Skip to content

Commit d0cbbc0

Browse files
unkn0wNameunkn0wName
unkn0wName
authored and
unkn0wName
committed
feat: 累计更新2026-4-21，修复大量bug
1 parent 4aa4de0 commit d0cbbc0

36 files changed

Lines changed: 350 additions & 187 deletions

‎Lite_version/SKRoot_Lite(2026-4-21).apk‎

7.05 MB
Binary file not shown.

‎Lite_version/patch_kernel_root(2026-4-21).exe‎

1.91 MB
Binary file not shown.

‎Lite_version/src/PermissionManager/app/build.gradle‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ android {
1010
minSdk 26
1111
targetSdk 31
1212
versionCode 1
13-
versionName "2026-4-8"
13+
versionName "2026-4-21"
1414

1515
testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
1616
externalNativeBuild {

‎Lite_version/src/PermissionManager/app/src/main/java/com/linux/permissionmanager/MainActivity.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ public void handleMessage(@NonNull Message msg) {
133133
super.handleMessage(msg);
134134
}
135135
};
136-
DialogUtils.showInputDlg(this, rootKey,"请输入Root权限的KEY", null, inputCallback, null);
136+
DialogUtils.showInputDlg(this, rootKey,"请输入Root权限的Key", null, inputCallback, null);
137137
}
138138
private void checkGetAppListPermission() {
139139
if(GetAppListPermissionHelper.getPermissions(this)) return;

‎Lite_version/src/PermissionManager/app/src/main/res/layout/activity_main.xml‎

Lines changed: 42 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
33
xmlns:tools="http://schemas.android.com/tools"
4+
xmlns:app="http://schemas.android.com/apk/res-auto"
45
android:layout_width="match_parent"
56
android:layout_height="match_parent"
67
android:orientation="vertical"
@@ -97,60 +98,88 @@
9798
android:textColor="@color/black"
9899
/>
99100

100-
<Button
101+
<com.google.android.material.button.MaterialButton
101102
android:layout_marginTop="5dp"
102103
android:id="@+id/test_root_btn"
103104
android:layout_width="wrap_content"
104105
android:layout_height="wrap_content"
105106
android:text="1.测试Root权限"
107+
android:paddingLeft="20dp"
108+
android:paddingRight="20dp"
109+
app:cornerRadius="8dp"
110+
style="@style/Widget.MaterialComponents.Button"
106111
/>
107112

108-
<Button
113+
<com.google.android.material.button.MaterialButton
109114
android:layout_marginTop="5dp"
110115
android:id="@+id/run_root_cmd_btn"
111116
android:layout_width="wrap_content"
112117
android:layout_height="wrap_content"
113118
android:text="2.执行Root命令"
119+
android:paddingLeft="20dp"
120+
android:paddingRight="20dp"
121+
app:cornerRadius="8dp"
122+
style="@style/Widget.MaterialComponents.Button"
114123
/>
115124

116-
<Button
125+
<com.google.android.material.button.MaterialButton
117126
android:layout_marginTop="5dp"
118127
android:id="@+id/root_exec_process_btn"
119128
android:layout_width="wrap_content"
120129
android:layout_height="wrap_content"
121130
android:text="3.以Root运行程序"
131+
android:paddingLeft="20dp"
132+
android:paddingRight="20dp"
133+
app:cornerRadius="8dp"
134+
style="@style/Widget.MaterialComponents.Button"
122135
/>
123136

124-
<Button
137+
<com.google.android.material.button.MaterialButton
125138
android:layout_marginTop="5dp"
126139
android:id="@+id/su_env_install_btn"
127140
android:layout_width="wrap_content"
128141
android:layout_height="wrap_content"
129142
android:text="4.安装部署su"
143+
android:paddingLeft="20dp"
144+
android:paddingRight="20dp"
145+
app:cornerRadius="8dp"
146+
style="@style/Widget.MaterialComponents.Button"
130147
/>
131148

