该楼层疑似违规已被系统折叠 隐藏此楼查看此楼
DataOutputStream os = new DataOutputStream(process.getOutputStream());
os.writeBytes("mount -oremount,rw /dev/block/mtdblock3 /system\n");
os.writeBytes("busybox cp /data/data/com.koushikdutta.superuser/su /system/bin/su\n");
os.writeBytes("busybox chown 0:0 /system/bin/su\n");
os.writeBytes("chmod 4755 /system/bin/su\n");
os.writeBytes("exit\n");
os.flush();
有进程使用root权限,superuser是怎么知道的呢,关键是句:
sprintf(sysCmd, "am start -a android.intent.action.MAIN
-n com.koushikdutta.superuser/com.koushikdutta.superuser.SuperuserRequestActivity
--ei uid %d --ei pid %d > /dev/null", g_puid, ppid);
if (system(sysCmd))
return executionFailure("am.");
原理是am命令,am的用法:
usage: am [subcommand] [options]
start an Activity: am start [-D] [-W]
-D: enable debugging
-W: wait for launch to complete
start a Service: am startservice
send a broadcast Intent: am broadcast
start an Instrumentation: am instrument [flags]
-r: print raw results (otherwise decode REPORT_KEY_STREAMRESULT)