本文为源码定制学习的root指纹抹除篇,通过本文的学习,读者可以掌握Android指纹的基本定制能力和root定制能力,本文参考了看雪大佬应用root检测通杀篇,为实验记录笔记。有问题,可以一一指出:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
ro.
=
GRI40 (版本
ID
)
ro.build.
=
GRJ22 (版本号)
ro.build.version.incremental
=
eng.buildbot.
20110619.060228
(版本增量)
ro.build.version.sdk
=
10
(sdk版本)
ro.build.version.codename
=
REL (版本代号)
ro.build.version.release
=
2.3
.
4
(Android
2.3
.
4
系统)
ro.build.date
=
Sun Jun
19
06
:
02
:
58
UTC
2011
(制作者及制作时间)
ro.build.date.utc
=
0
ro.build.
type
=
user (编译模式,如user,userdebug,eng,test模式)
ro.build.user
=
buildbot (编译账户)
ro.build.host
=
bb1 (编译主机系统)
ro.build.tags
=
test
-
keys (编译标签)
ro.product.model
=
HTC Wildfire (HTC内部手机代号)
ro.product.brand
=
htc_wwe (手机品牌)
ro.product.name
=
htc_buzz (手机正式名称)
ro.product.device
=
buzz (采用的设备)
ro.product.board
=
buzz (采用的处理器)
ro.product.cpu.abi
=
armeabi
-
v6j (cpu的版本)
ro.product.cpu.abi2
=
armeabi (cpu的品牌)
ro.product.manufacturer
=
HTC (手机制造商)
ro.product.locale.language
=
zh (手机默认语言)
ro.product.locale.region
=
CN (地区语言)
ro.wifi.channels
=
(WIFI连接的渠道)
ro.board.platform
=
msm7k (主板平台)
ro.build.product
=
buzz (建立产品)
ro.build.description
=
passion
-
user
2.3
.
3
GRI40
102588
release
-
keys (用户的KEY)
ro.build.fingerprint
=
google
/
passion
/
passion:
2.3
.
3
/
GRI40
/
102588
:user
/
release
-
keys (系统指纹)
ro.sf.lcd_density
=
240
(显示屏分辨率,数值越大分辨率越底,
240
就是
800
*
480
的)
view.fading_edge_length
=
8
view.touch_slop
=
15
(触摸屏灵敏度,数值越大越灵敏)
view.minimum_fling_velocity
=
25
(滑动速度)
view.scroll_friction
=
0.008
(滑动误差)
rild.libpath
=
/
system
/
lib
/
libhtc_
ro.ril.ecc.HTC
-
WWE
=
999
ro.ril.ecc.HTC
-
ELL
=
92
,
93
,
94
ro.ril.enable.a52.HTC
-
ITA
=
1
ro.ril.enable.a53.HTC
-
ITA
=
1
ro.ril.enable.a52
=
0
ro.ril.enable.a53
=
1
ro.ril.vmail.
23415
=
1571
,BT
ro.ril.hsdpa.category
=
8
(hsdpa全称High Speed Downlink Packet Access中文意思:高速下行分组接入,设置的数越大传输越快)
ro.ril.htcmaskw1.bitmask
=
429496
ro.ril.htcmaskw1
=
14449
ro.ril.
def
.agps.mode
=
2
(打开AGPS服务支持,可改为ro.ril.
def
.agps.mode
=
0
改后能省电但GPS定位速度会变慢)
ro.ril.gprsclass
=
12
(GPRS设置)
ro.ril.disable.power.collapse
=
1
(关闭电源)
ro.gsm.
