如何通过以system-uid运行的应用程序获得root特权？

Question

I've set sharedUserId as "android.ui.system" in manifest and gotten it to run as system(uid), so now the apk has system privileges.

What should I do if I want to obtain root privilege on Android devices if the Android devices haven't been rooted yet (ie, there is no su)?

Answer 1

Though you have added System userId in the manifest file, the root access is not granded. There are additional checks like Signature match check.

Answer 2

Here's a link ...

You should be able to easily achieve root privilege by implementing the code from that link.

Thanks to Muzikant for the blog.