一、SystemUI启动流程
 路径:/frameworks/base/services/java/com/android/server/SystemServer.java
 /**
  * The main entry point from zygote.
  */
 public static void main(String[] args) {
     new SystemServer().run();
 }可以看到main()中生成了SystemServer对象并执行了run方法。
 SystemServer.run():private void run() {
     ...
     // Create the system service manager.
     mSystemServiceManager = new SystemServiceManager(mSystemContext);
     LocalServices.addService(SystemServiceManager.class,
     mSystemServiceManager);    // Start services.
     try {
         startBootstrapServices();
         startCoreServices();
         startOtherServices();
     } catch (Throwable ex) {
         ...
     }
     ...
 }进入startOtherServices():
 private void startOtherServices() {
     ...
     try {
         startSystemUi(context);
     } catch (Throwable e) {
         reportWtf("starting System UI", e);
     }
     ...
 }进入startSystemUi(context):
 static final void startSystemUi(Context context) {
     Intent intent = new Intent();
     intent.setComponent(new ComponentName("com.android.systemui","com.android.systemui.SystemUIService"));
     //Slog.d(TAG, "Starting service: " + intent);
     context.startServiceAsUser(intent, UserHandle.OWNER);
 }进入SystemUIService:
 /frameworks/base/packages/SystemUI/src/com/android/systemui/SystemUIService.javapublic void onCreate() {
     super.onCreate();
     ((SystemUIApplication) getApplication()).startServicesIfNeeded();
 }进入startServicesIfNeeded方法:
public void startServicesIfNeeded() {
     ...
     Log.v(TAG, "Starting SystemUI services.");
     final int N = SERVICES.length;
     for (int i=0; i<N; i++) {
         Class<?> cl = SERVICES[i];
         if (DEBUG) Log.d(TAG, "loading: " + cl);
         try {
             mServices[i] = (SystemUI)cl.newInstance();
         } catch (IllegalAccessException ex) {
             throw new RuntimeException(ex);
         } catch (InstantiationException ex) {
             throw new RuntimeException(ex);
         }
         mServices[i].mContext = this;
         mServices[i].mComponents = mComponents;
         if (DEBUG) Log.d(TAG, "running: " + mServices[i]);
         mServices[i].start();        if (mBootCompleted) {
             mServices[i].onBootCompleted();
         }
     }
     mServicesStarted = true;
 }可以看到startServicesIfNeeded()循环start了很多Services.
 数组SERVICES的定义如下:
 private final Class<?>[] SERVICES = new Class[] {
         com.android.systemui.tuner.TunerService.class,
         com.android.systemui.keyguard.KeyguardViewMediator.class,
         com.android.systemui.recents.Recents.class,
         com.android.systemui.volume.VolumeUI.class,
         com.android.systemui.statusbar.SystemBars.class,
         com.android.systemui.usb.StorageNotification.class,
         com.android.systemui.power.PowerUI.class,
         com.android.systemui.media.RingtonePlayer.class,
         com.android.systemui.keyboard.KeyboardUI.class,
 };进入SystemBars.Java:
 Frameworks/base/packages/SystemUI/src/com/android/systemui/statusbar/SystemBars.javapublic void start() {
     if (DEBUG) Log.d(TAG, "start");
     mServiceMonitor = new ServiceMonitor(TAG, DEBUG, mContext, Settings.Secure.BAR_SERVICE_COMPONENT, this);
     mServiceMonitor.start();  // will call onNoService if no remote service is found
 }进入onNoService ():
 public void onNoService() {
     if (DEBUG) Log.d(TAG, "onNoService");
     createStatusBarFromConfig();  // fallback to using an in-process implementation
 }进入createStatusBarFromConfig():
 private void createStatusBarFromConfig() {
     if (DEBUG) Log.d(TAG, "createStatusBarFromConfig");
     final String clsName = mContext.getString(R.string.config_statusBarComponent);
     if (clsName == null || clsName.length() == 0) {
         throw andLog("No status bar component configured", null);
     }
     Class<?> cls = null;
     try {
         cls = mContext.getClassLoader().loadClass(clsName);
     } catch (Throwable t) {
         throw andLog("Error loading status bar component: " + clsName, t);
     }
     try {
         mStatusBar = (BaseStatusBar) cls.newInstance();
     } catch (Throwable t) {
         throw andLog("Error creating status bar component: " + clsName, t);
     }
     mStatusBar.mContext = mContext;
     mStatusBar.mComponents = mComponents;
     mStatusBar.start();
     if (DEBUG) Log.d(TAG, "started " + mStatusBar.getClass().getSimpleName());
 }其中根据R.string.config_statusBarComponent找到定义位置:
 res/values/config.xml
 <!-- Component to be used as the status bar service.  Must implement the IStatusBar
  interface.  This name is in the ComponentName flattened format (package/class)  -->
 <string name="config_statusBarComponent" translatable="false">com.android.systemui.statusbar.phone.PhoneStatusBar</string>进入PhoneStatusBar.java:
 Frameworks/base/packages/SystemUI/src/com/android/systemui/statusbar/phone/PhoneStatusBar.javapublic void start() {
     ...
