鸿蒙模拟器root详解

00、参考资料

HarmonyOS Next 模拟器 root | wuxianlin

HarmonyOSNext模拟器Root（无视模拟器镜像完整性验证）（二）

01、环境

修改镜像使用：Ubuntu 24.10

模拟器是运行在 windows X86

DevEco Studio NEXT Developer Beta2(5.0.3.502)

02.准备工作

1、把system.img放入ubuntu中

2、忽略参考文档中的前大部分

03.开始root

1、挂载镜像

mkdir -p /mnt/harmonymount -o loop,offset=0 /system.img /mnt/harmony

2、修改system/etc/param/ohos.para

//修改前const.secure=1const.debuggable=0//修改后const.secure=0const.debuggable=1

3、修改system/etc/param/hdc.para

修改前：const.hdc.version = \"Ver: 3.0.0b\"修改后const.hdc.version = \"Ver: 3.0.0b\"persist.hdc.mode.usb = \"enable\"persist.hdc.mode.tcp = \"disable\"persist.hdc.mode.uart = \"disable\"

4、修改system/etc/init/hdcd.cfg

内容较多，源码链接为src/daemon/etc/hdcd.root.cfg · OpenHarmony/developtools_hdc - Gitee.com

用以上内容全部覆盖原内容后把倒数第二行改为\"secon\" : \"u:r:su:s0\",需要修改为\"secon\" : \"u:r:hdcd:s0\"

{ \"jobs\" : [{ \"name\" : \"post-fs-data\", \"cmds\" : [ \"mkdir /data/service/el1/public/hdc 0775 root shell\", \"restorecon /data/service/el1/public/hdc\" ] },{ \"name\" : \"param:persist.hdc.control=false\", \"condition\" : \"persist.hdc.control=false\", \"cmds\" : [ \"setparam persist.hdc.control.shell false\", \"setparam persist.hdc.control.file false\", \"setparam persist.hdc.control.fport false\" ] },{ \"name\" : \"param:persist.hdc.control=true\", \"condition\" : \"persist.hdc.control=true\", \"cmds\" : [ \"setparam persist.hdc.control.shell true\", \"setparam persist.hdc.control.file true\", \"setparam persist.hdc.control.fport true\" ] },{ \"name\" : \"param:persist.hdc.control_system=true\", \"condition\" : \"persist.hdc.control_system=true\", \"cmds\" : [ \"setparam persist.hdc.control true\" ] },{ \"name\" : \"param:persist.hdc.control_system=false\", \"condition\" : \"persist.hdc.control_system=false\", \"cmds\" : [ \"setparam persist.hdc.control false\" ] },{ \"name\" : \"param:persist.hdc.replace=true\", \"condition\" : \"persist.hdc.replace=true\", \"cmds\" : [ \"stop hdcd\", \"chmod 0755 /data/hdcd\", \"chmod 0644 /data/libuv.so\", \"chmod 0644 /data/libhdc.dylib.so\", \"chmod 0644 /data/libylong_runtime.dylib.so\", \"sleep 1\", \"copy /data/hdcd /system/bin/hdcd\", \"copy /data/libuv.so /system/lib64/libuv.so\", \"copy /data/libuv.so /system/lib/libuv.so\", \"copy /data/libhdc.dylib.so /system/lib64/libhdc.dylib.so\", \"copy /data/libhdc.dylib.so /system/lib/libhdc.dylib.so\", \"copy /data/libylong_runtime.dylib.so /system/lib64/libylong_runtime.dylib.so\", \"copy /data/libylong_runtime.dylib.so /system/lib/libylong_runtime.dylib.so\", \"start hdcd\", \"setparam persist.hdc.replace false\" ] },{ \"name\" : \"boot && param:const.hdc.secure=0\", \"condition\" : \"boot && const.secure=0\", \"cmds\" : [ \"setparam const.hdc.secure 0\" ] },{ \"name\" : \"param:persist.hdc.mode.tcp=enable\", \"condition\" : \"persist.hdc.mode.tcp=enable\", \"cmds\" : [ \"stop hdcd\", \"sleep 1\", \"start hdcd\" ] },{ \"name\" : \"param:persist.hdc.mode.tcp=disable && param:persist.hdc.mode.usb=enable\", \"condition\" : \"persist.hdc.mode.tcp=disable && persist.hdc.mode.usb=enable\", \"cmds\" : [ \"stop hdcd\", \"sleep 1\", \"start hdcd\" ] },{ \"name\" : \"param:persist.hdc.mode.tcp=disable && param:persist.hdc.mode.usb=disable\", \"condition\" : \"persist.hdc.mode.tcp=disable && persist.hdc.mode.usb=disable\", \"cmds\" : [ \"stop hdcd\" ] } ], \"services\" : [{ \"name\" : \"hdcd\", \"path\" : [\"/system/bin/hdcd\"], \"uid\" : \"root\", \"gid\" : [ \"root\", \"shell\", \"log\", \"readproc\", \"file_manager\", \"user_data_rw\" ], \"setuid\" : true, \"socket\" : [{ \"name\" : \"hdcd\", \"family\" : \"AF_UNIX\", \"type\" : \"SOCK_SEQPACKET\", \"protocol\" : \"default\", \"permissions\" : \"0660\", \"uid\" : \"root\", \"gid\" : \"shell\" }], \"critical\" : [ 0, 5, 10 ], \"apl\" : \"normal\", \"permission\" : [ \"ohos.permission.CHANGE_ABILITY_ENABLED_STATE\", \"ohos.permission.DUMP\", \"ohos.permission.GET_BUNDLE_INFO_PRIVILEGED\", \"ohos.permission.INSTALL_BUNDLE\", \"ohos.permission.REMOVE_CACHE_FILES\", \"ohos.permission.ACCELEROMETER\", \"ohos.permission.CLEAN_BACKGROUND_PROCESSES\", \"ohos.permission.START_ABILITIES_FROM_BACKGROUND\", \"ohos.permission.PERMISSION_USED_STATS\", \"ohos.permission.NOTIFICATION_CONTROLLER\", \"ohos.permission.PUBLISH_SYSTEM_COMMON_EVENT\", \"ohos.permission.CLEAN_APPLICATION_DATA\", \"ohos.permission.START_SYSTEM_DIALOG\", \"ohos.permission.GET_RUNNING_INFO\" ], \"permission_acls\" : [ \"ohos.permission.CHANGE_ABILITY_ENABLED_STATE\", \"ohos.permission.DUMP\", \"ohos.permission.GET_BUNDLE_INFO_PRIVILEGED\", \"ohos.permission.INSTALL_BUNDLE\", \"ohos.permission.REMOVE_CACHE_FILES\", \"ohos.permission.START_ABILITIES_FROM_BACKGROUND\", \"ohos.permission.PERMISSION_USED_STATS\", \"ohos.permission.NOTIFICATION_CONTROLLER\", \"ohos.permission.PUBLISH_SYSTEM_COMMON_EVENT\", \"ohos.permission.CLEAN_APPLICATION_DATA\", \"ohos.permission.START_SYSTEM_DIALOG\", \"ohos.permission.GET_RUNNING_INFO\" ], \"sandbox\" : 0, \"start-mode\" : \"condition\", \"secon\" : \"u:r:hdcd:s0\", \"disabled\" : 1 } ]}

未找到参考文档中说的“system/etc/selinux/system_common.cil 中的type sh需要修改为(typepermissive sh)”暂时忽略本步骤

04、验证

umount /mnt/harmony

将修改后的system.img放回原路径，启动后验证