956.3134052, https://www.securityweek.com/siri-alexa-google-now-vulnerable-ultrasound-attacks, https://www.helpnetsecurity.com/2020/03/03/ultrasonic-waves-access-cellphones/).

6. The attacker puts or delivers an ultrasound device near you. 

7. Now your phone is triggered to run commands by asking Hey Google or Siri in ultrasound. You don't realise it because humans can't hear ultrasound. See the demonstration video, get TAC by voice (I may use typing since my speaking is bad).  It has not been tested for ultrasound. The commands used: "Silent" -> "Dim the screen" -> "Open SMS app" -> "Send screenshot to 0133743923" -> "Please send" -> "Send".

How to open tiktok leaked(scraped?) db

Facebook custom list feed is not really gone

 I thought that custom list feed gone long time ago:

But actually you can still access custom list news feed with this URL format (x.facebook OR m.facebook both can work):

知乎 - "我们检测到您此次登录异常，请您进行安全验证" 的 bug

近两天知乎的每新打开一页都会出现 "我们检测到您此次登录异常，请您进行安全验证" 对话框。(截图注: www2 只是测试， www 一样):

输入手机验证，对话框关闭，但打开新一页或点击 "查看全部 xxx 答案" 都会重复出现该验证对话框。不验证直接 X 关闭对话框也行，不过重复出现很烦。

后来察觉专栏 zhuanlan.zhihu.com 没对话框，就想到换其它 subdomain 可能可以。

MySejahtera hotspot center locator

代码: https://github.com/limkokhole/MySejahtera

中文和英文双字幕观看 YouTube 视频

我英文差， 但是又不能只看中文(讲话的人是英文，失去原味)，所以打算双字幕观看。英文字幕在 mpv 播放器下方，看到不懂的字可以望上面的中文字幕。

虽然此视频  IlU-zDU6aQ0 网页版有英文字幕以及自动翻译的中文字幕，可是旧版本的 youtube-dl 和随便两个网站 (https://downsub.com 和 https://savesubs.com) 都只能拿到英文字幕。



虽然最新版本的  youtube-dl 已经 fix 了，无论如何，要手动完成此任务，也行的：

1. 下载英文字幕 (.vtt): youtube --skip-download --write-sub --sub-lang en https://www.youtube.com/watch?v=IlU-zDU6aQ0 。

2. 在 Youtube 播放器, 变改语言边 inspect network, 得到 `api/timedtext?` 链接。

用 curl 跑链接获得 .json 格式的字幕。

3.  转换 .json 去 .srt 不需要重造轮子，浏览 https://zhuanlan.zhihu.com/p/337934938 下载某人写的 node.js 代码， `parse_subtitle.js`, 加上这三条 line:

Trace python program from log perspective

刚回答了用 -vvv debug pip：


Just a reminder to whom google this error and come here.

Let's say I get this error:

$ python3 example.py
Traceback (most recent call last):
  File "example.py", line 7, in <module>
    import aalib
ModuleNotFoundError: No module named 'aalib'

Since it mentions aalib, I was thought to try aalib:

How to play Facebook Quiz

第一种方法在重复 submit 能发出多个 messenger notification 给该朋友我玩了你的 game，而第二种方法没 notification。不过两种方法都有在 game 内置的 notification。

列出美国所有 ip 的方法

 

视频用 N 倍速看对 fps 的影响

如果播放视频时加速，对 fps 有何影响？如何预测会 dropped 多少 frames？

mpv 确实可以 speed up 后如果仍可以满足 monitor 的 refresh rate Hz 就可以不 drop frames。

不过 165 Hz 要求 gpu+cpu 很高否则也是有问题(不然 multitasking 容易 drop frame)。

而且 144 Hz 或 120 Hz 都能被常见的 24 fps 完整除 (120 Hz 能被 youtube 常见的 30 fps 除)

，只有 165 Hz 怪怪的不能整除 (https://www.svp-team.com/forum/viewtopic.php?pid=63214#p63214)。



做个小实验验证一下：

MySejahtera bug

MySejahtera 的隐私 bug，可以查看其它店的人流， 甚至更新资料。

有些非 Master branch 而看不到更新资料的页面，能通过 email 得知 `Hi contact_name`(有些填手机号)。

由于 bug 会被滥用，我就不公开方法了。(更新: 已被修复)

