Develop Bugs

[ROOTED] Rooting An Acer Iconia A101

Yes, finally, for us A101 owners out there, a rooting method has finally been found!
Firstly, it's important to point out that I DID NOT DISCOVER this rooting method. All credit for that goes to ZeroNull and can be found in his original post here. All I have done is to essentially translate it to more native English and hopefully explain it a little better. I've been a bit more long winded than ZeroNull was, but it's kinda necessary to make things clear.
Finally, and most importantly:
DO THIS AT YOUR OWN RISK! NEITHER I NOR ZERONULL ARE TO BLAME IF YOU MESS UP YOUR TAB!
You will need a few things:
1. The A10x_Rooting.zip file attached at the bottom of this thread. This contains ADB and SU.
2. An A100 ROM. It's probably best to go for as early a verion as you can but any should probably work. Get one from vache's thread here.
3. An A101 ROM. Any version will do, again you can get one from vache's thread above. Note there are some updated ROMs on about page 13 or so of that thread.
4. The ability to follow instructions CAREFULLY. Seriously, I can't stress this enough. One typo can make the process fail, so copy/paste the commands, OK?
5. Basic knowledge of how to open a cmd shell in Windows (I'm not a Linux person, but most of this guide will probably apply).
Right, on to the instructions!
Part One
1. Download all needed file as above and extract into a directory somewhere.
2. Connect your A101 to USB, make sure USB debugging is turned on, and open a command window in the same folder you extracted A10x_Rooting.zip in to.
3. Copy the A100's update.zip to the root of your external SD card on the tablet.
4. Reboot into recovery (hold power and left side of the vol rocker until you see the text).
5. Wait for the A100 ROM to install. This is the slightly scary bit as you just emasculated your tab! :O
Part Two
6. Once your tab has booted, make sure USB debugging is on and go to your command window. Type:
Code:
adb devices
If all is well, you'll get your UID in response. You don't need this for rooting, but it's a damn good idea to write this down somewhere safe.
7. Assuming 6 was OK, then proceed. If it wasn't, you'll need to sort that out yourselves
Enter the following commands.
Code:
adb shell
/system/bin/cmdclient ec_micswitch '`echo 'ro.kernel.qemu=1' > /data/local.prop`'
Nothing will echo back to you, and trying to ls that folder will give you a permission denied. Don't worry, it should have worked.
8. Type exit at the $ prompt to exit ADB shell.
9. Copy the A101 update.zip to the root of the external SD card, reboot to recovery and flash it.
Part Three
10. Once booted back up, go back to your command window and enter the following:
Code:
adb remount
adb push su /system/xbin/
adb shell "chmod 06755 /system/xbin/su"
11. Now you need to undo the qemu command. Enter the following in the command window.
Code:
adb shell "echo '#' >/data/local.prop"
Your root should now be 95% complete, but we're not quite finished yet.
12. Load the market and download BusyBox, SuperUser, and if you want it, Titanium Backup. Install all of these but DO NOT RUN THEM YET.
13. Reboot the device. Another scary part!
14. Once booted, run SuperUser then drop back to the desktop.
15. Run BusyBox and go through the install steps. During this SU should ask permission to give BB root access, if it does, it worked!
By the way, for me at least, SU moaned about being out of date whilst installing BB. Let BB install, then afterward, let SU update itself.
Important Note
After doing this once, if you install a newer ROM, you will NOT need to go back to the A100 to re-root, that part only has to be done one time. The local.prop file will now persist between ROM's so all you'll need to do is to go back to step 7 and proceed from there.

How does one figure out which version they have?
Sent from my Acer Iconia using xda premium

Mordak said:
How does one figure out which version they have?
Sent from my Acer Iconia using xda premium
Click to expand...
Click to collapse
You mean a100 or a101? A100 is the wifi only version that most of us have. The A101 has a spot for a phone SIMM card.

Mordak said:
How does one figure out which version they have?
Sent from my Acer Iconia using xda premium
Click to expand...
Click to collapse
It's under Settings -> About
Though I'm kinda puzzled as to how come you don't know which model you bought...

Thanks
Been waiting for ages till i searched it in google today.
Is there any chance we can install recovery like CWM?

Not at this time. Devs are working hard trying to bypass the locked bootloader on the A100. I'm assuming the bootloader on the A101 is similar enough that whatever method eventually gets worked out would work on both. I may be wrong. Wouldn't surprise me if I was lol
Sent from my Inspire 4G using Tapatalk

Hope you're right
Uh, and i think you should bold this:
3. Copy the A100's update.zip to the root of your external SD card on the tablet.
Since i've missed the "external" sd card and just copied it right to the internal sd, the rom was'nt detected by then. My bad, but there may be people like me hahaha

icefish1412 said:
Hope you're right
Uh, and i think you should bold this:
3. Copy the A100's update.zip to the root of your external SD card on the tablet.
Since i've missed the "external" sd card and just copied it right to the internal sd, the rom was'nt detected by then. My bad, but there may be people like me hahaha
Click to expand...
Click to collapse
Point 4 of the "things you will need" covers that.
4. The ability to follow instructions CAREFULLY. Seriously, I can't stress this enough. One typo can make the process fail, so copy/paste the commands, OK?
Click to expand...
Click to collapse

FloatingFatMan said:
It's under Settings -> About
Though I'm kinda puzzled as to how come you don't know which model you bought...
Click to expand...
Click to collapse
I never saw a 3G version in any of the stores near me. I did see the spot where a sim could go but I had no idea this was the differentiating factor. Thanks for the info.

Will this rooting method work on the A100?

