Android检查手机是否Root以及应用是否获取Root权限

在Android中如何判断手机是否Root以及应用是否获取了Root权限，下面我们将对开源项目RootTools的源码进行分析。RootTools的源码地址：https://github.com/Stericson/RootTools一、RootTools.isRootAvailable()判断手机是否已经Root下面RootTools这个类中，RootTools.isRootAvailable

文章共5,240字 · 阅读需要大约18分钟

一键AI生成摘要，助你高效阅读

问答

DroidMind

8107人浏览 · 2015-11-15 17:33:34

DroidMind · 2015-11-15 17:33:34 发布

在Android中如何判断手机是否Root以及应用是否获取了Root权限，下面我们将对开源项目RootTools的源码进行分析。

RootTools的源码地址：https://github.com/Stericson/RootTools

一、RootTools.isRootAvailable()判断手机是否已经Root
下面RootTools这个类中，RootTools.isRootAvailable()可以判断手机是否已经Root，下面我们来看看它的源码。

public static boolean isRootAvailable()
{
    return RootShell.isRootAvailable();
}

它实质调用的是RootShell.isRootAvailable()函数，我们接着来看看这个函数的源码。

public static boolean isRootAvailable() {
    return (findBinary("su")).size() > 0;
}

从上面的代码中我们可以看到它实际是在查找su这个执行文件是否存在，我们知道，我们切换到root用户下，使用的就是su命令，如果这个文件存在，就基本可以知道手机已经Root，因为我们可以运行su命令切换到root用户下。

下面我们来看看RootShell.findBinary(“su”)这个函数。

public static List<String> findBinary(final String binaryName) {
    return findBinary(binaryName, null);
}

public static List<String> findBinary(final String binaryName, List<String> searchPaths) {

    final List<String> foundPaths = new ArrayList<String>();

    boolean found = false;

    // 1、如果搜索路径为空，得到环境变量PATH路径
    if(searchPaths == null)
    {
        searchPaths = RootShell.getPath();
    }

    RootShell.log("Checking for " + binaryName);

    // 2、使用了两种方法来检查
    // 2.1、遍历所有路径，尝试使用stat命令来查看su文件信息
    //Try to use stat first
    try {
        for (String path : searchPaths) {

            if(!path.endsWith("/"))
            {
                path += "/";
            }

            final String currentPath = path;

            Command cc = new Command(0, false, "stat " + path + binaryName) {
                // 对执行stat命令后的输出信息进行判断
                // 如果包含了"File: "和"su"就表示这个路径存在su命令
                @Override
                public void commandOutput(int id, String line) {
                    if (line.contains("File: ") && line.contains(binaryName)) {
                        foundPaths.add(currentPath);

                        RootShell.log(binaryName + " was found here: " + currentPath);
                    }

                    RootShell.log(line);

                    super.commandOutput(id, line);
                }
            };

            RootShell.getShell(false).add(cc);
            commandWait(RootShell.getShell(false), cc);

        }

        found = !foundPaths.isEmpty();
    } catch (Exception e) {
        RootShell.log(binaryName + " was not found, more information MAY be available with Debugging on.");
    }

    // 2.2、如果第一种方法没有找到，就使用下面这种方法
    // 遍历所有路径，使用ls命令查看su文件是否存在
    if (!found) {
        RootShell.log("Trying second method");

        for (String path : searchPaths) {

            if(!path.endsWith("/"))
            {
                path += "/";
            }

            if (RootShell.exists(path + binaryName)) {
                RootShell.log(binaryName + " was found here: " + path);
                foundPaths.add(path);
            } else {
                RootShell.log(binaryName + " was NOT found here: " + path);
            }
        }
    }

    Collections.reverse(foundPaths);

    return foundPaths;
}

1、如果搜索路径为空，得到环境变量PATH路径
这一步的关键就是RootShell.getPath()这个函数。我们来重点看看这个函数。

public static List<String> getPath() {
    return Arrays.asList(System.getenv("PATH").split(":"));
}

我们可以很容易的看出，它首先获取环境变量PATH的值，然后得到PATH里面配置的所有路径。

2、针对上面得到的路径，这些路径可能就是su文件所在的路径，进行遍历，主要提供了两种方法。

2.1、遍历所有路径，尝试使用stat命令来查看su文件信息
（1）使用for循环依次得到每个路径，然后将su文件拼接在后面。例如我们得到一个/system/bin/路径，然后将su拼接在后面就是/system/bin/su。
（2）创建一个”stat /system/bin/su”的Command命令。并且重写了Command的commandOutput方法，这个方法可以得到执行”stat /system/bin/su”的输出信息，然后对输出信息进行比较判断，如果输出信息包含了”File: “和”su”，那么就说明这个路径下面包含了su命令，就将它添加到foundPaths列表中，最终如果foundPaths为空，表示没有找到，如果不为空就表示找到了，如果为空，就使用第二种方法接着查找。

