Android检查手机是否Root以及应用是否获取Root权限
在Android中如何判断手机是否Root以及应用是否获取了Root权限，下面我们将对开源项目RootTools的源码进行分析。
RootTools的源码地址：https://github.com/Stericson/RootTools
一、RootTools.isRootAvailable()判断手机是否已经Root
下面RootTools这个类中，RootTools.isRootAvailable()可以判断手机是否已经Root，下面我们来看看它的源码。
public static boolean isRootAvailable()
{
return RootShell.isRootAvailable();
}它实质调用的是RootShell.isRootAvailable()函数，我们接着来看看这个函数的源码。
public static boolean isRootAvailable() {
return (findBinary("su")).size() > 0;
}从上面的代码中我们可以看到它实际是在查找su这个执行文件是否存在，我们知道，我们切换到root用户下，使用的就是su命令，如果这个文件存在，就基本可以知道手机已经Root，因为我们可以运行su命令切换到root用户下。
下面我们来看看RootShell.findBinary(“su”)这个函数。
public static List<String> findBinary(final String binaryName) {
return findBinary(binaryName, null);
}
public static List<String> findBinary(final String binaryName, List<String> searchPaths) {
final List<String> foundPaths = new ArrayList<String>();
boolean found = false;
// 1、如果搜索路径为空，得到环境变量PATH路径
if(searchPaths == null)
{
searchPaths = RootShell.getPath();
}
RootShell.log("Checking for " + binaryName);
// 2、使用了两种方法来检查
// 2.1、遍历所有路径，尝试使用stat命令来查看su文件信息
//Try to use stat first
try {
for (String path : searchPaths) {
if(!path.endsWith("/"))
{
path += "/";
}
final String currentPath = path;
Command cc = new Command(0, false, "stat " + path + binaryName) {
// 对执行stat命令后的输出信息进行判断
// 如果包含了"File: "和"su"就表示这个路径存在su命令
@Override
public void commandOutput(int id, String line) {
if (line.contains("File: ") && line.contains(binaryName)) {
foundPaths.add(currentPath);
RootShell.log(binaryName + " was found here: " + currentPath);
}
RootShell.log(line);
super.commandOutput(id, line);
}
};
RootShell.getShell(false).add(cc);
commandWait(RootShell.getShell(false), cc);
}
found = !foundPaths.isEmpty();
} catch (Exception e) {
RootShell.log(binaryName + " was not found, more information MAY be available with Debugging on.");
}
// 2.2、如果第一种方法没有找到，就使用下面这种方法
// 遍历所有路径，使用ls命令查看su文件是否存在
if (!found) {
RootShell.log("Trying second method");
for (String path : searchPaths) {
if(!path.endsWith("/"))
{
path += "/";
}
if (RootShell.exists(path + binaryName)) {
RootShell.log(binaryName + " was found here: " + path);
foundPaths.add(path);
} else {
RootShell.log(binaryName + " was NOT found here: " + path);
}
}
}
Collections.reverse(foundPaths);
return foundPaths;
}1、如果搜索路径为空，得到环境变量PATH路径
这一步的关键就是RootShell.getPath()这个函数。我们来重点看看这个函数。
public static List<String> getPath() {
return Arrays.asList(System.getenv("PATH").split(":"));
}我们可以很容易的看出，它首先获取环境变量PATH的值，然后得到PATH里面配置的所有路径。
2、针对上面得到的路径，这些路径可能就是su文件所在的路径，进行遍历，主要提供了两种方法。
2.1、遍历所有路径，尝试使用stat命令来查看su文件信息
（1）使用for循环依次得到每个路径，然后将su文件拼接在后面。例如我们得到一个/system/bin/路径，然后将su拼接在后面就是/system/bin/su。
（2）创建一个”stat /system/bin/su”的Command命令。并且重写了Command的commandOutput方法，这个方法可以得到执行”stat /system/bin/su”的输出信息，然后对输出信息进行比较判断，如果输出信息包含了”File: “和”su”，那么就说明这个路径下面包含了su命令，就将它添加到foundPaths列表中，最终如果foundPaths为空，表示没有找到，如果不为空就表示找到了，如果为空，就使用第二种方法接着查找。
2.2、遍历所有路径，使用ls命令查看su文件是否存在
它的核心就是RootShell.exists(path + binaryName)这个检查函数。
public static boolean exists(final String file) {
return exists(file, false);
}
public static boolean exists(final String file, boolean isDir) {
final List<String> result = new ArrayList<String>();
String cmdToExecute = "ls " + (isDir ? "-d " : " ");
Command command = new Command(0, false, cmdToExecute + file) {
@Override
public void commandOutput(int id, String line) {
RootShell.log(line);
result.add(line);
super.commandOutput(id, line);
}
};
try {
//Try without root...
