Adding su to blob.APP - Android Software/Hacking General [Developers Only]

Hi All, I've been researching on how to modify the blobs that are present in the OTA and custom roms, I've used blobunpack to extract the various blobs and managed to mount blob.APP using this syntax: mount blob.APP -loop -o remount,rw /mnt/Transformer. I can then add / remove files to the *mounted* blob file and run umount /mnt/Transformer followed by blobpack etc... to recreate the updated blob, what do I need to put in the blob.APP image so that when I flash it I will have root ? ( hope this makes sense )

You'll need /system/app/Superuser.apk and /system/xbin/su. Superuser can have the same persmissions as all the other apps, but su should have 6755 or rwsr.sr.x. I think there are other superuser.apk available now. The su binary is usually in sbin or xbin, but it has to be in your path so that other apks can find it.
Have fun!

Thanks very much will have a go

So the device wil be rooted automatically on first boot ? No need to run exploit ?

Related

something up with my shell scripts.

I seem to be frequently flashing or messing up my G1 so I decided to write some shell scripts to help out but they seem to only half work if at all. Actually I'm not sure what they did because they displayed no output.
This script is supposed to backup the default init.rc and mountd.conf files then replace the existing ones with the modified ones.
Though it does not work.
Code:
mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system
mkdir /system/sd
busybox cp -a /system/etc/mountd.conf /sdcard/recovery/mountd.conf.bak
busybox cp -a /system/init.rc /sdcard/recovery/init.rc.bak
busybox cp -a /sdcard/recovery/mountd.conf /system/etc/mountd.conf
busybox cp -a /sdcard/recovery/init.rc /system/init.rc
then this is the next set to move the apks and the program caches which doesn't work.
Code:
mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system
busybox cp -a /data/app /system/sd
rm -r /data/app
ln -s /system/sd/app /data/app
busybox cp -a /data/app-private /system/sd/app-private
rm -r /data/app-private
ln -s /system/sd/app-private /data/app-private
rm -R /data/data/com.android.browser/cache/webviewCache
ln -s /sdcard/cache/webviewCache /data/data/com.android.browser/cache/webviewCache
rm -R /data/data/com.android.vending/cache
ln -s /sdcard/cache/marketCache /data/data/com.android.vending/cache
rm -R /data/data/com.google.android.street/cache
ln -s /sdcard/cache/streetCache /data/data/com.google.android.street/cache
reboot
Plus both run and output no errors either. Who knows what problems I'll run into because I have no idea what they actually did.
Anyone see anything wrong here?
Well I'll help you.
1-) After you back up the mount and stuff and put the other back, you MUST reboot before keep going.
2-)After boot then you can copy the files or make the symlink. I suggest you dont copy the app to the sdcard on teh scrip since they should be there already. so do that manually once then the script just delete the folders and then crate the symlinmks.
I have a menu that does that and I have got some experience as why it works one day and not the other.
Rafase282 said:
Well I'll help you.
1-) After you back up the mount and stuff and put the other back, you MUST reboot before keep going.
Click to expand...
Click to collapse
I took the reboot out after the mountd.conf and init.rc did not appear to copy due to the lack of /dev/mmcblk0p2 hoping to see some sort of output why it did not run. Unfortunately it runs and backs up the files but does not replace them with the modded ones.
Rafase282 said:
2-)After boot then you can copy the files or make the symlink. I suggest you dont copy the app to the sdcard on teh scrip since they should be there already. so do that manually once then the script just delete the folders and then crate the symlinmks.
Click to expand...
Click to collapse
Not copying the apps is a good idea, modified the script to not do so.
Rafase282 said:
I have a menu that does that and I have got some experience as why it works one day and not the other.
Click to expand...
Click to collapse
Does Android require that you do a chmod on all shell scripts first?
On Debian I usually just use sudo sh ./ and it runs the script w/o changing anything on the file permissions so I figured Android would be similar if I just ran them as root. Still I see a lot of people requiring a chmod 777 on any guide referring to running shell scripts.
