[Android Software/Hacking General [Developers Only]] bitye:
My changes:

init.rc

on init

sysclktz 0

loglevel 3

# setup the global environment
export PATH /sbin:/system/sbin:/system/bin:/system/xbin
export LD_LIBRARY_PATH /system/lib:/data/cust/lib
export ANDROID_BOOTLOGO 1
export ANDROID_ROOT /system
export ANDROID_ASSETS /system/app
export ANDROID_DATA /data
export EXTERNAL_STORAGE /mnt/sdcard
export ASEC_MOUNTPOINT /mnt/asec
export BOOTCLASSPATH /system/framework/core.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/android.policy.jar:/system/framework/services.jar
export TERMINFO /system/etc/terminfo

# Backward compatibility
symlink /system/etc /etc
symlink /sys/kernel/debug /d

# create mountpoints
mkdir /mnt 0775 root system
mkdir /mnt/sdcard 0000 system system

# Create cgroup mount point for cpu accounting
mkdir /acct
mount cgroup none /acct cpuacct
mkdir /acct/uid

# Backwards Compat - XXX: Going away in G*
symlink /mnt/sdcard /sdcard

mkdir /system
mkdir /data 0771 system system
mkdir /cust

mkdir /cache 0770 system cache
mkdir /config 0500 root root

# Directory for putting things only root should see.
mkdir /mnt/secure 0700 root root

# Directory for staging bindmounts
mkdir /mnt/secure/staging 0700 root root

# Directory-target for where the secure container
# imagefile directory will be bind-mounted
mkdir /mnt/secure/asec 0700 root root

# Secure container public mount points.
mkdir /mnt/asec 0700 root system
mount tmpfs tmpfs /mnt/asec mode=0755,gid=1000

mount rootfs rootfs / ro remount

write /proc/sys/kernel/panic_on_oops 1
write /proc/sys/kernel/hung_task_timeout_secs 0
write /proc/cpu/alignment 4
write /proc/sys/kernel/sched_latency_ns 10000000
write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000
write /proc/sys/kernel/sched_compat_yield 1
write /proc/sys/kernel/sched_child_runs_first 0

# Create cgroup mount points for process groups
mkdir /dev/cpuctl
mount cgroup none /dev/cpuctl cpu
chown system system /dev/cpuctl
chown system system /dev/cpuctl/tasks
chmod 0777 /dev/cpuctl/tasks
write /dev/cpuctl/cpu.shares 1024

mkdir /dev/cpuctl/fg_boost
chown system system /dev/cpuctl/fg_boost/tasks
chmod 0777 /dev/cpuctl/fg_boost/tasks
write /dev/cpuctl/fg_boost/cpu.shares 1024

mkdir /dev/cpuctl/bg_non_interactive
chown system system /dev/cpuctl/bg_non_interactive/tasks
chmod 0777 /dev/cpuctl/bg_non_interactive/tasks
# 5.0 %
write /dev/cpuctl/bg_non_interactive/cpu.shares 52

# mount mtd partitions
# Mount /system rw first to give the filesystem a chance to save a checkpoint
mount yaffs2 mtd@system /system
mount yaffs2 mtd@system /system ro remount

# We chown/chmod /data again so because mount is run as root + defaults
mount yaffs2 mtd@userdata /data nosuid nodev
chown system system /data
chmod 0771 /data

# Mount /cust rw first to give the filesystem a chance to save a checkpoint
mount yaffs2 mtd@cust /cust
mount yaffs2 mtd@cust /cust ro remount

# Create dump dir and collect dumps.
# Do this before we mount cache so eventually we can use cache for
# storing dumps on platforms which do not have a dedicated dump partition.

mkdir /data/dontpanic
chown root log /data/dontpanic
chmod 0750 /data/dontpanic

# Collect apanic data, free resources and re-arm trigger
copy /proc/apanic_console /data/dontpanic/apanic_console
chown root log /data/dontpanic/apanic_console
chmod 0640 /data/dontpanic/apanic_console

copy /proc/apanic_threads /data/dontpanic/apanic_threads
chown root log /data/dontpanic/apanic_threads
chmod 0640 /data/dontpanic/apanic_threads

symlink /system/cdrom /data/cdrom

write /proc/apanic_console 1

# Same reason as /data above
mount yaffs2 mtd@cache /cache nosuid nodev
mkdir /cache/fotapkg 0777 system system
mkdir /cache/fotapkg/tmp 0777 system system
chown system cache /cache
chmod 0771 /cache

