forked from abcz316/SKRoot-linuxKernelRoot
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathmain.cpp
More file actions
147 lines (122 loc) · 3.47 KB
/
main.cpp
File metadata and controls
147 lines (122 loc) · 3.47 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
#include <cstdio>
#include <sys/capability.h>
#include "super_root.h"
#include "adb_inject.h"
#define ROOT_KEY 0x7F6766F8
void show_capability_info()
{
struct __user_cap_header_struct cap_header_data;
cap_user_header_t cap_header = &cap_header_data;
struct __user_cap_data_struct cap_data_data;
cap_user_data_t cap_data = &cap_data_data;
cap_header->pid = getpid();
cap_header->version = _LINUX_CAPABILITY_VERSION_3; //_1、_2、_3
if (capget(cap_header, cap_data) < 0) {
perror("FAILED capget()");
exit(1);
}
printf("Cap data 0x%x, 0x%x, 0x%x\n", cap_data->effective, cap_data->permitted, cap_data->inheritable);
printf("now getuid()=%d,geteuid()=%d,getgid()=%d,getegid()=%d\n", getuid(), geteuid(), getgid(), getegid());
FILE * fp = popen("getenforce", "r");
if (fp)
{
char cmd[512] = { 0 };
fread(cmd, 1, sizeof(cmd), fp);
pclose(fp);
printf("SELinux status: %s\n", cmd);
}
}
void test_root()
{
show_capability_info();
printf("get_root ret:%d\n", get_root(ROOT_KEY));
show_capability_info();
//system("id");
//system("/data/local/tmp/getmyinfo");
//system("insmod /sdcard/rwProcMem37.ko ; echo $?");
//system("cat /proc/1/maps");
//system("ls /proc");
//system("screencap -p /sdcard/temp.png");
return;
}
void test_disable_selinux()
{
int ret = disable_selinux(ROOT_KEY);
printf("disable_selinux ret:%d\n", ret);
printf("done.\n");
return;
}
void test_enable_selinux()
{
int ret = enable_selinux(ROOT_KEY);
printf("enable_selinux ret:%d\n", ret);
printf("done.\n");
return;
}
void test_run_cmd(char * cmd, bool bKeepAdbRoot = false) {
printf("inject_cmd_remote_process(%s)\n", cmd);
char szResult[0x1000] = { 0 };
ssize_t ret = safe_inject_adb_process_run_cmd_wrapper(ROOT_KEY, cmd, bKeepAdbRoot, szResult, sizeof(szResult));
printf("inject_cmd_remote_process ret val:%zd\n", ret);
printf("inject_cmd_remote_process result:%s\n", szResult);
}
int main(int argc, char *argv[])
{
printf(
"======================================================\n"
"本工具名称: Linux ARM64 完美隐藏ROOT演示\n"
"本工具功能列表：\n"
"\t1.显示自身权限信息\n"
"\t2.获取ROOT权限\n"
"\t3.绕过SELinux\n"
"\t4.还原SELinux\n"
"\t5.执行ROOT权限级别的Shell命令\n"
"\t6.赋予ADB最高级别权限\n"
"\t新一代root，跟面具完全不同思路，摆脱面具被检测的弱点，完美隐藏root功能，挑战全网root检测手段，兼容安卓APP直接JNI调用，稳定、流畅、不闪退。\n"
"======================================================\n"
);
++argv;
--argc;
int cmdc;
char *cmdv[6];
while (argc) {
// Clean up
cmdc = 0;
memset(cmdv, 0, sizeof(cmdv));
// Split the commands
for (char *tok = strtok(argv[0], " "); tok; tok = strtok(nullptr, " "))
{
cmdv[cmdc++] = tok;
if (cmdc == 0)
{
continue;
}
}
if (strcmp(cmdv[0], "show") == 0) {
show_capability_info();
}
else if (strcmp(cmdv[0], "root") == 0) {
test_root();
}
else if (strcmp(cmdv[0], "disable") == 0) {
test_disable_selinux();
}
else if (strcmp(cmdv[0], "enable") == 0) {
test_enable_selinux();
}
else if (strcmp(cmdv[0], "cmd") == 0) {
test_run_cmd("id");
//test_run_cmd("id > /sdcard/run.txt");
//test_run_cmd("insmod rwProcMem37.ko > /sdcard/run.txt");
}
else if (strcmp(cmdv[0], "adb") == 0) {
test_run_cmd("id", true);
}
else {
return 1;
}
--argc;
++argv;
}
return 0;
}