android checkwhitelist 白名单 框架,【转自黑吧】Android 获取ROOT权限原理

该楼层疑似违规已被系统折叠 隐藏此楼查看此楼

DataOutputStream os = new DataOutputStream(process.getOutputStream());

os.writeBytes("mount -oremount,rw /dev/block/mtdblock3 /system\n");

os.writeBytes("busybox cp /data/data/com.koushikdutta.superuser/su /system/bin/su\n");

os.writeBytes("busybox chown 0:0 /system/bin/su\n");

os.writeBytes("chmod 4755 /system/bin/su\n");

os.writeBytes("exit\n");

os.flush();

有进程使用root权限，superuser是怎么知道的呢，关键是句：

sprintf(sysCmd, "am start -a android.intent.action.MAIN

-n com.koushikdutta.superuser/com.koushikdutta.superuser.SuperuserRequestActivity

--ei uid %d --ei pid %d > /dev/null", g_puid, ppid);

if (system(sysCmd))

return executionFailure("am.");

原理是am命令，am的用法：

usage: am [subcommand] [options]

start an Activity: am start [-D] [-W]

-D: enable debugging

-W: wait for launch to complete

start a Service: am startservice

send a broadcast Intent: am broadcast

start an Instrumentation: am instrument [flags]

-r: print raw results (otherwise decode REPORT_KEY_STREAMRESULT)