雷神改机-改机原理分析

保存OAID：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
public void updateModel(JSONObject arg13) {
   try {
     this.execCommand("echo ro.product.brand=huawei > /data/adb/modules/mfcx/system.prop");
     this.execCommand("echo ro.product.manufacturer=huawei >> /data/adb/modules/mfcx/system.prop");
     this.execCommand("echo ro.product.name=" + arg13.get("device_name") + " >> /data/adb/modules/mfcx/system.prop");
     this.execCommand("echo ro.product.model=" + arg13.get("model") + " >> /data/adb/modules/mfcx/system.prop");
     this.execCommand("echo ro.product.device=" + arg13.get("model") + " >> /data/adb/modules/mfcx/system.prop");
     this.execCommand("echo ro.build.version.release=" + arg13.get("android_version") + " >> /data/adb/modules/mfcx/system.prop");
     this.execCommand("echo ro.build.display.id=" + arg13.get("version") + " >> /data/adb/modules/mfcx/system.prop");
     this.execCommand("echo ro.build.id=" + arg13.get("version") + " >> /data/adb/modules/mfcx/system.prop");
     this.execCommand("echo ro.build.system.build.id=" + arg13.get("version") + " >> /data/adb/modules/mfcx/system.prop");
     this.editor.putString("oaid", arg13.getString("oaid"));
     this.editor.putString("name", arg13.getString("device_name"));
     this.editor.commit();
     this.mode.setText(arg13.getString("device_name"));
     this.showToast("数据写入成功");
   }
   catch(JSONException v5) {
     this.showToast("数据写入失败!");
   }
 }

选择某一厂商：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70

public void oper(View arg15) {
    Class v9;
    if(!this.getRootAhth()) {
      this.showToast("请检查root权限!");
      return;
    }

    int v3 = arg15.getId();
    if(v3 == 0x7F080003) { // id:samsung
      this.showDialog("三星", "samsung");
      return;
    }

    if(v3 == 0x7F080004) { // id:xiaomi
      this.showDialog("小米", "xiaomi");
      return;
    }

    if(v3 == 0x7F080005) { // id:huawi
      this.showDialog("华为", "huawei");
      return;
    }

    if(v3 == 0x7F080006) { // id:oppo
      this.showDialog("OPPO", "oppo");
      return;
    }传奇Unity手游分析

    if(v3 == 0x7F080007) { // id:vivo
      this.showDialog("VIVO", "vivo");
      return;
    }

    if(v3 == 0x7F080008) { // id:setoaid
      this.showOaidDialog();
      return;
    }

    if(v3 == 0x7F080009) { // id:geturl
      this.dialog.show();
      new Thread(new 100000001(this)).start();
      return;
    }

    if(v3 == 0x7F08000A) { // id:savedevice
      Intent v4 = new Intent();
      try {
        v9 = Class.forName("mfcx.yunyou.leishengaiji.LoginActivity");
      }
      catch(ClassNotFoundException v7) {
        throw new NoClassDefFoundError(v7.getMessage());
      }

      v4.setClass(this, v9);
      this.startActivity(v4);
      return;
    }

    if(v3 == 0x7F08000B) { // id:reboot
      this.execCommand("reboot");
      return;
    }

    if(v3 == 0x7F08000C) { // id:reset
      this.reset();
      return;
    }
  }

magisk模块开发文档中：

雷神改机通过system.prop文件写入相应系统信息属性，但是该文件还有一层作用就是通过 resetprop 作为系统属性加载。以此实现改机的功能。