Hello everybody,
I rooted my dream phone with :
Code:
fastboot boot boot.img
# mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
# cd system
# cd bin
# cat sh > su
# chmod 4755 su
All work fine !
I tried to install busybox like this :
Code:
adb push busybox /data/local/tmp
cat /data/local/tmp/busybox > /system/bin/busybox
chmod 4755 /system/bin/busybox
No problem with this step, but now if I type :
Code:
$su
#busybox ls /data
I have a permission denied
If I type
Code:
$su
#ls /data
all work fine
(ls is an symbolic link to toolbox)
ls -l /system/bin
Code:
-rwsr-xr-x root root 1745016 2009-07-28 11:01 busybox
-rwsr-xr-x root root 86936 2009-07-28 11:11 su
-rwxr-xr-x root shell 68472 2009-03-03 22:31 toolbox
...
I think busybox is not launch with root permission.. why?
I tried : ln -s busybox ls
but same problem !
What is wrong ?
Thanks.
Any particular reason why you setuid busybox? Try chmod 0755 busybox; chown root:shell busybox
This guide is for people who want root but want to keep their stock rom, not breaking the warranty, unlocking bootloader etc.
A proud ubuntu user, I am writing this in a new thread purely because the manual rageagainstthecage method and SuperOneClick method did not not work for me, see link to my conclusion below if you care
http://forum.xda-developers.com/showpost.php?p=11305312&postcount=2526
What did work however was via adb shell using psneuter and its fairly simple if you follow the following commands.
This guide assumes you know how to get access to the shell via adb, if you dont then search elsewhere for a useful guide
OK lets get to business!
1. Download the attached nexus_one_softroot.tar from the bottom of this post and extract contents to the same folder as adb
2. Open up your terminal, cd to the same folder as adb and the extracted files
3. Enter the following commands:
Code:
sudo ./adb push psneuter /data/local/tmp/psneuter
sudo ./adb push busybox /data/local/tmp/busybox
sudo ./adb push su /data/local/tmp/su
sudo ./adb shell chmod 755 /data/local/tmp/psneuter
sudo ./adb shell chmod 755 /data/local/tmp/busybox
sudo ./adb shell chmod 755 /data/local/tmp/su
sudo ./adb shell
After this you should see only a $ which tells us that we at the android command line with user privileges only, lets continue
Code:
$ cd /data/local/tmp
$ ls
busybox
su
psneuter
$ ./psneuter
property service neutered.
killing adbd. (should restart in a second or two)
You will now be kicked out of android shell, lets go back in
Code:
sudo ./adb shell
After this you should see only a # which tells us that we root baby! If you want to double check issue this command
Code:
# id
uid=0(root) gid=0(root)
Lets continue on. From this point we will install busybox and su which will make root permanent
Code:
# mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
# cd /data/local/tmp
# ./busybox cp busybox /system/bin
# chmod 4755 /system/bin/busybox
# busybox cp su /system/bin
# chmod 4755 /system/bin/su
# exit
For some reason I sometimes have to enter exit twice to leave the android shell. Again, re-access the android shell
Code:
sudo ./adb shell
Now in the android shell we can finish up
Code:
# su
# mount -o remount,ro -t yaffs2 /dev/block/mtdblock3 /system
# exit
# exit
Lastly we must install Superuser, and I did this from the android market so I knew its the latest version, its simple to get, less command input etc.
Now you have root! I hope this was simple enough to follow, I have not really written a guide before but from lots of searching I just could not find a solution for my Nexus One 2.2.1 FRG83D, especially any guide that uses psneuter.
Anyway, glad to contribute
EDIT - also, being new to starting threads, this may not quite be in the right section of the forum, sorry if thats the case mods
Added link to the thread from Wiki.
upgraded to gingerbread 2.3.3. after copying and setting permissions, got this:
PHP:
$ cd /data/local/tmp
$ ls -l
-rwxr-xr-x shell shell 26248 2010-07-22 10:20 su
-rwxr-xr-x shell shell 1062992 2010-10-16 22:29 busybox
-rwxr-xr-x shell shell 585731 2011-01-08 18:02 psneuter
su
busybox
psneuter
$ ./psneuter
Failed to set prot mask (Inappropriate ioctl for device)
second time threw me out of shell. again adb shell gives this:
PHP:
$ id
uid=2000(shell) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1009(mount),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet)
mfkr said:
upgraded to gingerbread 2.3.3. after copying and setting permissions, got this:
Code:
$ ./psneuter
Failed to set prot mask (Inappropriate ioctl for device)
Click to expand...
