Android system root and silent installation

<span id="Label3"></p>Android system root and silent installation <blockquote> <blockquote> <p>Silent installation, which refers to installation without any user intervention, directly to the default settings to install the app. because, It does not need user intervention, in many cases become the user does not know, the application unknowingly Installed. is in the promotion of extremely rogue means, very similar to the bundled installation on the PC. Because the silent installation is extremely rogue promotion behavior, so, Its promotion price is extremely high.</p> </blockquote> </blockquote><p><p><strong>Android apps are installed in four different ways</strong></p></p> <table> <thead> <tr> <th align="left">installation Form</th> <th align="left">Completion Method</th> </tr> </thead> <tbody> <tr> <td align="left">System Application Installation</td> <td align="left">Complete the boot, need to join the boot execution script, no installation interface</td> </tr> <tr> <td align="left">Network Download Application Installation</td> <td align="left">Complete with System Market application, no Installation Interface</td> </tr> <tr> <td align="left">Installation in the ADB tool</td> <td align="left">Using the PM install command, there is no installation interface.</td> </tr> <tr> <td align="left">Third-party App Installation</td> <td align="left">Installed via the SD card apk file, There is an installation interface, which is handled by the PACKAGEINSTALLER.APK application to handle the installation and uninstallation Process.</td> </tr> </tbody> </table><p><p><strong>Process and path for application installation</strong></p></p> <table> <thead> <tr> <th align="left">Catalogue</th> <th align="left">Key Features</th> </tr> </thead> <tbody> <tr> <td align="left">/system/app</td> <td align="left">The system comes with the application to store, the root permission can change</td> </tr> <tr> <td align="left">/data/app</td> <td align="left">User program installs the directory, has the delete Permission. Copy the apk file to this directory during installation</td> </tr> <tr> <td align="left">/data/data</td> <td align="left">Store data for your application</td> </tr> <tr> <td align="left">Data/dalvik-cache</td> <td align="left">Install the Dex file in the APK into the Dalvik-cache directory</td> </tr> </tbody> </table><p><p><strong>installation Process</strong><br>Copy the APK installation package into the Data/app directory, unzip and scan the installation package, save the Dex file (dalvik Bytecode) to the Dalvik-cache directory, and create the corresponding application Data directory in the Data/data directory.</p></p><p><p><strong>Uninstallation Process</strong><br>Delete the files and directories created in the above three directories during the installation Process.</p></p>Permission declarations <blockquote> <blockquote> <p>Google's security policy requires that any app should prompt the APK installation package at the time of installation confirmation, confirming the Developer's rights in Androidmanafest.xml. Of course, Google has also done some things on android, allowing some of the system's internal apps to be installed without an authorized Interface. And the system into the installation interface is actually based on this intent jump to the Packageinstaller application to complete the prompt and installation of permissions.</p> </blockquote> </blockquote><p><p>Here we write the code piece ' We control the app app in the app, actually sending a intent as Follows. To call Packageinstaller for installation, The specific operation code is as Follows:</p></p><pre class="prettyprint"><pre class="prettyprint"><code class=" hljs avrasm"><span class="hljs-comment">/* 安装apk */</span>Intent intent = new Intent()<span class="hljs-comment">;</span>intent<span class="hljs-preprocessor">.setAction</span>(Intent<span class="hljs-preprocessor">.ACTION</span>_VIEW)<span class="hljs-comment">;</span>intent<span class="hljs-preprocessor">.addFlags</span>(Intent<span