# This may have been created by the recovery system with odd permissions
chown system cache /cache/recovery
chmod 0770 /cache/recovery

#change permissions on vmallocinfo so we can grab it from bugreports
chown root log /proc/vmallocinfo
chmod 0440 /proc/vmallocinfo

#change permissions on kmsg & sysrq-trigger so bugreports can grab kthread stacks
chown root system /proc/kmsg
chmod 0440 /proc/kmsg
chown root system /proc/sysrq-trigger
chmod 0220 /proc/sysrq-trigger

# create basic filesystem structure
mkdir /data/misc 01771 system misc
mkdir /data/misc/bluetoothd 0770 bluetooth bluetooth
mkdir /data/misc/bluetooth 0770 system system
mkdir /data/misc/keystore 0700 keystore keystore
mkdir /data/misc/vpn 0770 system system
mkdir /data/misc/systemkeys 0700 system system
mkdir /data/misc/vpn/profiles 0770 system system
# give system access to wpa_supplicant.conf for backup and restore
mkdir /data/misc/wifi 0770 wifi system
chmod 0770 /data/misc/wifi
chmod 0660 /data/misc/wifi/wpa_supplicant.conf
mkdir /data/local 0771 shell shell
mkdir /data/local/tmp 0771 shell shell
mkdir /data/data 0771 system system
mkdir /data/app-private 0771 system system
mkdir /data/app 0771 system system
mkdir /data/property 0700 root root

mkdir /data/calibration 0777 system system

# modify for wifi baseline
#create WIFI filesystem structure
mkdir /data/misc/wifi 0777 wifi system
mkdir /data/misc/wifi/sockets 0777 wifi system
mkdir /data/misc/wpa_supplicant 0777 wifi system
chmod 0777 /data/misc/wpa_supplicant
chown wifi system /data/misc/wpa_supplicant
mkdir /data/misc/dhcp 0777 wifi system
#for WAPI
mkdir /data/wapi 0777 system system

# create dalvik-cache and double-check the perms
mkdir /data/dalvik-cache 0771 system system
chown system system /data/dalvik-cache
chmod 0771 /data/dalvik-cache

# create the lost+found directories, so as to enforce our permissions
mkdir /data/lost+found 0770
mkdir /cache/lost+found 0770

# double check the perms, in case lost+found already exists, and set owner
chown root root /data/lost+found
chmod 0770 /data/lost+found
chown root root /cache/lost+found
chmod 0770 /cache/lost+found

mkdir /data/drm 0777 root root
chown root root /data/drm
chmod 0777 /data/drm

mkdir /data/drm/rights 0777 root root
chown root root /data/drm/rights
chmod 0777 /data/drm/rights
mkdir /data/hwvefs 0777 root root
chown root root /data/hwvefs
chmod 0777 /data/hwvefs

chown root root /data/cdrom
chmod 0444 /data/cdrom
chown root root /data/cdrom/autorun.iso
chmod 0444 /data/cdrom/autorun.iso

#on cust
# mkdir /data/cust

# custcopy apk_name_need_to_enable.xml /data/cust/apk_name_need_to_enable.xml
# chmod 0666 /data/cust/apk_name_need_to_enable.xml

#remove old custcopy
# custsymlink nv /data/cust/nv

# the follow is a example for customize config copy,please pay attention to the mode of the file.
# mkdir /data/cust/wifi
# custcopy wpa_supplicant.conf /data/cust/wifi/wpa_supplicant.conf
# chmod 0777 /data/cust/wifi/wpa_supplicant.conf

