{"id":1071,"date":"2026-09-19T14:08:33","date_gmt":"2026-09-19T06:08:33","guid":{"rendered":"https:\/\/blog.nanoturtle.cn\/?p=1071"},"modified":"2026-09-19T14:20:13","modified_gmt":"2026-09-19T06:20:13","slug":"what-i-did-this-month","status":"publish","type":"post","link":"https:\/\/blog.nanoturtle.cn\/index.php\/2026\/09\/19\/what-i-did-this-month\/","title":{"rendered":"\u4e00\u4e2a\u6708\u4ee5\u6765\uff0c\u6211\u5e72\u4e86\u4e9b\u4ec0\u4e48\uff1f"},"content":{"rendered":"
\n\t\t\t\t
<\/div>\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t<\/svg><\/span>\n\t\t\t\t\t\u6458\u8981\u751f\u6210\u4e2d<\/span>\n\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t<\/div>\n\t\t\t\t
\u4e00\u4e2a\u6708\u7684\u4e3b\u7ebf\u662f\u628a\u4e09\u661fS24 Ultra\u56fd\u884c\u514d\u89e3\u9501root\u4ece\u5355\u673a\u5076\u7136\u6210\u529f\u6253\u78e8\u6210\u53ef\u590d\u73b0\u3001\u53ef\u5ba1\u8ba1\u3001\u53ef\u5feb\u901f\u9002\u914d\u65b0\u56fa\u4ef6\u7684\u6d41\u6c34\u7ebf\u3002\u6838\u5fc3\u7ed3\u8bba\u662f\u8f7d\u8377\u6309\u5185\u6838\u6784\u5efa\u5b9a\u6807\u800c\u975e\u6309\u673a\u578b\uff0c\u540c\u6784\u5efa\u53f7\u4e0d\u540c\u673a\u578b\u53ef\u5171\u7528\uff0c\u56fd\u884c\u4e0e\u5916\u7248\u4e0d\u53ef\u6df7\u7528\uff0c\u5185\u6838\u7248\u672c\u4e0d\u540c\u5fc5\u987b\u5355\u72ec\u5b9a\u6807\u3002\u5b9a\u6807\u6d41\u7a0b\u5df2\u4ece\u4e0b\u8f7d14GB\u5168\u5305\u624b\u6284\u504f\u79fb\u538b\u7f29\u4e3a\u4e0b\u8f7d120MB\u3001\u8dd1\u4e09\u4e2a\u811a\u672c\u3001\u5341\u51e0\u5206\u949f\u5b8c\u6210\u3002DZF2\u4e0eDZH3\u540c\u5185\u6838\u7ebf\uff0c\u5341\u4e07\u4f59\u7b26\u53f7\u4e2d\u4ec5\u4e03\u4e2a\u9759\u6001\u5b57\u7b26\u4e32\u4e0d\u540c\uff0c\u8f7d\u8377\u76f4\u63a5\u590d\u7528\uff1bCZB2\u5c5e\u53e6\u4e00\u6761\u7ebf\u5219\u9700\u5355\u72ec\u5b9a\u6807\u3002<\/div>
\u2014 AI\u751f\u6210\uff0c\u4ec5\u4f9b\u53c2\u8003<\/span><\/div>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n

\u9898\u8bb0\uff1a\u5e9f\u8bdd\u4e0d\u8bf4\uff0c\u76f4\u63a5\u8fdb\u6b63\u9898\u3002\u672c\u6708\u4e3b\u7ebf\u4e00\u53e5\u8bdd\uff1a\u628a”\u4e09\u661fS24 Ultra\u56fd\u884c\u514d\u89e3\u9501root”\u4ece\u4e00\u53f0\u673a\u5b50\u7684\u5076\u7136\u6210\u529f\uff0c\u78e8\u6210\u4e00\u5957\u53ef\u590d\u73b0\u3001\u53ef\u5ba1\u8ba1\u3001\u53ef\u7ed9\u65b0\u56fa\u4ef6\u5feb\u901f\u9002\u914d\u7684\u6d41\u6c34\u7ebf\u3002<\/strong>\u6d3b\u513f\u5927\u90e8\u5206\u662f\u914d\u5408AI\uff08\u67d0\u81ea\u7136\u8bed\u8a00\u5904\u7406\u5927\u6a21\u578b\uff09\u5e72\u7684\uff0c\u4ee3\u7801\u8bf4\u5b9e\u8bdd\u6211\u90fd\u6ca1\u5b8c\u5168\u5403\u900f\uff0c\u4f46\u6211\u76f8\u4fe1\u603b\u4f1a\u7406\u89e3\u7684\u2014\u2014\u6bd5\u7adf\u8fd9\u4ee3\u7801\u672c\u8eab\u5c31\u662f\u5927\u6a21\u578b\u5199\u7684\u3002<\/p>\n\n\n\n

0x00 RootMyS24<\/h2>\n\n\n\n