The A100 has its own rooting method, but there's no reason why it shouldn't. In fact, someone posted a slightly modded version of this method for that model, in the A100 rooting thread.

sorry but i can't apply
adb shell
/system/bin/cmdclient ec_micswitch '`echo 'ro.kernel.qemu=1' > /data/local.prop`'
what can i do?

^ Defining "I can't apply" would help...
Seriously, that's about as much help to debugging the problem as a chocolate teapot.

ok,
when i submit the command
/system/bin/cmdclient ec_micswitch '`echo 'ro.kernel.qemu=1' > /data/local.prop`'
i get this from the console
/system/bin/cmdclient ec_micswitch '`echo 'ro.kernel.qemu=1' > /data/local.prop`'
and when i follow the next steps
i cant remount

What ROM are you running on?

[HOW-TO] [GSM & CDMA] Root without Unlocking Bootloader via exploit (for 4.0.1/4.0.2)

[HOW-TO] [GSM & CDMA] Root without Unlocking Bootloader via exploit (for 4.0.1/4.0.2)
Edit: This does not works on anything newer than ICL53F (i.e., 4.0.2). It works fine on ITL41D (4.0.1), ITL41F (4.0.1) and ICL53F (4.0.2)
Once you have got root, you can now use segv11's BootUnlocker app to unlock your bootloader without wiping anything. Easy as pie!
Disclaimer: I take no credit for this exploit or the implementation of it (but I will take credit for the step-by step ). Thanks to kendong2 for pointing it out to me here.
So, it looks like zx2c4 has found a local privilege escalation exploit. See source here, and saurik has managed to package it together for Android. See here. Although this may be old news to some, I hadn't seen it before.
So what does this all mean:
If you are running a 2.6.39 kernel (or above), which all Galaxy Nexus' are, you can now root your device without having to unlock your bootloader (and without losing your data).
Moreover, you should now be able to root your device even if your hardware buttons are not working.
Additionally, this allows those who have not received an OTA update and want to apply it without having an unlocked bootloader or root to do so by copying the OTA update to /cache from /sdcard.
Notes:
1) This assumes that you have USB Debugging enable on your device (Settings > Developer Options > Enable USB Debugging) and the drivers for your device installed on your computer. For the drivers, I would recommend you remove all old drivers and install these. If you don't know how to install them, or are having issues, look here.
2) This needs to be done over ADB, as a terminal emulator on-device does not have the appropriate access. If you do not have ADB, I've attached it in the zip. Unzip all files.
3) Some users indicate that, once finished the procedure, they needed to open the Superuser app.
Step-by-step:
1) Download the attached files to your computer and unzip them in the same directory as your adb.exe file;
2) Open a command prompt in the same directory;
3) Copy the files to your device:
adb push mempodroid /data/local/tmp/mempodroid
adb push su /data/local/tmp/su
adb push Superuser.apk /data/local/tmp/Superuser.apk
4) Open a shell: adb shell
5) Change permission on mempodroid to allow it to run: chmod 777 /data/local/tmp/mempodroid
6) Run the exploit: ./data/local/tmp/mempodroid 0xd7f4 0xad4b sh
Note: Once you do step 6, your prompt should change from $ to #. If not, it did not work.
7) Mount the system partition as rw: mount -o remount,rw -t ext4 /dev/block/mmcblk0p1 /system
8) Copy su to /system: cat /data/local/tmp/su > /system/bin/su
9) Change permissions on su: chmod 06755 /system/bin/su
10) Copy Superuser.apk: cat /data/local/tmp/Superuser.apk > /system/app/Superuser.apk
11) Change permissions on Superuser.apk: chmod 0644 /system/app/Superuser.apk
12) Mount the system partition as r/o: mount -o remount,ro -t ext4 /dev/block/mmcblk0p1 /system
13) Rescind root: exit
14) Exit the ADB shell: exit
15) Done. You now should have root without having to unlock your bootloader.

Reserved

Reserved

This is the same as https://github.com/saurik/mempodroid
saurik ftw.

times_infinity said:
This is the same as https://github.com/saurik/mempodroid
saurik ftw.
Click to expand...
Click to collapse
Not sure what you are getting at? I mentioned saurik in the first post, and the link you posted is in the first post. And I mentioned that this may be old news, but I haven't seen it anywhere before today in the GN forums.

Yikes! This exploit works on any kernel from 2.6.39 and >. This could become a common root method for many devices. Linus Torvalds himself posted the fix commit! Nice work by zx2c4!

Sleuth255 said:
Yikes! This exploit works on any kernel from 2.6.39 and >. This could become a common root method for many devices. Linus Torvalds himself posted the fix commit! Nice work by zx2c4!
Click to expand...
Click to collapse
You need ics to have a vulnerable kernel version, so given the number of devices which currently have ics officially, I doubt it will be common. I'd also expect Google and vendors to correct this in next release.
Also many custom kernels don't have this flaw as they are at or over 3.0.18 or have patched it. This prevents gaining unnoticed root.
Sent from my Galaxy Nexus

Hmmm I thought 2.6.39 was found in GB builds. This exploit is almost a root fix for the Moto DX 4.5.621 fiasco. Unfortunately the kernel for that build is 2.6.32.9.
Sent from my Galaxy Nexus using xda premium

This was huge in the headlines a few weeks back. It's nice to see someone putting it to a good use!
Sent from my Galaxy Nexus using xda premium

Hi, been lurking awhile, registered to clear up somethings.
I did some research while attempting to access the /data/local/ -folder with terminal emulator and I found that it would be impossible to write or to find it while being unrooted. Rooting a phone through using an unrooted access root seems impossible.
Did I miss something or is there any other way to copy mempodroid to the data- folder? I sure would like to keep all my files.