I will try that and report back with my findings. Thanks for replying.
Does Android require that you do a chmod on all shell scripts first? I just have to type m oon anywhere in the androud shell and my scripts run, for that i put it on /system/bin and do a chmod 4755 to the file. it is still needed to type su before you run the script.
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
mkdir /system/sd
cp /sdcard/media/Data/mountd.conf /system/etc/mountd.conf
cp /sdcard/media/Data/init.rc /system/init.rc
Thats my code for copying the modified files to the right place. So maybe you should try that.
Oh for androoid you dont unless you put it on /system/bin then you will have to use sude and sometiems it still wont run due to lack or permisions so is better to do a chmod 4755
Well I made the changes suggested and did a chmod on all the files prior to running but with no luck.
The odd thing is if I use the shell scripts as a guide list it works perfectly but if I try to launch them as a shell script all sorts of strange undesirable things happen to my phone.
The time consumed trying to use the scripts and recover from what happens from what they do out weight the effects of typing everything in.
joshtheitguy said:
Well I made the changes suggested and did a chmod on all the files prior to running but with no luck.
The odd thing is if I use the shell scripts as a guide list it works perfectly but if I try to launch them as a shell script all sorts of strange undesirable things happen to my phone.
The time consumed trying to use the scripts and recover from what happens from what they do out weight the effects of typing everything in.
Click to expand...
Click to collapse
you can only run the script once .. when the "ln -s" has already been done it has to be undone before trying to run the script again .. otherwise you would be copying the files onto themselves .. not sure if you've tried running it more than once
LucidREM said:
you can only run the script once .. when the "ln -s" has already been done it has to be undone before trying to run the script again .. otherwise you would be copying the files onto themselves .. not sure if you've tried running it more than once
Click to expand...
Click to collapse
These scripts were intended for my usage after a system restore from a update.zip file which wipes /system in the process.
My intentions were to:
1. remount the fs rw
2. copy the original init and mountd files to the sd then copy the modified to their respective places in the system folders then reboot
3. reboot then create the sym links appropriately then move my caches too
Well unfortunately the only thing that works is the backing up of the original init and mountd files.
joshtheitguy said:
These scripts were intended for my usage after a system restore from a update.zip file which wipes /system in the process.
My intentions were to:
1. remount the fs rw
2. copy the original init and mountd files to the sd then copy the modified to their respective places in the system folders then reboot
3. reboot then create the sym links appropriately then move my caches too
Well unfortunately the only thing that works is the backing up of the original init and mountd files.
Click to expand...
Click to collapse
yes .. but you can't create the sym links when they already exist .. running the update.zip only wipes the /system .. not /data .. if the links were there before the update.zip they will be there after

Java in Vodafone 858 Smart

I've a problem installing Java in my 858:
I follow theses steps:
Open Terminal Emulator
su
mount -o remount,rw /dev/block/mtdblock3 /system
cp /sdcard/jbed.apk /system/app
cp /sdcard/libjbedvm.so /system/lib
but at the last command say me the memory is not enought, so retried but say the file exist and is read only, open the explorer i see the file is some kb versus the 3 mb in sdcard, i tried in terminal change permission with chmod in 777 at this file, tried in adb, tried to eliminate but nothing to do, i've smartlucky rom 2.4 (froyo 2.2.2 rooted).
Some suggestion ?

Deodexed v21D stock

Hi everyone
Instructions as follows, based on the one here but modified for Optimus 3D and my personal experience:
Prerequisites:
Rooted Optimus 3D with CWM installed
USB debugging enabled
Root explorer or any similar software (must have R/W access to system)
Android SDK with ADB installed
Java SDK installed
LG USB drivers installed
xUltimate downloaded and unzipped somewhere.
Instructions:
This was tested and working using v21D. YMMV for other roms, depending on what apps can or cannot be deodexed.
BACKUP YOUR ROM USING CWM. THIS IS VERY IMPORTANT. I WILL NOT ACCEPT ANY RESPONSIBILITY FOR ANY BRICKED PHONES.