\u5148\u8bf4\u7ed3\u8bba\uff1a\u8f7d\u8377\u662f\u6309\u5185\u6838\u6784\u5efa\u5b9a\u6807\u7684\uff0c\u4e0d\u662f\u6309\u673a\u578b\u3002<\/strong>\u673a\u578b\u53ea\u662f\u8868\u9762\uff0c\u771f\u6b63\u51b3\u5b9a\u80fd\u4e0d\u80fd\u8dd1\u7684\u662f\u90a3\u51e0\u884c\u504f\u79fb\u548c\u90a3\u5f20\u6ed1\u52a8\u6307\u7eb9\u3002<\/p>\n\n\n\n

0x00-1 \u5b9a\u6807\u4e09\u89c4\u5219<\/h3>\n\n\n\n

\u8fd9\u4e00\u4e2a\u6708\u53cd\u590d\u9a8c\u8bc1\uff0c\u6c89\u6dc0\u6210\u4e09\u6761\u89c4\u5219\uff1a<\/p>\n\n\n\n

    \n
  • \u540c\u6784\u5efa\u53f7\u3001\u4e0d\u540c\u673a\u578b\uff0c\u8f7d\u8377\u53ef\u5171\u7528\u3002S9210\/S9260\/S9280\u56fd\u884c\u540cbuild\uff0c\u4e00\u5957\u8f7d\u8377\u901a\u5403\uff08\u4ee3\u7801\u6bb5\u7b26\u53f7\u3001\u6570\u636e\u6bb5\u504f\u79fb\u3001\u6307\u7eb9\u90fd\u4e00\u6837\uff09\u3002<\/li>\n\n\n\n
  • \u56fd\u884c\u4e0e\u4e0a\u7248\/\u5916\u7248\u4e0d\u53ef\u6df7\u7528\u3002\u54ea\u6015\u5185\u6838\u7248\u672c\u53f7\u4e00\u6837\uff0ckmalloc_caches\u3001nfnetlink_log\u8fd9\u7c7b\u6570\u636e\u6bb5\u504f\u79fb\u4e0d\u540c\uff0c\u786c\u5957\u5c31\u662f\u5168\u6302\u3002\u6e2f\u53f0\u540cbuild\u53ef\u4e92\u7528\uff0c\u56fd\u884c\u662f\u5355\u72ec\u4e00\u6761\u7ebf\u3002<\/li>\n\n\n\n
  • \u5185\u6838\u7248\u672c\u4e0d\u540c\uff0c\u5fc5\u987b\u5355\u72ec\u5b9a\u6807\u3002\u6700\u8d39\u529f\u592b\u3001\u6700\u5bb9\u6613\u7ffb\u8f66\uff0c\u8fd9\u4e2a\u6708\u683d\u8fc7\u8ddf\u5934\u3002<\/li>\n<\/ul>\n\n\n\n

    0x00-2 \u628a\u5b9a\u6807\u6d41\u7a0b\u4ece”\u7384\u5b66”\u53d8\u6210”\u811a\u672c”<\/h3>\n\n\n\n

    \u4ee5\u524d\u9002\u914d\u65b0\u56fa\u4ef6\uff1a\u4e0b\u8f7d14GB\u5168\u5305 \u2192 \u89e3\u5305 \u2192 \u53cd\u6c47\u7f16 \u2192 \u624b\u6284\u504f\u79fb \u2192 \u771f\u673a\u8bd5\u9519\u3002\u73b0\u5728\uff1a\u4e0b120MB \u2192 \u8dd1\u4e09\u4e2a\u811a\u672c \u2192 \u7f16\u4e00\u6b21\uff0c\u4ece\u5934\u5230\u5c3e\u5341\u51e0\u5206\u949f\u3002\u6838\u5fc3\u811a\u672c\u9010\u6bb5\u770b\uff1a<\/p>\n\n\n\n

    0x00-2-1 \u53d6 boot\uff1afetch_boot_prefix.sh<\/h4>\n\n\n\n
    VER=\"${1:?\u9700\u89814\u6bb5\u7248\u672c\u4e32}\"          # \u4f8b\uff1aS9280ZCS5CZB2\/S9280CHC5CZB2\/S9280ZCS5CZB1\/S9280ZCS5CZB2\nOUT=\"${2:?\u9700\u8981\u8f93\u51fa\u76ee\u5f55}\"\nNEED=${3:-120000000}                # \u9ed8\u8ba4\u53ea\u8981\u6587\u4ef6\u5f00\u5934120MB\u5c31\u591f\u8986\u76d6AP\u91cc\u7684boot\n\"$T\/samloader\" download -m SM-S9280 -r CHC -j 1 -v \"$VER\" -d \"$OUT\" &   # -j1\u5355\u7ebf\u7a0b,\u907f\u514d\u5206\u5757\u7ebf\u7a0b\u5361\u6b7b\n# \u7b49\"\u6587\u4ef6\u5f00\u5934N\u5b57\u8282\u90fd\u771f\u6b63\u843d\u76d8\"\uff08\u7a00\u758f\u6587\u4ef6\u91cc\u672a\u4e0b\u8f7d\u533a\u57df\u662f\u7a7a\u6d1e,\u8bfb\u51fa\u6765\u662f\u5168\u96f6\uff09\nprefix_cov() {   # \u7528SEEK_DATA\/SEEK_HOLE\u6570\u51fa[0,\u7b2c\u4e00\u4e2a\u7a7a\u6d1e)\u7684\u957f\u5ea6,\u5373\u5df2\u8fde\u7eed\u4e0b\u8f7d\u7684\u5b57\u8282\n  python3 - \"$f\" <<'PY'\nimport os, sys\nfd=os.open(sys.argv[1], os.O_RDONLY)\ntry:\n    d=os.lseek(fd, 0, os.SEEK_DATA)   # \u7b2c\u4e00\u4e2a\u6709\u6570\u636e\u7684\u504f\u79fb(\u4ece0\u5f00\u59cb=0)\n    h=os.lseek(fd, d, os.SEEK_HOLE)   # \u7b2c\u4e00\u4e2a\u7a7a\u6d1e\u504f\u79fb\n    print(h if d==0 else 0)           # \u82e50\u5904\u662f\u6570\u636e,\u524d\u7f00\u8986\u76d6\u5230h;\u5426\u52190\nfinally: os.close(fd)\nPY\n}\n# \u8986\u76d6\u591f120MB\u540e\u6740\u6389\u4e0b\u8f7d,\u628azip\u91cc\u7b2c\u4e00\u4e2atar\u7684boot.img.lz4\u62a0\u51fa\u6765\u89e3\u538b<\/pre>\n\n\n\n
    \u5999\u5904\uff1asamloader\u591a\u7ebf\u7a0b\u9ed8\u8ba4\u628a\u6587\u4ef6\u5206\u62108\u6bb5\u4e71\u5e8f\u4e0b\u8f7d\uff0cchunk 0\u90a3\u6761\u7ebf\u7a0b\u6709\u65f6\u4f1a\u5361\u6b7b\uff08\u4e0a\u6b21DZH3\u5361\u572886MB\u4e0d\u52a8\uff09\u3002\u5355\u7ebf\u7a0b\u987a\u5e8f\u5199\uff0c\u524d\u7f00\u5c31\u80fd\u7a33\u5b9a\u589e\u957f\uff0c\u5230120MB\u7acb\u523b\u6390\u3002<\/p>\n\n\n\n
    0x00-2-2 \u8fd8\u539f\u5185\u6838\uff1aanalyze_boot.sh<\/h4>\n\n\n\n
    # \u62c6boot,\u5f97\u5230kernel + ramdisk\nmagiskboot unpack boot.img\n# \u5185\u6838\u672c\u8eab\u53ef\u80fd\u662flz4\u538b\u7f29\u7684,\u89e3\u51fa\u6765;raw\u7684\u8bdd\u76f4\u63a5\u7528\nmagiskboot decompress kernel kernel_raw 2>\/dev\/null || cp kernel kernel_raw\n# \u4ece\u539f\u59cbImage\u8fd8\u539f\u5e26\u7b26\u53f7\u7684ELF\u2014\u2014\u540e\u9762\u6240\u6709\u504f\u79fb\u90fd\u4ece\u8fd9\u67e5\nPYTHONPATH=vmlinux-to-elf python3 -m vmlinux_to_elf.scripts.vmlinux_to_elf \\\n  kernel_raw vmlinux.elf   # \u4ea7\u51fa43MB ELF,\u7b26\u53f7\u53ef\u7528llvm-nm\/objdump\u67e5<\/pre>\n\n\n\n
    0x00-2-3 \u7b26\u53f7\u8eab\u4efd\u8fc1\u79fb\uff1agen_target_h.py<\/h4>\n\n\n\n
    \u628a”\u9002\u914d\u4ece\u6284\u4f5c\u4e1a\u53d8\u6210\u67e5\u7b26\u53f7\u8868”\u7684\u5173\u952e\u3002\u601d\u8def\uff1a\u4ee5DZF2\u7684target.h\u4e3a\u6a21\u677f\uff0c\u5bf9\u6bcf\u4e2a\u504f\u79fb\u53d6”\u6a21\u677f\u5185\u6838\u91cc\u90a3\u4e2a\u5730\u5740\u4e0a\u7684\u7b26\u53f7\u540d”\uff0c\u5728\u65b0\u5185\u6838\u91cc\u6309\u540c\u540d\u56de\u67e5\uff0c\u81ea\u52a8\u751f\u6210\u65b0target.h\uff1a<\/p>\n\n\n\n
    def main():\n    ...\n    for i,line in enumerate(lines):\n        m = re.match(r\"(\\s*#define\\s+)([A-Z0-9_]+_OFF)(\\s+)(0x[0-9a-fA-F]+)\", line)\n        if not m: continue\n        old = int(m.group(4), 16)\n        # 1) \u6a21\u677f\u5185\u6838\u91cc,\u8fd9\u4e2a\u504f\u79fb\u843d\u5728\u54ea\u4e2a\u7b26\u53f7\u4e0a?