class="hljs-preprocessor">.FLAG</span>_ACTIVITY_NEW_TASK)<span class="hljs-comment">;</span>intent<span class="hljs-preprocessor">.setDataAndType</span>(Uri<span class="hljs-preprocessor">.parse</span>(<span class="hljs-string">"file://"</span>+ fileName)， <span class="hljs-string">"application/vnd.android.package-archive"</span>)<span class="hljs-comment">;</span>context<span class="hljs-preprocessor">.startActivity</span>(intent)<span class="hljs-comment">;</span></code></pre></pre><p><p>In contrast to the normal installation process, the essence of a silent installation is to remove the process that the user authorizes to install as shown, and install the application directly.</p></p><p><p></p></p><p><p><strong>SOURCE Analysis</strong></p></p><p><p>After reading the source code we know that the system installation process is actually called the system Packageinstaller to Complete. If you want to install silently, find a way to bypass the permission-granting prompts in Packageinstaller and continue with the installation steps.<br>so, The idea is very simple, we can operate from two aspects:</p></p> <ul> <ul> <li>Find the Packageinstaller source code, skip permission to grant reminders, directly call the following installation API to complete the Installation. (this allows good compatibility with normal installation, not easy to Error)</li> <li>Install using the PM install Command.</li> </ul> </ul><p><p><strong>Calling the hidden API in Packageinstaller</strong></p></p> <blockquote> <blockquote> <p>View Packageinstaller Source Code We can find that, in fact, Packageinstaller is also installed by using Packagemanager. Called is its installpackage method, but this method is an abstract, and is not visible to the outside (hide),</p> </blockquote> </blockquote><p><p>The definition is as Follows:</p></p><pre class="prettyprint"><pre class="prettyprint"><code class="hljs java"><span class="hljs-keyword">public </span> abstractclass Packagemanager {..... <span class="hljs-javadoc">/** * Install app apk file *<span class="hljs-javadoctag"> @param </span> Packageuri The location of the apk file to be installed, can be ' File: ' or ' content: ' URI. *<span class="hljs-javadoctag"> @param </span> Observer an APK file installation Status Viewer *<span class="hljs-javadoctag"> @param </span> Flags installation form install_forward_lock, install_replace_existing, Install_allow_test. *<span class="hljs-javadoctag"> @paraminstallerPackageName </span> APK installation package PackageName */</span> <span class="hljs-comment">//@SystemApi </span> <span class="hljs-keyword">public </span> <span class="hljs-keyword">abstract </span> <span class="hljs-keyword">void </span> <span class="hljs-title">installpackage </span> (uripackageuri, packageinstallobserverobserver,<span class="hljs-keyword">int </span> flags, stringinstallerpackagename);} </code> </pre></pre><p><p>and Packagemanager and InstallPackage both are abstract abstractions. Its implementation is in applicationpackagemanager, and its implementation in InstallPackage Is:</p></p><pre class="prettyprint"><pre class="prettyprint"><code class=" hljs java"><span class="hljs-keyword">final</span> classApplicationPackageManager extends PackageManager { ...... ApplicationPackageManager(ContextImpl context， IPackageManager pm) { mContext = context; mPM = pm; } <span class="hljs-annotation">@Override</span> <span class="hljs-keyword">public</span><span class="hljs-keyword">void</span><span class="hljs-title">installPackage</span>(Uri packageURI， IPackageInstallObserver observer，intflags， String installerPackageName){ <span class="hljs-keyword">try</span> { mPM.installPackage(packageURI， observer， flags， installerPackageName); <span class="hljs-keyword">catch</span> (RemoteException e) { <span class="hljs-comment">// Should never happen!