2.2、遍历所有路径，使用ls命令查看su文件是否存在

它的核心就是RootShell.exists(path + binaryName)这个检查函数。

public static boolean exists(final String file) {
    return exists(file, false);
}

public static boolean exists(final String file, boolean isDir) {
    final List<String> result = new ArrayList<String>();

    String cmdToExecute = "ls " + (isDir ? "-d " : " ");

    Command command = new Command(0, false, cmdToExecute + file) {
        @Override
        public void commandOutput(int id, String line) {
            RootShell.log(line);
            result.add(line);

            super.commandOutput(id, line);
        }
    };

    try {
        //Try without root...
        RootShell.getShell(false).add(command);
        commandWait(RootShell.getShell(false), command);

    } catch (Exception e) {
        return false;
    }

    for (String line : result) {
        if (line.trim().equals(file)) {
            return true;
        }
    }

    result.clear();

    try {
        RootShell.getShell(true).add(command);
        commandWait(RootShell.getShell(true), command);

    } catch (Exception e) {
        return false;
    }

    //Avoid concurrent modification...
    List<String> final_result = new ArrayList<String>();
    final_result.addAll(result);

    for (String line : final_result) {
        if (line.trim().equals(file)) {
            return true;
        }
    }

    return false;

}

可以看到，这个逻辑跟上面2.1的基本一样，就是执行的Command命令不一样，2.1执行的是stat命令，这里执行的是ls命令。

既然这两种方法的思想是一样的，那么下面，我们来看看这个Command命令是如何执行的。

1、创建Command命令

Command cc = new Command(0, false, "stat " + path + binaryName) {
    @Override
    public void commandOutput(int id, String line) {
        if (line.contains("File: ") && line.contains(binaryName)) {
            foundPaths.add(currentPath);

            RootShell.log(binaryName + " was found here: " + currentPath);
        }

        RootShell.log(line);

        super.commandOutput(id, line);
    }
};

2、执行RootShell.getShell(false)

public static Shell getShell(boolean root) throws IOException, TimeoutException, RootDeniedException {
    return RootShell.getShell(root, 0);
}

public static Shell getShell(boolean root, int timeout) throws IOException, TimeoutException, RootDeniedException {
    return getShell(root, timeout, Shell.defaultContext, 3);
}

public static Shell getShell(boolean root, int timeout, Shell.ShellContext shellContext, int retry) throws IOException, TimeoutException, RootDeniedException {
    if (root) {
        return Shell.startRootShell(timeout, shellContext, retry);
    } else {
        return Shell.startShell(timeout);
    }
}

我们可以看到，最终执行的是Shell.startShell(timeout)函数。

public static Shell startShell(int timeout) throws IOException, TimeoutException {

    try {
        if (Shell.shell == null) {
            RootShell.log("Starting Shell!");
            Shell.shell = new Shell("/system/bin/sh", ShellType.NORMAL, ShellContext.NORMAL, timeout);
        } else {
            RootShell.log("Using Existing Shell!");
        }
        return Shell.shell;
    } catch (RootDeniedException e) {
        //Root Denied should never be thrown.
        throw new IOException();
    }
}

如果shell为空，就创建一个shell，我们来看看这个创建过程new Shell(“/system/bin/sh”, ShellType.NORMAL, ShellContext.NORMAL, timeout)。

private Shell(String cmd, ShellType shellType, ShellContext shellContext, int shellTimeout) throws IOException, TimeoutException, RootDeniedException {

    RootShell.log("Starting shell: " + cmd);
    RootShell.log("Context: " + shellContext.getValue());
    RootShell.log("Timeout: " + shellTimeout);

    this.shellType = shellType;
    this.shellTimeout = shellTimeout > 0 ? shellTimeout : this.shellTimeout;
    this.shellContext = shellContext;

    // 1、这里会执行cmd命令，就是上面传过来的"/system/bin/sh"
    if (this.shellContext == ShellContext.NORMAL) {
        this.proc = Runtime.getRuntime().exec(cmd);
    } else {
        String display = getSuVersion(false);
        String internal = getSuVersion(true);

