知识储备
1、恢复出厂接口调用
从系统设置中重置页面入手，很容易找到
packages/apps/Settings/src/com/android/settings/MasterClearConfirm.java
其实就是发送 ACTION_FACTORY_RESET 广播，通知 framework 进行重置,所以我们的工具也可以调用
private void doMasterClear() {
Intent intent = new Intent(Intent.ACTION_FACTORY_RESET);
intent.setPackage("android");
intent.addFlags(Intent.FLAG_RECEIVER_FOREGROUND);
intent.putExtra(Intent.EXTRA_REASON, "MasterClearConfirm");
intent.putExtra(Intent.EXTRA_WIPE_EXTERNAL_STORAGE, mEraseSdCard);
intent.putExtra(Intent.EXTRA_WIPE_ESIMS, mEraseEsims);
getActivity().sendBroadcast(intent);
// Intent handling is asynchronous -- assume it will happen soon.
}
2、nvram 区域累加次数
由于需要记录实际恢复出厂的次数，所以首选 nvram 存储，回复出厂将清除一切用户数据。
关于 nvram 存储，你可以新加节点或者使用现有节点都行，这里我就偷懒了使用 PRODUCT_INFO 节点存储。
新增节点的方法可参考这篇
上代码
1、在 packages/app/ 下新建 RecoverTool 目录， 增加 Android.mk, 引入 nvram 读写 jar 包
LOCAL_PATH := $(call my-dir)
include $(CLEAR_VARS)
LOCAL_STATIC_JAVA_LIBRARIES += vendor.mediatek.hardware.nvram-V1.0-java
LOCAL_MODULE_TAGS := optional
LOCAL_SRC_FILES := $(call all-subdir-java-files)
LOCAL_PACKAGE_NAME := RecoverTool
LOCAL_PRIVATE_PLATFORM_APIS := true
LOCAL_CERTIFICATE := platform
#LOCAL_SDK_VERSION := current
include $(BUILD_PACKAGE)
2、新建 AndroidManifest.xml,增加恢复出厂权限
<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="com.android.qrdc"
android:sharedUserId="android.uid.system">
<uses-permission android:name="android.permission.MASTER_CLEAR" />
<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
<application android:label="@string/app_name" >
<activity android:name=".NVActivity"
android:label="@string/app_name">
<intent-filter>
<action android:name="android.intent.action.MAIN" />
<category android:name="android.intent.category.LAUNCHER" />
</intent-filter>
</activity>
<receiver android:name="com.android.qrdc.MyStateReceiver">
<intent-filter android:priority="1000">
<action android:name="android.intent.action.BOOT_COMPLETED" />
</intent-filter>
</receiver>
</application>
</manifest>
3、在 src/com/android/qrdc 目录下新增 NVActivity.java
一开始在收到开机广播后，然后去读取 nvram 中保存值，发现一直异常，无法成功读取。
从报错的log来看大致是有两个进程同时操作 nvram 对应 binder，后来加了延时去读取发现依旧是一样的问题。
后来又想的办法是，收到开机广播后台拉起 NVActivity，在界面中延迟读取写入，这条路可行。
正好这样拉起界面来也能显示当前记录的次数。
package com.android.qrdc;
import android.app.Activity;
import android.os.Bundle;
import android.util.Log;
import android.view.View;
import android.widget.EditText;
import android.widget.TextView;
import android.text.TextUtils;
import android.content.Intent;
import java.util.ArrayList;
import java.util.Arrays;
import android.os.Handler;
import android.os.Looper;
import vendor.mediatek.hardware.nvram.V1_0.INvram;
import com.android.internal.util.HexDump;
public class NVActivity extends Activity {
private static final String TAG = "NVActivity";
private TextView tv_result,tv_resetcount;
private EditText cmdEt,regEt,idPath;
private static int ADDRESS_OFFSET = 0;
private static void log(String msg) {
Log.e("NVActivity", msg);
}
@Override
protected void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
setContentView(R.layout.nv_layout);
tv_result = findViewById(R.id.tv_result);
tv_resetcount = findViewById(R.id.tv_resetcount);
cmdEt = findViewById(R.id.cmdEt);
regEt = findViewById(R.id.regEt);
idPath = findViewById(R.id.idPath);
//tv_resetcount.setText("current reset count="+ readData());
new Handler(Looper.getMainLooper()).postDelayed(new Runnable() {
@Override
public void run() {
// doReadNV();
autoDoReset();
}
}, 3000);
}
private void doMasterClear() {
Intent intent = new Intent(Intent.ACTION_FACTORY_RESET);
intent.setPackage("android");
intent.addFlags(Intent.FLAG_RECEIVER_FOREGROUND);
intent.putExtra(Intent.EXTRA_REASON, "NVActivity");
intent.putExtra(Intent.EXTRA_WIPE_EXTERNAL_STORAGE, false);
intent.putExtra(Intent.EXTRA_WIPE_ESIMS, false);
sendBroadcast(intent);
// Intent handling is asynchronous -- assume it will happen soon.