</span> } }}</code></pre></pre><p><p>The InstallPackage method for the visible call is the InstallPackage method in Ipackagemanager. In Contextimpl by invoking the<br>Activitythread.getpackagemanager () Gets the Ipackagemanager instance Object. In the Activitythread.getpackagemanager () method, the service named package in Systemservice is called to Instantiate. The code is as Follows:</p></p><pre class="prettyprint"><pre class="prettyprint"><code class=" hljs cs">staticIPackageManager sPackageManager;<span class="hljs-keyword">public</span><span class="hljs-title">getPackageManager</span>() { <span class="hljs-keyword">if</span><span class="hljs-keyword">null</span>) { <span class="hljs-keyword">return</span> sPackageManager; } IBinder b = ServiceManager.getService(<span class="hljs-string">"package"</span>); sPackageManager = IPackageManager.Stub.asInterface(b); <span class="hljs-keyword">return</span> sPackageManager;}</code></pre></pre><p><p>Because InstallPackage is the System's api, in order to use Packagemanagerservice.installpackage (), consider using the reflection mechanism to invoke InstallPackage ().</p></p><p><p>But what is hard to get is the type of ipackageinstallobserver in its argument, and we look at Ipackageinstallobserver and find that ipackageinstallobserver is defined by the Aidl file. This too can not fail us, through the characteristics of the Aidl file, Copy the Ipackageinstallobserver.aidl file into the local program, you can get the class ipackageinstallobserver.calss, which reflects the InstallPackage () method.</p></p><p><p>however, when invoke calls the method, it cannot get the instance object of Ipackageinstallobserver. The instance object of Ipackageinstallobserver must be obtained by means of IPackageInstallObserver.Stub.asInterface (binder binder) and cannot get the binder object it binds to. therefore, the reflected method cannot be Executed.</p></p><p><p>second, It should be the system API that declares the right to install the app: android.permission.INSTALL_PACKAGES. This kind of more sensitive permission was not said to be given by the claims system, but also required that our installation package APK file had the same signature as the system in order to complete the silent installation Operation. The silent installation of this method is unrealistic for widespread application.</p></p><p><p><strong>Installing using the PM command</strong></p></p> <blockquote> <blockquote> <p>The PM command is an android Packagemanage command line that is used to install the package Operation. And the system is mainly to provide us in ADB<br>The PM command is used in the shell, so the PM command also exists under the "/system" directory, and of course, the application with the root authority can use it for silent Installation.</p> </blockquote> </blockquote><p><p>The specific operation code is as Follows:</p></p><pre class="prettyprint"><code class=" hljs cs"><code class="hljs cs"><span class="hljs-comment">//xxx.apk placed in the root directory of the built-in storage </span> execcommand ( <span class="hljs-string"> "system/bin/pminstall-r" </span> + <span class="hljs-string"> "sdcard/xxx.apk" </span>); span class= "hljs-comment" >//execute command <span class="hljs-keyword">public </span> <span class="hljs-title"> Booleanexeccommand </span> (String cmd) {process process = <span class="hljs-keyword">null </span>; <span class="hljs-keyword">try </span> {process = runtime.getruntime (). exec (cmd); Process.waitfor (); } <span class="hljs-keyword">catch </span> (Exception e) {<span class="hljs-keyword">return </span> <span class="hlj S-keyword ">false </span>; } <span class="hljs-keyword">finally </span> {<span class="hljs-keyword">try </span> {process.destroy (); } <span class="hljs-keyword">catch </span> (Exception e) {}} <span class="hljs-keyword">return </span> Span class= "hljs-keyword" >true ;} </code></code></pre> <blockquote> <blockquote> <p>PM Command Source Directory:<br>/frameworks/base/cmds/pm/src/com/android/commands/pm/pm.java,</p> </blockquote> </blockquote><p><p>We look at its source code, as Follows:</p></p><pre class="prettyprint"><code class=" hljs java"><span class="hljs-keyword"><span class="hljs-keyword"></span> public</span>Finalclass Pm {ipackagemanager mPm; Iusermanager mUm;<span class="hljs-keyword"><span