[HOWTO] Root Nexus One 2.2.1 FRG83D without OEM unlock - Nexus One Q&A, Help & Troubleshooting

This guide is for people who want root but want to keep their stock rom, not breaking the warranty, unlocking bootloader etc.
A proud ubuntu user, I am writing this in a new thread purely because the manual rageagainstthecage method and SuperOneClick method did not not work for me, see link to my conclusion below if you care
http://forum.xda-developers.com/showpost.php?p=11305312&postcount=2526
What did work however was via adb shell using psneuter and its fairly simple if you follow the following commands.
This guide assumes you know how to get access to the shell via adb, if you dont then search elsewhere for a useful guide
OK lets get to business!
1. Download the attached nexus_one_softroot.tar from the bottom of this post and extract contents to the same folder as adb
2. Open up your terminal, cd to the same folder as adb and the extracted files
3. Enter the following commands:
Code:
sudo ./adb push psneuter /data/local/tmp/psneuter
sudo ./adb push busybox /data/local/tmp/busybox
sudo ./adb push su /data/local/tmp/su
sudo ./adb shell chmod 755 /data/local/tmp/psneuter
sudo ./adb shell chmod 755 /data/local/tmp/busybox
sudo ./adb shell chmod 755 /data/local/tmp/su
sudo ./adb shell
After this you should see only a $ which tells us that we at the android command line with user privileges only, lets continue
Code:
$ cd /data/local/tmp
$ ls
busybox
su
psneuter
$ ./psneuter
property service neutered.
killing adbd. (should restart in a second or two)
You will now be kicked out of android shell, lets go back in
Code:
sudo ./adb shell
After this you should see only a # which tells us that we root baby! If you want to double check issue this command
Code:
# id
uid=0(root) gid=0(root)
Lets continue on. From this point we will install busybox and su which will make root permanent
Code:
# mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
# cd /data/local/tmp
# ./busybox cp busybox /system/bin
# chmod 4755 /system/bin/busybox
# busybox cp su /system/bin
# chmod 4755 /system/bin/su
# exit
For some reason I sometimes have to enter exit twice to leave the android shell. Again, re-access the android shell
Code:
sudo ./adb shell
Now in the android shell we can finish up
Code:
# su
# mount -o remount,ro -t yaffs2 /dev/block/mtdblock3 /system
# exit
# exit
Lastly we must install Superuser, and I did this from the android market so I knew its the latest version, its simple to get, less command input etc.
Now you have root! I hope this was simple enough to follow, I have not really written a guide before but from lots of searching I just could not find a solution for my Nexus One 2.2.1 FRG83D, especially any guide that uses psneuter.
Anyway, glad to contribute
EDIT - also, being new to starting threads, this may not quite be in the right section of the forum, sorry if thats the case mods

Added link to the thread from Wiki.

upgraded to gingerbread 2.3.3. after copying and setting permissions, got this:
PHP:
$ cd /data/local/tmp
$ ls -l
-rwxr-xr-x shell shell 26248 2010-07-22 10:20 su
-rwxr-xr-x shell shell 1062992 2010-10-16 22:29 busybox
-rwxr-xr-x shell shell 585731 2011-01-08 18:02 psneuter
su
busybox
psneuter
$ ./psneuter
Failed to set prot mask (Inappropriate ioctl for device)
second time threw me out of shell. again adb shell gives this:
PHP:
$ id
uid=2000(shell) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1009(mount),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet)

mfkr said:
upgraded to gingerbread 2.3.3. after copying and setting permissions, got this:
Code:
$ ./psneuter
Failed to set prot mask (Inappropriate ioctl for device)
Click to expand...
Click to collapse
I believe this is due to a change in the kernel as it is upgraded into gingerbread, the input/output controls have changed, leaving psneuter out of date with the current kernel.
However if an exploit is found with the kernel used in 2.3.3, you can use it in place of psneuter with the above method.

