forked from abcz316/SKRoot-linuxKernelRoot
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathtestRoot.cpp
More file actions
189 lines (164 loc) · 5.48 KB
/
Copy pathtestRoot.cpp
File metadata and controls
189 lines (164 loc) · 5.48 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
#include "testRoot.h"
#include <sstream>
#include <sys/capability.h>
#include "super_root.h"
#include "adb64_inject.h"
#include "env64_inject.h"
#define ROOT_KEY 0x7F6766F8
void show_capability_info()
{
struct __user_cap_header_struct cap_header_data;
cap_user_header_t cap_header = &cap_header_data;
struct __user_cap_data_struct cap_data_data;
cap_user_data_t cap_data = &cap_data_data;
cap_header->pid = getpid();
cap_header->version = _LINUX_CAPABILITY_VERSION_3; //_1、_2、_3
if (capget(cap_header, cap_data) < 0) {
perror("FAILED capget()");
exit(1);
}
printf("Cap data 0x%x, 0x%x, 0x%x\n", cap_data->effective, cap_data->permitted, cap_data->inheritable);
printf("now getuid()=%d,geteuid()=%d,getgid()=%d,getegid()=%d\n", getuid(), geteuid(), getgid(), getegid());
FILE * fp = popen("getenforce", "r");
if (fp)
{
char shell[512] = { 0 };
fread(shell, 1, sizeof(shell), fp);
pclose(fp);
printf("SELinux status: %s\n", shell);
}
}
void test_root()
{
show_capability_info();
printf("get_root ret:%d\n", get_root(ROOT_KEY));
show_capability_info();
//system("id");
//system("/data/local/tmp/getmyinfo");
//system("insmod /sdcard/rwProcMem37.ko ; echo $?");
//system("cat /proc/1/maps");
//system("ls /proc");
//system("screencap -p /sdcard/temp.png");
return;
}
void test_disable_selinux()
{
int ret = disable_selinux(ROOT_KEY);
printf("disable_selinux ret:%d\n", ret);
printf("done.\n");
return;
}
void test_enable_selinux()
{
int ret = enable_selinux(ROOT_KEY);
printf("enable_selinux ret:%d\n", ret);
printf("done.\n");
return;
}
void test_run_adb64_shell(const char * shell, bool bKeepAdbRoot = false) {
printf("inject_shell_remote_process(%s)\n", shell);
char szResult[0x1000] = { 0 };
ssize_t ret = safe_inject_adb64_process_run_shell_wrapper(ROOT_KEY, shell, bKeepAdbRoot, szResult, sizeof(szResult));
printf("inject_shell_remote_process ret val:%zd\n", ret);
printf("inject_shell_remote_process result:%s\n", szResult);
}
void test_run_root_cmd(const char * shell) {
printf("test_run_root_cmd(%s)\n", shell);
char szResult[0x1000] = { 0 };
ssize_t ret = run_root_cmd(ROOT_KEY, shell, szResult, sizeof(szResult));
printf("test_run_root_cmd ret val:%zd\n", ret);
printf("test_run_root_cmd result:%s\n", szResult);
}
void test_su_env_inject(unsigned int pid, const char * su_folder_path) {
printf("test_su_env_inject(%d, %s)\n", pid, su_folder_path);
ssize_t ret = inject_process_env64_PATH_wrapper(ROOT_KEY, pid, su_folder_path);
printf("test_su_env_inject ret val:%zd\n", ret);
}
void test_auto_su_env_inject(const char* target_cmdline, const char * su_folder_path)
{
printf("test_auto_su_env_inject Waiting for process creation(%s, %s)\n", target_cmdline, su_folder_path);
int pid = -1;
while (1)
{
sleep(0);
pid = find_cmdline_process(target_cmdline);
if (pid == -1)
{
continue;
}
break;
}
printf("test_auto_su_env_inject(%d, %s)\n", pid, su_folder_path);
ssize_t ret = inject_process_env64_PATH_wrapper(ROOT_KEY, pid, su_folder_path);
printf("test_auto_su_env_inject ret val:%zd\n", ret);
}
int main(int argc, char *argv[])
{
printf(
"======================================================\n"
"本工具名称: Linux ARM64 完美隐藏ROOT演示\n"
"本工具功能列表：\n"
"\t1.显示自身权限信息\n"
"\t2.获取ROOT权限\n"
"\t3.绕过SELinux\n"
"\t4.还原SELinux\n"
"\t5.执行ROOT命令\n"
"\t6.执行ADB Shell命令\n"
"\t7.赋予ADB最高级别权限\n"
"\t8.授予ROOT到其他进程\n"
"\t新一代root，跟面具完全不同思路，摆脱面具被检测的弱点，完美隐藏root功能（免root级别），兼容安卓APP直接JNI稳定调用。\n"
"======================================================\n"
);
++argv;
--argc;
if (strcmp(argv[0], "show") == 0) { //1.显示自身权限信息
show_capability_info();
}
else if (strcmp(argv[0], "root") == 0) { //2.获取ROOT权限
test_root();
}
else if (argc >=2 && strcmp(argv[0], "selinux") == 0 && strcmp(argv[1], "disable") == 0) {//3.绕过SELinux
test_disable_selinux();
}
else if (argc >= 2 && strcmp(argv[0], "selinux") == 0 && strcmp(argv[1], "enable") == 0) { //4.还原SELinux
test_enable_selinux();
}
else if (argc >= 2 && strcmp(argv[0], "shell") == 0) { //5.执行ROOT命令
std::stringstream sstrCmd;
for (int i = 1; i < argc; i++) {
sstrCmd << argv[i];
}
test_run_root_cmd((char*)sstrCmd.str().c_str());
}
else if (argc > 2 && strcmp(argv[0], "adb") == 0 && strcmp(argv[1], "shell") == 0) { //6.执行ADB Shell命令
std::stringstream sstrCmd;
for (int i = 2; i < argc; i++) {
sstrCmd << argv[i];
}
test_run_adb64_shell((char*)sstrCmd.str().c_str());
}
else if (argc >= 2 && strcmp(argv[0], "adb") == 0 && strcmp(argv[1], "root") == 0) { //7.赋予ADB最高级别权限
test_run_adb64_shell("id", true);
}
else if (argc > 1 && strcmp(argv[0], "su") == 0) { //8.授予ROOT到其他进程
std::stringstream sstrCmd;
sstrCmd << argv[1];
unsigned int target_pid = 0;
sstrCmd >> target_pid;
if (target_pid) {
test_su_env_inject(target_pid, "/data/local/tmp");
}
}
else if (argc > 1 && strcmp(argv[0], "autosu") == 0) { //8.授予ROOT到其他进程
std::stringstream sstrCmd;
sstrCmd << argv[1];
if (sstrCmd.str().length()) {
test_auto_su_env_inject(sstrCmd.str().c_str(), "/data/local/tmp");
}
}
else {
printf("unknown command.\n");
return 1;
}
return 0;
}