Huxleysäl said:
Hi, been lurking awhile, registered to clear up somethings.
I did some research while attempting to access the /data/local/ -folder with terminal emulator and I found that it would be impossible to write or to find it while being unrooted. Rooting a phone through using an unrooted access root seems impossible.
Did I miss something or is there any other way to copy mempodroid to the data- folder? I sure would like to keep all my files.
Click to expand...
Click to collapse
I think you are mistaken. In a terminal emulator type: cd /data/local/tmp
Edit: Fixed a mistake made by auto correct...
Sent from my Galaxy Nexus using Tapatalk

efrant said:
I think you are mistaken. In a terminal emulator type: cd /data/local/temp
Sent from my Galaxy Nexus using Tapatalk
Click to expand...
Click to collapse
Just did. It says "No such file or directory."
Not the best source, but if you google it, people state what I state. Sorry, can't post links

try /data/local/tmp

Huxleysäl said:
Just did. It says "No such file or directory."
Not the best source, but if you google it, people state what I state. Sorry, can't post links
Click to expand...
Click to collapse
Sorry, damn auto correct. It should be: cd /data/local/tmp
Not "temp".
It works fine.
Edit: Sleuth255 beat me to it!
Sent from my Galaxy Nexus using Tapatalk

efrant said:
Sorry, damn auto correct. It should be: cd /data/local/tmp
Not "temp".
It works fine.
Edit: Sleuth255 beat me to it!
Sent from my Galaxy Nexus using Tapatalk
Click to expand...
Click to collapse
Sure, OK, it worked. But as I'm trying to replicate his instructions, copying mempodroid to data/local/tmp doesn't compute. I tried extracting the files, puting mempodroid in a new folder in ./sdcard/ (which I named Nex), and it still couldn't find it.
Wait, just had an idea. Brb

Huxleysäl said:
Sure, OK, it worked. But as I'm trying to replicate his instructions, copying mempodroid to data/local/tmp doesn't compute. I tried extracting the files, puting mempodroid in a new folder in ./sdcard/ (which I named Nex), and it still couldn't find it.
Wait, just had an idea. Brb
Click to expand...
Click to collapse
Hmm. Looks like you may be correct. In GB, we had write access to that directory, but it looks like we don't in ICS. I'll have another look tomorrow and try to figure something out.
Sent from my Galaxy Nexus using Tapatalk

OK, this is exactly what I did:
I downloaded the files, extracted them into the ./sdcard folder of my android. I opened the console, wrote exactly as stated. Reaction? Cannot create /data/local/tmp/mempodroid: Permission denied
So, what I'm thinking is this: I tried the cd ./sdcard/mempodroid, found it. So, logically, that should mean that since the permission is dennied, the problem lies not in where I put the mempodroid, but with my authority over my phone. So, here we are again. Could anybody smarter then me clarify?
efrant said:
Hmm. Looks like you may be correct. In GB, we had write access to that directory, but it looks like we don't in ICS. I'll have another look tomorrow and try to figure something out.
Sent from my Galaxy Nexus using Tapatalk
Click to expand...
Click to collapse
****, I was hoping I was wrong. I originally thought that the exploit was this. But alas.
Try finding an alternative write route to the /data/local/- folder. That should solve all problems, I guess. Big words, ey? This is for the simpletons like me, who stupidly forgot to bootload.

Might want to expand on the steps.
Like what program to use to copy the file.
How do you change permission.
How do you run the exploit.
How to mount rw.
How to copy su.

convolution said:
Might want to expand on the steps.
Like what program to use to copy the file.
How do you change permission.
How do you run the exploit.
How to mount rw.
How to copy su.
Click to expand...
Click to collapse
I hade my initial problems with that too. But as if this moment it doesn't really matter. Read above posts. Anyhow, to answer your question: you need to download a console emulator
Just search for it in the market. Also the commands go in this console
For example: cat /directory/filename > /newdirectory/samefilename means to copy or move from one place. To change permission you just write that line of code ending with 777 instead of cat and then the filename etc and etc.
I didn't know any of this 'till yesterday, so it is quite understandable.
cheers

Huxleysäl said:
F***, I was hoping I was wrong. I originally thought that the exploit was this. But alas.
Try finding an alternative write route to the /data/local/- folder. That should solve all problems, I guess. Big words, ey? This is for the simpletons like me, who stupidly forgot to bootload.
Click to expand...
Click to collapse
I've updated the first post. Give that a go and let me know how it turns out. (The guide may need some minor tweaking, but I am here to help you through it.)
It seems that ADB has rw access to /data/local/tmp but a terminal emulator on-device does not. So for now, you need to be plugged into your computer.
It may be possible to do this with ADB-over-Wi-Fi, but I haven't gotten there yet.

[Q] HELP!!! Lcd Density Problem !!