Related

noob guide for noob like me....

anyone kind enough to make a complete step by step noob guide on rooting, installing the SU and custom boot.img..... cause im lost in installing the SU and the custom boot img....thanks in advance for the guide.....
see here
http://www.androidworld.it/wiki/Root_HTC_Tattoo
can it be in english???
shazarul said:
can it be in english???
Click to expand...
Click to collapse
Hi,
see #237 post of the page 24 of this thread for what you want:
http://forum.xda-developers.com/showthread.php?t=635961
You need to collect the files: m7 at page 1, tattoo-hack.ko at page 23, and su at page 23. Just follow the sequence of #237.
Note that if you haven't pushed "su" to /data/local/bin, you can only execute the
Code:
while do /data/local/bin/m7 ; done
for first rooting, otherwise
Code:
/data/local/bin/su
At the first time to root it, you need to push the files to /data/local/bin, like:
Code:
----------- Your machine ----------------------------
adb push m7 /data/local/bin
adb push tattoo-hack.ko /data/local/bin
----------- Android Shell ----------------------------
adb shell
chmod 755 /data/local/bin/m7
while do /data/local/bin/m7 ; done
(find your first character of shell changing from $ to #, got root already.)
----------- Your machine ----------------------------
adb push su /data/local/bin/su
adb push su /sdcard
----------- Android Shell ----------------------------
export LD_LIBRARY_PATH=/system/lib
export PATH=/system/bin
mount -o rw,remount /dev/block/mtdblock3 /data
chown root.root /data/local/bin/su
chmod 4755 /data/local/bin/su
(and run the #237 procedure from step 7, insmod tattoo-hack.ko ......)
After the first time rooting, you can just type "su" to enter root again. If not, you need to do the #237 procedure from step 1 to last.
thanks guys for the help.....finally root my fone.....

[Q] Problem with ADB and Removing Apps

I'm not new to coding per se, I'm a web designer and developer and most of this makes complete sense to me, but I'm not sure what I'm doing wrong here. I have decided I want to learn more by customizing the stock .5 RUU rom (reverted back from .6). So I am working on removing the stock Sprint apps at the moment. I rooted via UnrEVOked one-touch. I am running ROM Manager with the ClockWorkMod Recovery Image.
Here's my setup. I'm running Parallels on my Macbook with Windows XP. I added android-sdk-windows to my C:\ drive and started into the ADB. (I do have SU permission). I have USB Debugging running and I'm in Charge Only Mode.
Code:
C:\android-sdk-windows\tools>adb shell
$ su
su
[B]mount -o rw,remount Permission denied[/B]
$ # mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system
# mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system
$ cd system/app
cd system/app
$ ls
[Returns the long list of System Apps that are installed ]
$ # rm amazonmp3.apk
# rm amazonmp3.apk
$ exit
C:\android-sdk-windows\tools> exit
This is just an test, trying to remove the amazonmp3.apk. I reboot into recovery and reboot the system from there, but the app isn't removed. I've highlighted the possible "problem" commands. - The "Permission denied" error is automatic, I don't get to finish writing the remount code before it automatically gives me the "denied" error
Any ideas on what I'm doing wrong? I've read that the UnrEVOked app doesn't give you full root access, is this correct?
When in tools directory type
Adb remount
Adb shell
Rm (app name).apk /system/app
or if you removing several apps you may want to cd into the app dir
Code:
adb remount
adb shell
cd /system/app
rm amazonmp3.apk
yeah, I think that the UnrEVOked one-touch just doesn't cut it because I get Permission denied on the "adb remount" command
getting this:
Code:
adb shell
$ cd /system/app
cd /system/app
rm amazonmp3.apk
rm failed for amazonmp3.apk, Read-only file system
TexasTerp said:
getting this:
Code:
adb shell
$ cd /system/app
cd /system/app
rm amazonmp3.apk
rm failed for amazonmp3.apk, Read-only file system
Click to expand...
Click to collapse
Not really sure cause I've never used that method of rooting. Try using the regaw version found in the android Dev forum

