> Turns out there is a convenient setuid binary called “amossu” in the stock firmware, it simply does:
setgid(0);
setuid(0);
execv("/system/bin/sh",__argv);