Hi everybody,
Sorry for my bad english, i'm italian,
I've a problem with my a100 with stock ics. yesterday i've rooted it and i've installed lcd density modder. now, i've do a mistake and saved the dpi instead of temp apply. after the reboot the home won't start cause it freeze. i can only have access to settings i can't access the lcd density app. i've tried to reset to factory but it's still the same. Can anyone help me ?
thanks

Use adb to pull build.prop from /system use some text editor to open it and find this line ro.sf.lcd_density= and change it to ro.sf.lcd_density=160 then reboot.
The exact commands are :
Code:
adb pull /system/build.prop build.prop
adb push build.prop /system/build.prop
adb shell reboot

thank you so much, resolved

can you explain how to pull it up into the text editor i'm afraid i have the same problem and found this thread i enter the pull command and recieve this in cmd prompt:
C:\Users\Owner>adb pull /system/build.prop build.prop
224 KB/s (1841 bytes in 0.008s)
and now i'm lost.....

ilovemywife269 said:
can you explain how to pull it up into the text editor i'm afraid i have the same problem and found this thread i enter the pull command and recieve this in cmd prompt:
C:\Users\Owner>adb pull /system/build.prop build.prop
224 KB/s (1841 bytes in 0.008s)
and now i'm lost.....
Click to expand...
Click to collapse
Open your editor and then open build.prop in it.
Or name it build.txt then edit it then save as build.prop.
Tapatalked from my Galaxy S II.

pio_masaki said:
Open your editor and then open build.prop in it.
Or name it build.txt then edit it then save as build.prop.
Tapatalked from my Galaxy S II.
Click to expand...
Click to collapse
i'm a noob here i need more details on how exactly i should go about getting it opened

ilovemywife269 said:
i'm a noob here i need more details on how exactly i should go about getting it opened
Click to expand...
Click to collapse
Open whatever editor you want, then click on help for how to open documents in that program.
Otherwise, file>open>whereveryousavedit/build.prop
Then file>save.
Edit: for windows I suggest notepad++
Tapatalked from my Galaxy S II.

pio_masaki said:
Open whatever editor you want, then click on help for how to open documents in that program.
Otherwise, file>open>whereveryousavedit/build.prop
Then file>save.
Edit: for windows I suggest notepad++
Tapatalked from my Galaxy S II.
Click to expand...
Click to collapse
ok i didn't save it anywhere how do i save it?

ilovemywife269 said:
ok i didn't save it anywhere how do i save it?
Click to expand...
Click to collapse
C:\Users\owner\build.prop from what you posted before.
Tapatalked from my Galaxy S II.

pio_masaki said:
C:\Users\owner\build.prop from what you posted before.
Tapatalked from my Galaxy S II.
Click to expand...
Click to collapse
ok now i get:
C:Users\Owner>adb push build.prop /system/build.prop
failed to copy 'build.prop' to '/system/build.prop' : Read-only file system

what am i doing wrong shouldn't it be in a Read-Write system?

ilovemywife269 said:
what am i doing wrong shouldn't it be in a Read-Write system?
Click to expand...
Click to collapse
adb remount
adb push build.prop /system/build.prop
Edit: if that fails try this:
adb shell mount -o remount,rw -t ext4 /dev/block/mmcblk0p3 /system

mount: permission denied (are you root?)
i was rooted before i factory reset i went through the adb root method which is basicaly how i achieved root to begin with except i used a cmd prompt terminal app and did it all on my tablet and now i'm not sure i never had a "full" root idk how to explain that but it told me i was rooted and could run root apps and such but it still limited me on a few things if this helps i have
"bootloader 0.03.06-ics (unlocked)"
it came stock with gb or honeycomb i had to find a .zip file to get ics
now i've tried to adb root again and failed i'm not sure why...

ilovemywife269 said:
mount: permission denied (are you root?)
i was rooted before i factory reset i went through the adb root method which is basicaly how i achieved root to begin with except i used a cmd prompt terminal app and did it all on my tablet and now i'm not sure i never had a "full" root idk how to explain that but it told me i was rooted and could run root apps and such but it still limited me on a few things if this helps i have
"bootloader 0.03.06-ics (unlocked)"
it came stock with gb or honeycomb i had to find a .zip file to get ics
now i've tried to adb root again and failed i'm not sure why...
Click to expand...
Click to collapse
OK time for info then. What ROM are you on? What recovery? Why did you use a method other then one intended for the a100? Being rooted but limited is probably due to missing or bad busy box installation.
Tapatalked from my A100 - Kuroikaze B3

i used an update zip for what i believed to be a stock ics rom and i rooted with a method that was intended for the a100:
Download the su binary from here.
Hook your device to the computer via USB cable.
Copy the su binary file to /mnt/sdcard/ on your tablet.
Open a command prompt on your Windows computer.
Change directory to where ADB is located. (This is usually the /tools or /platform-tools directory inside the Android SDK installation directory.)
Type in the following commands at the terminal (press Enter after each command):
adb shell /system/bin/cmdclient ec_micswitch ‘`mount -o remount,rw /system`’
adb shell /system/bin/cmdclient ec_micswitch ‘`cat /mnt/sdcard/su >/system/xbin/su`’
adb shell /system/bin/cmdclient ec_micswitch ‘`chmod 6755 /system/xbin/su`’
Install the Superuser app from the Android Market.
i used this method but i used terminal emulator on my tablet i didn't use adb
here is the update zip i used for ics- this is the error i get trying to attach the zip file:
The connection was reset
The connection to the server was reset while the page was loading.
The site could be temporarily unavailable or too busy. Try again in a few
moments.
If you are unable to load any pages, check your computer's network
connection.
If your computer or network is protected by a firewall or proxy, make sure
that Firefox is permitted to access the Web.

Use the script as intended. From the PC. If you go running them on the tab itself you may have missed one somewhere.
You can't attach a file that large to a post.
Tapatalked from my Galaxy S II.

when i enter the first shell command it denies me and asks me if i am root......

ilovemywife269 said:
when i enter the first shell command it denies me and asks me if i am root......
Click to expand...
Click to collapse
http://forum.xda-developers.com/showthread.php?p=23285307
Use this method.
Tapatalked from my Galaxy S II.

i tried both ics rooting methods both of which told me they achieved root however i am still denied permission to remount

with my moto phones i've always been able to flash back to stock.....or flash back to life anyways is there a way to flash this tablet?