2nd_data_retry_config
=
max_retries
=
3
,
2000
,
2000
,
2000
wifi.interface
=
eth0 (WIFI界面)
wifi.supplicant_scan_interval
=
45
(WIFI扫描间隔时间,这里设置是
45
秒。把这个时间设置长点能省电)
mobiledata.interfaces
=
rmnet0,rmnet1,rmnet2
ro.tether.denied
=
false
ro.telephony.default_network
=
0
ro.c o m.google.locationfeatures
=
1
ro.opengles.version
=
65536
(开放式绘图介面参数)
sys.checkfs.fat
=
false
dalvik.vm.execution
-
mode
=
int
:jit
dalvik.vm.heapsize
=
24m
(虚拟内存大小,可设置为
16m
或
24m
或
32m
或
48m
)
persist.sys.use_dithering
=
1
persist.sys.purgeable_assets
=
1
ro.media.dec.jpeg.memcap
=
20000000
no_require_sim
=
true (手机卡保护设置)
ro.rommanager.developerid
=
cyanogenmodnightly (固件管理器开发者是CM大神)
ro.url.legal
=
http:
/
/
www.
/
intl
/
%
s
/
mobile
/
android
/
basic
/
phone
-
legal.html
ro.url.legal.android_privacy
=
http:
/
/
www]
/
intl
/
%
s
/
mobile
/
android
/
basic
/
privacy.html
ro. com.google.clientidbase
=
android
-
google (谷歌客户身份)
ro. com.android.wifi
-
watchlist
=
GoogleGuest (WIFI用户名单)
ro.setupwizard.enterprise_mode
=
1
(默认情景模式)
ro. com.android.dateformat
=
MM
-
dd
-
yyyy (默认时间格式,改为yyyy
-
MM
-
dd,显示效果就是XXXX年XX月XX日)
ro. com.android.dataroaming
=
false (漫游设置)
ro.config.ringtone
=
Playa.ogg (默认铃声设置,文件在
/
system
/
media
/
audio
/
ringtones 把喜欢的铃声放这里,比如
123.
MP3放入ringtones文件夹中,这里代码改为ro.config.ringtone
=
123.
mp3)
ro.config.notification_sound
=
regulus.ogg (默认提示音,文件在
/
system
/
media
/
audio
/
notifications 修改方法同上)
ro.config.alarm_alert
=
Alarm_Beep_03.ogg (默认闹铃,文件在
/
system
/
media
/
audio
/
alarms 修改方法同上)
ro.modversion
=
CyanogenMod
-
7
-
06192011
-
NIGHTLY
-
buzz (版本信息,改这个能让你大名出现系统关于中,改为ro.modversion
=
xxxxx)
ro.setupwizard.mode
=
OPTIONAL (安装向导模式)
net. bt. name
=
Android (系统名称)
dalvik.vm.stack
-
trace
-
file
=
/
data
/
anr
/
traces.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
1.detectRootManagementApps
—检测常见su包名,如{“com.noshufou.android.su”, “com.noshufou.android.su.elite”, “eu.chainfire.supersu”, “com.koushikdutta.superuser”, “com.thirdparty.superuser”, “com.yellowes.su”, “com.topjohnwu.magisk”, “com.kingroot.kinguser”, “com.kingo.root”, “com.smedialink.oneclickroot”, “com.zhiqupk.root.