\n        sym = tpl_addr2sym.get(BASE + old)      # \u5730\u5740\u2192\u7b26\u53f7\u540d\n        # 2) \u65b0\u5185\u6838\u91cc\u6309\u540c\u540d\u56de\u67e5,\u5f97\u5230\u65b0\u5730\u5740\n        if sym and sym in new_sym2addr:\n            new = new_sym2addr[sym] - BASE\n            lines[i] = f\"{m.group(1)}{m.group(2)}{m.group(3)}0x{new:09x}\\n\"\n        # 3) \u7279\u6b8a\"\u7b26\u53f7+\u5b57\u6bb5\u504f\u79fb\"\u578b:ashmem_miscs+0x10, worker_thread+0xa0 \u663e\u5f0f\u5904\u7406\n    # \u987a\u5e26\u628a BUILD_VARIANT_LABEL \/ BUILD_FINGERPRINT \u6362\u6210\u76ee\u6807\u578b\u53f7<\/pre>\n\n\n\n
    \u5b9e\u6d4b\uff1aDZF2\u2192DZH3\u8fc1\u79fb\u4e8623\u4e2a\u504f\u79fb\u5168\u5bf9\uff08\u7b26\u53f799.99%\u76f8\u540c\uff09\uff1bCZB2\u662f\u53e6\u4e00\u6761\u7ebf\uff0c20\u4e2a\u504f\u79fb0\u4e2a\u5bf9\u5f97\u4e0a\uff0c\u53ea\u80fd\u8001\u8001\u5b9e\u5b9e\u5355\u72ec\u5b9a\u6807\u3002<\/p>\n\n\n\n
    0x00-2-4 \u751f\u6210 KASLR \u6ed1\u52a8\u6307\u7eb9\uff1agen_p0_fingerprint.py<\/h4>\n\n\n\n
    # 32\u884c\u6307\u7eb9,\u6bcf\u884c\u5bf9\u5e94\u4e00\u4e2a\u53ef\u80fd\u7684slide(0x000000..0x1f0000\u6b65\u8fdb0x10000)\nfor slide in range(0, 0x200000, 0x10000):\n    at = 0x1f0000 - slide              # \u8be5slide\u4e0b,\u5185\u6838Image\u7684\u91c7\u6837\u57fa\u5740\n    words = [unpack64(img, at + o) for o in (0x000,0x200,...,0xe00)]  # 8\u4e2aqword\n    assert words[0] == unpack64(img, 0)  # \u672b\u884c(Index[0])=Image[0]\u7684MZ\u9b54\u6570,\u81ea\u68c0\n    # \u8fd98\u4e2aqword\u5c31\u662fP0\u7269\u7406\u9875oracle\u7528\u6765\u8ba4slide\u7684\u6307\u7eb9<\/pre>\n\n\n\n
    0x01-1 DZH3\uff1a\u6361\u4e86\u4e2a\u4fbf\u5b9c\uff0c\u7701\u4e86\u6574\u6bb5\u5b9a\u6807<\/h3>\n\n\n\n
    DZF2\u548cDZH3\u662f\u540c\u4e00\u5185\u6838\u7ebf\uff1a6.1.145-android14-11-3254743\uff0c\u53ea\u5dee\u672b\u5c3eDZF2\u2192DZH3\u3002\u6bd4\u5bf9\u2014\u2014103,514\u4e2a\u7b26\u53f7\u91cc103,507\u4e2a\u5730\u5740\u5b8c\u5168\u76f8\u540c\uff0c\u5c317\u4e2a\u9759\u6001\u5b57\u7b26\u4e32\uff08f_midi_longname\u3001pty_line_name\u3001trunc_msg\u90a3\u4e9b\uff09\u4e0d\u540c\u3002\u6240\u4ee5DZF2\u8f7d\u8377\u5bf9DZH3\u76f4\u63a5\u6709\u6548\uff0c\u53ea\u5deep0\u6307\u7eb9\u91cc1\u4e2a\u8bcd\uff08slide 0x1a0000\uff09\uff0c\u91cd\u751f\u6210\u4e00\u4efd\u5373\u53ef\u3002<\/p>\n\n\n\n
    0x01-2 CZB2\uff1a\u53e6\u4e00\u6761\u7ebf\uff0c\u5077\u4e0d\u5f97\u61d2<\/h3>\n\n\n\n
    CZB2\u662f6.1.128\uff0c\u6784\u5efa\u53f72755301\uff0c\u8ddfDZF2\u5b8c\u5168\u4e0d\u662f\u4e00\u6839\u85e4\u4e0a\u7684\u74dc\uff1a20\u4e2a\u5173\u952e\u504f\u79fb0\u4e2a\u76f8\u540c\uff0c10\u4e07\u5171\u6709\u7b26\u53f7\u91cc\u4ec50.44%\u5730\u5740\u4e00\u81f4\u3002\u53ea\u80fd\u8d70\u5b8c\u6574\u6d41\u6c34\u7ebf\u3002\u5b9e\u6d4b\u5728S9210ZCS5CZB2\u4e0aexploit\u4e00\u904d\u8fc7\uff08attempt 1\u5c31triggered=1\uff09\u2014\u2014\u7b49\u4e8e\u7ed9\u6574\u5957\u6d41\u7a0b\u505a\u4e86\u6b21\u771f\u673a\u9a8c\u6536\u3002<\/p>\n\n\n\n