Connect your phone to your computer.
Move the following apps in /system/apps to /sdcard/odex. These files will refuse to deodex using xUltimate:
Maps.apk and Maps.odex
Phonesky.apk and Phonesky.odex
PolarisOffice.apk and PolarisOffice.odex
PlusOne.apk and PlusOne.odex
VoiceSearch.apk and VoiceSearch.odex
Open Main.exe after extracting xUltimate, enter '5' and hit enter, accepting all prompts.
After some time, the deodexing process will complete and it will turn green and say the process was successful.
Open Root Explorer again, delete ALL of these apps in /system/apps. You'll get them back later after copying the deodexed files over. THIS IS REQUIRED OR YOUR PHONE WILL BOOTLOOP.
ApplicationManager.apk
ApplicationManager.odex
BookmarksWidget.apk
BookmarksWidget.odex
Browser.apk
Browser.odex
Calculator.apk
Calculator.odex
CarHome.apk
CarHome.odex
DrmProvider.apk
DrmProvider.odex
DrmService.apk
DrmService.odex
FavoriteContactsWidget.apk
FavoriteContactsWidget.odex
Finance.apk
Finance.odex
Gmail.apk
Gmail.odex
HiddenMenu.apk
HiddenMenu.odex
HiddenSIMUnlockManu.apk
HiddenSIMUnlockManu.odex
LGercui.apk
LGercui.odex
LGSetupWizard.apk
LGSetupWizard.odex
LGSetupWizardNotiForGB.apk
LGSetupWizardNotiForGB.odex
News.apk
News.odex
oem_install_flash_player.apk
oem_install_flash_player.odex
PicoTts.apk
PicoTts.odex
Protips.apk
Protips.odex
Richnote.apk
Richnote.odex
RichnoteWidget.apk
RichnoteWidget.odex
S3DApps.apk
S3DApps.odex
S3DGallery.apk
S3DGallery.odex
S3DGameAsphalt.apk
S3DGameAsphalt.odex
S3DGameGolf.apk
S3DGameGolf.odex
S3DGameNova.apk
S3DGameNova.odex
S3DGuide.apk
S3DGuide.odex
S3DSpace.apk
S3DSpace.odex
SetupWizard.apk
SetupWizard.odex
SmartShare.apk
SmartShare.odex
Street.apk
Street.odex
Talk.apk
Talk.odex
TodayPlusWidget.apk
TodayPlusWidget.odex
TtsService.apk
TtsService.odex
WeatherWidget.apk
WeatherWidget.odex
WhatsNew.apk
WhatsNew.odex
Click to expand...
Click to collapse
Turn on USB storage mode on your phone, copy done_app and done_frame to the internal SD card.
Turn USB storage mode off, open ADB in command prompt and enter the following commands. Make sure the # or $ signs have appeared after every command before continuing with the next step.
su (allow any superuser requests that appear here)
mount -o rw,remount -t ext4 /dev/block/mmcblk0p7 /system
busybox cp /sdcard/done_app/* /system/app/
busybox cp /sdcard/done_frame/* /system/framework/
rm /system/app/*.odex
rm /system/framework/*.odex
chmod 644 /system/app/*
chown root.root /system/app/*
chmod 644 /system/framework/*
chown root.root /system/framework/*
mount -o ro,remount -t ext4 /dev/block/mmcblk0p7 /system
reboot
Click to expand...
Click to collapse
If mount -o ro,remount -t ext4 /dev/block/mmcblk0p7 /system returns an error that device or resource is busy, ignore it and just reboot.
The first reboot will take a while, be patient.
After the phone reboots, you can move the files from /sdcard/odex back to /system/apps.
You're done! You can install any deodexed theme now
Mostly deodexed v21D files: Mediafire
Extract the files somewhere and follow the instructions from step 7 onwards.
This method should work for most stock roms. Make sure you make another CWM backup after the process to ensure everything remains as is afterwards
Another advantage of an almost fully deodexed rom is that the phone feels so much faster and smoother
EDIT: Verified that the ICS theme does not work with this method Lots of FCs everywhere. Try at your own peril.
