安卓提权调用系统接口教程

1、在你的安卓项目里创建一个Java文件，需要有main函数入口。

1
2
3
4
5
6
7
8
9
10
11
12
import android.os.Build;
import android.os.Looper;
import android.os.Process;

public class startAdbService {
    public static void main(String[] args) {
        // 利用looper让线程循环
        Looper.prepareMainLooper();
		//这里执行你的adb命令或者调用需要adb权限的aidl接口，即可。
        Looper.loop();
    }
}

2、编写激活脚本，用于实时生成对应的激活脚本。

1
2
3
4
5
6
7
8
9
public String getActiveADBScript(Context context){
        String str = "killall EAMADB\n" +
                "exec app_process -Djava.class.path=\""+context.getApplicationInfo().sourceDir+"\" /system/bin --nice-name=EAMADB "+ startAdbService.class.getName()+" >>/dev/null 2>&1 &\n" +
                "echo \"running ok [adb]\"";
//        String str = "killall EAMADB\n" +
//                "exec app_process -Djava.class.path=\""+context.getApplicationInfo().sourceDir+"\" /system/bin --nice-name=EAMADB "+ startAdbService.class.getName()+"\n" +
//                "echo \"running ok [adb]\"";
        return str;
    }

核心是这一段

1
exec app_process -Djava.class.path=\""+context.getApplicationInfo().sourceDir+"\" /system/bin --nice-name=EAMADB "+ startAdbService.class.getName()

这样你就提权成功了，不只是adb才行，root也可以，只要是在root的shell里面执行，就有root的权限了，可以做更多的操作。

3、创建接口文件，用来调用系统接口。
3-1、在你的项目创建一个IPackageManager.java文件，包名为

1
package android.content.pm;

3-2、在创建完毕后，你的IPackageManager.java文件内容为

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
package android.content.pm;

import android.content.ComponentName;
import android.content.Intent;
import android.net.Uri;
import android.os.Binder;
import android.os.IBinder;
import android.os.IInterface;
import android.os.PersistableBundle;
import android.os.RemoteException;

import java.util.List;

public interface IPackageManager extends IInterface {

    IPackageInstaller getPackageInstaller()
            throws RemoteException;
    String getInstallerPackageName(String packageName);
    ParceledListSlice getInstalledPackages(int flags, int userId);
    ParceledListSlice getInstalledPackages(long flags, int userId);
    PackageInfo getPackageInfo(String packageName, int flags, int userId);
    PackageInfo getPackageInfo(String packageName, long flags, int userId);
    PackageInfo getPackageInfo(String packageName, int flags);

    ApplicationInfo getApplicationInfo(String packageName, int flags ,int userId);
    ApplicationInfo getApplicationInfo(String packageName, long flags, int userId);
    //android4-5
    boolean addPermission(PermissionInfo info);
    void removePermission(String name);
    void grantPermission(String packageName, String permissionName);
    void revokePermission(String packageName, String permissionName);

    //android6-10
    void grantRuntimePermission(String packageName, String permissionName, int userId);
    void revokeRuntimePermission(String packageName, String permissionName, int userId);

    int checkPermission(String permName, String pkgName);
    int checkPermission(String permName, String pkgName, int userId);
    int checkUidPermission(String permName, int uid);

    //android 4.0.x
    void installPackage( Uri packageURI, IPackageInstallObserver observer, int flags, String installerPackageName);
    //android4.4
    void installPackageWithVerification(Uri packageURI, IPackageInstallObserver observer,
                                        int flags,  String installerPackageName,  Uri verificationURI,
                                         ManifestDigest manifestDigest, ContainerEncryptionParams encryptionParams);

    void installPackageWithVerificationAndEncryption( Uri packageURI,
                                                      IPackageInstallObserver observer, int flags,  String installerPackageName,
                                                      VerificationParams verificationParams,
                                                      ContainerEncryptionParams encryptionParams);



    void deletePackageAsUser(String packageName, IPackageDeleteObserver observer, int userId, int flags);
    void deletePackage(String packageName, IPackageDeleteObserver observer, int flags);
    int getPackageUid(String packageName, long flags, int userId);
    int getPackageUid(String packageName, int userId);
    int getPackageUid(String packageName, int flags, int userId);
    int getPackageUid(String packageName);

    void setComponentEnabledSetting( ComponentName componentName,int newState,  int flags, int userId);

    void setComponentEnabledSettings(List<PackageManager.ComponentEnabledSetting> settings, int userId);

    void setComponentEnabledSetting(ComponentName componentName, int newState,int flags, int userId, String callingPackage);
    void setComponentEnabledSetting(ComponentName componentName, int newState, int flags);
    void setComponentEnabledSettings(List<PackageManager.ComponentEnabledSetting> settings, int userId, String callingPackage);