    0x01-3 \u8e29\u8fc7\u6700\u5927\u7684\u5751\uff1a\u6539vermagic\u53ea\u5bf9\u76f8\u90bbbuild code\u5b89\u5168<\/h3>\n\n\n\n
    \u8fd9\u6708\u6700\u75db\u7684\u4e00\u8bfe\u3002KernelSU\u5185\u5d4c\u6a21\u5757\u8981\u5339\u914d\u76ee\u6807\u5185\u6838vermagic\u3002\u56fe\u7701\u4e8b\u628aS928U\u6a21\u5757\u7684vermagic\u5b57\u7b26\u4e32\u6539\u6210DZH3\u2014\u2014\u7ed3\u679c\u4e00\u4e0a\u771f\u673a\uff0clate-load\u540e\u4e00\u89e3\u9501\u5c31\u5361\u6b7b\u91cd\u542f\uff0c\u6beb\u65e0\u5f81\u5146\u3002<\/p>\n\n\n\n
      \n
    • \u8868\u8c61\uff1a\u52a0\u8f7dKernelSU\u540e\u7cfb\u7edf\u6781\u4e0d\u7a33\u5b9a\uff0c\u89e3\u9501\uff08\u5524\u9192\u663e\u793a\/GPU\u7684work\uff09\u4e00\u78b0\u5c31\u5d29\u3002<\/li>\n\n\n\n
    • \u6839\u56e0\uff1avermagic\u6539\u4e32\u53ea\u9a97\u8fc7\u7248\u672c\u68c0\u67e5\uff0c\u4f46\u6a21\u5757\u662f\u6309S928U\u5185\u6838\uff08\u6784\u5efa\u53f733419968\uff09\u7f16\u7684\uff0cDZH3\u662f3254743\u2014\u2014\u8de8\u5185\u6838\uff0c\u8fd0\u884c\u65f6\u7684KDP\/RKP\u94a9\u5b50\u3001cred\u5904\u7406\u3001\u7ed3\u6784\u4f53\u5047\u8bbe\u5168\u5bf9\u4e0d\u4e0a\u3002<\/li>\n\n\n\n
    • \u89e3\u6cd5\uff1a\u8de8\u5185\u6838\u4e00\u5f8b\u7528DDK\uff08ghcr.io\/ylarod\/ddk-min\uff09\u6309\u771f\u673a\u5185\u6838\u6b63\u5f0f\u91cd\u5efa\uff0cUTS_RELEASE\u8bbe\u6210\u76ee\u6807release\uff0c\u7ea6\u4e24\u5206\u949f\u7f16\u4e00\u4e2a\uff0c\u518d\u8dd1check_symbol + audit_module_against_target.py\uff08209\u5bfc\u5165\/0\u7f3a\u5931\/0 CRC\u4e0d\u5339\u914d\u5168\u8fc7\uff09\u3002<\/li>\n<\/ul>\n\n\n\n
      \u7ecf\u9a8c\uff1a\u6539\u4e32\u8fd9\u62db\u53ea\u5bf9\u540c\u4e00\u5185\u6838\u7ebf\u3001\u76f8\u90bbbuild code\u5b89\u5168\uff08DZF2\u2194DZH3\u8fd9\u79cd\uff09\uff1b\u8de8\u5185\u6838\u7248\u672c\uff0c\u7701\u4e0b\u7684\u65f6\u95f4\u4f1a\u52a0\u500d\u8d54\u8fdb\u53bb\u3002<\/p>\n\n\n\n
      0x01-4 \u771f\u673a\u8e29\u5751\u8bb0\u5f55<\/h3>\n\n\n\n
        \n
      • \u5751A \u89e3\u9501\u5c31\u5361\u6b7b\u91cd\u542f\u2014\u2014\u52a0\u8f7d\u4e86\u6309\u9519\u8bef\u5185\u6838\u6784\u5efa\u7684\u6a21\u5757\uff08\u89c10x01-3\uff09\u3002\u89e3\u6cd5\uff1aDDK\u6309\u771f\u673a\u5185\u6838\u91cd\u5efa\u3002\u5df2\u89e3\u51b3\u3002<\/li>\n\n\n\n
      • \u5751B \u8981\u4e48\u4e00\u904d\u8fc7\u8981\u4e48\u4e00\u76f4\u5931\u8d25\u2014\u2014fops-slide\u7ade\u6001\u8981\u591a\u4e2a\u5199\u7ebf\u7a0b\u5728\u7cbe\u786e\u7a97\u53e3\u62a2\u8c03\u5ea6\uff1bapp\u7184\u5c4f\/\u540e\u53f0\u628apayload\u538b\u8fdb\u540e\u53f0cgroup\uff08Android\u9650CPU\uff09\u2192\u5199\u7ebf\u7a0b\u997f\u6b7b\u2192triggered=0\u3002\u89e3\u6cd5\uff1a\u8dd1\u7684\u65f6\u5019\u522b\u8ba9\u8fdb\u7a0b\u8fdb\u540e\u53f0cgroup\uff08\u4e0d\u7184\u5c4f\/\u4fdd\u6301\u524d\u53f0\uff09\uff0c\u547d\u4e2d\u7387\u660e\u663e\u63d0\u5347\u3002<\/li>\n\n\n\n
