RK3562编译Android13 ROOT固件教程

深圳触觉科技

关闭selinux
& S; i7 s; A% x5 h  U2 U修改此文件（"+"号为修改内容）

% i2 Y$ c! }3 W/ Y2 ~device/rockchip/common/BoardConfig.mk
BOARD_BOOT_HEADER_VERSION ?= 2
BOARD_MKBOOTIMG_ARGS :=
BOARD_PREBUILT_DTBOIMAGE ?= $(TARGET_DEVICE_DIR)/dtbo.img
# p% G2 B  a/ }BOARD_ROCKCHIP_VIRTUAL_AB_ENABLE ?= false
-BOARD_SELINUX_ENFORCING ?= true
+BOARD_SELINUX_ENFORCING ?= false



注释用户组权限检测
修改此文件（"+"号为修改内容）
7 s* g* H! q, S7 G$ B2 j
9 W( ]3 ]" B/ X7 h3 p8 W1 xsystem/extras/su/su.cpp
/ S. D  l: {5 k- v3 e: I
void extract_uidgids(const char* uidgids, uid_t* uid, gid_t*
gid, gid_t* gids, i
}
; ^; O" X' J% ]3 lint main(int argc, char** argv) {
- uid_t current_uid = getuid();
- if (current_uid != AID_ROOT && current_uid != AID_SHELL) error(1, 0, "notallowed");
" t( o) |- u( I# p9 E+ //uid_t current_uid = getuid();
+ //if (current_uid != AID_ROOT && current_uid != AID_SHELL) error(1, 0, "notallowed");

3 F1 K9 o, A; w# V, ]. }" a( J

给su文件默认授予root权限
修改此文件（"+"号为修改内容）
4 m1 B: [8 v8 m7 Isystem/core/libcutils/fs_config.cpp
0 P: a  ?9 J& a8 t
, B! h7 P+ M" K) ]+ E& w4 d8 Vstatic const struct fs_path_config android_dirs[] = {
9 t$ L& `1 Z* o     { 00751, AID_ROOT,         AID_SHELL,        0, "system/bin" },
5 c' u- k: M8 U( P% r7 V9 V) K7 ^     { 00755, AID_ROOT,         AID_ROOT,         0, "system/etc/ppp" },
     { 00755, AID_ROOT,         AID_SHELL,        0, "system/vendor" },
" O& |7 [$ Y* B1 H" d: O-    { 00750, AID_ROOT,         AID_SHELL,        0, "system/xbin" },
+    { 00755, AID_ROOT,         AID_SHELL,        0, "system/xbin" },
) t# |4 {' ~+ X) L     { 00751, AID_ROOT,         AID_SHELL,        0, "system/apex/*/bin" },
; ~$ v+ M. N0 R8 m, @" N0 E     { 00751, AID_ROOT,         AID_SHELL,        0, "system_ext/bin" },
     { 00751, AID_ROOT,         AID_SHELL,        0, "system_ext/apex/*/bin" },
static const struct fs_path_config android_files[] = {
     // the following two files are INTENTIONALLY set-uid, but they
. O( W+ K0 I0 L2 B. I     // are NOT included on user builds.
! q) d; M3 r  m6 @+ Z# |     { 06755, AID_ROOT,      AID_ROOT,      0, "system/xbin/procmem" },
8 }; M5 F: ]$ s! V, ?6 A-    { 04750, AID_ROOT,      AID_SHELL,     0, "system/xbin/su" },
+    { 06755, AID_ROOT,      AID_SHELL,     0, "system/xbin/su" },
6 x3 i9 g& t, i% l6 Z7 l) \然后修改此文件（"+"号为修改内容）
+ D- n* K# I' W) s6 f* mframeworks/base/core/jni/com_android_internal_os_Zygote.cpp
) c- m* x+ P1 \static void DropCapabilitiesBoundingSet(fail_fn_t fail_fn) {
+/*
0 B- L5 k8 @0 Z' h# ?  for (int i = 0; prctl(PR_CAPBSET_READ, i, 0, 0, 0) >= 0; i++) {;
    if (prctl(PR_CAPBSET_DROP, i, 0, 0, 0) == -1) {
      if (errno == EINVAL) {
        ALOGE("prctl(PR_CAPBSET_DROP) failed with EINVAL. Please verify "
              "your kernel is compiled with file capabilities support");
      } else {
        fail_fn(CREATE_ERROR("prctl(PR_CAPBSET_DROP, %d) failed: %s", i, strerror(errno)));
      }
& [# q5 }' S- l9 s4 A    }
  }
+ */
4 D5 U: ^6 k  i% A}
- j; x% e, d7 R1 G最后修改此文件（"+"号为修改内容）
% A9 s& X+ l/ U4 b" skernel-5.10/security/commoncap.c
2 d2 Q9 K( n3 [- j: {int cap_task_setnice(struct task_struct *p, int nice)
static int cap_prctl_drop(unsigned long cap)
* q2 W; j0 L- z, f{
    struct cred *new;
+/*
    if (!ns_capable(current_user_ns(), CAP_SETPCAP))
    return -EPERM;
" ^3 z! ~7 _' H0 l- h) N) K- D    if (!cap_valid(cap))
    return -EINVAL;
-
8 K7 |9 }, z' G. R+ K, D+*/
new = prepare_creds();
  u/ O* x3 N$ d$ U" D3 B" E


源码编译并验证固件是否ROOT
* w8 C, }2 m5 k: R6 l" Q: c修改完上面三个步骤的文件后，重新编译内核和安卓源码，执行以下命令：
# make -j4
下载RootChecker测试APK软件包（自行下载）,可通过ADB命令或者U盘安装,安装后按照提示点击按钮检查root。

root成功如图：

7 i, i/ v9 V" {$ Z$ C

ybing12

程序写的很规范