# custsymlink xml /data/cust/xml
# custsymlink prop /data/cust/prop
# custsymlink wallpaper /data/cust/wallpaper

# custsymlink app /data/cust/app
# custsymlink lib /data/cust/lib
# custsymlink media /data/cust/media
# custsymlink logo /data/cust/logo
# exec /system/bin/load_oemlogo

on boot
# basic network init
ifup lo
hostname localhost
domainname localdomain

# set RLIMIT_NICE to allow priorities from 19 to -20
setrlimit 13 40 40
setrlimit 7 2048 2048

# Define the oom_adj values for the classes of processes that can be
# killed by the kernel. These are used in ActivityManagerService.
setprop ro.FOREGROUND_APP_ADJ 0
setprop ro.VISIBLE_APP_ADJ 1
setprop ro.SECONDARY_SERVER_ADJ 2
setprop ro.BACKUP_APP_ADJ 2
setprop ro.HOME_APP_ADJ 4
setprop ro.HIDDEN_APP_MIN_ADJ 7
setprop ro.CONTENT_PROVIDER_ADJ 14
setprop ro.EMPTY_APP_ADJ 15

# Define the memory thresholds at which the above process classes will
# be killed. These numbers are in pages (4k).
setprop ro.FOREGROUND_APP_MEM 1536
setprop ro.VISIBLE_APP_MEM 2048
setprop ro.SECONDARY_SERVER_MEM 4096
setprop ro.BACKUP_APP_MEM 4096
setprop ro.HOME_APP_MEM 4096
setprop ro.HIDDEN_APP_MEM 5120
setprop ro.CONTENT_PROVIDER_MEM 5632
setprop ro.EMPTY_APP_MEM 6144
# setprop ro.HIDDEN_APP_MEM 7168
# setprop ro.CONTENT_PROVIDER_MEM 8192
# setprop ro.EMPTY_APP_MEM 8192

# Write value must be consistent with the above properties.
# Note that the driver only supports 6 slots, so we have HOME_APP at the
# same memory level as services.
write /sys/module/lowmemorykiller/parameters/adj 0,1,2,7,14,15

write /proc/sys/vm/overcommit_memory 1
write /proc/sys/vm/min_free_order_shift 4
write /sys/module/lowmemorykiller/parameters/minfree 1536,2048,4096,5120,5632,6144
# write /sys/module/lowmemorykiller/parameters/minfree 1536,2048,4096,7168,8192,8192

# Set init its forked children's oom_adj.
write /proc/1/oom_adj -16

# Tweak background writeout
# write /proc/sys/vm/dirty_expire_centisecs 200
# write /proc/sys/vm/dirty_background_ratio 5
write /proc/sys/vm/dirty_expire_centisecs 0
write /proc/sys/vm/dirty_background_ratio 60
write /proc/sys/vm/dirty_ratio 95