132-
<Button
149+
<com.google.android.material.button.MaterialButton
133150
android:layout_marginTop="5dp"
134151
android:id="@+id/su_env_inject_btn"
135152
android:layout_width="wrap_content"
136153
android:layout_height="wrap_content"
137154
android:text="5.授权su到指定进程"
155+
android:paddingLeft="20dp"
156+
android:paddingRight="20dp"
157+
app:cornerRadius="8dp"
158+
style="@style/Widget.MaterialComponents.Button"
138159
/>
139160

140-
<Button
161+
<com.google.android.material.button.MaterialButton
141162
android:layout_marginTop="5dp"
142163
android:id="@+id/clean_su_btn"
143164
android:layout_width="wrap_content"
144165
android:layout_height="wrap_content"
145166
android:text="6.完全卸载清理su"
167+
android:paddingLeft="20dp"
168+
android:paddingRight="20dp"
169+
app:cornerRadius="8dp"
170+
style="@style/Widget.MaterialComponents.Button"
146171
/>
147172

148-
<Button
173+
<com.google.android.material.button.MaterialButton
149174
android:layout_marginTop="5dp"
150175
android:id="@+id/implant_app_btn"
151176
android:layout_width="wrap_content"
152177
android:layout_height="wrap_content"
153178
android:text="7.寄生到目标APP"
179+
android:paddingLeft="20dp"
180+
android:paddingRight="20dp"
181+
app:cornerRadius="8dp"
182+
style="@style/Widget.MaterialComponents.Button"
154183
/>
155184

156185
</LinearLayout>
@@ -184,18 +213,22 @@
184213
android:orientation="horizontal"
185214

186215
>
187-
<Button
216+
<com.google.android.material.button.MaterialButton
188217
android:id="@+id/copy_info_btn"
189218
android:layout_width="70dp"
190219
android:layout_height="wrap_content"
191220
android:text="复制"
221+
app:cornerRadius="8dp"
222+
style="@style/Widget.MaterialComponents.Button"
192223
/>
193-
<Button
224+
<com.google.android.material.button.MaterialButton
194225
android:id="@+id/clean_info_btn"
195226
android:layout_width="70dp"
196227
android:layout_height="wrap_content"
197228
android:layout_marginLeft="5dp"
198229
android:text="清空"
230+
app:cornerRadius="8dp"
231+
style="@style/Widget.MaterialComponents.Button"
199232
/>
200233
</LinearLayout>
201234

Lite_version/src/patch_kernel_root/3rdparty/find_func_return_offset.h renamed to Lite_version/src/patch_kernel_root/3rdparty/find_end_func_offset.h

Lines changed: 17 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,7 @@
1212
#include <cstdlib>
1313
#include <capstone/capstone.h>
1414

15-
namespace a64_find_func_return_offset {
16-
15+
namespace a64_find_end_func_offset {
1716
constexpr size_t k_npos = static_cast<size_t>(-1);
1817
constexpr int k_max_jump_region = 1024 * 1024 * 5; // 5MB
1918

@@ -69,9 +68,7 @@ namespace a64_find_func_return_offset {
6968
static inline bool is_force_jump_asm(const code_line& line) {
7069
if (line.cmd_id == ARM64_INS_BR) return true;
7170
return line.cmd_id == ARM64_INS_B &&
72-
(line.cc_id == ARM64_CC_INVALID ||
73-
line.cc_id == ARM64_CC_AL ||
74-
line.cc_id == ARM64_CC_NV);
71+
(line.cc_id == ARM64_CC_INVALID || line.cc_id == ARM64_CC_AL || line.cc_id == ARM64_CC_NV);
7572
}
7673

7774
static size_t index_by_addr(const std::vector<code_line>& v, uint64_t addr) {
@@ -80,14 +77,11 @@ namespace a64_find_func_return_offset {
8077
return k_npos;
8178
}
8279

83-
static void scan_from_index(const std::vector<code_line>& v_code_line,
84-
size_t start_idx,
85-
std::set<uint64_t>& branch_history,
86-
std::vector<uint64_t>& out_ret_addrs,
87-
std::vector<uint64_t>& out_branch_anchors) {
80+
static void scan_from_index(const std::vector<code_line>& v_code_line, size_t start_idx,
81+
std::set<uint64_t>& branch_history, std::vector<uint64_t>& out_ret_addrs, std::vector<uint64_t>& out_branch_anchors) {
82+
8883
for (size_t x = start_idx; x < v_code_line.size(); ++x) {
8984
const auto& line = v_code_line[x];
90-
9185
if (is_offset_jump_asm(line)) {
9286
const int64_t addr = line.final_imm;
9387
if (addr > 0 && addr < static_cast<int64_t>(line.addr + k_max_jump_region)) {
@@ -98,16 +92,22 @@ namespace a64_find_func_return_offset {
9892
}
9993
}
10094

