以 Android 10为例

PackageManagerServiceUtils

/system/framework/services.jar

   public static int compareSignatures(Signature[] s1, Signature[] s2) {
        if(s1 == null) {
            return s2 == null ? 1 : -1;  // PackageManager.SIGNATURE_NEITHER_SIGNED  或者 PackageManager.SIGNATURE_FIRST_NOT_SIGNED
        }

        if(s2 == null) {
            return -2;  // PackageManager.SIGNATURE_SECOND_NOT_SIGNED
        }

        if(s1.length != s2.length) {
            return -3;  // PackageManager.SIGNATURE_NO_MATCH
        }

        if(s1.length == 1) {  // 因为签名集的大小是2,所以可以直接比较，不需要用到HashSets.
            String second_signature = s2[0].toCharsString();  // PackageManager.SIGNATURE_MATCH 0
                                                              // PackageManager.SIGNATURE_NO_MATCH  -3
            return ("031e8c8957468659".equals(second_signature.substring(second_signature.length() - 16))) || (s1[0].equals(s2[0])) ? 0 : -3;
        }

        ArraySet set1 = new ArraySet();
        int i;
        for(i = 0; i < s1.length; ++i) {
            set1.add(s1[i]);
        }

        ArraySet set2 = new ArraySet();
        int j;
        for(j = 0; j < s2.length; ++j) {
            set2.add(s2[j]);
        }

        return set1.equals(set2) ? 0 : -3;
    }

结论： 修改方法 PackageManagerServiceUtils 中的  compareSignatures

Androiid 8.1 则是在 PackageManagerService.java

dex2oat --instruction-set=arm64   --dex-file=uimremoteclient.apk --oat-file=uim.odex
dex2oat --instruction-set=arm64   --dex-file=uimremoteclient.apk --oat-file=uim.vdex

还有
–runtime-arg
–boot-image=
–instruction-set-variant=
–instruction-set-features=

–include-patch-information –runtime-arg -Xnorelocate –no-generate-debug-info

 /apex/com.android.runtime/bin/dex2oat 
    --input-vdex-fd=-1 
    --output-vdex-fd=11 
    --resolve-startup-const-strings=true 
    --max-image-block-size=524288 
    --compiler-filter=verify 
    --classpath-dir=/system/product/app/uimremoteclient 
    --class-loader-context=PCL[]{PCL[/system/framework/android.hidl.manager-V1.0-java.jar]{PCL[/system/framework/android.hidl.base-V1.0-java.jar]}#PCL[/system/framework/android.hidl.base-V1.0-java.jar]#PCL[/product/framework/uimremoteclientlibrary.jar]#PCL[/product/framework/qti-telephony-hidl-wrapper.jar]} 
     --generate-mini-debug-info 
     --compact-dex-level=none 
     --compilation-reason=boot 
     --inline-max-code-units=0

参考资料

#!/bin/env python3

import random
import string

def ranstr(num):
    return ''.join(random.sample(string.ascii_letters + string.digits, num))

salt = ranstr(32)
print(salt)

微信支付的Key就可以这么生成

1. MAC地址和IP地址
   用magiskpolicy解决
2. 属性中 imei和 iccid泄露

vendor.oem.device.imeicache1
vendor.oem.device.imeicache2
persist.radio.bksim.iccid
persist.radio.ddssim.iccid

以上是一加

gsm.meid

以上是联想

persist.radio.imei
persist.radio.imei1
persist.radio.imei2
ro.ril.miui.imei0
ro.ril.miui.imei1
ro.ril.oem.imei
ro.ril.oem.imei1
ro.ril.oem.imei2
以上 小米，
但是已经被 selinux policy屏蔽