class="hljs-keyword">Private</span></span>weakhashmap<string, resources> Mresourcecache =<span class="hljs-keyword"><span class="hljs-keyword">New</span></span>weakhashmap<string, resources> ();<span class="hljs-keyword"><span class="hljs-keyword">Private</span></span>string[] margs;<span class="hljs-keyword"><span class="hljs-keyword">Private</span></span> <span class="hljs-keyword"><span class="hljs-keyword">int</span></span>mnextarg;<span class="hljs-keyword"><span class="hljs-keyword">Private</span></span>String mcurargdata;<span class="hljs-keyword"><span class="hljs-keyword">Private</span></span> <span class="hljs-keyword"><span class="hljs-keyword">Static</span></span> <span class="hljs-keyword"><span class="hljs-keyword">Final</span></span>String Pm_not_running_err =<span class="hljs-string"><span class="hljs-string">"error:could not access Thepackage Manager. Is the systemrunning? "</span></span>;<span class="hljs-keyword"><span class="hljs-keyword"></span> public</span> <span class="hljs-keyword"><span class="hljs-keyword">Static</span></span> <span class="hljs-keyword"><span class="hljs-keyword">void</span></span> <span class="hljs-title"><span class="hljs-title">Main</span></span>(string[] Args) {<span class="hljs-keyword"><span class="hljs-keyword">New</span></span>Pm (). Run (args); }<span class="hljs-javadoc"><span class="hljs-javadoc">/** * Parse Command parameters *<span class="hljs-javadoctag"> @param</span> args parameter</span> */</span> <span class="hljs-keyword"><span class="hljs-keyword"></span> public</span> <span class="hljs-keyword"><span class="hljs-keyword">void</span></span> <span class="hljs-title"><span class="hljs-title">Run</span></span>(string[] Args) {<span class="hljs-keyword"><span class="hljs-keyword">Boolean</span></span>Validcommand =<span class="hljs-keyword"><span class="hljs-keyword">false</span></span>;<span class="hljs-keyword"><span class="hljs-keyword">if</span></span>(args.length <<span class="hljs-number"><span class="hljs-number">1</span></span>) {showusage ();<span class="hljs-keyword"><span class="hljs-keyword">return</span></span>; } mUm =iusermanager.stub.asinterface (servicemanager.getservice (<span class="hljs-string"><span class="hljs-string">"user"</span></span>)); MPm =ipackagemanager.stub.asinterface (servicemanager.getservice (<span class="hljs-string"><span class="hljs-string">"package"</span></span>));<span class="hljs-keyword"><span class="hljs-keyword">if</span></span>(mPm = =<span class="hljs-keyword"><span class="hljs-keyword">NULL</span></span>) {System.err.println (pm_not_running_err);<span class="hljs-keyword"><span class="hljs-keyword">return</span></span>; } ......<span class="hljs-keyword"><span class="hljs-keyword">if</span></span>(<span class="hljs-string"><span class="hljs-string">"install"</span></span>. equals (op)) {runinstall ();<span class="hljs-keyword"><span class="hljs-keyword">return</span></span>; } ...... }<span class="hljs-javadoc"><span class="hljs-javadoc">/** * Start Installation *</span> /</span> <span class="hljs-keyword"><span class="hljs-keyword">Private</span></span> <span class="hljs-keyword"><span class="hljs-keyword">void</span></span> <span class="hljs-title"><span class="hljs-title">Runinstall</span></span>() { ......<span class="hljs-comment"><span class="hljs-comment">specific calls to//installation logic</span></span>Packageinstallobserver Obs = Newpackageinstallobserver ();<span class="hljs-keyword"><span class="hljs-keyword">Try</span></span>{verificationparamsverificationparams =<span class="hljs-keyword"><span class="hljs-keyword">New</span></span>Verificationparams (verificationuri, originatinguri, referreruri, verificationparams.no_uid,<span class="hljs-keyword"><span class="hljs-keyword">NULL</span></span>); Mpm.installpackagewithverificationandencryption (apkuri, obs, installflags, installerpackagename, Verifi cationparams, encryptionparams);<span class="hljs-keyword"><span class="hljs-keyword">synchronized</span></span>(obs) {<span class="hljs-keyword"><span class="hljs-keyword"></span> while</span>(!obs.finished) {<span