[HOW-TO] [GSM & CDMA] How to root without unlocking bootloader (for ITL41D to JRO03O)

[HOW-TO] [GSM & CDMA] How to root without unlocking bootloader (for ITL41D to JRO03O)
As of Oct 10, 2012: Google has patched this vulnerability starting with JRO03U. That is to say, this works on versions of ICS and JB from ITL41D to JRO03O inclusive. It will not work for JRO03U or newer. (My previous guide found here only worked on Android versions 4.0.1 and 4.0.2, i.e., ITL41D/F and ICL53F.
Once you have root, you can use segv11's BootUnlocker app to unlock your bootloader without wiping anything. Easy as pie!
Disclaimer: I take no credit for this exploit or the implementation of it. All credit goes to Bin4ry and his team. I just isolated the parts required for the GNex, modified it slightly and eliminated the script.
So, it looks like Bin4ry (with the help of a couple of others) has managed to find a way to exploit a timing difference in the "adb restore" command. See source here. (Although this may be old news to some, I hadn't seen it before a few days ago.) This is more for informational purposes, as having a Nexus device, we are able to backup our data, unlock the bootloader and restore the backup, so this is guide is not really that useful for most, but you still have those users who are scared to unlock their bootloader. It is useful however, for those with a broken power button, as it allows them to unlock their bootloader without the power button.
How this works
The way this works is as follows: the "adb restore" command needs to be able to write to /data to restore a backup. Because of this, we can find a way to write something to /data while this is being done. Now, Android parses a file called /data/local.prop on boot. If the following line exists in local.prop, it will boot your device in emulator mode with root shell access: ro.kernel.qemu=1. So, if we can place a file called local.prop with the aforementioned line in /data, once your device boots, it will boot in emulator mode and the shell user has root access, so we now can mount the system partition as r/w.
So what does this all mean:
You can now root any version of ICS and JB released to-date without having to unlock your bootloader (and without losing your data).
Moreover, you should now be able to root your device even if your hardware buttons are not working.
Additionally, this allows those who have not received an OTA update and want to apply it without having an unlocked bootloader or root to do so by copying the OTA update to /cache from /sdcard.
Notes:
1) Please read the entire post before attempting this.
2) This does not wipe any of your data, but I take no responsibility if something happens and you lose your data. Maybe consider doing a backup as per this thread before attempting this.
3) This assumes that you have USB Debugging enable on your device (Settings > Developer Options > Enable USB Debugging) and the drivers for your device installed on your computer. For the drivers, I would recommend you remove all old drivers and install these. If you don't know how to install them, or are having issues, look here.
4) This obviously needs to be done over ADB, as you cannot run adb in a terminal emulator on-device. If you do not have ADB, I've attached it in the zip (Windows and Linux versions). Unzip all files.
Step-by-step:
1) Download the attached files to your computer and unzip them;
2) Open a command prompt in that same directory;
3) Copy the root files to your device:
adb push su /data/local/tmp/su
adb push Superuser.apk /data/local/tmp/Superuser.apk
4) Restore the fake "backup": adb restore fakebackup.ab Note: do not click restore on your device. Just enter the command into the command prompt on your PC and press the enter key.
5) Run the "exploit": adb shell "while ! ln -s /data/local.prop /data/data/com.android.settings/a/file99; do :; done" Note: when you enter this command, you should see your adb window flooded with errors -- this is what is supposed to happen.
6) Now that the "exploit" is running, click restore on your device.
7) Once it finishes, reboot your device: adb reboot Note: Do not try and use your device when it reboots. Running this exploit will reboot your device into emulator mode, so it will be laggy and the screen will flicker -- this is normal.
8) Once it is rebooted, open a shell: adb shell
Note: Once you do step 8, your should have a root shell, i.e., your prompt should be #, not $. If not, it did not work. Start again from step 4. (It may take a few tries for it to work. Thanks segv11.)
Now we can copy su and Superuser.apk to the correct spots to give us root.
9) Mount the system partition as r/w: mount -o remount,rw -t ext4 /dev/block/mmcblk0p1 /system
10) Copy su to /system: cat /data/local/tmp/su > /system/bin/su
11) Change permissions on su: chmod 06755 /system/bin/su
12) Symlink su to /xbin/su: ln -s /system/bin/su /system/xbin/su
13) Copy Superuser.apk to /system: cat /data/local/tmp/Superuser.apk > /system/app/Superuser.apk
14) Change permissions on Superuser.apk: chmod 0644 /system/app/Superuser.apk
15) Delete the file that the exploit created: rm /data/local.prop
16) Exit the ADB shell: exit (May have to type exit twice to get back to your command prompt.)
17) Type the following (not sure if this is needed for the GNex, but it shouldn't matter): adb shell "sync; sync; sync;"
18) Reboot: adb reboot
19) Done. You now should have root without having to unlock your bootloader. If you want to unlock now, you can without wiping anything. See segv11's app linked at the beginning of this post.
Note: If you still do not have root access after doing these steps, redo them and add this step between 10 and 11:
10b) Change the owner of su: chown 0.0 /system/bin/su (Thanks maxrfon.)

I've done all. It installs supersuser app but the phone is not really rooted and apps that requires it doesn't work

Lorenzo_9 said:
I've done all. It installs supersuser app but the phone is not really rooted and apps that requires it doesn't work
Click to expand...
Click to collapse
Did you try opening the Superuser app?
What happens when you open an app that requires root? Do you get the request for su access?