global
”, “com.alephzain.framaroot”}
2.detectPotentiallyDangerousApps
—{“com.koushikdutta.rommanager”, “com.koushikdutta.rommanager.license”, “com.dimonvideo.luckypatcher”, “com.chelpus.lackypatch”, “com.ramdroid.appquarantine”, “com.ramdroid.appquarantinepro”, “com.android.vending.billing.InAppBillingService.COIN”, “com.android.vending.billing.InAppBillingService.LUCK”, “com.chelpus.luckypatcher”, “com.blackmartalpha”, “org.blackmart.market”, “com.allinone.free”, “com.repodroid.app”, “org.creeplays.hack”, “com.baseappfull.fwd”, “com.zmapp”, “com.dv.marketmod.installer”, “org.mobilism.android”, “com.android.wp.net.log”, “com.android.camera.update”, “cc.madkite.freedom”, “com.solohsu.android.edxp.manager”, “org.meowcat.edxposed.manager”, “com.xmodgame”, “com.cih.game_cih”, “com.charles.lpoqasert”, “catch_.me_.if_.you_.can_”}
3.detectRootCloakingApps
—{“com.devadvance.rootcloak”, “com.devadvance.rootcloakplus”, “de.robv.android.xposed.installer”, “com.saurik.substrate”, “com.zachspong.temprootremovejb”, “com.amphoras.hidemyroot”, “com.amphoras.hidemyrootadfree”, “com.formyhm.hiderootPremium”, “com.formyhm.hideroot”}
4.suPath
—遍历执行可能存在的su文件夹,如{“
/
data
/
local
/
”, “
/
data
/
local
/
bin
/
”, “
/
data
/
local
/
xbin
/
”, “
/
sbin
/
”, “
/
su
/
bin
/
”, “
/
system
/
bin
/
”, “
/
system
/
bin
/
.ext
/
”, “
/
system
/
bin
/
failsafe
/
”, “
/
system
/
sd
/
xbin
/
”, “
/
system
/
usr
/
we
-
need
-
root
/
”, “
/
system
/
xbin
/
”, “
/
cache
/
”, “
/
data
/
”, “
/
dev
/
”}
5.checkForDangerousProps
—检查一些属性的值.{ro.debuggable”, “
1
”},{“ro.secure”, “
0
”}
6.checkForRWPaths
—先执行(需要root)mount如果返回true然后再查看是否有读写权限{“
/
system”, “
/
system
/
bin
”, “
/
system
/
sbin”, “
/
system
/
xbin”, “
/
vendor
/
bin
”, “
/
sbin”, “
/
etc”}
7.detectTestKeys
—查看编译类型是否为 {“test
-
keys”}
8.checkBuildProp
—检查Buildprop的值,{“ro.build.display.
id
”,”ro.build.version.incremental”,”ro.build.date”,”ro.build.date.utc”,”ro.build.
type
”,”ro.build.user”,”ro.build.flavor”,”ro.build.tags”,”ro.build.description”,”ro.build.fingerprint”,”ro.product.model”,”ro.product.brand”,”ro.product.name”}
9.checkSuExists
—执行su,看看能否执行成功
10.checkForRootNative
—Native层root检查
11.checkForMagiskBinary
—检测是否存在Magisk
-
{“
/
data
/
local
/
”, “
/
data
/
local
/
bin
/
”, “
/
data
/
local
/
xbin
/
”, “
/
sbin
/
”, “
/
su
/
bin
/
”, “
/
system
/
bin
/
”, “
/
system
/
bin
/
.ext
/
”, “
/
system
/
bin
/
failsafe
/
”, “
/
system
/
sd
/
xbin
/
”, “
/
system
/
usr
/
we
-
need
-
root
/
”, “
/
system
/
xbin
/
”, “
/
cache
/
”, “
/
data
/
”, “
/
dev
/
”}
首先,我们编译user版本的镜像,里我需要编译的目标版本是aosp_sailfish-user
,那么在编译的选项中是没有这一项的,根据lunch
命令列出的文件,随意找一个文件进行修改,我们以device/google/marlin/vendorsetup.sh
文件为例,进行修改
尽管我们现在编译的是user版本,但是我们试验了一些测试的APP,发现其中有一些APP还是检测系统含有root,经过分析我们发现,无论是user编译还是user-debug编译,我们的系统签名都使用的是test-key,而我们真正的手机一般是release-key签名后发布的,所以很多APP将这里作为检测点
然后为了开展后面的实现,我们尝试拿到user版本的指纹,由于此时无法root,所以无法查看 /system/build.prop
的信息,所以我们直接对设备进行root
前面我们分别对user版和debug版的系统进行了分析,相应不少朋友应对一些常见的root检测的应用进行处理,那能不能即获得root的操作,又拥有user一样的镜像呢,这里我们就需要对root进行定制和指纹抹除