我自己的一部三星手机，在这之前我已经能把boot.img,system.img反编译后打包能刷入手机，并让手机正常运行。
之后我打算把手机内的system/framework or app都导出来反编译，重打包为jar和apk。然后我再通过手机本身的root权限用以下脚本进行odex化。重打包的时候除jar，所有apk都进行了重新的签名，用的是自己的签名。最后，还将service.jar内的PackageManagerService.smali中的verifySignaturesLP函数的实现给修改掉了。
odex化脚本：
#!/system/bin/sh
F_SYSTEM_FRAMEWORK=/sdcard/myframe/framework_out
F_SYSTEM_APP=/sdcard/myframe/app_out
F_SYSTEM_PRIVAPP=/sdcard/myframe/priv-app_out
F_MY_FRAMEWORK=/sdcard/myframe/framework
F_MY_APP=/sdcard/myframe/app
F_MY_PRIVAPP=/sdcard/myframe/priv-app
if [ ! -d $F_SYSTEM_FRAMEWORK ];then
#echo "$F_SYSTEM_FRAMEWORK not found!"
#exit 1
mkdir $F_SYSTEM_FRAMEWORK
fi
if [ ! -d $F_SYSTEM_APP ];then
#echo "$F_SYSTEM_APP not found!"
#exit 1
mkdir $F_SYSTEM_APP
fi
if [ ! -d $F_SYSTEM_PRIVAPP ];then
#echo "$F_SYSTEM_PRIVAPP not found!"
#exit 1
mkdir $F_SYSTEM_PRIVAPP
fi
BOOTCLASSPATH="/system/framework/core.jar:/system/framework/conscrypt.jar:/system/framework/okhttp.jar:/system/framework/core-junit.jar:/system/framework/bouncycastle.jar:/system/framework/ext.jar:/system/frameworkframework.jar:/system/framework/framework2.jar:/system/framework/telephony-common.jar:/system/framework/voip-common.jar:/system/framework/mms-common.jar:/system/framework/android.policy.jar:/system/framework/services.jar:/system/framework/apache-xml.jar:/system/framework/webviewchromium.jar:/system/framework/sec_edm.jar:/system/framework/timakeystore.jar:/system/framework/seccamera.jar:/system/framework/scrollpause.jar:/system/framework/stayrotation.jar:/system/framework/commonimsinterface.jar:/system/framework/smartfaceservice.jar:/system/framework/secocsp.jar:/system/framework/simageis.jar:/system/framework/qcmediaplayer.jar:/system/framework/WfdCommon.jar:/system/framework/oem-services.jar:/system/framework/org.codeaurora.Performance.jar"
for file_a in ${F_MY_FRAMEWORK}/*.jar; do
base_name=${file_a##*/}
odex_name=${base_name%.*}".odex"
jarpath=${F_MY_FRAMEWORK}/$base_name
odexpath=${F_MY_FRAMEWORK}/$odex_name
dexopt-wrapper $jarpath $odexpath $BOOTCLASSPATH
cat $odexpath > $F_SYSTEM_FRAMEWORK/$odex_name
rm -rf $odexpath
done
for file_a in ${F_MY_APP}/*.apk; do
base_name=${file_a##*/}
odex_name=${base_name%.*}".odex"
jarpath=${F_MY_APP}/$base_name
odexpath=${F_MY_APP}/$odex_name
dexopt-wrapper $jarpath $odexpath $BOOTCLASSPATH
cat $odexpath > $F_SYSTEM_APP/$odex_name
rm -rf $odexpath
done
for file_a in ${F_MY_PRIVAPP}/*.apk; do
base_name=${file_a##*/}
odex_name=${base_name%.*}".odex"
jarpath=${F_MY_PRIVAPP}/$base_name
odexpath=${F_MY_PRIVAPP}/$odex_name
dexopt-wrapper $jarpath $odexpath $BOOTCLASSPATH
cat $odexpath > $F_SYSTEM_PRIVAPP/$odex_name
rm -rf $odexpath
done
