1. 如果已经获得了root shell
adb shell mount -o remount,rw /system
adb push su /system/xbin/su
adb shell chown 0.0 /system/xbin/su
adb shell chmod 06755 /system/xbin/su
adb shell mount -o remount,ro /system
adb install Superuser.apk
adb push su /system/xbin/su
adb shell chown 0.0 /system/xbin/su
adb shell chmod 06755 /system/xbin/su
adb shell mount -o remount,ro /system
adb install Superuser.apk
2. 定制恢复镜像写入恢复分区
首先要知道恢复分区的位置
system@mx4:/dev/block/platform/mtk-msdc.0/by-name $ ls -l
ls -l
lrwxrwxrwx root root 2015-04-22 10:06 boot -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 2015-04-22 10:06 cache -> /dev/block/mmcblk0p15
lrwxrwxrwx root root 2015-04-22 10:06 custom -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 2015-04-22 10:06 expdb -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 2015-04-22 10:06 flashinfo -> /dev/block/mmcblk0p17
lrwxrwxrwx root root 2015-04-22 10:06 lk -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 2015-04-22 10:06 logo -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 2015-04-22 10:06 nvram -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 2015-04-22 10:06 para -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 2015-04-22 10:06 proinfo -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 2015-04-22 10:06 protect1 -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 2015-04-22 10:06 protect2 -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 2015-04-22 10:06 recovery -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 2015-04-22 10:06 seccfg -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 2015-04-22 10:06 secro -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 2015-04-22 10:06 system -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 2015-04-22 10:06 userdata -> /dev/block/mmcblk0p16
知道了恢复分区在mmcblk0p8处之后,我们可以用dd命令将一个定制化的恢复镜像写入恢复分区
adb shell push custom-recovery.img /sdcard/
adb shell dd if=/sdcard/custom-recovery.img of=/dev/block/mmcblk0p8
adb shell dd if=/sdcard/custom-recovery.img of=/dev/block/mmcblk0p8
写入完毕之后,我们需要重启设备,进入定制恢复模式,应用su更新包。
adb reboot recovery