# Permissions for System Server and daemons.
chown radio system /sys/android_power/state
chown radio system /sys/android_power/request_state
chown radio system /sys/android_power/acquire_full_wake_lock
chown radio system /sys/android_power/acquire_partial_wake_lock
chown radio system /sys/android_power/release_wake_lock
chown radio system /sys/power/state
chown radio system /sys/power/wake_lock
chown radio system /sys/power/wake_unlock
chmod 0660 /sys/power/state
chmod 0660 /sys/power/wake_lock
chmod 0660 /sys/power/wake_unlock
chown system system /sys/class/timed_output/vibrator/enable
chown system system /sys/class/leds/keyboard-backlight/brightness
chown system system /sys/class/leds/lcd-backlight/brightness
chown system system /sys/class/leds/button-backlight/brightness
chown system system /sys/class/leds/jogball-backlight/brightness
chown system system /sys/class/leds/red/brightness
chown system system /sys/class/leds/green/brightness
chown system system /sys/class/leds/blue/brightness
chown system system /sys/class/leds/red/device/grpfreq
chown system system /sys/class/leds/red/device/grppwm
chown system system /sys/class/leds/red/device/blink
chown system system /sys/class/leds/red/brightness
chown system system /sys/class/leds/green/brightness
chown system system /sys/class/leds/blue/brightness
chown system system /sys/class/leds/red/device/grpfreq
chown system system /sys/class/leds/red/device/grppwm
chown system system /sys/class/leds/red/device/blink
chown system system /sys/class/timed_output/vibrator/enable
chown system system /sys/module/sco/parameters/disable_esco
chown system system /sys/kernel/ipv4/tcp_wmem_min
chown system system /sys/kernel/ipv4/tcp_wmem_def
chown system system /sys/kernel/ipv4/tcp_wmem_max
chown system system /sys/kernel/ipv4/tcp_rmem_min
chown system system /sys/kernel/ipv4/tcp_rmem_def
chown system system /sys/kernel/ipv4/tcp_rmem_max
chown root radio /proc/cmdline
chown bluetooth bluetooth /sys/class/rfkill/rfkill0/type
chown bluetooth bluetooth /sys/class/rfkill/rfkill0/state
chmod 0660 /sys/class/rfkill/rfkill0/state
chown bluetooth bluetooth /sys/module/bluetooth_power/parameters/power
chown bluetooth bluetooth /proc/bluetooth/sleep/proto
chown system system /sys/module/sco/parameters/disable_esco
chmod 0660 /sys/module/bluetooth_power/parameters/power
chmod 0660 /proc/bluetooth/sleep/proto
chown bluetooth bluetooth /dev/ttyHS0
chmod 0660 /dev/ttyHS0
# gsensor
chmod 0666 /dev/accel
chmod 0666 /dev/ofn
chmod 0666 /dev/akm8973_aot
chmod 0666 /dev/akm8973_dev
chmod 0666 /dev/light
chmod 0666 /dev/proximity
chmod 0666 /sys/devices/system/cpu/cpu0/cpufreq/scaling_min_freq
chmod 0777 /sys/kernel/logger/log_main/enable
chmod 0777 /sys/kernel/logger/log_events/enable
chmod 0777 /sys/kernel/logger/log_radio/enable
chmod 0777 /sys/kernel/logger/log_main/priority
chmod 0777 /sys/kernel/logger/log_events/priority
chmod 0777 /sys/kernel/logger/log_radio/priority
#/*add project menu's camera info*/
chmod 0777 /dev/input/event0
chmod 0666 /dev/input/event1
chmod 0666 /dev/input/event2
chmod 0666 /dev/input/event3

# Define TCP buffer sizes for various networks
# ReadMin, ReadInitial, ReadMax, WriteMin, WriteInitial, WriteMax,
setprop net.tcp.buffersize.default 4096,87380,110208,4096,16384,110208
setprop net.tcp.buffersize.wifi 4095,87380,110208,4096,16384,110208
setprop net.tcp.buffersize.umts 4094,87380,110208,4096,16384,110208
setprop net.tcp.buffersize.edge 4093,26280,35040,4096,16384,35040
setprop net.tcp.buffersize.gprs 4092,8760,11680,4096,8760,11680

start userinit
on property:userinit.filesystem.ready=1
class_start default

## Daemon processes to be run by init.
##
service console /system/bin/sh
console

# adbd is controlled by the persist.service.adb.enable system property
service adbd /sbin/adbd
disabled

# adbd on at boot in emulator
on property:ro.kernel.qemu=1
start adbd

on property:persist.service.adb.enable=1
start adbd

on property:persist.service.adb.enable=0
stop adbd

#Add scaling method for MEDIA
on property:audio.governor=1
write /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor performance

on property:audio.governor=0
write /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor ondemand

# Add change CPU frequency method for performance
on property:powersave.cpufreq=1
write /sys/devices/system/cpu/cpu0/cpufreq/ondemand/powersave_bias 90
write /sys/devices/system/cpu/cpu0/cpufreq/ondemand/up_threshold 80

on property:powersave.cpufreq=0
write /sys/devices/system/cpu/cpu0/cpufreq/ondemand/powersave_bias 0
write /sys/devices/system/cpu/cpu0/cpufreq/ondemand/up_threshold 60

service servicemanager /system/bin/servicemanager
user system
critical
onrestart restart zygote
onrestart restart media

service vold /system/bin/vold
socket vold stream 0660 root mount
ioprio be 2

service netd /system/bin/netd
socket netd stream 0660 root system

service debuggerd /system/bin/debuggerd

service ril-daemon /system/bin/rild
socket rild stream 660 root radio
socket rild-debug stream 660 radio system
user root
group radio cache inet misc audio