    int getComponentEnabledSetting(ComponentName componentName, int userId);
    int getComponentEnabledSetting(ComponentName componentName);
    void setApplicationEnabledSetting(String packageName,int newState, int flags,int userId, String callingPackage);
    void setApplicationEnabledSetting(String packageName, int newState, int flags, int userId);
    void setApplicationEnabledSetting(String packageName, int newState, int flags);
    int getApplicationEnabledSetting(String packageName, int userId);
    int getApplicationEnabledSetting(String packageName);


    boolean setApplicationHiddenSettingAsUser(String packageName, boolean hidden, int userId);
    boolean getApplicationHiddenSettingAsUser(String packageName, int userId);

    int installExistingPackage(String packageName);
    int installExistingPackageAsUser(String packageName, int userId);

    int installExistingPackageAsUser(String packageName, int userId, int installFlags,int installReason);
    int installExistingPackageAsUser(String packageName, int userId, int installFlags,int installReason, List<String> whiteListedPermissions);
    void installPackageAsUser(String originPath,
                               IPackageInstallObserver2 observer,
                              int flags,
                               String installerPackageName,
                               VerificationParams verificationParams,
                               String packageAbiOverride,
                              int userId);

    //android 4.1
    List<UserInfo> getUsers();
    UserInfo getUser(int userId);

    //android15
    String[] setPackagesSuspendedAsUser(String[] packageNames, boolean suspended,
                                        PersistableBundle appExtras, PersistableBundle launcherExtras,
                                        SuspendDialogInfo dialogInfo, int flags, String suspendingPackage,
                                        int suspendingUserId, int targetUserId);

    //android10-14
    String[] setPackagesSuspendedAsUser(String[] packageNames, boolean suspended,
                                        PersistableBundle appExtras, PersistableBundle launcherExtras,
                                        SuspendDialogInfo dialogInfo, String callingPackage, int userId);


    //android9
    String[] setPackagesSuspendedAsUser(String[] packageNames, boolean suspended,
                                        PersistableBundle appExtras, PersistableBundle launcherExtras,
                                        String dialogMessage, String callingPackage, int userId);

    //android7-8
    String[] setPackagesSuspendedAsUser(String[] packageNames, boolean suspended, int userId);
    boolean isPackageSuspendedForUser(String packageName, int userId);

    void deleteApplicationCacheFilesAsUser(String packageName, int userId, IPackageDataObserver observer);


    ParceledListSlice queryIntentActivities(Intent intent, String resolvedType, long flags, int userId);
    ParceledListSlice queryIntentActivities(Intent intent,String resolvedType, int flags, int userId);
    abstract class Stub extends Binder implements IPackageManager {

        public static IPackageManager asInterface(IBinder obj) {
            throw new UnsupportedOperationException();
        }
    }
}

这些都是我自己用得到的接口，你如果需要其它的话，直接塞进去就行了。

3-3、创建BinderWrapper文件，名字随便，内容如下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
package com.easymanager.core.server;

import android.os.IBinder;
import android.os.IInterface;
import android.os.Parcel;
import android.os.RemoteException;

import java.io.FileDescriptor;
import java.util.Objects;

public class easyManagerBinderWrapper implements IBinder {

    private final  IBinder ori;

    public easyManagerBinderWrapper(IBinder ori2) {
        this.ori = Objects.requireNonNull(ori2);
    }

    @Override
    public String getInterfaceDescriptor() throws RemoteException {
        return ori.getInterfaceDescriptor();
    }

    @Override
    public boolean pingBinder() {
        return ori.pingBinder();
    }

    @Override
    public boolean isBinderAlive() {
        return ori.isBinderAlive();
    }

    @Override
    public IInterface queryLocalInterface(String s) {
        return ori.queryLocalInterface(s);
    }

    @Override
    public void dump(FileDescriptor fileDescriptor, String[] strings) throws RemoteException {
        ori.dump(fileDescriptor,strings);
    }

    @Override
    public void dumpAsync(FileDescriptor fileDescriptor, String[] strings) throws RemoteException {
        ori.dumpAsync(fileDescriptor, strings);
    }

    @Override
    public boolean transact(int i, Parcel parcel, Parcel parcel1, int i1) throws RemoteException {
        return ori.transact(i, parcel, parcel1, i1);
    }

    @Override
    public void linkToDeath(DeathRecipient deathRecipient, int i) throws RemoteException {
        ori.linkToDeath(deathRecipient, i);
    }

    @Override
    public boolean unlinkToDeath(DeathRecipient deathRecipient, int i) {
        return ori.unlinkToDeath(deathRecipient, i);
    }
}