     super.start(); // calls createAndAddWindows()
     ...
 }进入createAndAddWindows():
 public void createAndAddWindows() {
     addStatusBarWindow();
 }进入addStatusBarWindow():
 private void addStatusBarWindow() {
     makeStatusBarView();
     mStatusBarWindowManager = new StatusBarWindowManager(mContext);
     mStatusBarWindowManager.add(mStatusBarWindow, getStatusBarHeight());
 }进入makeStatusBarView():
 protected PhoneStatusBarView makeStatusBarView() {
     ...
     mStatusBarWindow = (StatusBarWindowView) View.inflate(context,R.layout.super_status_bar, null);
     ...
     mStatusBarView = (PhoneStatusBarView)
     mStatusBarWindow.findViewById(R.id.status_bar);
     mStatusBarView.setBar(this);
     ...
 }在Android中,SystemUI上显示信号状态栏的地方主要由三处,分别是状态栏、锁屏界面下的状态栏以及下拉通知栏的快捷设置区域。这三个引用处分别是status_bar.xml、keyguard_status_bar.xml、status_bar_expanded_header.xml;而这三个布局文件都会去include一个system_icons.xml布局,
 这个布局就是所要寻找的网络信号栏显示和电池图标显示view的地方进入res/layout/super_status_bar.xml:
 <com.android.systemui.statusbar.phone.PanelHolder
     android:id="@+id/panel_holder"
     android:layout_width="match_parent"
     android:layout_height="match_parent"
     android:background="@color/transparent" >
     <include layout="@layout/status_bar_expanded"
         android:layout_width="match_parent"
         android:layout_height="match_parent"
         android:visibility="gone" />
 </com.android.systemui.statusbar.phone.PanelHolder>进入res/layout/status_bar_expanded.xml:
 <include layout="@layout/status_bar_expanded_header" />进入res/layout/status_bar_expanded_header.xml:
 <FrameLayout android:id="@+id/system_icons_container"
     android:layout_width="wrap_content"
     android:layout_height="@dimen/status_bar_height"
     android:layout_gravity="center_vertical"
     >
     <include layout="@layout/system_icons" />
 </FrameLayout>进入res/layout/system_icons.xml:
 <include layout="@layout/signal_cluster_view"
     android:id="@+id/signal_cluster"
     android:layout_width="wrap_content"
     android:layout_height="wrap_content"
     android:layout_marginStart="2.5dp"/>进入res/layout/signal_cluster_view.xml:
 进入frameworks/base/packages/SystemUI/src/com/android/systemui/statusbar/SignalClusterView.java
 更新SIM卡、飞行模式、WIFI、有线网络四种状态 进入PhoneStatusBarView.java:
 Frameworks/base/packages/SystemUI/src/com/android/systemui/statusbar/phone/PhoneStatusBarView.java二、修改系统默认语言环境
 路径:/libcore/luni/src/main/java/java/util/Locale.java/**
  * Returns the default locale from system properties.
  *
  * @hide visible for testing.
  */
 public static Locale getDefaultLocaleFromSystemProperties() {
     final String languageTag = System.getProperty("user.locale", "");    final Locale defaultLocale;
     if (!languageTag.isEmpty()) {
         defaultLocale = Locale.forLanguageTag(languageTag);
     } else {
         String language = System.getProperty("user.language", "en");
         String region = System.getProperty("user.region", "US");
         String variant = System.getProperty("user.variant", "");
         defaultLocale = new Locale(language, region, variant);
     }    return defaultLocale;
 }三、系统APK裁剪
 路径device/fsl/imx6/imx6.mk四、修改系统硬件和产品架构配置
 路径:device/fsl/sabresd_6dq/overlay/frameworks/base/core/res/res/values/config.xmlUSB支持配置
     <!-- List of regexpressions describing the interface (if any) that represent tetherable
         USB interfaces.  If the device doesn't want to support tething over USB this should
         be empty.  An example would be "usb.*" -->
     <string-array translatable="false" name="config_tether_usb_regexs">
         <item>usb0</item>
     </string-array>WIFI支持配置
     <!-- List of regexpressions describing the interface (if any) that represent tetherable
         Wifi interfaces.  If the device doesn't want to support tethering over Wifi this
         should be empty.  An example would be "softap.*" -->
     <string-array translatable="false" name="config_tether_wifi_regexs">
         <item>"wlan0"</item>
     </string-array>蓝牙支持配置
     <!-- List of regexpressions describing the interface (if any) that represent tetherable
         bluetooth interfaces.  If the device doesn't want to support tethering over bluetooth this
         should be empty. -->
     <string-array translatable="false" name="config_tether_bluetooth_regexs">
         <item>"bt-pan"</item>
     </string-array>自动亮度配置
     <!-- Flag indicating whether we should enable the automatic brightness in Settings.
         config_hardware_automatic_brightness_available is not set, so we will use software implementation -->
     <bool name="config_automatic_brightness_available">false</bool>网络共存配置
     <!-- An Array of "[ConnectivityManager connectionType],
                       [# simultaneous connection types]"  -->
     <string-array translatable="false" name="radioAttributes">
         <item>"1,1"</item>
         <item>"0,1"</item>
         <item>"7,1"</item>
         <item>"9,1"</item>
     </string-array>
     