service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
socket zygote stream 666
onrestart write /sys/android_power/request_state wake
onrestart write /sys/power/state on
onrestart restart media

service media /system/bin/mediaserver
user media
group system audio camera graphics inet net_bt net_bt_admin net_raw
ioprio rt 4

service bootanim /system/bin/bootanimation
user graphics
group graphics
disabled
oneshot

service dbus /system/bin/dbus-daemon --system --nofork
socket dbus stream 660 bluetooth bluetooth
user bluetooth
group bluetooth net_bt_admin

service bluetoothd /system/bin/bluetoothd -n
socket bluetooth stream 660 bluetooth bluetooth
socket dbus_bluetooth stream 660 bluetooth bluetooth
# init.rc does not yet support applying capabilities, so run as root and
# let bluetoothd drop uid to bluetooth with the right linux capabilities
group bluetooth net_bt_admin misc
disabled

#service bcm_wlcoex /system/bin/bcm_wlcoex
# disabled
# oneshot

service hfag /system/bin/sdptool add --channel=10 HFAG
user bluetooth
group bluetooth net_bt_admin
disabled
oneshot

service hsag /system/bin/sdptool add --channel=11 HSAG
user bluetooth
group bluetooth net_bt_admin
disabled
oneshot

service opush /system/bin/sdptool add --channel=12 OPUSH
user bluetooth
group bluetooth net_bt_admin
disabled
oneshot

# HUAWEI WPA SETTING
service wpa_supplicant /system/bin/wpa_supplicant -Dwext -ieth0 -W -c/data/misc/wifi/wpa_supplicant.conf
disabled
oneshot

#service bcm_supplicant /system/bin/bcm_supplicant -Dwext -ieth0 -W -c/data/misc/wifi/wpa_supplicant.conf
# disabled
# oneshot

service dhcpcd /system/bin/dhcpcd eth0 -B
disabled
oneshot

service wlan_tool /system/bin/wlan_tool
disabled
oneshot

service pbap /system/bin/sdptool add --channel=19 PBAP
user bluetooth
group bluetooth net_bt_admin
disabled
oneshot

service installd /system/bin/installd
socket installd stream 600 system system

service abtfilt /system/bin/abtfilt -c -d -z -n
disabled
oneshot

# Add FOTA update to 7x25
service flash_recovery /system/bin/flash_image recovery /system/recovery.img
oneshot

service flash_recovery /system/etc/install-recovery.sh
oneshot

service racoon /system/bin/racoon
socket racoon stream 600 system system
# racoon will setuid to vpn after getting necessary resources.
group net_admin
disabled
oneshot

service mtpd /system/bin/mtpd
socket mtpd stream 600 system system
user vpn
group vpn net_admin net_raw
disabled
oneshot

#START HUAWEI COMPASS SERVICE
service akmd /system/bin/akmd2
disabled
oneshot
service keystore /system/bin/keystore /data/misc/keystore
user keystore
group keystore
socket keystore stream 666

# START HUAWEI RPC SERVICE
service oem_rpc_svc /system/bin/oem_rpc_svc
oneshot
service dumpstate /system/bin/dumpstate -s
socket dumpstate stream 0660 shell log
disabled
oneshot

service hwvefs /system/bin/hwvefs /data/hwvefs -o allow_other

service userinit /system/bin/logwrapper /system/bin/sh /system/bin/userinit.sh
disabled
oneshot

# Compcache
service compcache_on /system/bin/logwrapper /system/bin/sh /system/bin/compcache.sh start
disabled
oneshot

service compcache_off /system/bin/logwrapper /system/bin/sh /system/bin/compcache.sh stop
disabled
oneshot

on property:persist.service.compcache=1
start compcache_on

on property:persist.service.compcache=0
start compcache_off

# SD-card swap
service sdswap_on /system/bin/logwrapper /system/bin/sh /system/bin/sdswap.sh start
disabled
oneshot

service sdswap_off /system/bin/logwrapper /system/bin/sh /system/bin/sdswap.sh stop
disabled
oneshot