Rooting/unlocking Nexus One with broken power button using Linux terminal tools

I am attempting to get Cyanogenmod onto my Nexus One, but am running into far more problems than expected. The information on rooting Android devices seems heavily fragmented across the web and the tools unreliable. At least in my case, SuperOneClick has proven a complete misnomer. So I'd like to go back to basics - executing as many of the commands as possible from a Linux terminal to get the phone rooted/unlocked/whatever else has to happen to get Cyanogenmod installed. The two constraints I'm working with here are as follows:
1. The device is running Android 2.2.1 (I downgraded from 2.3.x using the PASSIMG method).
2. The power button on the device is broken, so any method which requires pressing/holding it is ruled out.
The problem I am having is that even after following Linux-centric guides, I get to the point of installing the SuperUser app followed by the ROM Manager app, but I'm never prompted to give ROM Manager superuser permissions and so can't flash the ClockworkMod recovery.
Below I describe the steps I've been taking so far, based on the "How To Root Nexus One Running Android 2.2.1 From Ubuntu Linux" guide (Google it, I can't post hyperlinks).
- Download/extract/move Nexus One Softroot files to same directory as adb
- From adb directory, execute the following commands:
sudo ./adb push psneuter /data/local/tmp/psneuter
sudo ./adb push busybox /data/local/tmp/busybox
sudo ./adb push su /data/local/tmp/su
sudo ./adb shell chmod 755 /data/local/tmp/psneuter
sudo ./adb shell chmod 755 /data/local/tmp/busybox
sudo ./adb shell chmod 755 /data/local/tmp/su
sudo ./adb shell cd /data/local/tmp ./psneuter
sudo ./adb shell
After executing sudo ./adb shell as above, I get the # prompt, which is purported to indicate that rooting was successful.
- Still following the guide, I then execute the commands which purportedly make root permanent:
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
cd /data/local/tmp
./busybox cp busybox /system/bin
chmod 4755 /system/bin/busybox
busybox cp su /system/bin
chmod 4755 /system/bin/su
exit
exit
- Again, still following the guide, I execute the commands which purportedly set the /system partition back to read-only:
sudo ./adb shell
su
mount -o remount,ro -t yaffs2 /dev/block/mtdblock3 /system
exit
exit
- Now, I download the SuperUser app from the Android Market and open it to make sure it's running.
- Next, I download the ROM Manager app from Google Play (looks like it pulled a sneaky and upgraded from Android Market to Google Play here).
- I run ROM Manager and choose Flash ClockworkMod Recovery. I'm prompted to confirm the phone is a Google Nexus One and then ROM Manager runs for about 30 seconds (yellow program bar goes all the way) before spitting out An error occurred while attempting to run privileged commands!. And this is the point I am stuck at.
I should note that at no point am I prompted by the SuperUser app to give the ROM Manager app super user permissions. I don't restart the phone or do anything else throughout all of the steps I've described above, so I can't see any reason for root to have been lost at any point. In fact, if I execute the command sudo ./adb shell after all this, I still get the # prompt indicating root. And when I execute id afterwards, I get uid=0(root) gid=0(root) -- further confirmation of root. I really am stuck on this one. I've spent a lot of time digging through forum posts and online articles, but the signal to noise ratio is poor and I haven't been able to find anything that actually works. Can someone suggest where I am going wrong?
Programs might expect su to be in /system/xbin rather than /system/bin, which is probably your case.
Also, use SuperSU instead of Superuser.
Also, make sure the su you're using is matching the relevant control program - which means, downloading Superuser from the Play Store won't help, if it can't work with the binary you have. So download a complete ZIP from XDA with SuperSU.apk and su binary, and use those. The last version I used was 0.89 and it was on XDA just like I described above.
interesting problem with ez fix, get new phone. n1's are $100 on ebay, thats how i got mine.