      • \u5751C \u6e90\u7801ksud\u7f3a–ephemeral\u2014\u2014ksud late-load: exit=2 unexpected argument ‘–ephemeral’ found\u3002\u51fa\u5382ksud-selected\u662f\u5b9a\u5236\u7248\u81ea\u5e26\u8be5\u53c2\u6570\uff08\u52a0\u8f7d\u6a21\u5757\u540e\u8df3\u8fc7ksud\u5b89\u88c5\u4e0e\/data\/adb\u5199\u5165\uff09\uff0c\u6e90\u7801\u91cd\u7f16\u7684\u6ca1\u6709\u3002\u89e3\u6cd5\uff1a\u628a–ephemeral\u52a0\u8fdbcli.rs\u7684LateLoad\uff08ephemeral=true\u65f6\u8df3\u8fc7stage_daemon_from\u4e0efinish_install\uff09\u3002\u5df2\u8865\uff0cexit=0\u3002<\/li>\n\n\n\n
      • \u5751D \u7ba1\u7406\u5668\u663e\u793a\u7248\u672c\u4e0d\u5bf9\u2014\u2014\u62ff3.3.0\u7684ksud\u6d4b\uff0c\u7ba1\u7406\u5668\u8fd8\u662f\u663e\u793av3.2.5(32525-2)\u3002\u6839\u56e0\uff1a\u7ba1\u7406\u5668\u663e\u793a\u7684\u662f\u5185\u6838\u6a21\u5757\u7248\u672c\u4e0d\u662fksud\u7248\u672c\uff1b\u6211\u7684\u6a21\u5757\u4ecev3.2.5\u6e90\u7801\u7f16\uff0c\u6c38\u8fdc\u62a532525\u3002\u89e3\u6cd5\uff1a\u8981\u663e\u793a32601\uff0c\u5f97\u628a\u6a21\u5757\u4e5f\u4ecev3.3.0\u6e90\u7801+\u4e09\u661f\u8865\u4e01\u91cd\u7f16\uff08\u9700rebase\u8865\u4e01\uff0c\u72ec\u7acb\u6d3b\uff0c\u8fd8\u6ca1\u505a\uff09\u3002<\/li>\n\n\n\n
      • \u5751E CZB2\u540c\u6b3e\u5751\u53c8\u8e29\u4e00\u904d\u2014\u2014CZB2\u673a\u5668exploit\u4e00\u904d\u8fc7\uff0c\u4f46late-load\u540e\u540c\u6837\u5361\u6b7b\u3002\u89e3\u6cd5\uff1a\u8d70DDK\u4e3aCZB2\u6b63\u5f0f\u91cd\u5efa\uff08vermagic 6.1.128-android14-11-2755301-abS9280ZCS5CZB2\uff09\uff0c\u5ba1\u8ba1\u5168\u8fc7\u3002<\/li>\n<\/ul>\n\n\n\n
        0x01 \u7f51\u7ad9<\/h2>\n\n\n\n
        \u8fd9\u4e2a\u6708\u4e0d\u5168\u662froot\u3002\u628arms24\u7684\u65e5\u5fd7\u4e0a\u62a5\u3001\u7edf\u8ba1\u3001\u4e0b\u8f7d\u9875\u6574\u5230\u4e86blog.nanoturtle.cn\uff1b\u5730\u56fe\u74e6\u7247\u6362\u4e86\u56fd\u5185\u5408\u89c4\u5e95\u56fe\uff08\u9ad8\u5fb7+\u53ef\u9009\u5929\u5730\u56fe+\u65e0\u5e95\u56fe\uff0c\u5750\u6807GCJ-02\u8f6c\u6362\uff09\uff1b\u5bfc\u822a\u3001\u9996\u9875\u5361\u7247\u91cd\u505a\uff08PDO\u76f4\u5199wp_posts\u7ed5\u5f00KSES\u8fc7\u6ee4\uff09\u3002\u987a\u624b\u4fee\u4e86\u53f0\u672c\u5730\u673a\u7684fcitx5\u62fc\u97f3\u2014\u2014\u5347\u7ea7addons\u540eABI\u5bf9\u4e0d\u4e0a\uff08\u65b0\u7248addons\u5f15\u7528\u4e86\u65e7\u6838\u5fc3\u6ca1\u6709\u7684fcitx::RegexConstrain\u7b26\u53f7\uff09\uff0c\u6362\u56de\u5b98\u65b9\u6838\u5fc35.1.22\u5c31\u597d\u3002\u771f\u7684\u6709\u70b9\u96be\u7ef7\u3002<\/p>\n\n\n\n
        0x02 \u603b\u7ed3<\/h2>\n\n\n\n
        \u4e00\u53e5\u8bdd\uff1a<\/p>\n\n\n\n
        \n