RootShell.getShell(false).add(command);
commandWait(RootShell.getShell(false), command);
} catch (Exception e) {
return false;
}
for (String line : result) {
if (line.trim().equals(file)) {
return true;
}
}
result.clear();
try {
RootShell.getShell(true).add(command);
commandWait(RootShell.getShell(true), command);
} catch (Exception e) {
return false;
}
//Avoid concurrent modification...
List<String> final_result = new ArrayList<String>();
final_result.addAll(result);
for (String line : final_result) {
if (line.trim().equals(file)) {
return true;
}
}
return false;
}可以看到，这个逻辑跟上面2.1的基本一样，就是执行的Command命令不一样，2.1执行的是stat命令，这里执行的是ls命令。
既然这两种方法的思想是一样的，那么下面，我们来看看这个Command命令是如何执行的。
1、创建Command命令
Command cc = new Command(0, false, "stat " + path + binaryName) {
@Override
public void commandOutput(int id, String line) {
if (line.contains("File: ") && line.contains(binaryName)) {
foundPaths.add(currentPath);
RootShell.log(binaryName + " was found here: " + currentPath);
}
RootShell.log(line);
super.commandOutput(id, line);
}
};2、执行RootShell.getShell(false)
public static Shell getShell(boolean root) throws IOException, TimeoutException, RootDeniedException {
return RootShell.getShell(root, 0);
}
public static Shell getShell(boolean root, int timeout) throws IOException, TimeoutException, RootDeniedException {
return getShell(root, timeout, Shell.defaultContext, 3);
}
public static Shell getShell(boolean root, int timeout, Shell.ShellContext shellContext, int retry) throws IOException, TimeoutException, RootDeniedException {
if (root) {
return Shell.startRootShell(timeout, shellContext, retry);
} else {
return Shell.startShell(timeout);
}
}我们可以看到，最终执行的是Shell.startShell(timeout)函数。
public static Shell startShell(int timeout) throws IOException, TimeoutException {
try {
if (Shell.shell == null) {
RootShell.log("Starting Shell!");
Shell.shell = new Shell("/system/bin/sh", ShellType.NORMAL, ShellContext.NORMAL, timeout);
} else {
RootShell.log("Using Existing Shell!");
}
return Shell.shell;
} catch (RootDeniedException e) {
//Root Denied should never be thrown.
throw new IOException();
}
}如果shell为空，就创建一个shell，我们来看看这个创建过程new Shell(“/system/bin/sh”, ShellType.NORMAL, ShellContext.NORMAL, timeout)。
private Shell(String cmd, ShellType shellType, ShellContext shellContext, int shellTimeout) throws IOException, TimeoutException, RootDeniedException {
RootShell.log("Starting shell: " + cmd);
RootShell.log("Context: " + shellContext.getValue());
RootShell.log("Timeout: " + shellTimeout);
this.shellType = shellType;
this.shellTimeout = shellTimeout > 0 ? shellTimeout : this.shellTimeout;
this.shellContext = shellContext;
// 1、这里会执行cmd命令，就是上面传过来的"/system/bin/sh"
if (this.shellContext == ShellContext.NORMAL) {
this.proc = Runtime.getRuntime().exec(cmd);
} else {
String display = getSuVersion(false);
String internal = getSuVersion(true);
//only done for root shell...