[HOWTO] Installing Superuser/busybox for Mac

Device is pre-rooted, but only lets you do stuff via terminal. I didn't find a way to install Superuser/busybox on Mac, so I decided to make a simple guide. Took me all of 3min to complete, well since I already had the sdk and everything else installed.
You'll need this Superuser.apk, su binary and busybox.apk, dL the files from here http://d-h.st/BBk, once you have the files installed and launch Superuser it will ask you to update the binary, just click yes. Place the 3 files in your sdk/platform-tools folder.
Open Terminal cd sdk/platform-tools
On your Desktop go to Go…Go to Folder and type ~/.android, open adb_usb.ini and add 0x2836 to that file, save and close.
To verify it's listed:
./adb kill-server
echo 0x2836
./adb start-server
./adb devices
Your device should be listed here. If you want wireless adb access so you're not always hooked up to the console do the following, make sure your device is still connected via usb:
./adb tcpip 5555
unplug console
./adb connect xxx.xxx.xxx.xxx (this is the ip of your console, this is listed under manage…system…console info, should be the second line)
You're set, now you can install apps wirelessly to your OUYA console. You need to make the console read/write to do this do the following
./adb shell
su
mount -o rw,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/APP
mount -o rw,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/UDA
mount -o rw,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/CAC
Now we will install su binary, superuser and busybox
./adb push su/system/bin/su /sdcard/su
./adb shell
su
cat /sdcard/su > /system/xbin/su
ln -s /system/xbin/su /system/bin/su
chmod 6755 /system/xbin/su
exit
exit
./adb install com.koushikdutta.superuser.apk
./adb install stericson.busybox.apk
Should be up and running, if this helped you please thank me or donate a couple bucks
You rock!
I was at this for a while before I found your post. I'm on windows, but this is the only thread I could find that had anything useful Mind if I share this around on other forums?
Just link them back, steps are almost identical for Windows. Just need to remove the ./ from the adb commands
Sent from my HTC One using Tapatalk 4 Beta
WinDroidGuy said:
Device is pre-rooted, but only lets you do stuff via terminal. I didn't find a way to install Superuser/busybox on Mac, so I decided to make a simple guide. Took me all of 3min to complete, well since I already had the sdk and everything else installed.
You'll need this Superuser.apk, su binary and busybox.apk, dL the files from here http://d-h.st/BBk, once you have the files installed and launch Superuser it will ask you to update the binary, just click yes. Place the 3 files in your sdk/platform-tools folder.
Open Terminal cd sdk/platform-tools
On your Desktop go to Go…Go to Folder and type ~/.android, open adb_usb.ini and add 0x2836 to that file, save and close.
To verify it's listed:
./adb kill-server
echo 0x2836
./adb start-server
./adb devices
Your device should be listed here. If you want wireless adb access so you're not always hooked up to the console do the following, make sure your device is still connected via usb:
./adb tcpip 5555
unplug console
./adb connect xxx.xxx.xxx.xxx (this is the ip of your console, this is listed under manage…system…console info, should be the second line)
You're set, now you can install apps wirelessly to your OUYA console. You need to make the console read/write to do this do the following
./adb shell
su
mount -o rw,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/APP
mount -o rw,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/UDA
mount -o rw,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/CAC
Now we will install su binary, superuser and busybox
./adb push su/system/bin/su /sdcard/su
./adb shell
su
cat /sdcard/su > /system/bin/su
cat /sdcard/su > /system/xbin/su
exit
exit
./adb install com.koushikdutta.superuser.apk
./adb install stericson.busybox.apk
Should be up and running, if this helped you please thank me or donate a couple bucks
Click to expand...
Click to collapse
It's pure luck that this works. There's several things wrong with it.
There's no reason to have two copies of su. There should only be one, and at most have the other be a symlink.
the su binary should be chmodded '6755'.
It works because piping the contents of a file to another file usually leaves the permissions intact. So, sort of works - it leaves a broken copy of su in /system/bin and a luckily working one in /system/xbin.
So, tl;dr, the guide should be:
Code:
./adb push su/system/bin/su /sdcard/su
./adb shell
su
cat /sdcard/su > /system/xbin/su
ln -s /system/xbin/su /system/bin/su
chmod 6755 /system/xbin/su
exit
exit
./adb install com.koushikdutta.superuser.apk
rayman said:
It's pure luck that this works. There's several things wrong with it.
There's no reason to have two copies of su. There should only be one, and at most have the other be a symlink.
the su binary should be chmodded '6755'.
It works because piping the contents of a file to another file usually leaves the permissions intact. So, sort of works - it leaves a broken copy of su in /system/bin and a luckily working one in /system/xbin.
So, tl;dr, the guide should be:
Code:
./adb push su/system/bin/su /sdcard/su
./adb shell
su
cat /sdcard/su > /system/xbin/su
ln -s /system/xbin/su /system/bin/su
chmod 6755 /system/xbin/su
exit
exit
./adb install com.koushikdutta.superuser.apk
Click to expand...
Click to collapse
Thanks, this was my first time doing anything like this...figured I'd try to hack together something from other guides, since I didn't see very many people with the device yet. I will change it now
WinDroidGuy said:
mount -o rw,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/UDA
mount -o rw,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/CAC
Click to expand...
Click to collapse
This is really pointless, userdata is already RW, cache should be RW, but more importantly you do nothing that would require them to be remounted
I'm not sure what I am doing wrong here. Can anyone help? All the files are there.
TadeoNYC said:
I'm not sure what I am doing wrong here. Can anyone help? All the files are there.
Click to expand...
Click to collapse
The command should be "adb push su /sdcard/su" (pushing su to the sdcard).
Setup wired and/or wireless ADB
(Optional) Put adb.exe in your Windows PATH variable so you can run it from anywhere
Download and unzip the SuperUser files from http://d-h.st/BBk
Open an ADB shell with elevated permissions
Code:
adb shell
su
Mount the system partition as read-write
Code:
mount -o rw,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/APP
Exit the ADB shell
Code:
exit
exit
or CTRL + C
Push su to the sdcard
Code:
adb push su /sdcard/su
Open an ADB shell with elevated permissions
Code:
adb shell
su
Cat su into /system/xbin
Code:
cat /sdcard/su > /system/xbin/su
Create a symbolic link to su in /system/xbin from /system/bin (safer/cleaner than just putting su directly in the bin folder)
Code:
ln -s /system/xbin/su /system/bin/su
Set the su permissions to -rwsr-sr-x
Code:
chmod 6755 /system/xbin/su
Exit the ADB shell
Code:
exit
exit
or CTRL + C
Install SuperUser
Code:
adb install com.koushikdutta.superuser.apk
Install BusyBox
Code:
adb install stericson.busybox.apk
Run SuperUser on the OUYA (Make > Software > SuperUser) and allow it to update
Thank you Elmero.
I'm so glad I gave up and went to bed last night. It could not have gone smoother. I followed the instructions for setting up wireless adb from here http://forum.xda-developers.com/showthread.php?t=2272266 as well.
TIP: I wasted an hour or more trying to figure out why PC was not recognizing the OUYA at all. It was the stupid Micro usb port, compunding the fact that all the ports are to close to begin with the micro usb port is very deep. Neither of my Samsung cables worked, fortunately I have a kodak pocket video cam and the cable for that is a few mm longer and worked perfectly.
And who said Kodac isn't relevant anymore?
Sent from my Nexus 7 using xda premium
The link to the Superuser.apk is not working.
pdelponte said:
The link to the Superuser.apk is not working.
Click to expand...
Click to collapse
Working fine for me...
Sent from my HTC One using Tapatalk 4 Beta
WinDroidGuy said:
Working fine for me...
Sent from my HTC One using Tapatalk 4 Beta
Click to expand...
Click to collapse
Not working for me either.
This webpage is not available
The webpage at http://fs1.d-h.st/download/00044/BBk/superuser.zip might be temporarily down or it may have moved permanently to a new web address.
Click to expand...
Click to collapse
There is an issue with the website. Just try back until it connects.
Sent from my GT-P3113 using Tapatalk 2
just to be clear. once its rooted, can i install any android apk to the console? the one that i've bought from android play market?
tanush said:
just to be clear. once its rooted, can i install any android apk to the console? the one that i've bought from android play market?
Click to expand...
Click to collapse
1) It's already rooted.
2) You can already sideload anything you want to it, same as (almost) any android device, whether it is rooted or not. (http://forum.xda-developers.com/showpost.php?p=41796467&postcount=11)
elmerohueso said:
The command should be "adb push su /sdcard/su" (pushing su to the sdcard).
Setup wired and/or wireless ADB
(Optional) Put adb.exe in your Windows PATH variable so you can run it from anywhere
Download and unzip the SuperUser files from http://d-h.st/BBk
Open an ADB shell with elevated permissions
Code:
adb shell
su
Mount the system partition as read-write
Code:
mount -o rw,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/APP
Exit the ADB shell
Code:
exit
exit
or CTRL + C
Push su to the sdcard
Code:
adb push su /sdcard/su
Open an ADB shell with elevated permissions
Code:
adb shell
su
Cat su into /system/xbin
Code:
cat /sdcard/su > /system/xbin/su
Create a symbolic link to su in /system/xbin from /system/bin (safer/cleaner than just putting su directly in the bin folder)
Code:
ln -s /system/xbin/su /system/bin/su
Set the su permissions to -rwsr-sr-x
Code:
chmod 6755 /system/xbin/su
Exit the ADB shell
Code:
exit
exit
or CTRL + C
Install SuperUser
Code:
adb install com.koushikdutta.superuser.apk
Install BusyBox
Code:
adb install stericson.busybox.apk
Run SuperUser on the OUYA (Make > Software > SuperUser) and allow it to update
Click to expand...
Click to collapse
So what steps need to be repeated after the OTA?
from my limited understanding I think it should be steps 4 through 12. Or does the system partition not need to be mounted as read-write again?
Sent from my GT-P3113 using Tapatalk 4 Beta
Yup 4-12
Edit
If su is still on the sdcard you can skip 6-8... wont hurt if you do them though...
Sent from my SAMSUNG-SGH-I337 using xda app-developers app
professorpoptart said:
Yup 4-12
Edit
If su is still on the sdcard you can skip 6-8... wont hurt if you do them though...
Sent from my SAMSUNG-SGH-I337 using xda app-developers app
Click to expand...
Click to collapse
Might be a good idea to do them. The OTA version of such is different from the one in this guide. I had tried keeping the stock su and superuser complained
Sent from my Nexus 7 using xda premium
Do you still have access to the ouya store after SU installed? I heard rumors that access to the store was blocked until root access removed?
Sent from my GT-N7100 using Tapatalk 2

