1、recovery函数：

#define	UPDATE_TITLE			"--update_package="
#define UPDATE_COMMAND_FILE		"/cache/recovery/command"
#define UPDATE_FLAG_FILE		"/cache/recovery/last_flag"
#define LAST_INSTALL_FILE		"/cache/recovery/last_install"
#define LAST_LOG_FILE			"/cache/recovery/last_log"
#define LAST_LOCALE_FILE		"/cache/recovery/last_locale"

#define printf 	ALOGD

int factory_data_reset(void)
{
	char data[] = {"--wipe_data\n--locale=en_US\n"};
	int len = 0, fd;

	printf("[%s]command:%s\n", __FUNCTION__, data);
	
	fd = open(UPDATE_COMMAND_FILE, O_RDWR|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR);
	if (fd < 0)
	{
		printf("[%s]creat command file failed\n", __FUNCTION__);
		return -3;
	}
	len = strlen(data);
	if (write(fd, data, len) != len)
	{
		printf("[%s]write command file failed\n", __FUNCTION__);
		close(fd);
		return -4;
	}
	close(fd);

	//delete last_install,last_log
	if (remove(LAST_INSTALL_FILE) != 0)
		printf("[%s]remove last_install failed\n", __FUNCTION__);

	if (remove(LAST_LOG_FILE) != 0)
		printf("[%s]remove last_log failed\n", __FUNCTION__);
		
	if (remove(LAST_LOCALE_FILE) != 0)
		printf("[%s]remove last_locale failed\n", __FUNCTION__);

	sync();

	//reboot to recovery
	__reboot(LINUX_REBOOT_MAGIC1, LINUX_REBOOT_MAGIC2, LINUX_REBOOT_CMD_RESTART2, (void*) "recovery");//这句需要root权限！
	printf("[%s]reboot failed\n", __FUNCTION__);
	return -7;
}

int install_ota_package(char const * package_file, int use_fuse)
{
	char *path = NULL;
	int len = 0, size, fd;
	
	len = strlen(package_file);
	if (len <= 0)
	{
		printf("[%s]strlen(package_file)=%d\n", __FUNCTION__, len);
		return -1;
	}
	
	path = (char*)malloc(len+24+3);
	if (path == 0)
	{
		printf("[%s]malloc failed\n", __FUNCTION__);
		return -2;
	}
	
	//UPDATE_COMMAND_FILE
	memset(path, 0, len+24+3);
	if (use_fuse)//(strncmp(package_file, "/vtfuse", 7) != 0)
	{
		strcpy(path, "--update_package=/vtfuse");
		strcpy(&path[24], package_file);
		strcpy(&path[24+len], "\n");
	}
	else
	{
		strcpy(path, "--update_package=");
		strcpy(&path[17], package_file);
		strcpy(&path[17+len], "\n");
	}
	printf("[%s]command:%s\n", __FUNCTION__, path);
	
	fd = open(UPDATE_COMMAND_FILE, O_RDWR|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR);
	if (fd < 0)
	{
		printf("[%s]creat command file failed\n", __FUNCTION__);
		free(path);
		return -3;
	}
	size = strlen(path);
	if (write(fd, path, size) != size)
	{
		printf("[%s]write command file failed\n", __FUNCTION__);
		free(path);
		close(fd);
		return -4;
	}
	close(fd);
	
	//UPDATE_FLAG_FILE
	memset(path, 0, len+24+3);
	if (use_fuse)//(strncmp(package_file, "/vtfuse", 7) != 0)
	{
		strcpy(path, "updating$path=/vtfuse");
		strcpy(&path[21], package_file);
		strcpy(&path[21+len], "\n");
	}
	else
	{
		strcpy(path, "updating$path=");
		strcpy(&path[14], package_file);
		strcpy(&path[14+len], "\n");
	}
	printf("[%s]last_flag:%s\n", __FUNCTION__, path);
	
	fd = open(UPDATE_FLAG_FILE, O_RDWR|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR);
	if (fd < 0)
	{
		printf("[%s]creat last_flag file failed\n", __FUNCTION__);
		free(path);
		return -5;
	}
	size = strlen(path);
	if (write(fd, path, size) != size)
	{
		printf("[%s]write last_flag file failed\n", __FUNCTION__);
		free(path);
		close(fd);
		return -6;
	}
	close(fd);
	
	//delete last_install,last_log
	if (remove(LAST_INSTALL_FILE) != 0)
		printf("[%s]remove last_install failed\n", __FUNCTION__);

	if (remove(LAST_LOG_FILE) != 0)
		printf("[%s]remove last_log failed\n", __FUNCTION__);

	sync();
	free(path);
	
	//reboot to recovery
	__reboot(LINUX_REBOOT_MAGIC1, LINUX_REBOOT_MAGIC2, LINUX_REBOOT_CMD_RESTART2, (void*) "recovery");//同样需要root权限
	printf("[%s]reboot failed\n", __FUNCTION__);
	return -7;
}

3.1 apk申请system权限，需要签名或者在源码中编译！

3.2 apk是无法直接获取到root权限的，最多system权限，因此我们可以采service！

参考：http://blog.chinaunix.net/uid-12348673-id-3030823.html

3.3 将上面的函数写两个应用，编译后放在/system/bin/下，这样我们即可在jni中或apk中去开启service：

init.rc中：

 servicerecovery /system/bin/recovery

apk： SystemProperties.set("ctl.start", "recovery");

jni： property_set("ctl.start", "recovery");

3.4这样就可以实现recovery，OTA了！