You can open the app but whith apps that requires root there are no requestes and they don't... Even using root checker you see that you're not rooted

Lorenzo_9 said:
You can open the app but whith apps that requires root there are no requestes and they don't... Even using root checker you see that you're not rooted
Click to expand...
Click to collapse
Re-run the entire procedure again (including pushing the su and Superuser.apk files). When I had done it, I used the latest version of su and Superuser.apk, but when I uploaded the files in the attachment in post #1, I used the files that Bin4ry had in his package, which I assume are older. Regardless, re-download the attachment in the first post and try it again.

efrant said:
Re-run the entire procedure again (including pushing the su and Superuser.apk files). When I had done it, I used the latest version of su and Superuser.apk, but when I uploaded the files in the attachment in post #1, I used the files that Bin4ry had in his package, which I assume are older. Regardless, re-download the attachment in the first post and try it again.
Click to expand...
Click to collapse
Ok I'll do it and then I'll report you what happens. So now have you updated su and superuser.apk?

Lorenzo_9 said:
Ok I'll do it and then I'll report you what happens. So now have you updated su and superuser.apk?
Click to expand...
Click to collapse
Yes, I put the latest versions in the zip in the first post.

I can confirm that this works, and also that step 10b was not needed for me. This is the first time I have not used a toolkit so if I can do it, anyone can.
Running a Verizon Galaxy Nexus, this allowed me to update to the leaked Jelly Bean OTA with a locked bootloader. I first flashed stock 4.0.4 and locked the bootloader. I then used the exploit to gain root access, allowing me to apply IMM76Q and JRO03O OTA updates via stock recovery. (Rebooting between updates.) Thank you for creating a guide that this newb could easily understand and follow.

serty4011 said:
I can confirm that this works, and also that step 10b was not needed for me. This is the first time I have not used a toolkit so if I can do it, anyone can.
Running a Verizon Galaxy Nexus, this allowed me to update to the leaked Jelly Bean OTA with a locked bootloader. I first flashed stock 4.0.4 and locked the bootloader. I then used the exploit to gain root access, allowing me to apply IMM76Q and JRO03O OTA updates via stock recovery. (Rebooting between updates.) Thank you for creating a guide that this newb could easily understand and follow.
Click to expand...
Click to collapse
Thanks for confirming that step was not needed.

Thanks!
Bookmarked for future reference :good:

does it work on nexus 7 ?

dacc said:
does it work on nexus 7 ?
Click to expand...
Click to collapse
Yes, it should.

thans for quick response

Works fine for my GNex, big thanks! How about putting it into a script for non-advanced users here?

wictor1992 said:
Works fine for my GNex, big thanks! How about putting it into a script for non-advanced users here?
Click to expand...
Click to collapse
Glad you got it working!
As for putting it into a script, I could but I'd rather not. As with most of the guides that I have written up, I purposely do not put things into a script so that people would actually go through all the steps and, by doing so, maybe get an understanding of what they are actually doing, and hopefully learn something in the process. If I would have packaged it up into a script, a lot of the less experienced users would not even try to go through the steps -- they would just use the script, and no one learns anything yet again. See here for some discussion on one-click scripts. Granted, blindly following a step-by-step is not much better, but I have tried to put comments and explanations throughout to facilitate learning. It's about the journey...
P.S.: I would appreciate it if no one else posts a script in this thread.

efrant said:
P.S.: I would appreciate it if no one else posts a script in this thread.
Click to expand...
Click to collapse
can i make a script that just puts in big text "STOP USING TOOLKITS AND 1 CLICKS"

Zepius said:
can i make a script that just puts in big text "STOP USING TOOLKITS AND 1 CLICKS"
Click to expand...
Click to collapse
LOL! Yes, sure, that's one script I don't mind being posted. LOL!

Heh, fair enough. I think I'm learning a bit about adb
One question: I can't replace system APKs by installing them, it tells me that there is a signature conflict. How can I fix that? I thought it shouldn't happen after rooting. (I'm trying to install the "international" velvet.apk).

wictor1992 said:
Heh, fair enough. I think I'm learning a bit about adb
One question: I can't replace system APKs by installing them, it tells me that there is a signature conflict. How can I fix that? I thought it shouldn't happen after rooting. (I'm trying to install the "international" velvet.apk).
Click to expand...
Click to collapse
Let's try to keep this thread on-topic please.
But to answer your question, don't install the apk. Using a file explorer that has root access, copy it to /system/app (after making sure that system is r/w) and make sure the permissions are set to match the other apks in that directory.

when running adb after running the command where i tell it to restore fake restore and then while the "exploit" is running ikeep getting , in cmd, link failed, no such file or directory, and it just keep doing that. is this normal or did i do something wrong.
efrant said:
Let's try to keep this thread on-topic please.
But to answer your question, don't install the apk. Using a file explorer that has root access, copy it to /system/app (after making sure that system is r/w) and make sure the permissions are set to match the other apks in that directory.
Click to expand...
Click to collapse

[UNIVERSAL GUIDE] Root Any Android Device Manually !