        //only done for root shell...
        //Right now only SUPERSU supports the --context switch
        if (isSELinuxEnforcing() &&
                (display != null) &&
                (internal != null) &&
                (display.endsWith("SUPERSU")) &&
                (Integer.valueOf(internal) >= 190)) {
            cmd += " --context " + this.shellContext.getValue();
        } else {
            RootShell.log("Su binary --context switch not supported!");
            RootShell.log("Su binary display version: " + display);
            RootShell.log("Su binary internal version: " + internal);
            RootShell.log("SELinuxEnforcing: " + isSELinuxEnforcing());
        }

        this.proc = Runtime.getRuntime().exec(cmd);

    }

    // 2、得到执行cmd命令之后的输入流、输出流和错误流
    this.inputStream = new BufferedReader(new InputStreamReader(this.proc.getInputStream(), "UTF-8"));
    this.errorStream = new BufferedReader(new InputStreamReader(this.proc.getErrorStream(), "UTF-8"));
    this.outputStream = new OutputStreamWriter(this.proc.getOutputStream(), "UTF-8");

    //3、启动一个Worker线程去不断的读取输入流
    Worker worker = new Worker(this);
    worker.start();

    try {
        worker.join(this.shellTimeout);

        if (worker.exit == -911) {

            try {
                this.proc.destroy();
            } catch (Exception e) {
            }

            closeQuietly(this.inputStream);
            closeQuietly(this.errorStream);
            closeQuietly(this.outputStream);

            throw new TimeoutException(this.error);
        }
        /**
         * Root access denied?
         */
        else if (worker.exit == -42) {

            try {
                this.proc.destroy();
            } catch (Exception e) {
            }

            closeQuietly(this.inputStream);
            closeQuietly(this.errorStream);
            closeQuietly(this.outputStream);

            throw new RootDeniedException("Root Access Denied");
        }
        /**
         * Normal exit
         */
        else {
            // 4、启动一个线程，向输入流中输入命令
            Thread si = new Thread(this.input, "Shell Input");
            si.setPriority(Thread.NORM_PRIORITY);
            si.start();

            // 5、启动一个线程，得到执行命令之后输出流的信息
            Thread so = new Thread(this.output, "Shell Output");
            so.setPriority(Thread.NORM_PRIORITY);
            so.start();
        }
    } catch (InterruptedException ex) {
        worker.interrupt();
        Thread.currentThread().interrupt();
        throw new TimeoutException();
    }
}

1、执行”/system/bin/sh”命令

this.proc = Runtime.getRuntime().exec(cmd);

2、得到执行命令之后的输入流、输出流、错误流

this.inputStream = new BufferedReader(new InputStreamReader(this.proc.getInputStream(), "UTF-8"));
this.errorStream = new BufferedReader(new InputStreamReader(this.proc.getErrorStream(), "UTF-8"));
this.outputStream = new OutputStreamWriter(this.proc.getOutputStream(), "UTF-8");

3、启动一个Worker线程去不断的读取输入流

protected static class Worker extends Thread {

    public int exit = -911;

    public Shell shell;

    private Worker(Shell shell) {
        this.shell = shell;
    }

    public void run() {
        try {
            shell.outputStream.write("echo Started\n");
            shell.outputStream.flush();

            // 这里有一个死循环，不断的读取输入流
            while (true) {
                String line = shell.inputStream.readLine();

                if (line == null) {
                    throw new EOFException();
                } else if ("".equals(line)) {
                    continue;
                } else if ("Started".equals(line)) {
                    this.exit = 1;
                    setShellOom();
                    break;
                }

                shell.error = "unknown error occurred.";
            }
        } catch (IOException e) {
            exit = -42;
            if (e.getMessage() != null) {
                shell.error = e.getMessage();
            } else {
                shell.error = "RootAccess denied?.";
            }
        }

    }
}

4、启动一个线程，向输入流中输入命令

我们来看看input这个传入的Runnable参数

private Runnable input = new Runnable() {
    public void run() {

        try {
            while (true) {

                synchronized (commands) {
                    while (!close && write >= commands.size()) {
                        isExecuting = false;
                        commands.wait();
                    }
                }

                if (write >= maxCommands) {
                    while (read != write) {
                        RootShell.log("Waiting for read and write to catch up before cleanup.");
                    }
                    /**
                     * Clean up the commands, stay neat.
                     */
                    cleanCommands();
                }

