MTK 10.0获取root权限（验证可行）

MTK 10.0获取root权限
最近做项目遇到的一个需求，以为和之前的版本差不多，结果差别比较大，在此记录一下。具体的修改补丁会在文章最后给出，文章只给出一些关键部分。

一. 先将seLinux关闭

--- a/system/core/init/selinux.cpp
+++ b/system/core/init/selinux.cpp
@@ -97,6 +97,12 @@ EnforcingStatus StatusFromCmdline() {
 }
 
 bool IsEnforcing() {
+       //add by  for root
+       #if 1
+       return false;
+       #endif
+       //end
+       
     if (ALLOW_PERMISSIVE_SELINUX) {
         return StatusFromCmdline() == SELINUX_ENFORCING;
     }

二. 其次是检查su是否参与编译

--- a/device/mediateksample/tb8768tp1_64_bsp/device.mk
+++ b/device/mediateksample/tb8768tp1_64_bsp/device.mk
@@ -172,3 +172,9 @@ PRODUCT_PACKAGES += FotaOverlay
 endif
 #adupsfota end
 
+##add by for root
+#ifeq ($(strip $(HX_VENDOR_ROOT)), yes)
+       PRODUCT_PACKAGES += su
+#endif
+##end
+

加入后在out下搜索是否有编译出文件名“su.o”文件，有则说明su参加编译

三. 进程名称在 AS Logcat 中显示，修改属性o.adb.secure 和 ro.debuggable

--- a/build/make/core/main.mk
+++ b/build/make/core/main.mk
@@ -299,6 +299,13 @@ ifneq (,$(user_variant))
   ADDITIONAL_DEFAULT_PROPERTIES += ro.secure=1
   ADDITIONAL_DEFAULT_PROPERTIES += security.perf_harden=1
 
+  ##add by for root 
+  ifeq ($(strip $(HX_VENDOR_ROOT)),yes)
+    ADDITIONAL_DEFAULT_PROPERTIES += ro.adb.secure=0
+    ADDITIONAL_DEFAULT_PROPERTIES += ro.debuggable=1
+  endif
+  ##end
+  
   ifeq ($(user_variant),user)
     ADDITIONAL_DEFAULT_PROPERTIES += ro.adb.secure=1
   endif

四. 初始化修改

--- a/frameworks/base/core/jni/com_android_internal_os_Zygote.cpp
+++ b/frameworks/base/core/jni/com_android_internal_os_Zygote.cpp
@@ -548,6 +548,8 @@ static void EnableKeepCapabilities(fail_fn_t fail_fn) {
 }
 
 static void DropCapabilitiesBoundingSet(fail_fn_t fail_fn) {
+  //add by for root
+  /*
   for (int i = 0; prctl(PR_CAPBSET_READ, i, 0, 0, 0) >= 0; i++) {;
     if (prctl(PR_CAPBSET_DROP, i, 0, 0, 0) == -1) {
       if (errno == EINVAL) {
@@ -558,6 +560,8 @@ static void DropCapabilitiesBoundingSet(fail_fn_t fail_fn) {
       }
     }
   }
+  */
+  //end
 }
 
 static void SetInheritable(uint64_t inheritable, fail_fn_t fail_fn) {

五. 修改system下的相关修改（部分）

--- a/system/core/adb/Android.bp
+++ b/system/core/adb/Android.bp
@@ -25,7 +25,9 @@ cc_defaults {
         "-Wthread-safety",
         "-Wvla",
         "-DADB_HOST=1",         // overridden by adbd_defaults
-        "-DALLOW_ADBD_ROOT=0",  // overridden by adbd_defaults
+        "-DALLOW_ADBD_ROOT=1",  // overridden by adbd_defaults
+               "-DALLOW_ADBD_DISABLE_VERITY=1",
+               "-DALLOW_ADBD_NO_AUTH=1",
     ],
     cpp_std: "experimental",
 
@@ -82,8 +84,8 @@ cc_defaults {
             cflags: [
                 "-UALLOW_ADBD_ROOT",
                 "-DALLOW_ADBD_ROOT=1",
-                "-DALLOW_ADBD_DISABLE_VERITY",
-                "-DALLOW_ADBD_NO_AUTH",
+                "-DALLOW_ADBD_DISABLE_VERITY=1",
+                "-DALLOW_ADBD_NO_AUTH=1",
             ],
         },
     },
@@ -404,13 +406,13 @@ cc_library {
         "liblog",
     ],
 