class="hljs-keyword"><span class="hljs-keyword">Try</span></span>{obs.wait (); }<span class="hljs-keyword"><span class="hljs-keyword">Catch</span></span>(interruptedexception E) { } }<span class="hljs-keyword"><span class="hljs-keyword">if</span></span>(obs.result ==packagemanager.install_succeeded) {System.out.println (<span class="hljs-string"><span class="hljs-string">"Success"</span></span>); }<span class="hljs-keyword"><span class="hljs-keyword">Else</span></span>{System.err.println (<span class="hljs-string"><span class="hljs-string">"failure["</span></span>+installfailuretostring (obs.result) +<span class="hljs-string"><span class="hljs-string">"]"</span></span>); } } }<span class="hljs-keyword"><span class="hljs-keyword">Catch</span></span>(remoteexception E) {System.err.println (e.tostring ()); System.err.println (pm_not_running_err); } } ......}</code></pre><p><p>found that the PM command is also called the installation method in packagemanager, but is a verification and encryption method installpackagewithverificationandencryption to Install. That is, its installation process is the same as the Packageinstaller.</p></p><p><p>While we install the app app, can be its own APK installation package files stored in two places "data/app" and "system/app", silent installation of the general situation is to choose to push their own apk file into the "system/app" directory, Because this directory is the system application directory, in this directory of malicious applications, to steal text messages, steal messages and other operations, users are very difficult to detect.</p></p>Remove preinstalled <blockquote> <blockquote> <p>The main purpose of most ordinary user root phones is to remove pre-installed applications and to remove them, we first need to know what is preinstalled and where they are stored. Or let's change our mind to see where the system manufacturer stores the App's apk file to become a system Application.</p> </blockquote> </blockquote><p><p><strong>1. The system default general application storage place</strong></p></p><p><p>Android bundled application software is basically installed under the "/system/app" folder, Delete the corresponding third-party software apk file below to perfect Uninstall. We know that "/system" is the directory of the system, the operation of this directory requires root access, so we delete the pre-installed application requires the root Phone. Each system program is basically paired, and the corresponding delete suffix is. apk and. Odex (optimized dex file) files to remove preinstalled Apps.</p></p><p><p>For example, use root Explorer to view the "/system/app" directory. You can see all of the System's built-in applications in the System.<br></p></p><p><p><strong>2. Modifying the pre-installed system boot</strong></p></p> <blockquote> <blockquote> <p>It is very common to store the apk file in the "/system/app" directory, which leads to the easy uninstallation of the preinstalled Application. Malicious phone ROM will think of a more disgusting way to retain preinstalled applications, such as modifying the logic of the system rom, so that the system at boot time to detect the integrity of their pre-installed and then Reinstall. well, of course, the installation files for preinstalled applications will also be saved in one copy.</p> </blockquote> </blockquote><p><p>This type of pre-installed application, also known as "boot silent installation", The common way is to modify the init.rc, add a boot execution script, in the script call a service using the PM install command to install the application in Bulk.