Click to collapse
I believe this is due to a change in the kernel as it is upgraded into gingerbread, the input/output controls have changed, leaving psneuter out of date with the current kernel.
However if an exploit is found with the kernel used in 2.3.3, you can use it in place of psneuter with the above method.
I have an un-rooted device, with Android 5.0 system, and the core is ARM Coretex A53.
I happen to found "adb root" works, that means I can play as root through ADB shell.
I successfully deleted a trash apk, renowned "kingroot", from my system.
Then, I try to manually update su and SuperSu file, through the bellowing commands:
# mount -o rw,remount /system
# cp /sdcard/mrw/su /system/xbin/su
# cp /sdcard/mrw/su /system/bin/su
# pm install /sdcard/mrw/superuser.apk
(I'm using a 2.46 SuperSu version, which should be OK for Android 5.0 system)
But it fails. The SuperSu told me " su binary not installed".
My questions:
1. Is this a feasible way to update Su and SuperSu, and get root access?
2. There's a bunch of architect, I tried both "arm" and "arm64", but none of the su binary can work. Which architect shall I choose, when I'm running on a ARM Coretex A53 core? ( I know it is a 64bit core)
Thanks a lot, and Best Regards,
towenyu
Did you get this device secondhand? Also what device is it, since many have their own root method because of OEM crap.
That said, you only need su in one location, either /system/xbin/su or /system/bin/su (I typically see it in /system/xbin/su). I'm not sure what happens if it's in both, but it's just wasted space.
You can try these commands through adb root; since you already were able to get su onto your device, it may be just a matter of ownership and permissions:
Code:
# mount -o rw,remount /system
# chmod 755 /system/xbin/su
# chown root:root /system/xbin/su
# mount -o ro,remount /system
chown 755 sets the permissions to rwxr-xr-x (user gets read/write/execute, group/other gets read/execute). Execute is the important bit here, since otherwise the su binary can't do its job. After those commands, try SuperSU again and see if it works (you might need a reboot, because of how Android 5.0+ handles changes to /system) The last mount -o ro command just changes /system back to read-only, to prevent accidental changes to other parts.
Successfully rooted!
Not that simple, but basically follow the update-binary script already inside supersu package.
Only need to made slight modification due to my system won't support "unzip"
Now that you're successfully rooted, go install Busybox, that'll give you a lot of Linux commands Android doesn't have by default, including unzip.
xfullmetal17 said:
Now that you're successfully rooted, go install Busybox, that'll give you a lot of Linux commands Android doesn't have by default, including unzip.
Click to expand...
Click to collapse
Thanks for your advice! I will try it.
But don't there's already a Busybox in android system? I guess what I need to do is find somewhere a more powerful busybox binary -- or build it by my own, but that may be not so easy for me.
Android has some basic Linux commands support, but I don't think it has Busybox (if you have a custom ROM you may have some additional commands, but since you said unrooted I don't think it was installed.
This is one of the most popular installers for Busybox: https://play.google.com/store/apps/details?id=stericson.busybox
I've used it since I first rooted with Android 2.2 and haven't had any issues with it (save for lack of vim, since stock Android doesn't have the correct libraries for it)
rooting my htc m9 running marshmallow
Hi, I'm totally blind, and twrp isn't an option for me since it doesn't have a built in screen reader. I would like to install supersu to system, would some one kindly help me in telling me what files to put where. I think the m9 is arm64, but besides su and supersu.apk, I think there's installrecovery.ssh and some other files that have to go in, so please help some one
xfullmetal17 said:
Android has some basic Linux commands support, but I don't think it has Busybox (if you have a custom ROM you may have some additional commands, but since you said unrooted I don't think it was installed.
