摘要：
char*外壳；char**argv；DB_允许}；极限。h>；标准工时>；#包括<；插管=0；intgid=0；｝charcommand[1024]；
本文原博客：http://hubingforever.blog.163.com/blog/static/171040579201372915716149/
在Android源代码的systemextras（比方Android4.0systemextras）下新建一个文件夹。比方su_robin文件夹
在su_robin文件夹下包括以三个文件：
su.h文件
#ifndef SU_h#define SU_h 1#ifdef LOG_TAG#undef LOG_TAG#endif#define LOG_TAG "robin"#define REQUESTOR "com.noshufou.android.su"#define REQUESTOR_DATA_PATH "/data/data/" REQUESTOR#define REQUESTOR_CACHE_PATH "/dev/" REQUESTOR#define REQUESTOR_DATABASES_PATH REQUESTOR_DATA_PATH "/databases"#define REQUESTOR_DATABASE_PATH REQUESTOR_DATABASES_PATH "/permissions.sqlite"/* intent actions */#define ACTION_REQUEST REQUESTOR ".REQUEST"#define ACTION_RESULT REQUESTOR ".RESULT"#define DEFAULT_SHELL "/system/bin/sh"#ifdef SU_LEGACY_BUILD#define VERSION_EXTRA "l"#else#define VERSION_EXTRA ""#endif#define VERSION "3.1.1" VERSION_EXTRA#define VERSION_CODE 17#define DATABASE_VERSION 6#define PROTO_VERSION 0struct su_initiator {pid_t pid;unsigned uid;char bin[PATH_MAX];char args[4096];};struct su_request {unsigned uid;int login;int keepenv;char *shell;char *command;char **argv;int argc;int optind;};struct su_context {struct su_initiator from;struct su_request to;mode_t umask;};enum {DB_INTERACTIVE,DB_DENY,DB_ALLOW};#endif
注意，这里的非常多东西是多余。
su.c文件
#include <sys/types.h>#include <sys/socket.h>#include <sys/un.h>#include <sys/wait.h>#include <sys/select.h>#include <sys/time.h>#include <unistd.h>#include <limits.h>#include <fcntl.h>#include <errno.h>#include <endian.h>#include <stdio.h>#include <stdlib.h>#include <string.h>#include <getopt.h>#include <stdint.h>#include <pwd.h>#include <private/android_filesystem_config.h>#include <cutils/properties.h>#include <cutils/log.h>#include "su.h"int main(int argc, char *argv[]){LOGI("hello !robin-su begin %d !",getuid());printf("hello !robin-su begin");int uid=0;int gid=0;if(setgid(gid) || setuid(uid)) {LOGI("robin su: permission denied ");fprintf(stderr,"su: permission denied ");return 1;}char command[1024];LOGI("hello !robin-su end %d !",getuid());printf("hello !robin-su end");/* Default exec shell. */execlp("/system/bin/sh", "sh", NULL);fprintf(stderr, "su: exec failed ");return 1;}
LOCAL_PATH := $(call my-dir)include $(CLEAR_VARS)LOCAL_MODULE := surLOCAL_SRC_FILES := su.cLOCAL_STATIC_LIBRARIES :=libloglibcLOCAL_MODULE_PATH := $(TARGET_OUT_OPTIONAL_EXECUTABLES)LOCAL_MODULE_TAGS := eng debugLOCAL_FORCE_STATIC_EXECUTABLE := trueinclude $(BUILD_EXECUTABLE)
编译Android源代码，生成rom
假设你还不知道怎样编译Android源代码。请參照
在out argetproductgenericsystemxbin文件夹下找到生成的可运行文件sur,就是我们自己制作的su文件
通过adb push命令将其推送到手机上的systemxbin文件夹。
通过运行系统原来自己带的su切换到root用户，对手机上sur文件运行chmod 6777 sur命令。
使文件属性变为rwsrwsrwx，例如以下所看到的
rwsrwsrwx root root 58960 2013-08-29 11:31 sur
然后你能够通过运行系统原来自己带的sur切换到root用户
结束！