//Right now only SUPERSU supports the --context switch
if (isSELinuxEnforcing() &&
(display != null) &&
(internal != null) &&
(display.endsWith("SUPERSU")) &&
(Integer.valueOf(internal) >= 190)) {
cmd += " --context " + this.shellContext.getValue();
} else {
RootShell.log("Su binary --context switch not supported!");
RootShell.log("Su binary display version: " + display);
RootShell.log("Su binary internal version: " + internal);
RootShell.log("SELinuxEnforcing: " + isSELinuxEnforcing());
}
this.proc = Runtime.getRuntime().exec(cmd);
}
// 2、得到执行cmd命令之后的输入流、输出流和错误流
this.inputStream = new BufferedReader(new InputStreamReader(this.proc.getInputStream(), "UTF-8"));
this.errorStream = new BufferedReader(new InputStreamReader(this.proc.getErrorStream(), "UTF-8"));
this.outputStream = new OutputStreamWriter(this.proc.getOutputStream(), "UTF-8");
//3、启动一个Worker线程去不断的读取输入流
Worker worker = new Worker(this);
worker.start();
try {
worker.join(this.shellTimeout);
if (worker.exit == -911) {
try {
this.proc.destroy();
} catch (Exception e) {
}
closeQuietly(this.inputStream);
closeQuietly(this.errorStream);
closeQuietly(this.outputStream);
throw new TimeoutException(this.error);
}
/** * Root access denied? */
else if (worker.exit == -42) {
try {
this.proc.destroy();
} catch (Exception e) {
}
closeQuietly(this.inputStream);
closeQuietly(this.errorStream);
closeQuietly(this.outputStream);
throw new RootDeniedException("Root Access Denied");
}
/** * Normal exit */
else {
// 4、启动一个线程，向输入流中输入命令
Thread si = new Thread(this.input, "Shell Input");
si.setPriority(Thread.NORM_PRIORITY);
si.start();
// 5、启动一个线程，得到执行命令之后输出流的信息
Thread so = new Thread(this.output, "Shell Output");
so.setPriority(Thread.NORM_PRIORITY);
so.start();
}
} catch (InterruptedException ex) {
worker.interrupt();
Thread.currentThread().interrupt();
throw new TimeoutException();
}
}1、执行”/system/bin/sh”命令
this.proc = Runtime.getRuntime().exec(cmd);2、得到执行命令之后的输入流、输出流、错误流
this.inputStream = new BufferedReader(new InputStreamReader(this.proc.getInputStream(), "UTF-8"));
this.errorStream = new BufferedReader(new InputStreamReader(this.proc.getErrorStream(), "UTF-8"));
this.outputStream = new OutputStreamWriter(this.proc.getOutputStream(), "UTF-8");3、启动一个Worker线程去不断的读取输入流
protected static class Worker extends Thread {
public int exit = -911;
public Shell shell;
private Worker(Shell shell) {
this.shell = shell;
}
public void run() {
try {
shell.outputStream.write("echo Started\n");
shell.outputStream.flush();
// 这里有一个死循环，不断的读取输入流
while (true) {
String line = shell.inputStream.readLine();
if (line == null) {
throw new EOFException();
} else if ("".equals(line)) {
continue;
} else if ("Started".equals(line)) {
this.exit = 1;
setShellOom();
break;
}
shell.error = "unknown error occurred.";
}
} catch (IOException e) {
exit = -42;
if (e.getMessage() != null) {
shell.error = e.getMessage();
} else {
shell.error = "RootAccess denied?.";
}
}
}
}4、启动一个线程，向输入流中输入命令
我们来看看input这个传入的Runnable参数
private Runnable input = new Runnable() {
public void run() {
try {
while (true) {
synchronized (commands) {
while (!close && write >= commands.size()) {
isExecuting = false;
commands.wait();
}
}
if (write >= maxCommands) {
while (read != write) {
RootShell.log("Waiting for read and write to catch up before cleanup.");
}
/** * Clean up the commands, stay neat. */
cleanCommands();
}
// 向outputStream中写入一条命令，也就是sh执行了一条命令
if (write < commands.size()) {
isExecuting = true;
Command cmd = commands.get(write);
cmd.startExecution();
RootShell.log("Executing: " + cmd.getCommand() + " with context: " + shellContext);
outputStream.write(cmd.getCommand());
String line = "\necho " + token + " " + totalExecuted + " $?\n";
outputStream.write(line);
outputStream.flush();
