Skip to content


Folders and files

Last commit message
Last commit date

Latest commit



47 Commits

Repository files navigation

Build Charm from Source

Copyright (c) 2016-2018 University of California, Irvine. All rights reserved.

Authors: Seyed Mohammadjavad Seyed Talebi and Hamid Tavakoli, UC Irvine; Hang Zhang and Zheng Zhang, UC Riverside; Ardalan Amiri Sani, UC Irvine; Zhiyun Qian, UC Riverside

This document is shared under the GNU Free Documentation License WITHOUT ANY WARRANTY. See for details.

Charm facilitates dynamic analysis of device drivers of mobile systems. This document is a toturial to build Charm on Linux.

Please refer to our paper for technical details: USENIX paper


It is strongly recommended to backup your system before proceeding.


You need to access to a linux machine with at least 4GB of RAM and 200GB storage.


The instruction has been tested on a linux server with ubuntu 16.4. you need to install the build essentials for each project prior to build them.

Charm organizaiton

Charm system consists of five main components:

  • Phone OS (Lineage OS Android for Bullhead)
  • Android emulator
  • Host OS (Ubuntu)
  • Syzkaller
  • VM OS (AOSP Android for goldfish)

In following section we show how to build these components from source. **Note: Please use our exact Naming convention for files and directories. ** first make a directory for Charm project and cd to it.

mkdir Charm && cd Charm

then make a directory for each component of Charm.

mkdir bullhead_lineage
mkdir goldfish_AOSP
mkdir Android_emulator
mkdir Host_Ubuntu
mkdir Syzkaller

build Phone OS

You can skip build process and download a built image from here or you may build from the source as following:

Download source code

Follow the documention for building Lineage OS (version cm-14.1) for bullhead, from here. Note: you need to change these two lines of the documentation:

~~cd ~/android/lineage repo init -u -b lineage-15.1~~
Instead use:

cd Charm/bullhead_lineage
repo init -u -b cm-14.1

Note: It might take a few hours to finish.
Note: Repo needs "python" to run. Python is not installed by default in recent distributions of Ubuntu. install python using: $ sudo apt install python-minimal

Apply changes

Considering you are in Charm/bullhead_lineage/ directory, In order to apply our changes, perform following steps:

cd kernel/lge/bullhead
git remote add charm_origin
git fetch charm_origin
git checkout -b Charm charm_origin/Charm

go back to Charm/bullhead_lineage/, then:

cd system/core
git remote add charm_origin
git fetch charm_origin
git checkout -b Charm charm_origin/Charm

go back to Charm/bullhead_lineage/, then:

cd frameworks/native
git remote add charm_origin
git fetch charm_origin
git checkout -b Charm charm_origin/Charm


To build the system go back to Charm/bullhead_lineage/, and run:

 source ./build/
 brunch lineage_bullhead-eng

Note: You might need to run export LANG=C prior bruch command if you are using newer ubuntu distributions for building.

Install on the Phone

After build proccess finshes you need to Install the Android on your phone. Connect your Nexus5x Phone to your system and run:

adb reboot recovery

In recovery menu please select adb-sideload. Assuming you are in Charm/bullhead_lineage/you can reach the OUT directory where all built images are, using:

cd out/target/product/bullhead 

You can find the LineageOS installer package under the name lineage-14.1-[DATE] (in which [DATE] is replaced with date of your build). To install the package on your phone:

adb sideload  lineage-14.1-[DATE]

Lineage OS 14-1 for bullhead is compatible with n2g47f vendor image, you might need to update your phone's vendor image if it has a different image. You can find n2g47f images here. It is recommanded to update radio and bootloader images to n2g47f as well.

build Android emulator

Download source code

downlaod the source for android emulator from Google. Assume you are in Charm/ directory:

cd Android_emulator
repo init -u -b emu-2.4-release
repo sync

Apply changes

then you need to apply Charm changes to the QEMU.

cd external/qemu
git remote add charm_origin 
git fetch charm_origin
git checkout -b Charm charm_origin/Charm


in order to build the emulator:


Note: the expected output should look like this:

Configuring build.
Building sources.
Checking for 'emulator' launcher program.
Checking that 'emulator' is a 64-bit program.
Running 64-bit unit test suite.
   - android_emu64_unittests
   - emugl64_common_host_unittests
   - emulator64_libui_unittests
   - emulator64_crashreport_unittests
   - lib64OpenglRender_unittests
   - lib64GLcommon_unittests
Running emugen_unittests.
Running emugen regression test suite.
Running test suite.
ERROR: Unit test failures:  android_emu64_unittests

build Host OS

Download source code

download the operating systme for the host.

cd Host_Ubuntu
git clone -b Charm


First you need to install the prerequisites:

sudo apt install gawk debhelper libudev-dev pciutils-dev libelf-dev autoconf libtool

Then build the ubuntu using build script.

cd charm_host_kernel

Note: It might take a few hours to finish.

after instalation finishes go back one directory to Charm/Host_Ubuntu/ to install the built Ubuntu on your system:

sudo dpkg -i linux-*4.10.0-28.32*.deb

Update the Grub

You need to ubdate the Grub and reboot your machine and boot the new Ubuntu.

build VM OS

Download source code

download the operating systme for the Charm's VM.

cd goldfish_AOSP
git clone -b charm_goldfish_camera


first you need to install prerequisites. install device tree compiler using

sudo apt install device-tree-compiler

Then you need to get the gcc compiler for building the android as following:

cd ~/Charm/goldfish_AOSP
mkdir compiler
cd compiler
git clone

Then to build the kernel

cd ~/Charm/goldfish_AOSP/charm_emulator_kernel

Then you need to download the ramdisk.img, system.img, encryptionkey.img, and the userdata.img and save them in ~/Charm/goldfish_AOSP/ folder.

Run Charm emulator

First you need to make an Android Virtual Device(AVD) to run the emulator.

Make an AVD

To make an AVD you need to download and install the latest Android Studio first.
Then open Android Studio, enter 'Cntrl+Shift+a' to open search menu, then type AVD manager and open AVD manager.
Select Nexus5x in AVD manager. AVD1 In the next step you need to check for the Nougat android and an ABI suitable for your machine. AVD2 In the next step name your AVD Nexus_5x_Charm and set both camera options to None. AVD3

Run Charm emulator using scripts

first you need to download the scripts to run Charm emulator.

cd ~/Charm/
git clone

Then you need to update the scripts using your phone device ID. you can find your phone device ID using:

adb devices

to update the script with your device ID:

cd ~/Charm/charm/scripts

then edit the DEVICE_ID and run the


No description, website, or topics provided.






No releases published


No packages published