-    product_variables: {
-        debuggable: {
+    //product_variables: {
+    //    debuggable: {
             required: [
                 "remount",
             ],
-        },
-    },
+    //    },
+    //},
 
     target: {
         android: {

--- a/system/core/adb/daemon/main.cpp
+++ b/system/core/adb/daemon/main.cpp
@@ -72,6 +72,12 @@ static bool should_drop_capabilities_bounding_set() {
 }
 
 static bool should_drop_privileges() {
+       //add by  for root
+       #if 1
+       return false;
+       #endif
+       //end add by for root
+
     // "adb root" not allowed, always drop privileges.
     if (!ALLOW_ADBD_ROOT && !is_device_unlocked()) return true;
 

--- a/system/core/fs_mgr/Android.bp
+++ b/system/core/fs_mgr/Android.bp
@@ -76,7 +76,8 @@ cc_library {
         "libfstab",
     ],
     cppflags: [
-        "-DALLOW_ADBD_DISABLE_VERITY=0",
+        "-DALLOW_ADBD_DISABLE_VERITY=1",
+               "-DALLOW_SKIP_SECURE_CHECK=1"
     ],
     product_variables: {
         debuggable: {
@@ -133,7 +134,7 @@ cc_binary {
         "fs_mgr_remount.cpp",
     ],
     cppflags: [
-        "-DALLOW_ADBD_DISABLE_VERITY=0",
+        "-DALLOW_ADBD_DISABLE_VERITY=1",
     ],
     product_variables: {
         debuggable: {

--- a/system/core/libcutils/fs_config.cpp
+++ b/system/core/libcutils/fs_config.cpp
@@ -197,7 +197,7 @@ static const struct fs_path_config android_files[] = {
     // the following two files are INTENTIONALLY set-uid, but they
     // are NOT included on user builds.
     { 06755, AID_ROOT,      AID_ROOT,      0, "system/xbin/procmem" },
-    { 04750, AID_ROOT,      AID_SHELL,     0, "system/xbin/su" },
+    { 06755, AID_ROOT,      AID_SHELL,     0, "system/xbin/su" },
 
     // the following files have enhanced capabilities and ARE included
     // in user builds.
@@ -219,6 +219,7 @@ static const struct fs_path_config android_files[] = {
     { 00750, AID_ROOT,      AID_SHELL,     0, "init*" },
     { 00755, AID_ROOT,      AID_SHELL,     0, "product/bin/*" },
     { 00750, AID_ROOT,      AID_SHELL,     0, "sbin/*" },
+       { 06755, AID_ROOT,      AID_ROOT,     0, "system/xbin/su" },
     { 00755, AID_ROOT,      AID_SHELL,     0, "system/bin/*" },
     { 00755, AID_ROOT,      AID_SHELL,     0, "system/xbin/*" },
     { 00755, AID_ROOT,      AID_SHELL,     0, "system/apex/*/bin/*" },

--- a/system/core/rootdir/init.rc
+++ b/system/core/rootdir/init.rc
@@ -12,6 +12,10 @@ import /init.usb.configfs.rc
 import /init.${ro.zygote}.rc
 
 # Cgroups are mounted right before early-init using list from /etc/cgroups.json
+
+# add for  start
+import /init.cdfinger.rc
+# add for end
 on early-init
     # Disable sysrq from keyboard
     write /proc/sys/kernel/sysrq 0
@@ -803,6 +807,11 @@ on property:vold.decrypt=trigger_shutdown_framework
 
 on property:sys.boot_completed=1
     bootchart stop
+    
+#add by for root
+start remount
+#end
+    
     # Setup per_boot directory so other .rc could start to use it on boot_completed
     exec - system system -- /bin/rm -rf /data/per_boot
     mkdir /data/per_boot 0700 system system
@@ -858,3 +867,14 @@ on property:ro.debuggable=1
 service flash_recovery /system/bin/install-recovery.sh
     class main
     oneshot
+#add by for root 
+
+
+
+service remount /system/bin/remount
+       class core
+       oneshot
+    disabled
+    user root
+    group root
+#add end

六.具体补丁
MTK 10.0获取root权限补丁连接
添加链接描述
https://download.csdn.net/download/juzi_bug/15111967
验证root的APK，安装后打开点击右上角“CHECK”, Root Access显示pass access 为通过
添加链接描述
https://download.csdn.net/download/juzi_bug/15111974