Remember to hit thanks below

[GUIDE] Rooting Samsung Galaxy [email protected] GT-B5330

This might work on other devices.
WARNING: this might brick your phone use it at your own risk.
Warning you have to have some knowlage of linux to do this kind of stuff.
WARNING: actually you have to have _good_ knowlage of linux/gnu stuff to do it.
The idea is this is to make the /system/bin/toolbox from the stock rom suid (permision 6755, it originaly has 0755)
This is how I did it. It might be simpler.
get a stock rom that you want. for me it was B5330XWALH3
it is now available at samsung-updates.
You need odin (heimdal will not work with my phone) (my was 3.07)
unpack the zip.
you get a .tar.md5 file (the tar file has broken headers so tar from ubuntu 12.04 will not unpackit).
the tar file works in sectors of 512 bytes.
take out the md5sum at the end of file. (some thing like: head -c (the size up to the last md5sum) original.tar.md5 > file1)
split the file so you will have the system.img.md5 separated (some thing like: head -c (the size upto "system.img.md5") file1 > file2;
head -c (the size upto "dt-blob.md5") file1 | tail -c +(the size upto "system.img.md5" + 1) > file3;
tail -c +(the size upto "dt-blob.md5" + 1) file1 > file4
file3 now has the system.img.md5, trim the md5sum from the tail and the tar headr from head (ex.:
head -c (upto the md5sum output from the rear of the file) file3 | tail -c +513 > file5)
file5 is a sparce image file of an ext4 filesystem. run simg2img (from ext4fs_utils (search on xda)) (ex.:
simg2img file5 file6)
sudo mount -o loop,ro file6 /mnt
look for the file /mnt/bin/toolbox (ex.: ls -l /mnt/bin/toolbox) it will give you an output like this:
-rwxr-xr-x 1 root 2000 99068 Aug 9 07:59 /mnt/bin/toolbox
sudo umount /mnt
the permisions and the size of the file yield the following hex sequence that you get in the file (we will hexedit the ext4 fs): ED 81 00 00 FC 82 01 00
in file3 edit the sequence (it should be only one in the file) from ED 81 00 00 FC 82 01 00 to ED 8D 00 00 FC 82 01 00 (practically adding the suid guid bits to the inode of the toolbox)
we are almost done, now to pack our bags and go.
verify that you have indeed put suid guid to toolbox:
head -c (upto the md5sum output from the rear of the file) file3 | tail -c +513 > file5;
simg2img file5 file6;
sudo mount -o loop,ro file6 /mnt;
ls -l /mnt/bin/toolbox
It should give an output:
-rwsr-sr-x 1 root 2000 99068 Aug 9 07:59 /mnt/bin/toolbox
sudo umount /mnt
recalculate the md5sum to the _expanded_ image: md5sum file6 > file7
overide the md5sum at the end of file3 with the one from file7
now pack the pieces in one tar: cat file2 file3 file4 > myfirmware.tar
add the md5sum to it: md5sum myfirmware.tar >> myfirmware.tar
change the name to .tar.md5: mv myfirmware.tar myfirmware.tar.md5
copy the file on a windowze machine (that has odin and the samsung drivers intalled).
update with odin the new firmware (which you should put in the PDA section) (don't forget to un check the repartitioning).
you should have now a practivally rooted device.
in order to have su and Superuser.apk on it you have to do the following steps:
push with adb su, busybox and Superuser.apk into /data/local/tmp on device (you get the files from other forums here at xda)
the next steps are on device (use adb shell)
verify that indeed we have a suid toolbox: ls -l /system/bin/toolbox should give that wanderfull -rwsr-sr-x permission.
find a rw mount that has suid (in my case a tmpfs is mounted /mnt/obb)
copy su to /mnt/obb (remember that we have suid toolbox this means that toolbox now gives you root on any command):
dd if=/data/local/tmp/su of=/mnt/obb/su
give su suid and make it owned by root: chmod 6755 /mnt/obb/su; chown 0.0 /mnt/obb/su
run su now and enjoy the #: /mnt/obb/su -
Click to expand...