This is one of the most popular installers for Busybox: https://play.google.com/store/apps/details?id=stericson.busybox
I've used it since I first rooted with Android 2.2 and haven't had any issues with it (save for lack of vim, since stock Android doesn't have the correct libraries for it)
Click to expand...
Click to collapse
Hi guys ,
it is possible to run manualy via adb shell update-binary file from META-INF supersu folder for install it ? (means before unpacked folder supersu is copied to ex. /tmp)
I'm asking bcose no custom recovery and no root on my device yet.
Thx
nalas said:
Hi guys ,
it is possible to run manualy via adb shell update-binary file from META-INF supersu folder for install it ? (means before unpacked folder supersu is copied to ex. /tmp)
I'm asking bcose no custom recovery and no root on my device yet.
Thx
Click to expand...
Click to collapse
I have same saturation, no TWRP, no SU installed on my device: [email protected]_cn:/ #, Android M,
What I have is a userdebug boot.img support "adb root", so my draft commands in my mind please run one by one, not batch.. WARNING, this may make your system bootloop,take your own risk!!!.)
fastboot flash boot boot_userdebug.img
fastboot reboot
adb wait-for-device
adb root
adb remount
adb disable-verity
adb shell setenforce 0
adb reboot
cd D:\tools\Downloads\SR3-SuperSU-v2.82-SR3-20170813133244\arm64
adb wait-for-device
adb root
adb remount
adb shell setenforce 0
adb push .\su /system/bin/su
adb push .\su /system/xbin/su
adb shell chmod 06755 /system/bin/su
adb shell chmod 06755 /system/xbin/su
adb shell /system/bin/su --install
adb shell /system/bin/su --daemon&
adb install ..\common\Superuser.apk
adb shell setenforce 0
adb disable-verity
if you found SuperSU not found root, try adb shell setenforce 0 again.
then you can get SuperSU found su file need to update, use normal way to do it.
then, it will be "Installation success !"
Enjoy it.
so reference log:
D:\tools\Downloads\SR3-SuperSU-v2.82-SR3-20170813133244\arm64>adb push su /system/bin/su
adb: error: failed to copy 'su' to '/system/bin/su': Read-only file system
D:\tools\Downloads\SR3-SuperSU-v2.82-SR3-20170813133244\arm64>adb root
D:\tools\Downloads\SR3-SuperSU-v2.82-SR3-20170813133244\arm64>adb push su /system/bin/su
adb: error: failed to copy 'su' to '/system/bin/su': Read-only file system
D:\tools\Downloads\SR3-SuperSU-v2.82-SR3-20170813133244\arm64>adb remount
remount succeeded
D:\tools\Downloads\SR3-SuperSU-v2.82-SR3-20170813133244\arm64>adb push su /system/bin/su
[100%] /system/bin/su
D:\tools\Downloads\SR3-SuperSU-v2.82-SR3-20170813133244\arm64>adb push su /system/xbin/su
adb: error: failed to copy 'su' to '/system/xbin/su': Read-only file system
D:\tools\Downloads\SR3-SuperSU-v2.82-SR3-20170813133244\arm64>adb shell
[email protected]_cn:/ # su
[email protected]_cn:/ # cd /system/bin
[email protected]_cn:/system/bin # chmod 06755 su
chmod: chmod 'su' to 106755: Read-only file system
1|[email protected]_cn:/system/bin # ls su
su
[email protected]_cn:/system/bin # ls -al su
-rwxr-xr-x root shell 108496 2008-02-29 03:33 su
[email protected]_cn:/system/bin # su --intall
[email protected]_cn:/system/bin # su --daemon&
[1] 6146
[email protected]_cn:/system/bin # getenforce
Enforcing
[1] + Done su --daemon
[email protected]_cn:/system/bin # setenforce 0
[email protected]_cn:/system/bin # getenforce
Permissive
[email protected]_cn:/system/bin # exit
[email protected]_cn:/system/bin # exit
[email protected]_cn:/ # exit
/system/bin/su
exit
^C
Azlun said:
I have same saturation, no TWRP, no SU installed on my device: [email protected]_cn:/ #, Android M,
What I have is a userdebug boot.img support "adb root", so my draft commands in my mind please run one by one, not batch.. WARNING, this may make your system bootloop,take your own risk!!!.)
