360 one-click root su analysis and 360rootsu Analysis

360 one-click root su analysis and 360rootsu Analysis

Today, a colleague asked me why 360 of the su permission is 755.

I did not pay attention to this detail before. I checked my mobile phone and used the 360root su.

Since there is no SUID or SGID permission, how does one access things under the root user.

So I spent some time studying it. 360 was mainly used to circumvent the selinux mechanism of android systems after 4.4.

The main steps are as follows:

1. Modify install-recovery.sh

The content of this file is changed to/system/bin/su -- daemon &

2. The install-recovery.sh is executed in the init phase and is not affected by selinux.

3. init stage

......

Determine the startup parameter. If it is -- daemon, change the process name to permmgrd.

4. view the permmgrd process in ps. In fact, permmgrd is the symbolic link of su.

5. c/s architecture

As a result, we have roughly understood that 360 of the total su groups have become.

(1) The permmgrd process started in the. init stage has full root permissions and is theoretically not restricted by selinux.

(2) The operations performed after the user executes su may be executed by the permmgrd process.