Click to collapse
Ofcorse after you get # you should remount /system as rw, copy su in /system/xbin, copy Superuser.apk in /system/app, copy busybox in /system/xbin, make symlinks to busybox for all the comands in /system/xbin.
You should also upon success remove suid from toolbox so as to not mistakely do damage to the system (for instance "rm /")
And here you have it.
If you do not understand what I have done, you should read more linux / tar / ext4 / md5sum.
This method should work for any phone provided that it has odin as bootloader and there is the stock rom available.
hello
I don't have knowledge about how you have rooted the firmware for b5330, the steps you made are waaaay to dificult for me . Could you provide here an already rooted firmware, to download and install. thanks in advance
ETTT said:
This might work on other devices.
WARNING: this might brick your phone use it at your own risk.
Warning you have to have some knowlage of linux to do this kind of stuff.
WARNING: actually you have to have _good_ knowlage of linux/gnu stuff to do it.
The idea is this is to make the /system/bin/toolbox from the stock rom suid (permision 6755, it originaly has 0755)
This is how I did it. It might be simpler.
Ofcorse after you get # you should remount /system as rw, copy su in /system/xbin, copy Superuser.apk in /system/app, copy busybox in /system/xbin, make symlinks to busybox for all the comands in /system/xbin.
You should also upon success remove suid from toolbox so as to not mistakely do damage to the system (for instance "rm /")
And here you have it.
If you do not understand what I have done, you should read more linux / tar / ext4 / md5sum.
This method should work for any phone provided that it has odin as bootloader and there is the stock rom available.
Click to expand...
Click to collapse
bogdan_rize said:
I don't have knowledge about how you have rooted the firmware for b5330, the steps you made are waaaay to dificult for me . Could you provide here an already rooted firmware, to download and install. thanks in advance
Click to expand...
Click to collapse
no need to upload 400M for this little modification.
I'm unable to post links, goto samsung-updates
go and download B5330XWALI2_B5330OXXALI2_B5330XWLH1_HOME stock firmware.
and apply this xdelta patch over it.
xdelta patch sGTB5330.patch B5330XWALI2_B5330OXXALI2_B5330XWLH1_HOME.tar.md5 myfrm.tar.md5
Click to expand...
Click to collapse
after that you have the firmware that I use to root my phone.
Still... this firmware will not have "su" install, it will just be a rootable firware because it has a suid'ed toolbox.
a suid'ed toolbox in android means that you can exec chown and chmod as a root.
So. After the patching of the stock rom and flashing it. you have to have this md5sum output:
032b4344ab503c8413db9127efaa3d83 myfrm.tar.md5
Click to expand...
Click to collapse
odin will accept it (I've used Oding 3.07).
after that you push the files from the attached tar.gz to /data/local/tmp
tar -xzf superuser_stuff.tar.gz
adb push su /data/local/tmp
adb push Superuser.apk /data/local/tmp
adb push busybox /data/local/tmp
Click to expand...
Click to collapse
after that you bassically have to run this commands in an android shell in order to get to a stardard rooted android:
adb shell # enter the in the phone
dd if=/data/local/tmp/su of=/mnt/obb/su # copy the su binary to a place that can be sudoed
chown 0.0 /mnt/obb/su # modify the owner
chmod 6755 /mnt/obb/su # set SUID flag.
/mnt/obb/su # becomes root !!
mount -o remount,rw /system # remount the system partition as readwrite.
dd if=/data/local/tmp/su of=/system/xbin/su #copy su in path
chown 0.0 /system/xbin/su
chmod 6755 /system/xbin/su
chmod 755 /system/bin/toolbox # close the security hole (toolbox is nologer with SUID)
dd if=/data/local/tmp/Superuser.apk of=/system/app/Superuser.apk # copy the superuser application
chown 0.0 /system/app/Superuser.apk
chmod 666 /system/app/Superuser.apk
#now this is done for busybox
dd if=/data/local/tmp/busybox of=/system/xbin/busybox
chown 0.0 /system/xbin/busybox
chmod 755 /system/xbin/busybox
Click to expand...