fastboot flash boot boot_userdebug.img
fastboot reboot
adb wait-for-device
adb root
adb remount
adb disable-verity
adb shell setenforce 0
adb reboot
cd D:\tools\Downloads\SR3-SuperSU-v2.82-SR3-20170813133244\arm64
adb wait-for-device
adb root
adb remount
adb shell setenforce 0
adb push .\su /system/bin/su
adb push .\su /system/xbin/su
adb shell chmod 06755 /system/bin/su
adb shell chmod 06755 /system/xbin/su
adb shell /system/bin/su --install
adb shell /system/bin/su --daemon&
adb install ..\common\Superuser.apk
adb shell setenforce 0
adb disable-verity
if you found SuperSU not found root, try adb shell setenforce 0 again.
then you can get SuperSU found su file need to update, use normal way to do it.
then, it will be "Installation success !"
Enjoy it.
so reference log:
D:\tools\Downloads\SR3-SuperSU-v2.82-SR3-20170813133244\arm64>adb push su /system/bin/su
adb: error: failed to copy 'su' to '/system/bin/su': Read-only file system
D:\tools\Downloads\SR3-SuperSU-v2.82-SR3-20170813133244\arm64>adb root
D:\tools\Downloads\SR3-SuperSU-v2.82-SR3-20170813133244\arm64>adb push su /system/bin/su
adb: error: failed to copy 'su' to '/system/bin/su': Read-only file system
D:\tools\Downloads\SR3-SuperSU-v2.82-SR3-20170813133244\arm64>adb remount
remount succeeded
D:\tools\Downloads\SR3-SuperSU-v2.82-SR3-20170813133244\arm64>adb push su /system/bin/su
[100%] /system/bin/su
D:\tools\Downloads\SR3-SuperSU-v2.82-SR3-20170813133244\arm64>adb push su /system/xbin/su
adb: error: failed to copy 'su' to '/system/xbin/su': Read-only file system
D:\tools\Downloads\SR3-SuperSU-v2.82-SR3-20170813133244\arm64>adb shell
[email protected]_cn:/ # su
[email protected]_cn:/ # cd /system/bin
[email protected]_cn:/system/bin # chmod 06755 su
chmod: chmod 'su' to 106755: Read-only file system
1|[email protected]_cn:/system/bin # ls su
su
[email protected]_cn:/system/bin # ls -al su
-rwxr-xr-x root shell 108496 2008-02-29 03:33 su
[email protected]_cn:/system/bin # su --intall
[email protected]_cn:/system/bin # su --daemon&
[1] 6146
[email protected]_cn:/system/bin # getenforce
Enforcing
[1] + Done su --daemon
[email protected]_cn:/system/bin # setenforce 0
[email protected]_cn:/system/bin # getenforce
Permissive
[email protected]_cn:/system/bin # exit
[email protected]_cn:/system/bin # exit
[email protected]_cn:/ # exit
/system/bin/su
exit
^C
Click to expand...
Click to collapse
Thank You - I will check and give feedback
Can I somehow just copy su and supersu files to phone (stock ROM) with full root shell to get root? Unfortunately bootloader is locked and only root shell is available.
user4978023 said:
Can I somehow just copy su and supersu files to phone (stock ROM) with full root shell to get root? Unfortunately bootloader is locked and only root shell is available.
Click to expand...
Click to collapse
Of course not. If it were that easy rooting would be a non-issue for devices with a locked bootloader.
towenyu said:
Successfully rooted!
Not that simple, but basically follow the update-binary script already inside supersu package.
Only need to made slight modification due to my system won't support "unzip"
Click to expand...
Click to collapse
Can you give more details ?
I'm in a similar situation (/system/bin/su and /system/xbin/su "updated" from Supersu zip , root access from adb shell , rom built as userdebug) but I'm unable to launch the update-binary through adb to get the TV fully rooted..
