patch the kernel image boot.img

Tools list:

1. split_bootimg.pl
2. mkbootimg
3. mkbootfs

boot.img contains the linux kernel and the ramdisk, while the default.prop in ramdisk can enable/disable the adb root permission. following is the default.prop contents for a droid product device:

* ro.secure=1
* ro.allow.mock.location=0
* ro.debuggable=0
* persist.service.adb.enable=0

droid product device with above default.prop has no adb root permissions if the device is not hacked. the default.prop with the following contents has the adb root permissions by default:

* ro.secure=0
* ro.allow.mock.location=0
* ro.debuggable=1
* persist.service.adb.enable=1

to create a boot.img with such default.prop, here is the steps:

1. split the boot.img: split_bootimg.pl boot.img, after running the command, two files are generated: boot.img-kernel and boot.img-ramdisk.gz.
2. create a temp folder (e.g. ramdisk), change to that folder, run the following command to extract the boot.img-ramdisk.gz: cat ../boot.img-ramdisk.gz | gzip -d | cpio -idm.
3. make the changes to the ramdisk file system in ramdisk folder, e.g. change the default.prop file to get adb root permissions.
4. return the parent folder, and run the following command to recreate the ramdisk package: mkbootfs ./ramdisk | gzip > ramdisk-new.gz
5. recreate the boot image: mkbootimg --kernel boot.img-kernel --ramdisk ramdisk-new.gz -o boot-new.img

done. flash the boot-new.img to the device with fastboot.
more things can be done with the above steps, such as change the boot up sequence by modify the init.rc.