<br>For example, from the top of one init.local.rc content is as Follows:</p></p><pre class="prettyprint"><pre class="prettyprint"><code class=" hljs avrasm"><span class="hljs-preprocessor">#Preinstall</span><span class="hljs-label">onproperty:</span>dev<span class="hljs-preprocessor">.bootcomplete</span>=<span class="hljs-number">1</span> start loadpreinstallsserviceloadpreinstalls /system/bin/logwrapper /system/bin/loadpreinstalls<span class="hljs-preprocessor">.sh</span> disabled oneshot</code></pre></pre><p><p>In the System's init.rc script, call init.local.rc as Follows:</p></p><pre class="prettyprint"><code class=" hljs bash"><span class="hljs-comment"><span class="hljs-comment">#在sysinit前面加</span></span><span class="hljs-comment"><span class="hljs-comment"># Include Extrainit file</span></span>Import/system/etc/init.local.rc and specific pre-installed scripts exist/system/bin/loadpreinstalls.sh<span class="hljs-comment"><span class="hljs-comment"># do preinstall Job</span></span><span class="hljs-keyword"><span class="hljs-keyword">if</span></span>[ !<span class="hljs-operator">- <span class="hljs-operator">e</span></span>/data/.notfirstrun]<span class="hljs-keyword"><span class="hljs-keyword"></span> then</span><span class="hljs-built_in"><span class="hljs-built_in">Echo</span></span> <span class="hljs-string"><span class="hljs-string">"dopreinstall sys"</span></span>>>/system/log.txt<span class="hljs-comment"><span class="hljs-comment">#安装 all apk files Under/system/preinstall</span></span>Apklist= ' ls/system/preinstall/*.apk '<span class="hljs-keyword"><span class="hljs-keyword"></span> for</span>Infiles<span class="hljs-keyword"><span class="hljs-keyword">inch</span></span> <span class="hljs-variable"><span class="hljs-variable">$APKLIST</span></span> <span class="hljs-keyword"><span class="hljs-keyword"></span> do</span> <span class="hljs-built_in"><span class="hljs-built_in">Echo</span></span>Setup Package:<span class="hljs-variable"><span class="hljs-variable">$INFILES</span></span>PM INSTALL-R<span class="hljs-variable"><span class="hljs-variable">$INFILES</span></span> <span class="hljs-keyword"><span class="hljs-keyword"></span> done</span><span class="hljs-built_in"><span class="hljs-built_in">Echo</span></span> <span class="hljs-string"><span class="hljs-string">"dopreinstall sd"</span></span>>>/system/log.txt<span class="hljs-comment"><span class="hljs-comment">#安装 all apk files Under/sdcard/preinstall</span></span>Apklist= ' ls/sdcard/preinstall/*.apk '<span class="hljs-keyword"><span class="hljs-keyword"></span> for</span>Infiles<span class="hljs-keyword"><span class="hljs-keyword">inch</span></span> <span class="hljs-variable"><span class="hljs-variable">$APKLIST</span></span> <span class="hljs-keyword"><span class="hljs-keyword"></span> do</span> <span class="hljs-built_in"><span class="hljs-built_in">Echo</span></span>Setup Package:<span class="hljs-variable"><span class="hljs-variable">$INFILES</span></span>PM INSTALL-R<span class="hljs-variable"><span class="hljs-variable">$INFILES</span></span> <span class="hljs-keyword"><span class="hljs-keyword"></span> done</span> <span class="hljs-built_in"><span class="hljs-built_in">Echo</span></span> <span class="hljs-string"><span class="hljs-string">"do Preinstall ok"</span></span>>>/system/log.txt BusyBox Touch/data/.notfirstrun<span class="hljs-keyword"><span class="hljs-keyword">fi</span></span><span class="hljs-built_in"><span class="hljs-built_in">Echo</span></span> <span class="hljs-string"><span class="hljs-string">"============================================"</span></span>>>/system/log.txt<span class="hljs-keyword"><span class="hljs-keyword">Exit</span></span></code></pre><p><p>This way do pre-installed users after the use of root Deleted/system/app installed applications under the system restart will be executed after the startup script automatically reload the application back, and pre-installed apk file storage directory according to different system ROM is not the same, is extremely rogue promotion strategy. Of course, we have seen through the analysis, if you want to delete this type of pre-installed applications, only need to scan the entire APK file and then Delete.</p></p><p><p>/*<br>* @author Zhoushengtao (Zhou San)<br>* @since January 27, 2015 14:02:22<br>* @weixin stchou_zst<br>* @blog http://blog.csdn.net/yzzst<br>* @ Exchange Learning QQ group: 341989536<br>* @ Private qq:445914891<br>/<br></p></p> <p><p>Android system root and silent installation</p></p></span>