3-4、再创建一个PortService文件，名字随便，内容如下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117

package com.easymanager.core.server;

import android.os.IBinder;
import android.os.Parcel;
import android.text.TextUtils;

import java.io.Serializable;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.util.HashMap;
import java.util.Map;

public class easyManagerPortService implements Serializable {

    private static final Map<String, IBinder> SYSTEM_SERVICE_CACHE = new HashMap<>();
    private static final Map<String, Integer> TRANSACT_CODE_CACHE = new HashMap<>();

    private static Method getService;

    static {
        Class<?> sm = null;
        try {
            sm = Class.forName("android.os.ServiceManager");
            getService = sm.getMethod("getService", String.class);
        } catch (ClassNotFoundException e) {
            throw new RuntimeException(e);
        } catch (NoSuchMethodException e) {
            throw new RuntimeException(e);
        }

    }

    /**
     * Returns a reference to a service with the given name.
     *
     * @param name the name of the service to get such as "package" for android.content.pm.IPackageManager
     * @return a reference to the service, or <code>null</code> if the service doesn't exist
     */
    public static IBinder getSystemService(String name) {
        IBinder binder = SYSTEM_SERVICE_CACHE.get(name);
        if (binder == null) {
            try {
                binder = (IBinder) getService.invoke(null, name);
            } catch (IllegalAccessException e) {
                throw new RuntimeException(e);
            } catch (InvocationTargetException e) {
                throw new RuntimeException(e);
            }
            SYSTEM_SERVICE_CACHE.put(name, binder);
        }
        return binder;
    }

    /**
     * Returns transaction code from given class and method name.
     *
     * @param className  class name such as "android.content.pm.IPackageManager$Stub"
     * @param methodName method name such as "getInstalledPackages"
     * @return transaction code, or <code>null</code> if the class or the method doesn't exist
     * @deprecated Use {@link easyManagerBinderWrapper} instead
     */
    @Deprecated
    public static Integer getTransactionCode( String className, String methodName) {
        final String fieldName = "TRANSACTION_" + methodName;
        final String key = className + "." + fieldName;

        Integer value = TRANSACT_CODE_CACHE.get(key);
        if (value != null) return value;

        try {
            final Class<?> cls = Class.forName(className);
            Field declaredField = null;
            try {
                declaredField = cls.getDeclaredField(fieldName);
            } catch (NoSuchFieldException e) {
                for (Field f : cls.getDeclaredFields()) {
                    if (f.getType() != int.class)
                        continue;

                    String name = f.getName();
                    if (name.startsWith(fieldName + "_")
                            && TextUtils.isDigitsOnly(name.substring(fieldName.length() + 1))) {
                        declaredField = f;
                        break;
                    }
                }
            }
            if (declaredField == null) {
                return null;
            }

            declaredField.setAccessible(true);
            value = declaredField.getInt(cls);

            TRANSACT_CODE_CACHE.put(key, value);
            return value;
        } catch (Exception e) {
            e.printStackTrace();
        }
        return null;
    }


    @Deprecated
    public static Parcel obtainParcel( String serviceName,  String interfaceName,  String methodName) {
        return obtainParcel(serviceName, interfaceName, interfaceName + "$Stub", methodName);
    }

    @Deprecated
    public static Parcel obtainParcel( String serviceName, String interfaceName,  String className,  String methodName) {
        throw new UnsupportedOperationException("Direct use of Shizuku#transactRemote is no longer supported, please use ShizukuBinderWrapper");
    }
}


3-5、去需要提权的那个Java main文件里面，编写调用的语句

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
import android.os.Build;
import android.os.Looper;
import android.os.Process;

public class startAdbService {
    public static void main(String[] args) {
        // 利用looper让线程循环
        Looper.prepareMainLooper();
		
		int pkguid = getPKGUID("com.test",0):
		System.out.println("pkguid ::: " + pkguid);//这样就能输出获取的包名uid了
        Looper.loop();
    }
		
		public static IPackageManager getIPackageManager(){
	IPackageManager iPackageManager = null;
	if(iPackageManager != null && iPackageManager.asBinder().isBinderAlive()){
		return iPackageManager;
	}
	Singleton<IPackageManager> iPackageManagerSingleton = new Singleton<IPackageManager>() {
		@Override
		protected IPackageManager create() {
			return IPackageManager.Stub.asInterface(new easyManagerBinderWrapper(easyManagerPortService.getSystemService("package")));
		}
	};
	iPackageManager = iPackageManagerSingleton.get();
	return iPackageManager;
}


public static int getPKGUID(String pkgname , int uid){
	IPackageManager iPackageManager = getIPackageManager();
	if(Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU){
		return iPackageManager.getPackageUid(pkgname,0L,uid);
	}else if(Build.VERSION.SDK_INT >=Build.VERSION_CODES.N){
		return iPackageManager.getPackageUid(pkgname,0,uid);
	}else if(Build.VERSION.SDK_INT >=Build.VERSION_CODES.JELLY_BEAN){
		return iPackageManager.getPackageUid(pkgname,uid);
	}else {
		return iPackageManager.getPackageUid(pkgname);
	}
}
		
}

这样就是一个完整的调用教程，文章已结束。

enjoy😀