     
 frameworks\base\core\java\android\net\ConnectivityManager.java
 public static final int TYPE_MOBILE      = 0;
 public static final int TYPE_WIFI        = 1;
 public static final int TYPE_MOBILE_MMS  = 2;
 public static final int TYPE_MOBILE_SUPL = 3;
 public static final int TYPE_MOBILE_DUN  = 4;
 public static final int TYPE_MOBILE_HIPRI = 5;
 public static final int TYPE_WIMAX       = 6;
 public static final int TYPE_BLUETOOTH   = 7;
 public static final int TYPE_DUMMY       = 8;
 public static final int TYPE_ETHERNET    = 9;
 public static final int TYPE_MOBILE_FOTA = 10;
 public static final int TYPE_MOBILE_IMS  = 11;
 public static final int TYPE_MOBILE_CBS  = 12;
 frameworks\base\core\java\android\net\NetworkConfig.java    
 网络优先级配置
     <!-- An Array of "[Connection name],[ConnectivityManager.TYPE_xxxx],[associated radio-type],[priority],[restoral-timer(ms)],[dependencyMet]  -->
     <!-- the 5th element "resore-time" indicates the number of milliseconds to delay
          before automatically restore the default connection.  Set -1 if the connection
          does not require auto-restore. -->
     <!-- the 6th element indicates boot-time dependency-met value. -->
     <string-array translatable="false" name="networkAttributes">
         <item>"wifi,        1,    1,    1,    -1,        true"</item>
         <item>"mobile,        0,    0,    0,    -1,        true"</item>
         <item>"mobile_mms,    2,    0,    3,    60000,    true"</item>
         <item>"mobile_supl,    3,    0,    3,    60000,    true"</item>
         <item>"mobile_hipri,5,    0,    4,    60000,    true"</item>
         <item>"mobile_fota,    10,    0,    3,    60000,    true"</item>
         <item>"mobile_ims,    11,    0,    3,    60000,    true"</item>
         <item>"mobile_cbs,    12,    0,    3,    60000,    true"</item>
         <item>"bluetooth,    7,    7,    2,    -1,        true"</item>
         <item>"ethernet,    9,    9,    2,    -1,        true"</item>
     </string-array>熄屏配置
     <!-- Array of light sensor LUX values to define our levels for auto backlight brightness support.
          The N entries of this array define N + 1 zones as follows:         Zone 0:        0 <= LUX < array[0]
          Zone 1:        array[0] <= LUX < array[1]
          ...
          Zone N:        array[N - 1] <= LUX < array[N]
          Zone N + 1:    array[N] <= LUX < infinity         Must be overridden in platform specific overlays -->
     <integer-array name="config_autoBrightnessLevels">
         <item>5</item>
         <item>15</item>
         <item>50</item>
         <item>100</item>
         <item>200</item>
         <item>400</item>
         <item>1000</item>
         <item>2000</item>
         <item>3000</item>
         <item>5000</item>
         <item>10000</item>
         <item>30000</item>
     </integer-array>
     