THIS GUIDE NO LONGER WORKS BECAUSE ANDROID ISN'T WHAT IT USED TO BE BACK IN 2013-14.
PLEASE STOP WASTING TIME TO FOLLOW THIS OBSOLETE METHOD 1. PLEASE REFER ONLY TO METHOD 3​
The Ultimate Guide to Rooting any Android Device Manually !!!!​
Wanting to ROOT Your Phone but can't do Because Of No rooting Guides or want to learn to root any device ? Then , This Guide Is For YOU
OK So lets start....
**What You Need**
1.Your Unrooted Android Device.
2.ADB Drivers Installed On Your PC. If you Don't Have Download From Here :
Code:
adbdriver.com/‎
3. The Most Inportant Root Kit Made By Me (N'ayam Amarsh'e) - Download From The Attachment.
4.Strength And Courage 'Coz Rooting Voids Your Warranty... If You have a samsung device then Don't Worry Your warranty is gone forever... But if you own any other, maybe you can void it or maybe......
I've Written Android Device as ADV to make it more easy....
**Steps**
So you have the adb drivers installed let's go....
1. Open The root kit by Extracting The Rootkit with WinRAR....
2.Turn 'USB DEBUGGING' 'ON' in your ADV...
3. Connect your ADV to Your PC...
4.In the root kit Open Cmd.exe File ... [ IF YOU CAN'T OPEN CMD, GOTO C:/WINDOWS/SYSTEM32/ COPY CMD .EXE TO YOUR ROOTKIT FOLDER]
5. In CMD window Type the following command...
Code:
->adb devices *Your device will get listed in the window if it doesn't check your adb drivers or if you have followed the steps properly...
->adb push busybox /data/local/tmp
->adb push su /data/local/tmp
->adb push Superuser.apk /data/local/tmp
If you Succeed Move On ...
6.Then You need Root Shell Type :
Code:
adb shell
Note that you see a "$" sign in the command prompt. That means you are not in 'su' shell.
7.Next run the following commands in the shell to change permissions and get some limited privileges for the Superuser files:
Code:
->chmod 6755 /data/local/tmp/su
->chmod 755 /data/local/tmp/busybox
->chmod 644 /data/local/tmp/Superuser.apk
{Note}The names of the files are case sensitive!
8.Done ? Now You need to open a copy of linux which has nautilus... So enter your linux (I recommend using ubuntu 11.4) and type in the terminal (ctrl+alt+T)
Code:
->sudo nautilus
this will open nautilus with root privileges...
You can just boot it from USB so no hassle of installing it... http://www.cyberciti.biz/tips/download-ubuntu-linux-11-04-iso-cd-dvd-images-natty-narwhal.html
Having your ADV connected with USB to PC switch it off and put it in download/recovery mode...
superlouro said:
DEVICE OFFLINE?
! SOLUTION ! (click me)
Click to expand...
Click to collapse
9.In The Exploring Window navigate to
Code:
/data/local/tmp
and move/cut 'su' and 'busybox' to
Code:
/system/bin
...
10.From the tmp Folder you went earlier Move/cut 'Superuser.apk' to
Code:
/system/app
11.Now Reboot You ADV ... Congrats ! You're now ROOTED !
Many Users Are Having Problem with This Method, If you can't do the method 1. Try Method 2.
METHOD 2
PLEASE DON'T ASK ME ABOUT THIS METHOD, THIS IS JUST FOR A TRY, MY BROTHER FOUND THIS METHOD TO BE WORKING, I HAVEN'T TRIED IT YET!
This is linux based method, It's quite easy if you follow every step correctly...
You need to download psneuter, https://github.com/tmzt/g2root-kmod/tree/master/scotty2/psneuter
When you have it execute the following...
Code:
adb devices
Code:
adb push psneuter /data/local/tmp
This will copy the file to your device and now we'll execute it..
Code:
adb shell
cd /data/local/tmp
chmod 777 psneuter
./psneuter
Now You'll see
Code:
adb kill-server
adb devices
adb shell
now # will appear in place of $, or after typing $su.
Code:
# mount -o remount,rw -t rfs /dev/block/st19/system
# exit
$ adb push busybox /system/bin
$ adb push su /system/bin
$ adb install Superuser.apk
$ adb shell
# chmod 4755 /system/bin/busybox
# chmod 4755 /system/bin/su
# mount -o remount,ro -t rfs /dev/block/st19/system
# exit
$ adb reboot
Now your device will reboot and you can see SuperUser App in your app drawer...
----------------------------------------------------------------------
METHOD 3
There is no chance of the phone not getting rooted with my method but If you don't want to do the above methods, Try these, I'm pretty sure they will root your device with ease...
1. Framroot App [Not On Google Play]-http://forum.xda-developers.com/apps/framaroot/root-framaroot-one-click-apk-to-root-t2130276
2.KingoRoot App - www.kingoapp.com
3.One Click Root Free/Pro (My Favorite app, roots many devices with No-Brick Guarantee) - www.oneclickroot.com
4.Root Master App - forum.xda-developers.com/showthread.php?t=2672150
5.z4root App - http://forum.xda-developers.com/showthread.php?t=833953
6.Easy rooting toolkit App-http://forum.xda-developers.com/showthread.php?t=1321582
7.Vroot Software - http://vrootdownload.info/ or http://www.mgyun.com/en/getvroot
8.SRSRoot Software - http://www.srsroot.com
9.Unlock Root Software - http://www.unlockroot.com/download.html
10.Universal Androot App - forum.xda-developers.com/attachment.php?attachmentid=391774
ONLY FOR MTK DEVICES- MTK DROID TOOLS- http://forum.gsmhosting.com/vbb/f60...3-2014-imei-repair-rooting-tool-more-1780568/
HOPE THESE WILL DO....
Press Thanks To appreciate me to Work On Other Guides And Roms....
Your Appreciation Is Needed...
And This GUIDE IS Originally By N'ayam Amarsh'e

I have any error. Device is offline.
---------- Post added at 09:13 AM ---------- Previous post was at 09:02 AM ----------
uukasz92 said:
I have any error. Device is offline.
Click to expand...
Click to collapse
Problem solved i download another adb drivers and work fine

In /UserData/local/tmp i only have one file "directory" and nothing else. It's look like something block the data folder.

uukasz92 said:
In /UserData/local/tmp i only have one file "directory" and nothing else. It's look like something block the data folder.
Click to expand...
Click to collapse
that means you have not properly pushed the files into the directory.... Try installing adb drivers again and do the same steps...Good luck
When you open cmd just type ' adb devices' if your device gets listed then you can start if it doesn't check your drivers...