MySejahtera 没网络 check-in

 实验：

MySejahtera app 在没网络下，扫描二维码后， 政府还能不能收到该 check-in？

 

实验结果：

 

每次点击 "close" 按钮后的十秒， 都会调用 js 的 checkAndSync() 函数， 检查 checkInQue 数据库表之前有没有失败的请求 queue，有的话就（等多一秒）一个个调用 syncCheckIn() 函数尝试 "/clockin" API 终点请求上传。"Clear storage" 会清除该 queue，"Clear Cache" 则不会。

 

实验总结：

 

请确保点击 "close" 按钮后的十一秒后有网络，才能上传之前没网络的 check-in 给政府。即使你扫描新的二维码， 是不会包括之前没网络所累积的 check-in， 必须点击 "close" 按钮等十一秒。十一秒是开始上传的时间，上传全部需时十一秒以上。

 

Facebook 鏈接對下載質量的影響

用 youtube-dl 和 you-get 下載 4 種視頻鏈接格式:
[1] 'https://www.facebook.com/<username>/videos/123/'
[2] 'https://www.facebook.com/<username>/posts/123'
[3] 'https://www.facebook.com/permalink.php?story_fbid=123&id=123'
[4] 'https://www.facebook.com/watch/?v=123'
[5] 手動下載。

實驗結果:

怎样才能在 Facebook 上传下载最高清的图实验。

Android 上传 4 MiB (4032x3024) 的文件, PXL_20201022_141809183.NIGHT.jpg:
[1] 浏览器能下载 241 KiB (1440x1080) 的 JPEG 图。
[2] Android Facebook app 能下载 114 KiB (1080x810) 的 JPEG 图。

浏览器上传同样的 PXL_20201022_141809183.NIGHT.jpg:
[1] 浏览器能下载 509 KiB (2016x1504) 的 JPEG 图。
[2] Android Facebook app 能下载 109 KiB (1080x806) 的 JPEG 图。

实验总结：

bash -c "$pitfall"

If user use bash -c "" will easy to get unexpected result if user just copy-paste working code from existing shell session into bash -c "" (OR extend existing bash -c "") and expect it same. But if user use single quotes(outermost) consistently, then user can get rid a lot of trouble.

Facebook 新设计的 bug

如果群组组员的主页 URL 是没用户名 (譬如 https://www.facebook.com/zuck 格式) 而只有 id (譬如 https://www.facebook.com/profile.php?id=12345 格式)

，那么群组的组员页面的 "View Main Profile" 按钮是 link 去 www.facebook.com 而不是该用户的主页。需要去网址栏删除 groups/<组id>/user/ 再浏览。

如果你只有 id 那么就可以减少 (当然, 不可能完全避免) 组里 stalker 们 stalk 你主页， 反之如果你是搞宣传的且希望在组里引流去你的 profile， 则劝你放个用户名。

我转换去新设计后早就注意到这个 bug 很久了(很明显好不)，只是到现在都没去 fix 囧， fb 的员工懒到囧 😆。

万恶的 baidu

百度百度， baiduyunguanjia 协议打开网盘程序可以理解，可是你乱入 text/html (点击html 文件得经过网盘程序) 是计划通想干嘛 🎃 

汝即非 html 浏览器，亦非 html 编辑器， 想干嘛？想干嘛？ 🎃

v2ex 有人调侃 Linux 版网盘先来个硬盘扫描似乎并非调侃 🌚

【2021 更新】
skype 也有类似的情况, lolr share 你毛， 我不喜欢 share 东西囧

Google Pixel 4a 超坑人的 alarm bug

我就奇怪做么 alarm ⏰ 常没声音，原来 slider 的 alarm volume bar 要超过一半才等于 clock alarm 的第一个 volume，wth  🥶🥶🥶🤖🎃🥃


Media volume 1/3 的声音就够了，所以 Alarm volume 也跟着调 1/3， 没想到是个大坑：

与上图 slider 相应的 volume， 在 clock app 的设置是 mute 囧：

 

来个全景经典画面， 左（slider 设置）1/3, 右 (clock app 设置) 是 mute， 两者名字都称 "Alarm volume" 囧， 应该坑了不少人， 不说了我迟到了 🌚：