 熄屏LCD背光值配置
     <!-- Array of output values for LCD backlight corresponding to the LUX values
          in the config_autoBrightnessLevels array.  This array should have size one greater
          than the size of the config_autoBrightnessLevels array.
          This must be overridden in platform specific overlays -->
     <integer-array name="config_autoBrightnessLcdBacklightValues">
         <item>5</item>    <!-- 0-5 -->
         <item>20</item>   <!-- 5-15 -->
         <item>30</item>   <!-- 15-50 -->
         <item>40</item>   <!-- 50-100 -->
         <item>50</item>   <!-- 100-200 -->
         <item>60</item>   <!-- 200-400 -->
         <item>70</item>   <!-- 400-1000 -->
         <item>80</item>   <!-- 1000-2000 -->
         <item>130</item>  <!-- 2000-3000 -->
         <item>180</item>  <!-- 3000-5000 -->
         <item>255</item>  <!-- 5000-10000 -->
         <item>255</item>  <!-- 10000-30000 -->
         <item>255</item>  <!-- 30000+ -->
     </integer-array>
     
 熄屏按钮背光值配置    
     <!-- Array of output values for button backlight corresponding to the LUX values
          in the config_autoBrightnessLevels array.  This array should have size one greater
          than the size of the config_autoBrightnessLevels array.
          This must be overridden in platform specific overlays -->
     <integer-array name="config_autoBrightnessButtonBacklightValues">
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
     </integer-array>熄屏键盘背光值配置
     <!-- Array of output values for keyboard backlight corresponding to the LUX values
          in the config_autoBrightnessLevels array.  This array should have size one greater
          than the size of the config_autoBrightnessLevels array.
          This must be overridden in platform specific overlays -->
     <integer-array name="config_autoBrightnessKeyboardBacklightValues">
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
         <item>0</item>
     </integer-array>        
     
 导航栏显示配置
     <!-- Whether a software navigation bar should be shown. NOTE: in the future this may be
          autodetected from the Configuration. -->
     <bool name="config_showNavigationBar">true</bool>    
     