Click to collapse
have fun.
I downloaded this firmware: Samsung-Updates.com-GT-B5330_COA_1_20120913171601_pducfx5hbw.zip. Where, how, what???...i unzipped it and now how to apply the patch? The rest of the stept i think i get it....i think For you it's easy to say, for me it's hard to do. I've had sgs1, sgs2 and sgs3, and the root of those was sooooooo easy... but this piece of crap b5330 drives me crazy )
ETTT said:
no need to upload 400M for this little modification.
I'm unable to post links, goto samsung-updates
go and download B5330XWALI2_B5330OXXALI2_B5330XWLH1_HOME stock firmware.
and apply this xdelta patch over it.
after that you have the firmware that I use to root my phone.
Still... this firmware will not have "su" install, it will just be a rootable firware because it has a suid'ed toolbox.
a suid'ed toolbox in android means that you can exec chown and chmod as a root.
So. After the patching of the stock rom and flashing it. you have to have this md5sum output:
odin will accept it (I've used Oding 3.07).
after that you push the files from the attached tar.gz to /data/local/tmp
after that you bassically have to run this commands in an android shell in order to get to a stardard rooted android:
have fun.
Click to expand...
Click to collapse
bogdan_rize said:
I downloaded this firmware: Samsung-Updates.com-GT-B5330_COA_1_20120913171601_pducfx5hbw.zip. Where, how, what???...i unzipped it and now how to apply the patch? The rest of the stept i think i get it....i think For you it's easy to say, for me it's hard to do. I've had sgs1, sgs2 and sgs3, and the root of those was sooooooo easy... but this piece of crap b5330 drives me crazy )
Click to expand...
Click to collapse
I've used xdelta package.
if you are on win then you're on your own.
there is xdelta.org and it seems to have pachage for windows.
for sgs[123] was easy because are main streams. may hackers were working on it.
this device is very new/obscure.
I whould have made a script, but alas, "heimdal" firmware loader whould not work with this device.
I've used linux to patch the firmware and windowze to upload it.
So a script whould be imposible, but after you pach .tar.md5 file and load it on your phone is just about cut and paste form my previous post.
My hope is that a more android savy guy will take this concept and make it a script.
I am just happy that I can now have debian on my phone.
yes, i am on win....there is no way to patch that COA firmware (i am from romania) and upload somewhere to download???i know i am probably asking to much from you, but i dont't think i will manage by my own...this rooting busines is driving me crazyyyyy :crying::crying::crying: thank you so much for your answer!!!
ETTT said:
I've used xdelta package.
if you are on win then you're on your own.
there is xdelta.org and it seems to have pachage for windows.
for sgs[123] was easy because are main streams. may hackers were working on it.
this device is very new/obscure.
I whould have made a script, but alas, "heimdal" firmware loader whould not work with this device.
I've used linux to patch the firmware and windowze to upload it.
So a script whould be imposible, but after you pach .tar.md5 file and load it on your phone is just about cut and paste form my previous post.
My hope is that a more android savy guy will take this concept and make it a script.
I am just happy that I can now have debian on my phone.
Click to expand...
Click to collapse
bogdan_rize said:
yes, i am on win....there is no way to patch that COA firmware (i am from romania) and upload somewhere to download???i know i am probably asking to much from you, but i dont't think i will manage by my own...this rooting busines is driving me crazyyyyy :crying::crying::crying: thank you so much for your answer!!!
Click to expand...
Click to collapse
ok here it is the modified firmware.
http://dl.transfer.ro/myfrm-transfer_ro-29oct-8a4089.zip
Interesting, reading carefully
Sent from my GT-B5330 using xda app-developers app
Thank you so much, tomorow morning i know how i'll spend my time...installing and rooting my b5330, unfortunately this evening i don't have my laptop on me forgoted at work ), but i've downloaded the firmware from phone and now waiting to have it done...finally!!! I'll let you know what have i done. Have a nice day and once again thanks!!!
