pixel刷机
下载
下载对应镜像 https://developers.google.com/android/images#sailfish 下载twrp推荐3.0.0 https://dl.twrp.me/sailfish/twrp-3.3.0-0-sailfish.img.html 下载magisk 下载最新的 https://github.com/topjohnwu/Magisk/releases frida-server https://github.com/frida/frida/releases
安装
刷机
解压下载的sailfish-opm4.171019.021.p1-factory-0bcf4315.zip系统
adb reboot bootloader
执行 ./flash-all.sh
twrp
adb reboot bootloader
» fastboot devices tea@teadeMacBook-Pro
FA7530300871 fastboot
» fastboot flash recovery twrp-3.3.0-0-sailfish.img
Sending 'recovery' (31000 KB) OKAY [ 0.941s]
Writing 'recovery' (bootloader) Flashing active slot "_a"
FAILED (remote: 'partition [recovery] doesn't exist')
fastboot: error: Command failed
如果有报错尝试执行
» fastboot boot twrp-3.3.0-0-sailfish.img
Sending 'boot.img' (31000 KB) OKAY [ 0.773s]
Booting OKAY [ 0.906s]
Finished. Total time: 1.709smagisk
adb push Magisk-v21.4.zip /sdcard
安装-选择Magisk-v21.4.zip 安装成功选择reboot system
frida
下载frida-server选择arm64
frida-server-14.2.13-android-arm64.xz
查看手机架构命令
adb shell getprop ro.product.cpu.abi
启动frida
» adb shell tea@teadeMacBook-Pro
sailfish:/ $ su
sailfish:/ # cd /data/local/tmp
sailfish:/data/local/tmp # ls
fs1280arm64
sailfish:/data/local/tmp # ./fs1280arm64
/system/bin/sh: ./fs1280arm64: can't execute: Permission denied
126|sailfish:/data/local/tmp # chmod 755 fs1280arm64
sailfish:/data/local/tmp # ./fs1280arm64 exposed
下载magisk-riru https://github.com/yangzhaofeng/riru-core adb push magisk-riru-v21.1.zip /sdcard/Download magisk manager 选择模块 从本地安装 选择magisk-riru-v21.1.zip 安装成功后重启
下载EdXposed-SandHook-v0.4.6.2.4529.-release.zip https://github.com/ElderDrivers/EdXposed/releases/tag/v0.4.6.4 adb push EdXposed-SandHook-v0.4.6.2.4529.-release.zip /sdcard/Download magisk manager 选择模块 从本地安装 选择EdXposed-SandHook-v0.4.6.2.4529.-release.zip 安装成功后重启 重启后要很长时间要等好久 不要重启之类的操作哦
下载edxoosed manager https://github.com/ElderDrivers/EdXposedManager/releases adb install EdXposedManager-4.5.7-45700-org.meowcat.edxposed.manager-release.apk
腾讯云开发者