 五、修改系统init.rc
 路径:device/fsl/sabresd_6dq/init.rc    
 可修改系统文件权限六、修改系统root权限
#define CUSTOM_ROOT 
1、修改/system/extras/su/su.c
 int main(int argc, char** argv) {
    uid_t current_uid = getuid();
 #ifndef CUSTOM_ROOT
          if (current_uid != AID_ROOT && current_uid != AID_SHELL) error(1, 0, "not allowed");//kang
 #endif
     ...
 }    2、修改/system/core/libcutils/fs_config.c
 static const struct fs_path_config android_files[] = {
     ...
     /* the following five files are INTENTIONALLY set-uid, but they
      * are NOT included on user builds. */
 #ifdef CUSTOM_ROOT     
     { 06755, AID_ROOT,      AID_SHELL,     0, "system/xbin/su" },
 #else
     { 04750, AID_ROOT,      AID_SHELL,     0, "system/xbin/su" },
 #endif    
     { 06755, AID_ROOT,      AID_ROOT,      0, "system/xbin/librank" },
     { 06755, AID_ROOT,      AID_ROOT,      0, "system/xbin/procrank" },
     { 06755, AID_ROOT,      AID_ROOT,      0, "system/xbin/procmem" },
     { 04770, AID_ROOT,      AID_RADIO,     0, "system/bin/pppd-ril" },    /* the following files have enhanced capabilities and ARE included in user builds. */
     { 00750, AID_ROOT,      AID_SHELL,     (1ULL << CAP_SETUID) | (1ULL << CAP_SETGID), "system/bin/run-as" },
     { 00700, AID_SYSTEM,    AID_SHELL,     (1ULL << CAP_BLOCK_SUSPEND), "system/bin/inputflinger" },    { 00750, AID_ROOT,      AID_ROOT,      0, "system/bin/uncrypt" },
     { 00750, AID_ROOT,      AID_ROOT,      0, "system/bin/install-recovery.sh" },
 #ifdef CUSTOM_ROOT        
     { 06755, AID_ROOT,      AID_ROOT,      0, "system/bin/su" },
 #endif    
     { 00755, AID_ROOT,      AID_SHELL,     0, "system/bin/*" },
     ...
 };3、修改/frameworks/base/cmds/app_process/app_main.cpp
 int main(int argc, char* const argv[])
 {
 #ifndef CUSTOM_ROOT
     if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
         // Older kernels don't understand PR_SET_NO_NEW_PRIVS and return
         // EINVAL. Don't die on such kernels.
         if (errno != EINVAL) {
             LOG_ALWAYS_FATAL("PR_SET_NO_NEW_PRIVS failed: %s", strerror(errno));
             return 12;
         }
     }
 #endif
     ...
 }    
 4、修改/frameworks/base/core/jni/com_android_internal_os_Zygote.cpp
 static void DropCapabilitiesBoundingSet(JNIEnv* env) {
 #ifndef CUSTOM_ROOT
   for (int i = 0; prctl(PR_CAPBSET_READ, i, 0, 0, 0) >= 0; i++) {
     int rc = prctl(PR_CAPBSET_DROP, i, 0, 0, 0);
     if (rc == -1) {
       if (errno == EINVAL) {
         ALOGE("prctl(PR_CAPBSET_DROP) failed with EINVAL. Please verify "
               "your kernel is compiled with file capabilities support");
       } else {
         ALOGE("prctl(PR_CAPBSET_DROP) failed");
         RuntimeAbort(env);
       }
     }
   }
 #endif
 }5、修改/system/core/adb/adb_main.cpp
 static bool should_drop_privileges() {
 #ifdef CUSTOM_ROOT
     return false;
 #endif
     ...
 }    6、修改/system/core/init/init.cpp
 static bool selinux_is_disabled(void)
 {
 #ifdef CUSTOM_ROOT
     return true;
 #endif
     
     if (ALLOW_DISABLE_SELINUX) {
         if (access("/sys/fs/selinux", F_OK) != 0) {
             // SELinux is not compiled into the kernel, or has been disabled
             // via the kernel command line "selinux=0".
             return true;
         }
         return selinux_status_from_cmdline() == SELINUX_DISABLED;
     }    return false;
 }七、屏蔽系统开机文字LOGO
 路径:/system/core/init/init.cpp
 static int console_init_action(int nargs, char **args)
 {
     char console[PROP_VALUE_MAX];
     if (property_get("ro.boot.console", console) > 0) {
         snprintf(console_name, sizeof(console_name), "/dev/%s", console);
     }    int fd = open(console_name, O_RDWR | O_CLOEXEC);
     if (fd >= 0)
         have_console = 1;
     close(fd);
 /*
     fd = open("/dev/tty0", O_WRONLY | O_CLOEXEC);
     if (fd >= 0) {
         const char *msg;
             msg = "\n"
         "\n"
         "\n"
         "\n"
         "\n"
         "\n"
         "\n"  // console is 40 cols x 30 lines
         "\n"
         "\n"
         "\n"
         "\n"
         "\n"
         "\n"
         "\n"
         "             A N D R O I D ";
         write(fd, msg, strlen(msg));
         close(fd);
     }
 */
     return 0;
 }八、修改系统U盘挂载
 1、修改/system/core/rootdir/init.rc
     