ETTT said:
ok here it is the modified firmware.
http://dl.transfer.ro/myfrm-transfer_ro-29oct-8a4089.zip
Click to expand...
Click to collapse
it's not working, when i'm trying to adb remont it says: remount failed: Opertaion not permited. After i flashed with odin the firmware you gave to me, i think i do not have permission to make any changes, and i don't know why
ETTT said:
ok here it is the modified firmware.
http://dl.transfer.ro/myfrm-transfer_ro-29oct-8a4089.zip
Click to expand...
Click to collapse
Can you make patch for dxlh3..? Thanks
Sent from my GT-B5330 using xda app-developers app
bogdan_rize said:
it's not working, when i'm trying to adb remont it says: remount failed: Opertaion not permited. After i flashed with odin the firmware you gave to me, i think i do not have permission to make any changes, and i don't know why
Click to expand...
Click to collapse
There commands are supposed to be given in a command line box (cmd on win).
where does it gives you error?
adb shell # enter the in the phone
dd if=/data/local/tmp/su of=/mnt/obb/su # copy the su binary to a place that can be sudoed
chown 0.0 /mnt/obb/su # modify the owner
chmod 6755 /mnt/obb/su # set SUID flag.
/mnt/obb/su # becomes root !!
mount -o remount,rw /system # remount the system partition as readwrite.
dd if=/data/local/tmp/su of=/system/xbin/su #copy su in path
chown 0.0 /system/xbin/su
chmod 6755 /system/xbin/su
chmod 755 /system/bin/toolbox # close the security hole (toolbox is nologer with SUID)
dd if=/data/local/tmp/Superuser.apk of=/system/app/Superuser.apk # copy the superuser application
chown 0.0 /system/app/Superuser.apk
chmod 666 /system/app/Superuser.apk
#now this is done for busybox
dd if=/data/local/tmp/busybox of=/system/xbin/busybox
chown 0.0 /system/xbin/busybox
chmod 755 /system/xbin/busybox
finally it worked
yeeeees, damn you're good!!!! i have managed to root my b5330, root checher tell me that i am rooted and busybox is instaled...the only problem is that it shows me that i do not have installed superuser and supersu. Is there a problem if i just copy paste the apk file (supersu.apk and superuser.apk -> i've downloaded the pro version of bouth of them ) straight into the directory /data/local/tmp where it should be? or to copy-paste in another directory. Thanks in advance, CMD(and adb shell) gave me headache, but i finally got it an succedeed )) :victory::good:
ETTT said:
There commands are supposed to be given in a command line box (cmd on win).
where does it gives you error?
adb shell # enter the in the phone
dd if=/data/local/tmp/su of=/mnt/obb/su # copy the su binary to a place that can be sudoed
chown 0.0 /mnt/obb/su # modify the owner
chmod 6755 /mnt/obb/su # set SUID flag.
/mnt/obb/su # becomes root !!
mount -o remount,rw /system # remount the system partition as readwrite.
dd if=/data/local/tmp/su of=/system/xbin/su #copy su in path
chown 0.0 /system/xbin/su
chmod 6755 /system/xbin/su
chmod 755 /system/bin/toolbox # close the security hole (toolbox is nologer with SUID)
dd if=/data/local/tmp/Superuser.apk of=/system/app/Superuser.apk # copy the superuser application
chown 0.0 /system/app/Superuser.apk
chmod 666 /system/app/Superuser.apk
#now this is done for busybox
dd if=/data/local/tmp/busybox of=/system/xbin/busybox
chown 0.0 /system/xbin/busybox
chmod 755 /system/xbin/busybox
Click to expand...
Click to collapse
bogdan_rize said:
yeeeees, damn you're good!!!! i have managed to root my b5330, root checher tell me that i am rooted and busybox is instaled...the only problem is that it shows me that i do not have installed superuser and supersu. Is there a problem if i just copy paste the apk file (supersu.apk and superuser.apk -> i've downloaded the pro version of bouth of them ) straight into the directory /data/local/tmp where it should be? or to copy-paste in another directory. Thanks in advance, CMD(and adb shell) gave me headache, but i finally got it an succedeed )) :victory::good:
Click to expand...