        \u6d3b\u90fd\u5728\u5de5\u5177\u7684\u81ea\u52a8\u5316\u91cc\uff0c\u771f\u6b63\u96be\u7684\u8fd8\u662f\u5185\u6838\u4fa7\u7684\u8fd0\u884c\u65f6\u5047\u8bbe\u3002<\/p>\n<\/blockquote>\n\n\n\n
        \u8fd9\u4e2a\u6708\u80fd\u8ba9\u6211\u5982\u6b64\u5fd9\u788c\u7684\u5bfc\u706b\u7d22\u8fd8\u662f\u56e0\u4e3a\u6211\u624b\u8d31\u5347\u7ea7OneUI8.5\uff0c\u5509\uff0c\u7d2f\u4e86\u3002<\/p>\n\n\n\n
        \u5c31\u8fd9\u6837\u3002\u597d\u4e45\u6ca1\u89c1\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
        \u4e00\u4e2a\u6708\u7684\u4e3b\u7ebf\u662f\u628a\u4e09\u661fS24 Ultra\u56fd\u884c\u514d\u89e3\u9501root\u4ece\u5355\u673a\u5076\u7136\u6210\u529f\u6253\u78e8\u6210\u53ef\u590d\u73b0\u3001\u53ef\u5ba1\u8ba1\u3001\u53ef\u5feb\u901f\u9002\u914d\u65b0\u56fa\u4ef6\u7684\u6d41\u6c34\u7ebf\u3002\u6838\u5fc3\u7ed3\u8bba\u662f\u8f7d\u8377\u6309\u5185\u6838\u6784\u5efa\u5b9a\u6807\u800c\u975e\u6309\u673a\u578b\uff0c\u540c\u6784\u5efa\u53f7\u4e0d\u540c\u673a\u578b\u53ef\u5171\u7528\uff0c\u56fd\u884c\u4e0e\u5916\u7248\u4e0d\u53ef\u6df7\u7528\uff0c\u5185\u6838\u7248\u672c\u4e0d\u540c\u5fc5\u987b\u5355\u72ec\u5b9a\u6807\u3002\u5b9a\u6807\u6d41\u7a0b\u5df2\u4ece\u4e0b\u8f7d14GB\u5168\u5305\u624b\u6284\u504f\u79fb\u538b\u7f29\u4e3a\u4e0b\u8f7d120MB\u3001\u8dd1\u4e09\u4e2a\u811a\u672c\u3001\u5341\u51e0\u5206\u949f\u5b8c\u6210\u3002DZF2\u4e0eDZH3\u540c\u5185\u6838\u7ebf\uff0c\u5341\u4e07\u4f59\u7b26\u53f7\u4e2d\u4ec5\u4e03\u4e2a\u9759\u6001\u5b57\u7b26\u4e32\u4e0d\u540c\uff0c\u8f7d\u8377\u76f4\u63a5\u590d\u7528\uff1bCZB2\u5c5e\u53e6\u4e00\u6761\u7ebf\u5219\u9700\u5355\u72ec\u5b9a\u6807\u3002<\/p>\n","protected":false},"author":1,"featured_media":83,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_uag_custom_page_level_css":"","_excerptai":2,"_xhaitool_aitasks":false,"_xhaitool_aitasks_status":true,"_aiimage_cueword":"","_aiimage_status":0,"_xhai_excerpt":"\u4e00\u4e2a\u6708\u7684\u4e3b\u7ebf\u662f\u628a\u4e09\u661fS24 Ultra\u56fd\u884c\u514d\u89e3\u9501root\u4ece\u5355\u673a\u5076\u7136\u6210\u529f\u6253\u78e8\u6210\u53ef\u590d\u73b0\u3001\u53ef\u5ba1\u8ba1\u3001\u53ef\u5feb\u901f\u9002\u914d\u65b0\u56fa\u4ef6\u7684\u6d41\u6c34\u7ebf\u3002\u6838\u5fc3\u7ed3\u8bba\u662f\u8f7d\u8377\u6309\u5185\u6838\u6784\u5efa\u5b9a\u6807\u800c\u975e\u6309\u673a\u578b\uff0c\u540c\u6784\u5efa\u53f7\u4e0d\u540c\u673a\u578b\u53ef\u5171\u7528\uff0c\u56fd\u884c\u4e0e\u5916\u7248\u4e0d\u53ef\u6df7\u7528\uff0c\u5185\u6838\u7248\u672c\u4e0d\u540c\u5fc5\u987b\u5355\u72ec\u5b9a\u6807\u3002\u5b9a\u6807\u6d41\u7a0b\u5df2\u4ece\u4e0b\u8f7d14GB\u5168\u5305\u624b\u6284\u504f\u79fb\u538b\u7f29\u4e3a\u4e0b\u8f7d120MB\u3001\u8dd1\u4e09\u4e2a\u811a\u672c\u3001\u5341\u51e0\u5206\u949f\u5b8c\u6210\u3002DZF2\u4e0eDZH3\u540c\u5185\u6838\u7ebf\uff0c\u5341\u4e07\u4f59\u7b26\u53f7\u4e2d\u4ec5\u