}
public void doReset(View v) {
log("doReset click");
int nvCount = readData();
writeData(++nvCount);
doMasterClear();
}
private void autoDoReset(){
ADDRESS_OFFSET = Integer.parseInt(regEt.getText().toString());
String newIdPath = idPath.getText().toString();
if (!TextUtils.isEmpty(newIdPath)) {
PRODUCT_INFO_FILENAME = newIdPath;
}
int nvCount = readData();
tv_resetcount.setText("current reset count="+ nvCount);
writeData(++nvCount);
doMasterClear();
}
public void readNv(View v) {
log("readNv click");
ADDRESS_OFFSET = Integer.parseInt(regEt.getText().toString());
String newIdPath = idPath.getText().toString();
if (!TextUtils.isEmpty(newIdPath)) {
PRODUCT_INFO_FILENAME = newIdPath;
}
tv_result.setText("read result="+ readData());
}
public void writeNv(View v) {
String cmd = cmdEt.getText().toString();
ADDRESS_OFFSET = Integer.parseInt(regEt.getText().toString());
log("writeNv click -----" + cmd);
String newIdPath = idPath.getText().toString();
if (!TextUtils.isEmpty(newIdPath)) {
PRODUCT_INFO_FILENAME = newIdPath;
}
writeData(Integer.parseInt(cmd));
}
@Override
protected void onDestroy() {
super.onDestroy();
}
public static String PRODUCT_INFO_FILENAME = "/mnt/vendor/nvdata/APCFG/APRDEB/PRODUCT_INFO";
private static void writeData(int n) {
byte[] write_buff = new byte[]{0, 0, 0, 0};
byte[] by = getBytes(n);
for (int i = 0; i < 4; i++) {
write_buff[i] = by[i];
}
try {
INvram agent = INvram.getService();
if (agent != null) {
ArrayList<Byte> dataArray = new ArrayList<>(4);
for (byte b : write_buff) {
dataArray.add(new Byte(b));
}
int ret_1 = agent.writeFileByNamevec(PRODUCT_INFO_FILENAME, ADDRESS_OFFSET, dataArray);
if (ret_1>0){
log("write success"+ ret_1);
}else {
log("write failed"+ ret_1);
}
} else {
Log.e(TAG, "writeData: agent null");
}
} catch (Exception e) {
Log.e(TAG, "writeData exception:" + e.getLocalizedMessage());
e.printStackTrace();
}
}
private static byte[] getBytes(int data) {
byte[] bytes = new byte[4];
bytes[0] = (byte) (data & 0xff);
bytes[1] = (byte) ((data & 0xff00) >> 8);
bytes[2] = (byte) ((data & 0xff0000) >> 16);
bytes[3] = (byte) ((data & 0xff000000) >> 24);
return bytes;
}
public static int readData() {
int targets = 0;
try {
String buff = null;
INvram agent = INvram.getService();
Log.i(TAG, "readData from PRODUCT_INFO_FILENAME");
if (agent != null) {
buff = agent.readFileByName(PRODUCT_INFO_FILENAME, ADDRESS_OFFSET);//10
}
byte[] buffArr = HexDump.hexStringToByteArray(buff.substring(0, buff.length() - 1));
targets = (buffArr[0] & 0xff) | ((buffArr[1] << 8) & 0xff00) | ((buffArr[2] << 24) >>> 8) | (buffArr[3] << 24);
Log.i(TAG, "readData: buffArr=" + Arrays.toString(buffArr) + ", targets == " + targets);
} catch (Exception e) {
Log.e(TAG, "readData exception:" + e.getLocalizedMessage());
e.printStackTrace();
}
return targets;
}
}
4、增加对应的布局文件 nv_layout.xml
<?xml version="1.0" encoding="utf-8"?>
<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
android:layout_width="match_parent"
android:layout_height="match_parent"
android:layout_marginTop="20dp"
android:orientation="vertical">
<TextView
android:layout_width="wrap_content"
android:layout_height="wrap_content"
android:gravity="top|center_horizontal"
android:textSize="22sp"
android:text="pwd " />
<EditText
android:id="@+id/regEt"
android:layout_width="150dp"
android:layout_height="wrap_content"
android:text="100" />
<EditText
android:id="@+id/idPath"
android:layout_width="wrap_content"
android:layout_height="wrap_content"
android:text="/mnt/vendor/nvdata/APCFG/APRDEB/PRODUCT_INFO" />
<LinearLayout
android:layout_width="match_parent"
android:layout_height="wrap_content"
android:orientation="horizontal">
<EditText
android:id="@+id/cmdEt"
android:layout_width="0dp"
android:layout_height="wrap_content"
android:layout_weight="1"
android:text="10" />
<Button
android:id="@+id/write"
android:layout_width="0dp"
android:layout_height="wrap_content"
android:layout_gravity="center"
android:layout_weight="1"
android:onClick="writeNv"
android:text="writeNv" />
<Button
android:id="@+id/read"
android:layout_width="0dp"
android:layout_height="wrap_content"
android:layout_gravity="center"
android:layout_weight="1"
android:onClick="readNv"