write++;
totalExecuted++;
} else if (close) {
isExecuting = false;
outputStream.write("\nexit 0\n");
outputStream.flush();
RootShell.log("Closing shell");
return;
}
}
} catch (IOException e) {
RootShell.log(e.getMessage(), RootShell.LogLevel.ERROR, e);
} catch (InterruptedException e) {
RootShell.log(e.getMessage(), RootShell.LogLevel.ERROR, e);
} finally {
write = 0;
closeQuietly(outputStream);
}
}
};5、启动一个线程，得到执行命令之后输出流的信息
我们来看看output这个传入的Runnable参数
private Runnable output = new Runnable() {
public void run() {
try {
Command command = null;
while (!close || inputStream.ready() || read < commands.size()) {
isReading = false;
// 从输入流中读出一行
String outputLine = inputStream.readLine();
isReading = true;
if (outputLine == null) {
break;
}
if (command == null) {
if (read >= commands.size()) {
if (close) {
break;
}
continue;
}
command = commands.get(read);
}
int pos = -1;
pos = outputLine.indexOf(token);
// 最终调用我们Command重新的那个函数，用来处理输出信息
if (pos == -1) {
command.output(command.id, outputLine);
} else if (pos > 0) {
command.output(command.id, outputLine.substring(0, pos));
}
if (pos >= 0) {
outputLine = outputLine.substring(pos);
String fields[] = outputLine.split(" ");
if (fields.length >= 2 && fields[1] != null) {
int id = 0;
try {
id = Integer.parseInt(fields[1]);
} catch (NumberFormatException e) {
}
int exitCode = -1;
try {
exitCode = Integer.parseInt(fields[2]);
} catch (NumberFormatException e) {
}
if (id == totalRead) {
processErrors(command);
int iterations = 0;
while (command.totalOutput > command.totalOutputProcessed) {
if(iterations == 0)
{
iterations++;
RootShell.log("Waiting for output to be processed. " + command.totalOutputProcessed + " Of " + command.totalOutput);
}
try {
synchronized (this)
{
this.wait(2000);
}
} catch (Exception e) {
RootShell.log(e.getMessage());
}
}
RootShell.log("Read all output");
command.setExitCode(exitCode);
command.commandFinished();
command = null;
read++;
totalRead++;
continue;
}
}
}
}
try {
proc.waitFor();
proc.destroy();
} catch (Exception e) {
}
while (read < commands.size()) {
if (command == null) {
command = commands.get(read);
}
if(command.totalOutput < command.totalOutputProcessed)
{
command.terminated("All output not processed!");
command.terminated("Did you forget the super.commandOutput call or are you waiting on the command object?");
}
else
{
command.terminated("Unexpected Termination.");
}
command = null;
read++;
}
read = 0;
} catch (IOException e) {
RootShell.log(e.getMessage(), RootShell.LogLevel.ERROR, e);
} finally {
closeQuietly(outputStream);
closeQuietly(errorStream);
closeQuietly(inputStream);
RootShell.log("Shell destroyed");
isClosed = true;
isReading = false;
}
}
};二、RootTools.isAccessGiven()判断app是否被授予root权限
public static boolean isAccessGiven()
{
return RootShell.isAccessGiven();
}可以看到它实际调用了RootShell.isAccessGiven()方法，所以我们来看看它的源码。
public static boolean isAccessGiven() {
final Set<String> ID = new HashSet<String>();
final int IAG = 158;
try {
RootShell.log("Checking for Root access");
Command command = new Command(IAG, false, "id") {
@Override
public void commandOutput(int id, String line) {
if (id == IAG) {
ID.addAll(Arrays.asList(line.split(" ")));
}
super.commandOutput(id, line);
}
};
Shell.startRootShell().add(command);
commandWait(Shell.startRootShell(), command);
//parse the userid
for (String userid : ID) {
RootShell.log(userid);
if (userid.toLowerCase().contains("uid=0")) {
RootShell.log("Access Given");
return true;
}
}
return false;
} catch (Exception e) {
e.printStackTrace();
return false;
}
}可以看到这里的思想跟上面2.1和2.2的也基本相同，都是执行Command命令，这里执行的是id这个命令。它的原理就是如果使用id得到所有的id信息，然后对这些id信息进行判断，如果里面包含”uid=0”就表示应用获取到了Root权限。
参考文章：
检查Android是否已经获取root权限
Android中判断手机是否已经Root
http://bbs.csdn.net/topics/390885158