101-
if (is_force_jump_asm(line)) break;
95+
if (is_force_jump_asm(line)) {
96+
// 无条件跳转如果是往回跳，视为一个“假的RET边界”
97+
// 这里记录当前跳转指令地址，而不是跳转目标地址
98+
if (addr > 0 && static_cast<uint64_t>(addr) < line.addr) {
99+
out_ret_addrs.push_back(line.addr);
100+
}
101+
break;
102+
}
102103
continue;
103104
}
104105

105106
if (is_ret_insn(line.cmd_id)) out_ret_addrs.push_back(line.addr);
106107
}
107108
}
108109

109-
static bool handle_candidate_offsets(const std::vector<code_line>& v_code_line,
110-
size_t& candidate_offsets) {
110+
static bool handle_candidate_offsets(const std::vector<code_line>& v_code_line, size_t& candidate_offsets) {
111111
std::vector<uint64_t> ret_addrs;
112112
std::vector<uint64_t> branch_anchors;
113113
std::set<uint64_t> branch_history;
@@ -128,18 +128,14 @@ namespace a64_find_func_return_offset {
128128
}
129129

130130
if (!ret_addrs.empty()) {
131-
candidate_offsets = static_cast<size_t>(
132-
*std::max_element(ret_addrs.begin(), ret_addrs.end())
133-
);
131+
candidate_offsets = static_cast<size_t>(*std::max_element(ret_addrs.begin(), ret_addrs.end()));
134132
return true;
135133
}
136134

137135
return false;
138136
}
139137

140-
static bool find_func_return_offset(const std::vector<char>& file_buf,
141-
size_t start,
142-
size_t& candidate_offsets) {
138+
static bool find_end_func_offset(const std::vector<char>& file_buf, size_t start, size_t& candidate_offsets) {
143139
bool res = false;
144140

145141
csh handle;
@@ -216,4 +212,4 @@ namespace a64_find_func_return_offset {
216212
return res;
217213
}
218214

219-
} // namespace a64_find_func_return_offset
215+
} // namespace a64_find_end_func_offset

‎Lite_version/src/patch_kernel_root/analyze/init_cred_searcher.cpp‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,11 @@
66
#define ATOMIC_INIT_4 4
77
#define SECUREBITS_DEFAULT 0
88

9-
#define CAP_FULL_SET 0x1FFFFFFFFFULL
10-
#define CAP_FULL_SET_3_16_0 0x3FFFFFFFFFULL
11-
#define CAP_FULL_SET_5_8_0 0xFFFFFFFFFFULL
12-
#define CAP_FULL_SET_5_9_0 0x1FFFFFFFFFFULL
9+
#define CAP_FULL_SET 0x1FFFFFFFFFULL
10+
#define CAP_FULL_SET_3_16_0 0x3FFFFFFFFFULL
11+
#define CAP_FULL_SET_HUAWEI_4_9_X 0x7FFFFFFFFFULL
12+
#define CAP_FULL_SET_5_8_0 0xFFFFFFFFFFULL
13+
#define CAP_FULL_SET_5_9_0 0x1FFFFFFFFFFULL
1314

1415
namespace {
1516
#pragma pack(push, 1)
@@ -94,7 +95,7 @@ std::vector<InitCredResult> InitCredSearcher::build_usage_candidates_impl() {
9495
Head4T head_u4;
9596
Head8T head_u8;
9697
std::vector<InitCredResult> out;
97-
uint64_t cap_max_arr[] = { CAP_FULL_SET_5_9_0, CAP_FULL_SET_5_8_0, CAP_FULL_SET_3_16_0, CAP_FULL_SET };
98+
uint64_t cap_max_arr[] = { CAP_FULL_SET_5_9_0, CAP_FULL_SET_5_8_0, CAP_FULL_SET_3_16_0, CAP_FULL_SET_HUAWEI_4_9_X, CAP_FULL_SET };
9899
int cap_cnt = get_cap_cnt();
99100
for (auto cap_max : cap_max_arr) {
100101
cred_cap_info4 cap4{};