After uinstall all adb drivers and phone drivers comand prompt shows me a device code and status ofline. At the begining i install atached to therad package of adb drivers. But lately some where in Internet I find some update package of adb drivers. And there was the same sort of files like in your package. I put them there and replace and after that adb shows the device is working and status is online but your guide still does not work. Question is where is real problem ? I checked and Debug Mod is on, drivers are installed.

Try this , download android commander and try to copy the busybox , su and superuser to data/local/tmp

N'ayam Amarsh'e said:
Try this , download android commander and try to copy the busybox , su and superuser to data/local/tmp
Sent from my Mi-492 using xda app-developers app
Click to expand...
Click to collapse
I used the same files in android commander because program can't finde my device to.

Which phone you have.... Try to download its original drivers this might help...

I using Samsung Galaxy Grand Neo (GT-I9060) Jelly Bean 4.2.2
Now is working. But how to move "su" and busybox into system/bin ? Android commander says " You need root to do this." when i try to copy does files into system/bin. Folders are protected and I dont have premission to do anything with them.

uukasz92 said:
I using Samsung Galaxy Grand Neo (GT-I9060) Jelly Bean 4.2.2
Now is working. But how to move "su" and busybox into system/bin ? Android commander says " You need root to do this." when i try to copy does files into system/bin. Folders are protected and I dont have premission to do anything with them.
Click to expand...
Click to collapse
Sorry I forgot that Android Commander works only for rooted phones... Silly Me...
OK you will need to do it with Droid Explorer
OR
linux and in the linux you'll have to type 'sudo nautilus' it'll open it with root privilages...

N'ayam Amarsh'e said:
Sorry I forgot that Android Commander works only for rooted phones... Silly Me...
OK you will need to do it with Droid Explorer
OR
linux and in the linux you'll have to type 'sudo nautilus' it'll open it with root privilages...
Click to expand...
Click to collapse
And in your guide need little correct. In step 9 should be /data/local/tmp not /UserData/local/tmp. Does are two diffrent folders. And before I think I do something wrong when all files be already on right place

Droid Explorer cant change folders premission too. Command prompt says : Read-only drirectory. I don't know what to do now.

uukasz92 said:
And in your guide need little correct. In step 9 should be /data/local/tmp not /UserData/local/tmp. Does are two diffrent folders. And before I think I do something wrong when all files be already on right place
Click to expand...
Click to collapse
thanks.... Guide is updated now

Good 1 helped alot

harmeet singh said:
Good 1 helped alot
Click to expand...
Click to collapse
I am happy that I helped....

Hi! First thank you for that guide. I rooted several devices but with a noname(10.1" A10 dual core) china tablet I have some problems so I hope your solution works.
I have some problems/questions:
1. Step 5: Are you sure it's:
Code:
adb push su /data/local/tmp
instead of
adb push su /data/local/tmp[B][SIZE="5"]/[/SIZE][/B]
I'm currently not able to look at the data folder but if I change the directions e.g to /test/local/tmp it just creates a "tmp" file and overwrites the file with every push command.
2. Step 6: If it's a $ it's not rootet, what should be there if it's rooted? I have a # there. Rootchecker says it's rooted since the beginning, but I cant access with superuser/supersu etc.
3. Step 8 doesn't work. I use a virtual box with ubuntu 13.10(Stinson: new is always better?) for the first time. With "sudo nautilus" I get the message that root access is not granted(failed to register client). I used "gksudo nautilus" instead... does that matter?
4. I can't connect my device to the virtual box. I tried to add the usb device but didn't work. USB Developer Android[0223] is in virtual box connected. However, I dont know where to find it in ubuntu. I'm a ubuntu noob sorry :/
5. Is there another way to get rw permissions?
Thanks in advance :good:

thankyou for information i think is hard for me

Very nice, ty

Humbel said:
Hi! First thank you for that guide. I rooted several devices but with a noname(10.1" A10 dual core) china tablet I have some problems so I hope your solution works.
I have some problems/questions:
1. Step 5: Are you sure it's:
Code:
adb push su /data/local/tmp
instead of
adb push su /data/local/tmp[B][SIZE="5"]/[/SIZE][/B]
I'm currently not able to look at the data folder but if I change the directions e.g to /test/local/tmp it just creates a "tmp" file and overwrites the file with every push command.
2. Step 6: If it's a $ it's not rootet, what should be there if it's rooted? I have a # there. Rootchecker says it's rooted since the beginning, but I cant access with superuser/supersu etc.
3. Step 8 doesn't work. I use a virtual box with ubuntu 13.10(Stinson: new is always better?) for the first time. With "sudo nautilus" I get the message that root access is not granted(failed to register client). I used "gksudo nautilus" instead... does that matter?
4. I can't connect my device to the virtual box. I tried to add the usb device but didn't work. USB Developer Android[0223] is in virtual box connected. However, I dont know where to find it in ubuntu. I'm a ubuntu noob sorry :/
5. Is there another way to get rw permissions?
Thanks in advance :good:
Click to expand...
Click to collapse
For Your First Answer You Need not to worry /tmp and /tmp/ are the same...
2.Have you tried typing 'adb shell' then ' su ' if yes there's your solution.... If not then you have problem with su binary or busybox....
3.You have an Ubuntu 11.4 .iso file so burn it to a blank disk and boot your live disk .... It should be all right then...
4.Answer in 3....
5.Answer in 3....
6.Press Thanks if I helped...

bro im confused wt to do exactly in that sudo ... step pls give a brief explaination