4e03\u4e2a\u9759\u6001\u5b57\u7b26\u4e32\u4e0d\u540c\uff0c\u8f7d\u8377\u76f4\u63a5\u590d\u7528\uff1bCZB2\u5c5e\u53e6\u4e00\u6761\u7ebf\u5219\u9700\u5355\u72ec\u5b9a\u6807\u3002","footnotes":""},"categories":[22],"tags":[46,69,47,48],"class_list":["post-1071","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-22","tag-android","tag-kernelsu","tag-root-permission","tag-samsung-flashing"],"uagb_featured_image_src":{"full":["https:\/\/blog.nanoturtle.cn\/wp-content\/uploads\/2026\/01\/421776.jpg",1080,1085,false],"thumbnail":["https:\/\/blog.nanoturtle.cn\/wp-content\/uploads\/2026\/01\/421776-150x150.jpg",150,150,true],"medium":["https:\/\/blog.nanoturtle.cn\/wp-content\/uploads\/2026\/01\/421776-300x300.jpg",300,300,true],"medium_large":["https:\/\/blog.nanoturtle.cn\/wp-content\/uploads\/2026\/01\/421776-768x772.jpg",768,772,true],"large":["https:\/\/blog.nanoturtle.cn\/wp-content\/uploads\/2026\/01\/421776-1019x1024.jpg",1019,1024,true],"1536x1536":["https:\/\/blog.nanoturtle.cn\/wp-content\/uploads\/2026\/01\/421776.jpg",1080,1085,false],"2048x2048":["https:\/\/blog.nanoturtle.cn\/wp-content\/uploads\/2026\/01\/421776.jpg",1080,1085,false]},"uagb_author_info":{"display_name":"NanoTurtle","author_link":"https:\/\/blog.nanoturtle.cn\/author\/nanoturtle\/"},"uagb_comment_info":0,"uagb_excerpt":"\u4e00\u4e2a\u6708\u7684\u4e3b\u7ebf\u662f\u628a\u4e09\u661fS24 Ultra\u56fd\u884c\u514d\u89e3\u9501root\u4ece\u5355\u673a\u5076\u7136\u6210\u529f\u6253\u78e8\u6210\u53ef\u590d\u73b0\u3001\u53ef\u5ba1\u8ba1\u3001\u53ef\u5feb\u901f\u9002\u914d\u65b0\u56fa\u4ef6\u7684…","_links":{"self":[{"href":"https:\/\/blog.nanoturtle.cn\/index.php\/wp-json\/wp\/v2\/posts\/1071","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.nanoturtle.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.nanoturtle.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.nanoturtle.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.nanoturtle.cn\/index.php\/wp-json\/wp\/v2\/comments?post=1071"}],"version-history":[{"count":1,"href":"https:\/\/blog.nanoturtle.cn\/index.php\/wp-json\/wp\/v2\/posts\/1071\/revisions"}],"predecessor-version":[{"id":1072,"href":"https:\/\/blog.nanoturtle.cn\/index.php\/wp-json\/wp\/v2\/posts\/1071\/revisions\/1072"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.nanoturtle.cn\/index.php\/wp-json\/wp\/v2\/media\/83"}],"wp:attachment":[{"href":"https:\/\/blog.nanoturtle.cn\/index.php\/wp-json\/wp\/v2\/media?parent=1071"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.nanoturtle.cn\/index.php\/wp-json\/wp\/v2\/categories?post=1071"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.nanoturtle.cn\/index.php\/wp-json\/wp\/v2\/tags?post=1071"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}