‎Lite_version/src/patch_kernel_root/analyze/kallsyms_lookup_interface.h‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#pragma once
2+
#include <cstdint>
3+
#include <string>
4+
#include <unordered_map>
5+
6+
class IKallsymsLookup {
7+
public:
8+
virtual ~IKallsymsLookup() = default;
9+
10+
virtual bool init() = 0;
11+
virtual bool is_inited() const = 0;
12+
virtual uint64_t kallsyms_lookup_name(const char* name) = 0;
13+
virtual uint64_t kallsyms_symbol_size(uint64_t cur_addr) = 0;
14+
virtual std::unordered_map<std::string, uint64_t> kallsyms_on_each_symbol() = 0;
15+
};

‎Lite_version/src/patch_kernel_root/analyze/kallsyms_lookup_name.cpp‎

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -99,14 +99,10 @@ bool KallsymsLookupName::init() {
9999
return true;
100100
}
101101

102-
bool KallsymsLookupName::is_inited() {
102+
bool KallsymsLookupName::is_inited() const {
103103
return m_inited;
104104
}
105105

106-
int KallsymsLookupName::get_kallsyms_num() {
107-
return m_kallsyms_num;
108-
}
109-
110106
static bool __find_kallsyms_addresses_list(const std::vector<char>& file_buf, size_t max_cnt, size_t& start, size_t& end) {
111107
const int var_len = sizeof(uint64_t);
112108
for (auto x = 0; x + var_len < file_buf.size(); x += var_len) {
@@ -360,6 +356,22 @@ uint64_t KallsymsLookupName::kallsyms_lookup_name(const char* name) {
360356
return iter->second;
361357
}
362358

359+
uint64_t KallsymsLookupName::kallsyms_symbol_size(uint64_t cur_addr) {
360+
if (cur_addr == 0) return 0;
361+
std::unordered_map<std::string, uint64_t> syms = kallsyms_on_each_symbol();
362+
uint64_t next_addr = 0;
363+
for (const auto& kv : syms) {
364+
uint64_t addr = kv.second;
365+
if (addr > cur_addr) {
366+
if (next_addr == 0 || addr < next_addr) {
367+
next_addr = addr;
368+
}
369+
}
370+
}
371+
if (next_addr == 0 || next_addr <= cur_addr) return 0;
372+
return next_addr - cur_addr;
373+
}
374+
363375
std::unordered_map<std::string, uint64_t> KallsymsLookupName::kallsyms_on_each_symbol() {
364376
if (!m_kallsyms_symbols_cache.size()) {
365377
for (auto i = 0, off = 0; i < m_kallsyms_num; i++) {

‎Lite_version/src/patch_kernel_root/analyze/kallsyms_lookup_name.h‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,19 @@
33
#include <cstdint>
44
#include <vector>
55
#include <unordered_map>
6+
#include "kallsyms_lookup_interface.h"
67

7-
class KallsymsLookupName
8-
{
8+
class KallsymsLookupName : public IKallsymsLookup {
99
public:
1010
KallsymsLookupName(const std::vector<char>& file_buf);
1111
~KallsymsLookupName();
1212

1313
public:
14-
bool init();
15-
bool is_inited();
16-
uint64_t kallsyms_lookup_name(const char* name);
17-
std::unordered_map<std::string, uint64_t> kallsyms_on_each_symbol();
18-
int get_kallsyms_num();
14+
bool init() override;
15+
bool is_inited() const override;
16+
uint64_t kallsyms_lookup_name(const char* name) override;
17+
uint64_t kallsyms_symbol_size(uint64_t cur_addr) override;
18+
std::unordered_map<std::string, uint64_t> kallsyms_on_each_symbol() override;
1919

2020
private:
2121
bool find_kallsyms_addresses_list(size_t& start, size_t& end);

0 commit comments

Comments
 (0)