I have a 65 inch XiaomiTV 3 (note, this is a different flavor of OS from MiBox), it works great until Xiaomi starts to push video ads everytime I turn on the TV. Xiaomi has disabled (likely completely removed ADB) from their system (mine is 1.12.10, any newer version would not be allow u to gain root access in anyway, unless you prove me wrong). Since there is no way to install a new recovery on XiaomiTV 3 (not that I know of, I should add), I tried the only tool that can root this system with an exploit, the 360 Root (http://root.360.cn/). Now this tool itself has some ads, so I will need to remove it later. But at least it allows me to use `su` in a terminal emulator.
Once I gain the root access on my device, I first tried to use ADB by running (and I need to add, XiaomiTV 3 does not have USB debugging port) a terminal emulator (I use Android Terminal Emulator):
Code:
su
stop adbd
setprop service.adb.tcp.port 5555
start adbd
Then I try to connect to my XiaomiTV 3 (its ip is 192.168.123.123) by:
Code:
adb connect 192.168.123.123
It connects, meaning ADB is not removed completely. However if I type `adb devices` it shows 192.168.123.123 is offline.
I then upgraded my Android platform tools and adb by:
Code:
android update sdk no-ui
android update adb
Restart the adb server:
Code:
adb kill-server
adb connect 192.168.123.123
Here it still shows offline, so I restarted both the XiaomiTV 3 and my laptop, and regain root (I will lose root everytime I reboot XiaomiTV 3), did the above all over again. No luck. Then I thought to copy my `~/.android/adbkey.pub` to a usb drive, and then plug it in to XiaomiTV 3, then use a terminal emulator to:
Code:
su
mv /mnt/usb/sdcard/adbkey.pub /data/misc/adb/adb_keys
Then
Code:
stop adbd
setprop service.adb.tcp.port 5555
start adbd
Still, after I
Code:
adb kill-server
adb connect 192.168.123.123
the device is still offline.
Then I tried another approach to get get SuperSU to the system by first copying supersu to a USB drive and then copy it to `/data/superuser` in XiaomiTV 3.
Then I did:
Code:
su
mount -o rw,remount /system
mkdir /system/bin/.ext
chmod 777 /system/bin/.ext
chown root /system/bin/.ext
cp /data/superuser/su /system/bin/.ext/.su
chmod 6755 /system/bin/.ext/.su
chown root /system/bin/.ext/.su
cp /data/superuser/su /system/xbin/su
chmod 755 /system/xbin/su
chown root /system/xbin/su
cp /data/superuser/su /system/xbin/daemonsu
chmod 755 /system/xbin/daemonsu
chown root /system/xbin/daemonsu
cp /data/superuser/supolicy /system/xbin/supolicy
chmod 755 /system/xbin/supolicy
cp /data/superuser/libsupol.so /system/lib/libsupol.so
chmod 644 /system/lib/libsupol.so
mkdir /system/etc/init.d
chmod 644 /system/etc/init.d
cp /data/superuser/99SuperSUDaemon /system/etc/init.d/99SuperSUDaemon
chmod 744 /system/etc/init.d/99SuperSUDaemon
busybox_xm touch /system/etc/.installed_su_daemon
echo 1 >> /system/etc/.installed_su_daemon
chmod 644 /system/etc/.installed_su_daemon
mkdir /system/app/SuperSU
chmod 755 /system/app/SuperSU
cp /data/superuser/SuperSU.apk /system/app/SuperSU/SuperSU.apk
chmod 644 /system/app/SuperSU/SuperSU.apk
cp /data/superuser/install-recovery.sh /system/etc/install-recovery.sh
chmod 755 /system/etc/install-recovery.sh
ln -s /system/etc/install-recovery.sh /system/bin/install-recovery.sh
Then I reboot, apparently, the system overwrites the `/system/xbin/su` (either by 360 root or Xiaomi's OS). So I redid everything above, without reboot. Sadly, SuperSU still asks me to upgrade/update my binary file.