on property:persist.service.sdswap=1
start sdswap_on

on property:persist.service.sdswap=0
start sdswap_off

userinit.sh

#!/system/bin/sh
#
#

# Fix for not using the custcopy stuff in init.rc
if [ -f /data/cust/wifi/wpa_supplicant.conf ]
then
/system/xbin/chmod 777 /data/cust/wifi/wpa_supplicant.conf
else
/system/xbin/mkdir /data/cust
/system/xbin/mkdir /data/cust/wifi
# /system/xbin/cp /system/wifi/wpa_supplicant.conf /data/cust/wifi/
/system/xbin/cp /data/misc/wifi/wpa_supplicant.conf /data/cust/wifi/
/system/xbin/chmod 777 /data/cust/wifi/wpa_supplicant.conf
fi

# Fix wpa_supplicant and wifi structure by Biti
# Create wpa_supplicant directory under /data/misc/
if [ -f /data/misc/wpa_supplicant/wpa_supplicant.conf ]
then
/system/xbin/chmod 777 /data/misc/wpa_supplicant/wpa_supplicant.conf
else
/system/xbin/mkdir /data/misc/wpa_supplicant
/system/xbin/mkdir /data/misc/wpa_supplicant/sockets
/system/xbin/cp /data/misc/wifi/wpa_supplicant.conf /data/misc/wpa_supplicant/
/system/xbin/chmod 777 /data/misc/wpa_supplicant/wpa_supplicant.conf
/system/xbin/chmod 777 /data/misc/wpa_supplicant/sockets
fi

# chmod and chown to proper values all wifi related files
/system/xbin/chmod 770 /data/misc/wifi/wpa_supplicant.conf
/system/xbin/chown wifi.system /data/misc/wifi/wpa_supplicant.conf

/system/xbin/chmod 770 /data/misc/wpa_supplicant
/system/xbin/chown wifi.system /data/misc/wpa_supplicant

/system/xbin/chmod 777 /system/etc/wifi/wpa_supplicant.conf
/system/xbin/chown wifi.system /system/etc/wifi/wpa_supplicant.conf

/system/xbin/chmod 777 /system/wifi/wpa_supplicant.conf
/system/xbin/chown wifi.system /system/wifi/wpa_supplicant.conf

# Run a2sd
#/system/bin/a2sd

# Done here
/system/bin/setprop userinit.filesystem.ready 1

In wpa_supplicant.conf files GROUP=system

first problem: /data/misc/wifi/wpa_supplicant.conf is not alvailable wile first wifi start!

sec proble: manually executed userinit.sh not create /data/misc/wpa_supplicant/wpa_supplicant.conf so script don't work

Because I have a lot of problems to run commands from userinit.sh I created a script and executed from root explorer, now all of my modifications ok.

mkdir /data/cust
mkdir /data/cust/wifi
cp /data/misc/wifi/wpa_supplicant.conf /data/cust/wifi/wpa_supplicant.conf
chmod 777 /data/cust/wifi/
chmod 777 /data/cust/wifi/wpa_supplicant.conf
mkdir /data/misc/wpa_supplicant
mkdir /data/misc/wpa_supplicant/sockets
cp /data/misc/wifi/wpa_supplicant.conf /data/misc/wpa_supplicant/wpa_supplicant.conf
chmod 777 /data/misc/wpa_supplicant
chmod 777 /data/misc/wpa_supplicant/wpa_supplicant.conf
chmod 777 /data/misc/wpa_supplicant/sockets
chmod 770 /data/misc/wpa_supplicant
chown wifi.system /data/misc/wpa_supplicant
chmod 770 /data/misc/wifi/wpa_supplicant.conf
chown wifi.system /data/misc/wifi/wpa_supplicant.conf
chmod 777 /system/etc/wifi/wpa_supplicant.conf
chown wifi.system /system/etc/wifi/wpa_supplicant.conf
chmod 777 /system/wifi/wpa_supplicant.conf
chown wifi.system /system/wifi/wpa_supplicant.conf

some of these commands maybe cannot execute cause already created directories or files, but all chown and chmod ok.

After enter password for my network that always drop me down, wifi on/off and works.

After reboot wifi on/off and works now.

I need more tests.