     ...
     mkdir /mnt/secure 0700 root root
     mkdir /mnt/secure/asec 0700 root root
     mkdir /mnt/asec 0755 root system
     mkdir /mnt/obb 0755 root system
     mkdir /mnt/media_rw 0750 root media_rw
     mkdir /mnt/user 0755 root root
     mkdir /mnt/user/0 0755 root root
     mkdir /mnt/expand 0771 system system
     mkdir /mnt/udisk 0755 system system #添加U盘挂载
     
     
     # Storage views to support runtime permissions
     mkdir /storage 0755 root root
     mkdir /mnt/runtime 0700 root root
     mkdir /mnt/runtime/default 0755 root root
     mkdir /mnt/runtime/default/self 0755 root root
     mkdir /mnt/runtime/read 0755 root root
     mkdir /mnt/runtime/read/self 0755 root root
     mkdir /mnt/runtime/write 0755 root root
     mkdir /mnt/runtime/write/self 0755 root root    # Symlink to keep legacy apps working in multi-user world
     symlink /storage/self/primary /sdcard
     symlink /mnt/user/0/primary /mnt/runtime/default/self/primary
     symlink /mnt/udisk /udisk #添加U盘挂载
     
 2、修改/frameworks/base/core/res/res/xml/storage_list.xml    
 <StorageList xmlns:android="http://schemas.android.com/apk/res/android">
     <!-- removable is not set in nosdcard product -->
     <storage
         android:mountPoint="/storage/sdcard"
         android:storageDescription="@string/storage_usb"
         android:primary="true" />
     <!-- 添加U盘挂载 -->
     <storage android:mountPoint="/mnt/udisk"
         android:storageDescription="@string/storage_usb"
         android:removable="true"
         android:primary="false" />
 </StorageList>九、修改系统默认配置
 方式一:
 路径:/frameworks/base/core/res/res/values/config.xml    关闭双击开机键启动照相机功能
     <!-- Allow the gesture to double tap the power button twice to start the camera while the device
          is non-interactive. -->
     <bool name="config_cameraDoubleTapPowerGestureEnabled">false</bool>方式二:
 1、添加新字段
 路径:\frameworks\base\core\java\android\provider\Settings.java
     public static final class System extends NameValueTable {
         public static final String SYS_PROP_SETTING_VERSION = "sys.settings_system_version";
         
         //在此处添加
         
         /**
          * @hide
          */
         public static interface Validator {
             public boolean validate(String value);
         }
         ...
     }    2、添加新字段默认值    
 路径:/frameworks/base/packages/SettingsProvider/res/values/defaults.xml    3、加载默认值到数据库
 路径:\frameworks\base\packages\SettingsProvider\src\com\android\providers\settings\DatabaseHelper.java
     private void loadSystemSettings(SQLiteDatabase db) {
         loadBooleanSetting(stmt, Settings.System.NOTIFICATION_LIGHT_PULSE,
                     R.bool.def_notification_pulse);        loadUISoundEffectsSettings(stmt);
        loadIntegerSetting(stmt, Settings.System.POINTER_SPEED,
                 R.integer.def_pointer_speed);
             
         //在此处添加        
         
         ...    
     }
     
     
     
 十、修改系统默认风格
 路径:/frameworks/base/core/res/res/values/styles_material.xml    十一、修改系统默认Size
 路径:frameworks/base/core/res/res/values/dimens.xml    ...
     <!-- Height of the status bar -->
     <dimen name="status_bar_height">32dp</dimen>
     <!-- Height of the bottom navigation / system bar. -->
     <dimen name="navigation_bar_height">48dp</dimen>
     <!-- Height of the bottom navigation bar in portrait; often the same as @dimen/navigation_bar_height -->
     <dimen name="navigation_bar_height_landscape">62dp</dimen>
     <!-- Width of the navigation bar when it is placed vertically on the screen -->
     <dimen name="navigation_bar_width">160dp</dimen>
     ...十二、修改系统默认音量配置
 修改默认值:/frameworks/base/media/java/android/media/AudioSystem.java        public static int[] DEFAULT_STREAM_VOLUME = new int[] {
         4,  // STREAM_VOICE_CALL
         7,  // STREAM_SYSTEM
         5,  // STREAM_RING
         11, // STREAM_MUSIC
         6,  // STREAM_ALARM 
         5,  // STREAM_NOTIFICATION 
         7,  // STREAM_BLUETOOTH_SCO
         7,  // STREAM_SYSTEM_ENFORCED
         11, // STREAM_DTMF
         11  // STREAM_TTS
     };
     
