Skip to content

Commit 45610ee

Browse files
abcz316abcz316
committed
first commit
0 parents  commit 45610ee

File tree

9 files changed

+606
-0
lines changed

9 files changed

+606
-0
lines changed

‎testRoot/README.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
printf(
2+
"======================================================\n"
3+
"本工具名称: Linux ARM64 完美隐藏ROOT演示\n"
4+
"本工具功能列表：\n"
5+
"\t1.显示自身权限信息\n"
6+
"\t2.获取ROOT权限\n"
7+
"\t3.绕过SELinux\n"
8+
"\t4.还原SELinux\n"
9+
"\t5.执行ROOT权限级别的Shell命令\n"
10+
"\t6.赋予ADB最高级别权限\n"
11+
"\t新一代root，跟面具完全不同思路，摆脱面具被检测的弱点，完美隐藏root功能，挑战全网root检测手段，兼容安卓APP直接JNI调用，稳定、流畅、不闪退。\n"
12+
"======================================================\n"
13+
);

‎testRoot/jni/Android.mk‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
LOCAL_PATH := $(call my-dir)
2+
3+
include $(CLEAR_VARS)
4+
LOCAL_CPPFLAGS += -std=c++1y
5+
LOCAL_CFLAGS += -fPIE
6+
LOCAL_CFLAGS += -fvisibility=hidden
7+
LOCAL_LDFLAGS += -fPIE -pie
8+
LOCAL_DISABLE_FATAL_LINKER_WARNINGS := true
9+
LOCAL_MODULE := testRoot.out
10+
LOCAL_SRC_FILES := ../main.cpp ../adb_inject.cpp ../ptrace_arm64_utils.cpp
11+
include $(BUILD_EXECUTABLE)

‎testRoot/jni/Application.mk‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
APP_ABI := arm64-v8a
2+
APP_STL := c++_static

‎testRoot/main.cpp‎

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
#include <cstdio>
2+
#include <sys/capability.h>
3+
4+
#include "super_root.h"
5+
#include "adb_inject.h"
6+
#define ROOT_KEY 0x7F6766F8
7+
8+
void show_capability_info()
9+
{
10+
struct __user_cap_header_struct cap_header_data;
11+
cap_user_header_t cap_header = &cap_header_data;
12+
13+
struct __user_cap_data_struct cap_data_data;
14+
cap_user_data_t cap_data = &cap_data_data;
15+
16+
cap_header->pid = getpid();
17+
cap_header->version = _LINUX_CAPABILITY_VERSION_3; //_1、_2、_3
18+
19+
if (capget(cap_header, cap_data) < 0) {
20+
perror("FAILED capget()");
21+
exit(1);
22+
}
23+
24+
printf("Cap data 0x%x, 0x%x, 0x%x\n", cap_data->effective, cap_data->permitted, cap_data->inheritable);
25+
printf("now getuid()=%d,geteuid()=%d,getgid()=%d,getegid()=%d\n", getuid(), geteuid(), getgid(), getegid());
26+
27+
FILE * fp = popen("getenforce", "r");
28+
if (fp)
29+
{
30+
char cmd[512] = { 0 };
31+
fread(cmd, 1, sizeof(cmd), fp);
32+
pclose(fp);
33+
34+
printf("SELinux status: %s\n", cmd);
35+
}
36+
}
37+
void test_root()
38+
{
39+
show_capability_info();
40+
41+
printf("get_root ret:%d\n", get_root(ROOT_KEY));
42+
43+
show_capability_info();
44+
45+
//system("id");
46+
//system("/data/local/tmp/getmyinfo");
47+
//system("insmod /sdcard/rwProcMem37.ko ; echo $?");
48+
//system("cat /proc/1/maps");
49+
//system("ls /proc");
50+
//system("screencap -p /sdcard/temp.png");
51+
return;
52+
}
53+
54+
void test_disable_selinux()
55+
{
56+
int ret = disable_selinux(ROOT_KEY);
57+
printf("disable_selinux ret:%d\n", ret);
58+
printf("done.\n");
59+
return;
60+
}
61+
62+
void test_enable_selinux()
63+
{
64+
int ret = enable_selinux(ROOT_KEY);
65+
printf("enable_selinux ret:%d\n", ret);
66+
printf("done.\n");
67+
return;
68+
}
69+
70+
71+
void test_run_cmd(char * cmd, bool bKeepAdbRoot = false) {
72+
printf("inject_cmd_remote_process(%s)\n", cmd);
73+
char szResult[0x1000] = { 0 };
74+
ssize_t ret = safe_inject_adb_process_run_cmd_wrapper(ROOT_KEY, cmd, bKeepAdbRoot, szResult, sizeof(szResult));
75+
printf("inject_cmd_remote_process ret val:%zd\n", ret);
76+
printf("inject_cmd_remote_process result:%s\n", szResult);
77+
}
78+
79+
int main(int argc, char *argv[])
80+
{
81+
printf(
82+
"======================================================\n"
83+
"本工具名称: Linux ARM64 完美隐藏ROOT演示\n"
84+
"本工具功能列表：\n"
85+
"\t1.显示自身权限信息\n"
86+
"\t2.获取ROOT权限\n"
87+
"\t3.绕过SELinux\n"
88+
"\t4.还原SELinux\n"
89+
"\t5.执行ROOT权限级别的Shell命令\n"
90+
"\t6.赋予ADB最高级别权限\n"
91+
"\t新一代root，跟面具完全不同思路，摆脱面具被检测的弱点，完美隐藏root功能，挑战全网root检测手段，兼容安卓APP直接JNI调用，稳定、流畅、不闪退。\n"
92+
"======================================================\n"
93+
);
94+
95+
96+
++argv;
97+
--argc;
98+
99+
100+
int cmdc;
101+
char *cmdv[6];
102+
103+
while (argc) {
104+
// Clean up
105+
cmdc = 0;
106+
memset(cmdv, 0, sizeof(cmdv));
107+
108+
// Split the commands
109+
for (char *tok = strtok(argv[0], " "); tok; tok = strtok(nullptr, " "))
110+
{
111+
cmdv[cmdc++] = tok;
112+
if (cmdc == 0)
113+
{
114+
continue;
115+
}
116+
}
117+
118+
119+
if (strcmp(cmdv[0], "show") == 0) {
120+
show_capability_info();
121+
}
122+
else if (strcmp(cmdv[0], "root") == 0) {
123+
test_root();
124+
}
125+
else if (strcmp(cmdv[0], "disable") == 0) {
126+
test_disable_selinux();
127+
}
128+
else if (strcmp(cmdv[0], "enable") == 0) {
129+
test_enable_selinux();
130+
}
131+
else if (strcmp(cmdv[0], "cmd") == 0) {
132+
test_run_cmd("id");
133+
//test_run_cmd("id > /sdcard/run.txt");
134+
//test_run_cmd("insmod rwProcMem37.ko > /sdcard/run.txt");
135+
}
136+
else if (strcmp(cmdv[0], "adb") == 0) {
137+
test_run_cmd("id", true);
138+
}
139+
else {
140+
return 1;
141+
}
142+
143+
--argc;
144+
++argv;
145+
}
146+
return 0;
147+
}

0 commit comments

Comments
 (0)