Issue with SuperSU on AndroidThings 1.0

I tried to perform a manual installation of SuperSU (2.82 SR5) on my Raspberry Pi running the developer version of AndroidThings 1.0.4, which is based on Android 8.1.0 / API 27. Rather than flashing the zip in recovery, as I'm not sure where to start with that on the Things platform, I manually pushed files and set file permissions and contexts via adb shell. My guide for this was the summary at the top of the script at SuperSU/META-INF/com/google/android/update-binary.
The new su binary appears to work for the most part. I can execute su and read/write with the interactive shell. However, when I attempt to execute the same operations as a command through su (ie: su -c mkdir /system/testdirectory), it responds saying its a read-only filesystem. The filesystem has been remounted with adb remount. I'm unable to perform the remount with the mount command, as /system is not listed in /proc/filesystems. From my understanding, this is due to some recent security model changes in Android. That being said, after the adb remount, all other normal interactions with the filesystem seem to work without issue. I have verified that selinux is in permissive mode.
I don't have busybox installed. These efforts are to allow for installation of busybox for other projects.
Does anybody know whats causing the commands proxied through su to not work correctly?
Here are the commands I used to perform my manual installation.
Code:
cd ~/Downloads/SuperSU-2.82-SR5
adb connect [IP_ADDRESS]:5555
adb root
adb remount
adb push common/install-recovery.sh /system/etc/install-recovery.sh
adb shell chmod 0755 /system/etc/install-recovery.sh
adb shell chcon u:object_r:toolbox_exec:s0 /system/etc/install-recovery.sh
adb shell ln -s /system/etc/install-recovery.sh /system/bin/install-recovery.sh
adb shell chcon -h u:object_r:toolbox_exec:s0 /system/bin/install-recovery.sh
cd armv7
# adding as `su_next` to prevent any issues before dropping it in
adb push su /system/xbin/su_next
adb shell chmod 0755 /system/xbin/su_next
adb shell chcon u:object_r:system_file:s0 /system/xbin/su_next
adb push su /system/xbin/daemonsu
adb shell chmod 0755 /system/xbin/daemonsu
adb shell chcon u:object_r:system_file:s0 /system/xbin/daemonsu
adb push supolicy /system/xbin/supolicy
adb shell chmod 0755 /system/xbin/supolicy
adb shell chcon u:object_r:system_file:s0 /system/xbin/supolicy
adb push libsupol.so /system/lib/libsupol.so
adb shell chmod 0644 /system/lib/libsupol.so
adb shell chcon u:object_r:system_file:s0 /system/lib/libsupol.so
adb shell cp /system/bin/app_process32 /system/bin/app_process32_original
adb shell cp /system/bin/app_process32 /system/bin/app_process_init
adb shell rm /system/bin/app_process
adb shell ln -s /system/xbin/daemonsu /system/bin/app_process
adb shell rm /system/bin/app_process32
adb shell ln -s /system/xbin/daemonsu /system/bin/app_process32
adb shell chmod 0755 /system/bin/app_process
adb shell chmod 0755 /system/bin/app_process32
adb shell chcon u:object_r:system_file:s0 /system/bin/app_process
adb shell chcon u:object_r:zygote_exec:s0 /system/bin/app_process32
# Swapping new su binary in
adb shell cp /system/xbin/su /system/xbin/su_original
adb shell rm /system/xbin/su
adb shell mv /system/xbin/su_next /system/xbin/su
adb shell /system/xbin/su --install
adb reboot
I need to correct myself: the new su binary can only read with privileges. It cannot write at all. I am only able to write either as the adb root shell, or with the stock su binary. I noticed that the device's adbd process relaunches with its own privileged context passed to it when adb remount is run. (adbd --root_seclabel=u:r:su:s0)
If I've run adb root and adb remount, adb shell, and then enter the su binary, I lose the ability to write to the remounted filesystem. So it appears that there is something wrong with the new su binary and its related files.
Anyway, this isn't critical to my project, so I'm abandoning my efforts for now. If anyone has any ideas on what is wrong here, I'd love to hear them and give this another shot!

Categories

Resources