 修改最大值:/frameworks/base/services/core/java/com/android/server/audio/AudioService.java
     private static int[] MAX_STREAM_VOLUME = new int[] {
         5,  // STREAM_VOICE_CALL
         7,  // STREAM_SYSTEM
         7,  // STREAM_RING
         15, // STREAM_MUSIC
         7,  // STREAM_ALARM
         7,  // STREAM_NOTIFICATION
         15, // STREAM_BLUETOOTH_SCO
         7,  // STREAM_SYSTEM_ENFORCED
         15, // STREAM_DTMF
         15  // STREAM_TTS
     };
     
 十三、修改系统打印程序
 路径:/frameworks/base/packages/PrintSpooler十四、修改系统状态栏
 路径:/frameworks/base/packages/SystemUI十五、修改系统WindowManagerService
 路径:/frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java十六、修改系统PackageManagerService
 路径:/frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java十七、修改系统权限申请
 1、修改/frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java    //源码
         ...
         mPromoteSystemApps =
                     mIsUpgrade && ver.sdkVersion <= Build.VERSION_CODES.LOLLIPOP_MR1;
         ...
         if (pkg.applicationInfo.targetSdkVersion > Build.VERSION_CODES.LOLLIPOP_MR1) {
             p.group = mPermissionGroups.get(p.info.group);
         ...
         if (pkg.applicationInfo.targetSdkVersion <= Build.VERSION_CODES.LOLLIPOP_MR1) {
             // For legacy apps dangerous permissions are install time ones.
             grant = GRANT_INSTALL_LEGACY;
         ...    
         if (!allowed && (bp.protectionLevel
                     & PermissionInfo.PROTECTION_FLAG_PRE23) != 0
                     && pkg.applicationInfo.targetSdkVersion < Build.VERSION_CODES.M) {
             // If this was a previously normal/dangerous permission that got moved
             // to a system permission as part of the runtime permission redesign, then
             // we still want to blindly grant it to old apps.
             allowed = true;
         }
         ...
         if (oldTargetSdk > Build.VERSION_CODES.LOLLIPOP_MR1
                 && newTargetSdk <= Build.VERSION_CODES.LOLLIPOP_MR1) {
             res.setError(PackageManager.INSTALL_FAILED_PERMISSION_MODEL_DOWNGRADE,
                     "Package " + pkg.packageName + " new target SDK " + newTargetSdk
                             + " doesn't support runtime permissions but the old"
                             + " target SDK " + oldTargetSdk + " does.");
             return;
         }
         ...            
     //修改
         ...
         mPromoteSystemApps =
                     mIsUpgrade && ver.sdkVersion <= Build.VERSION_CODES.M;
         ...
         if (pkg.applicationInfo.targetSdkVersion > Build.VERSION_CODES.M) {
             p.group = mPermissionGroups.get(p.info.group);
         ...
         if (pkg.applicationInfo.targetSdkVersion <= Build.VERSION_CODES.M) {
             // For legacy apps dangerous permissions are install time ones.
             grant = GRANT_INSTALL_LEGACY;
         ...
         if (!allowed && (bp.protectionLevel
                     & PermissionInfo.PROTECTION_FLAG_PRE23) != 0
                     && pkg.applicationInfo.targetSdkVersion <= Build.VERSION_CODES.M) {
             // If this was a previously normal/dangerous permission that got moved
             // to a system permission as part of the runtime permission redesign, then
             // we still want to blindly grant it to old apps.
             allowed = true;
         }
         ...
         if (oldTargetSdk > Build.VERSION_CODES.M
                 && newTargetSdk <= Build.VERSION_CODES.M) {
             res.setError(PackageManager.INSTALL_FAILED_PERMISSION_MODEL_DOWNGRADE,
                     "Package " + pkg.packageName + " new target SDK " + newTargetSdk
                             + " doesn't support runtime permissions but the old"
                             + " target SDK " + oldTargetSdk + " does.");
             return;
         }
         ...        2、修改/frameworks/support/v4/java/android/support/v4/app/ActivityCompat.java    
     public static void requestPermissions(final @NonNull Activity activity,
             final @NonNull String[] permissions, final int requestCode) {
         //源码 if (Build.VERSION.SDK_INT >= 23) {
         if (Build.VERSION.SDK_INT > 23) {
             ActivityCompatApi23.requestPermissions(activity, permissions, requestCode);
         } else if (activity instanceof OnRequestPermissionsResultCallback) {
             Handler handler = new Handler(Looper.getMainLooper());
             handler.post(new Runnable() {
                 @Override
                 public void run() {
                     final int[] grantResults = new int[permissions.length];                    PackageManager packageManager = activity.getPackageManager();
                     String packageName = activity.getPackageName();                    final int permissionCount = permissions.length;
                     for (int i = 0; i < permissionCount; i++) {
                         grantResults[i] = packageManager.checkPermission(
                                 permissions[i], packageName);
                     }                    ((OnRequestPermissionsResultCallback) activity).onRequestPermissionsResult(
                             requestCode, permissions, grantResults);
                 }
             });
         }
     }    public static boolean shouldShowRequestPermissionRationale(@NonNull Activity activity,
             @NonNull String permission) {
         //源码 if (Build.VERSION.SDK_INT >= 23) {
         if (Build.VERSION.SDK_INT > 23) {
             return ActivityCompatApi23.shouldShowRequestPermissionRationale(activity, permission);
         }
         return false;
     }
     