                // 向outputStream中写入一条命令，也就是sh执行了一条命令
                if (write < commands.size()) {
                    isExecuting = true;
                    Command cmd = commands.get(write);
                    cmd.startExecution();
                    RootShell.log("Executing: " + cmd.getCommand() + " with context: " + shellContext);

                    outputStream.write(cmd.getCommand());
                    String line = "\necho " + token + " " + totalExecuted + " $?\n";
                    outputStream.write(line);
                    outputStream.flush();
                    write++;
                    totalExecuted++;
                } else if (close) {
                    isExecuting = false;
                    outputStream.write("\nexit 0\n");
                    outputStream.flush();
                    RootShell.log("Closing shell");
                    return;
                }
            }
        } catch (IOException e) {
            RootShell.log(e.getMessage(), RootShell.LogLevel.ERROR, e);
        } catch (InterruptedException e) {
            RootShell.log(e.getMessage(), RootShell.LogLevel.ERROR, e);
        } finally {
            write = 0;
            closeQuietly(outputStream);
        }
    }
};

5、启动一个线程，得到执行命令之后输出流的信息

我们来看看output这个传入的Runnable参数

private Runnable output = new Runnable() {
    public void run() {
        try {
            Command command = null;

            while (!close || inputStream.ready() || read < commands.size()) {
                isReading = false;
                // 从输入流中读出一行
                String outputLine = inputStream.readLine();
                isReading = true;

                if (outputLine == null) {
                    break;
                }

                if (command == null) {
                    if (read >= commands.size()) {
                        if (close) {
                            break;
                        }

                        continue;
                    }

                    command = commands.get(read);
                }

                int pos = -1;

                pos = outputLine.indexOf(token);
                // 最终调用我们Command重新的那个函数，用来处理输出信息
                if (pos == -1) {
                    command.output(command.id, outputLine);
                } else if (pos > 0) {
                    command.output(command.id, outputLine.substring(0, pos));
                }

                if (pos >= 0) {
                    outputLine = outputLine.substring(pos);
                    String fields[] = outputLine.split(" ");

                    if (fields.length >= 2 && fields[1] != null) {
                        int id = 0;

                        try {
                            id = Integer.parseInt(fields[1]);
                        } catch (NumberFormatException e) {
                        }

                        int exitCode = -1;

                        try {
                            exitCode = Integer.parseInt(fields[2]);
                        } catch (NumberFormatException e) {
                        }

                        if (id == totalRead) {
                            processErrors(command);

                            int iterations = 0;
                            while (command.totalOutput > command.totalOutputProcessed) {

                                if(iterations == 0)
                                {
                                    iterations++;
                                    RootShell.log("Waiting for output to be processed. " + command.totalOutputProcessed + " Of " + command.totalOutput);
                                }

                                try {

                                    synchronized (this)
                                    {
                                        this.wait(2000);
                                    }
                                } catch (Exception e) {
                                    RootShell.log(e.getMessage());
                                }
                            }

                            RootShell.log("Read all output");

                            command.setExitCode(exitCode);
                            command.commandFinished();
                            command = null;

                            read++;
                            totalRead++;
                            continue;
                        }
                    }
                }
            }

            try {
                proc.waitFor();
                proc.destroy();
            } catch (Exception e) {
            }

            while (read < commands.size()) {
                if (command == null) {
                    command = commands.get(read);
                }

                if(command.totalOutput < command.totalOutputProcessed)
                {
                    command.terminated("All output not processed!");
                    command.terminated("Did you forget the super.commandOutput call or are you waiting on the command object?");
                }
                else
                {
                    command.terminated("Unexpected Termination.");
                }

                command = null;
                read++;
            }

            read = 0;

        } catch (IOException e) {
            RootShell.log(e.getMessage(), RootShell.LogLevel.ERROR, e);
        } finally {
            closeQuietly(outputStream);
            closeQuietly(errorStream);
            closeQuietly(inputStream);

            RootShell.log("Shell destroyed");
            isClosed = true;
            isReading = false;
        }
    }
};

二、RootTools.isAccessGiven()判断app是否被授予root权限

public static boolean isAccessGiven()
{
    return RootShell.isAccessGiven();
}

可以看到它实际调用了RootShell.isAccessGiven()方法，所以我们来看看它的源码。

public static boolean isAccessGiven() {
    final Set<String> ID = new HashSet<String>();
    final int IAG = 158;

    try {
        RootShell.log("Checking for Root access");

        Command command = new Command(IAG, false, "id") {
            @Override
            public void commandOutput(int id, String line) {
                if (id == IAG) {
                    ID.addAll(Arrays.asList(line.split(" ")));
                }

                super.commandOutput(id, line);
            }
        };

        Shell.startRootShell().add(command);
        commandWait(Shell.startRootShell(), command);

        //parse the userid
        for (String userid : ID) {
            RootShell.log(userid);

            if (userid.toLowerCase().contains("uid=0")) {
                RootShell.log("Access Given");
                return true;
            }
        }

        return false;
    } catch (Exception e) {
        e.printStackTrace();
        return false;
    }
}