android:text="readNv" />
<Button
android:id="@+id/reset"
android:layout_width="0dp"
android:layout_height="wrap_content"
android:layout_gravity="center"
android:layout_weight="1"
android:onClick="doReset"
android:text="reset" />
</LinearLayout>
<TextView
android:id="@+id/tv_result"
android:layout_width="wrap_content"
android:layout_height="wrap_content"
android:textSize="30sp"
android:text="this is test text"/>
<TextView
android:id="@+id/tv_resetcount"
android:layout_width="wrap_content"
android:layout_height="wrap_content"
android:textSize="30sp"
android:text="current reset count="/>
</LinearLayout>
5、增加 MyStateReceiver 监听开机广播 BOOT_COMPLETED
package com.android.qrdc;
import android.content.BroadcastReceiver;
import android.content.Context;
import android.content.Intent;
import android.util.Log;
import android.content.Intent;
import java.util.ArrayList;
import java.util.Arrays;
import android.os.Handler;
import android.os.Looper;
public class MyStateReceiver extends BroadcastReceiver {
private static String TAG = "MyStateReceiver";
public int nvCount;
@Override
public void onReceive(final Context context, Intent intent) {
String action = intent.getAction();
Log.d(TAG, action);
if (action.equals("android.intent.action.BOOT_COMPLETED")) {
new Handler(Looper.getMainLooper()).postDelayed(new Runnable() {
@Override
public void run() {
/*nvCount = readData();
Log.d(TAG, "read done");*/
Intent ffintent = new Intent(context, NVActivity.class);
ffintent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
context.startActivity(ffintent);
}
}, 1000*5);
}
}
}
6、androidQ 新特性禁止后台拉起 Activity，增加当前app包名白名单
frameworks\base\services\core\java\com\android\server\wm\ActivityStarter.java
boolean shouldAbortBackgroundActivityStart(int callingUid, int callingPid,
final String callingPackage, int realCallingUid, int realCallingPid,
WindowProcessController callerApp, PendingIntentRecord originatingPendingIntent,
boolean allowBackgroundActivityStart, Intent intent) {
// don't abort for the most important UIDs
final int callingAppId = UserHandle.getAppId(callingUid);
if (callingUid == Process.ROOT_UID || callingAppId == Process.SYSTEM_UID
|| callingAppId == Process.NFC_UID) {
return false;
}
...
//cczheng add for custom app can backgroundstartActivity S
if("com.android.qrdc".equals(callingPackage)){
Slog.w(TAG, "Background activity start for CustomMadeApp ,ignored");
return false;
}
//E
// don't abort if the callingUid is the device owner
if (mService.isDeviceOwner(callingUid)) {
return false;
}
....
7、编译搞起还需要解决的 selinux 权限问题
device/mediatek/sepolicy/basic/non_plat/nvram_agent_binder.te
#cczheng add
allow nvram_agent_binder proc_cmdline:file { read open getattr };
allow nvram_agent_binder sysfs_dt_firmware_android:dir { search };
allow nvram_agent_binder sysfs_dt_firmware_android:file { read };
device/mediatek/sepolicy/basic/non_plat/platform_app.te
#cczheng add
allow platform_app nvram_agent_binder_hwservice:hwservice_manager { find };
allow platform_app nvram_agent_binder:binder { call };
device/mediatek/sepolicy/basic/non_plat/untrusted_app.te
#cczheng add
allow untrusted_app nvram_agent_binder:binder { call };
allow untrusted_app nvram_agent_binder_hwservice:hwservice_manager { find };
system/sepolicy/prebuilts/api/29.0/private/app_neverallows.te
system/sepolicy/private/app_neverallows.te
-full_treble_only(`
- neverallow all_untrusted_apps {
- halserverdomain
- -coredomain
- -hal_cas_server
- -hal_codec2_server
- -hal_configstore_server
- -hal_graphics_allocator_server
- -hal_neuralnetworks_server
- -hal_omx_server
- -binder_in_vendor_violators # TODO(b/35870313): Remove once all violations are gone
- -untrusted_app_visible_halserver_violators
- }:binder { call transfer };
-')
+# full_treble_only(`
+# neverallow all_untrusted_apps {
+# halserverdomain
+# -coredomain
+# -hal_cas_server
+# -hal_codec2_server
+# -hal_configstore_server
+# -hal_graphics_allocator_server
+# -hal_neuralnetworks_server
+# -hal_omx_server
+# -binder_in_vendor_violators # TODO(b/35870313): Remove once all violations are gone
+# -untrusted_app_visible_halserver_violators
+# }:binder { call transfer };
+# ')
8、完
1414
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