 3、修改/frameworks/support/v4/java/android/support/v4/app/AppOpsManagerCompat.java    
     static {
         //源码 if (Build.VERSION.SDK_INT >= 23) {
         if (Build.VERSION.SDK_INT > 23) {
             IMPL = new AppOpsManager23();
         } else {
             IMPL = new AppOpsManagerImpl();
         }
     }
     
 十八、修改系统首次启动安装指定APP
 路径:/frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java    
     public void systemReady() {
         ...
         //添加
         if(isFirstBoot()){  
             //TODO  
         } 
     }    
     
 十九、修改系统Settings
 路径:/packages/apps/Settings
     
 二十、关闭系统底部导航栏
 路径:device\fsl\sabresd_6dq\overlay\frameworks\base\core\res\res\values\config.xml    <!-- Whether a software navigation bar should be shown. NOTE: in the future this may be
      autodetected from the Configuration. -->
     <bool name="config_showNavigationBar">false</bool>    二十一、禁止系统状态栏下拉    
 路径:Frameworks/base/packages/SystemUI/src/com/android/systemui/statusbar/phone/StatusBarWindowView.java    public boolean onInterceptTouchEvent(MotionEvent ev) {
         //直接return true
         return true;
     }
  二十二、实现WLAN、以太网共存
 1、路径:/frameworks/base/services/core/java/com/android/server/ConnectivityService.java
     private void teardownUnneededNetwork(NetworkAgentInfo nai) {
         for (int i = 0; i < nai.networkRequests.size(); i++) {
             NetworkRequest nr = nai.networkRequests.valueAt(i);
             // Ignore listening requests.
             if (!isRequest(nr)) continue;
             loge("Dead network still had at least " + nr);
             break;
         }
         //nai.asyncChannel.disconnect(); //屏蔽此行代码
     }
     
 2、路径:/frameworks/opt/net/ethernet/java/com/android/server/ethernet/EthernetNetworkFactory.java
     public synchronized void start(Context context, Handler target) {
         // The services we use.
         IBinder b = ServiceManager.getService(Context.NETWORKMANAGEMENT_SERVICE);
         mNMService = INetworkManagementService.Stub.asInterface(b);
         mEthernetManager = (EthernetManager) context.getSystemService(Context.ETHERNET_SERVICE);        // Interface match regex.
         mIfaceMatch = context.getResources().getString(
                 com.android.internal.R.string.config_ethernet_iface_regex);        // Create and register our NetworkFactory.
         mFactory = new LocalNetworkFactory(NETWORK_TYPE, context, target.getLooper());
         mFactory.setCapabilityFilter(mNetworkCapabilities);
         //源码 mFactory.setScoreFilter(-1); // this set high when we have an iface 
         mFactory.setScoreFilter(110);
         mFactory.register();        mContext = context;
         ...
     }