So this is when I stopped knowing what to do next. Any ideas?
I tried to perform a manual installation of SuperSU (2.82 SR5) on my Raspberry Pi running the developer version of AndroidThings 1.0.4, which is based on Android 8.1.0 / API 27. Rather than flashing the zip in recovery, as I'm not sure where to start with that on the Things platform, I manually pushed files and set file permissions and contexts via adb shell. My guide for this was the summary at the top of the script at SuperSU/META-INF/com/google/android/update-binary.
The new su binary appears to work for the most part. I can execute su and read/write with the interactive shell. However, when I attempt to execute the same operations as a command through su (ie: su -c mkdir /system/testdirectory), it responds saying its a read-only filesystem. The filesystem has been remounted with adb remount. I'm unable to perform the remount with the mount command, as /system is not listed in /proc/filesystems. From my understanding, this is due to some recent security model changes in Android. That being said, after the adb remount, all other normal interactions with the filesystem seem to work without issue. I have verified that selinux is in permissive mode.
I don't have busybox installed. These efforts are to allow for installation of busybox for other projects.
Does anybody know whats causing the commands proxied through su to not work correctly?
Here are the commands I used to perform my manual installation.
Code:
cd ~/Downloads/SuperSU-2.82-SR5
adb connect [IP_ADDRESS]:5555
adb root
adb remount
adb push common/install-recovery.sh /system/etc/install-recovery.sh
adb shell chmod 0755 /system/etc/install-recovery.sh
adb shell chcon u:object_r:toolbox_exec:s0 /system/etc/install-recovery.sh
adb shell ln -s /system/etc/install-recovery.sh /system/bin/install-recovery.sh
adb shell chcon -h u:object_r:toolbox_exec:s0 /system/bin/install-recovery.sh
cd armv7
# adding as `su_next` to prevent any issues before dropping it in
adb push su /system/xbin/su_next
adb shell chmod 0755 /system/xbin/su_next
adb shell chcon u:object_r:system_file:s0 /system/xbin/su_next
adb push su /system/xbin/daemonsu
adb shell chmod 0755 /system/xbin/daemonsu
adb shell chcon u:object_r:system_file:s0 /system/xbin/daemonsu
adb push supolicy /system/xbin/supolicy
adb shell chmod 0755 /system/xbin/supolicy
adb shell chcon u:object_r:system_file:s0 /system/xbin/supolicy
adb push libsupol.so /system/lib/libsupol.so
adb shell chmod 0644 /system/lib/libsupol.so
adb shell chcon u:object_r:system_file:s0 /system/lib/libsupol.so
adb shell cp /system/bin/app_process32 /system/bin/app_process32_original
adb shell cp /system/bin/app_process32 /system/bin/app_process_init
adb shell rm /system/bin/app_process
adb shell ln -s /system/xbin/daemonsu /system/bin/app_process
adb shell rm /system/bin/app_process32
adb shell ln -s /system/xbin/daemonsu /system/bin/app_process32
adb shell chmod 0755 /system/bin/app_process
adb shell chmod 0755 /system/bin/app_process32
adb shell chcon u:object_r:system_file:s0 /system/bin/app_process
adb shell chcon u:object_r:zygote_exec:s0 /system/bin/app_process32
# Swapping new su binary in
adb shell cp /system/xbin/su /system/xbin/su_original
adb shell rm /system/xbin/su
adb shell mv /system/xbin/su_next /system/xbin/su
adb shell /system/xbin/su --install
adb reboot
I need to correct myself: the new su binary can only read with privileges. It cannot write at all. I am only able to write either as the adb root shell, or with the stock su binary. I noticed that the device's adbd process relaunches with its own privileged context passed to it when adb remount is run. (adbd --root_seclabel=u:r:su:s0)
If I've run adb root and adb remount, adb shell, and then enter the su binary, I lose the ability to write to the remounted filesystem. So it appears that there is something wrong with the new su binary and its related files.
Anyway, this isn't critical to my project, so I'm abandoning my efforts for now. If anyone has any ideas on what is wrong here, I'd love to hear them and give this another shot!