Click to collapse
1. I'm glad you got it.
2. You should give thanks (that button) if I helped you.
3. I'm you dont read instructions. Maybe it's a problem with us romanian engineers, or maybe engineers in general
look at item 11. from my previous post. maybe I just c&p here.
dd if=/data/local/tmp/Superuser.apk of=/system/app/Superuser.apk
So, when you are in adb shell and you go root (su command, you get the promt with #) and you have the /system mounted rw.
Then any apk that you copy to /system/app folder will get intalled and when you list your application (the button with 16 squares) you should see it.
Have fun.
i was having trouble understanding adb shell and cmd from the begining. I never used this command tool...ever ) and i think from yesterday to this day i managed really ok . Anyway i think i will just copy-paste the superuser.apk in "app" folder directly in the system (it's the same thing, isn't it??). I have done that in item 11., and after a restart supersu was instaled, only superuser.apk didn't, i think i wrote something wrong in adb shell
ETTT said:
1. I'm glad you got it.
2. You should give thanks (that button) if I helped you.
3. I'm you dont read instructions. Maybe it's a problem with us romanian engineers, or maybe engineers in general
look at item 11. from my previous post. maybe I just c&p here.
dd if=/data/local/tmp/Superuser.apk of=/system/app/Superuser.apk
So, when you are in adb shell and you go root (su command, you get the promt with #) and you have the /system mounted rw.
Then any apk that you copy to /system/app folder will get intalled and when you list your application (the button with 16 squares) you should see it.
Have fun.
Click to expand...
Click to collapse
hihihi
neeeah, my bad, i thought that in "superuser_stuff" is superuser and supersu files, it was just su->for superuser.apk, easy peasy, it worked and installed from the first time...it was just me verry verry dizzy and confused. Your guide is 100% OK, my phone is rooted and now i can enjoy !!!
ETTT said:
1. I'm glad you got it.
2. You should give thanks (that button) if I helped you.
3. I'm you dont read instructions. Maybe it's a problem with us romanian engineers, or maybe engineers in general
look at item 11. from my previous post. maybe I just c&p here.
dd if=/data/local/tmp/Superuser.apk of=/system/app/Superuser.apk
So, when you are in adb shell and you go root (su command, you get the promt with #) and you have the /system mounted rw.
Then any apk that you copy to /system/app folder will get intalled and when you list your application (the button with 16 squares) you should see it.
Have fun.
Click to expand...
Click to collapse
can you release xdelta patch for your XWALH3 because we have the same device..
phyxar said:
can you release xdelta patch for your XWALH3 because we have the same device..
Click to expand...
Click to collapse
I've started a new more universal thread:
http://forum.xda-developers.com/showthread.php?t=1965600
There you have the shell-script that will patch the firmware for you.
If you still want an xdelta patch I'll make one for you but:
Give a man a fish and it will be full for the day, teach him how to fish and it will never go hungry again.
Have fun.
ETTT said:
ok here it is the modified firmware.
dl.transfer.ro/myfrm-transfer_ro-29oct-8a4089.zip
Click to expand...
Click to collapse
Hello, i'm new here and i don't know about scripting, so need your help..
i downloaded your firmware and install it to my b5330 and did the cmd command, and it worked, thanks..:good:
but now i've a new problem that my b5330 can't type a question mark ('?').. can you help me please..
whenever i want to type a question mark it always typed a comma (',') in the screen..:crying:
it also it change the symbol and language key to emoticon and symbol, but that's not a problem for me..
andhikarogue said:
Hello, i'm new here and i don't know about scripting, so need your help..
i downloaded your firmware and install it to my b5330 and did the cmd command, and it worked, thanks..:good:
but now i've a new problem that my b5330 can't type a question mark ('?').. can you help me please..
whenever i want to type a question mark it always typed a comma (',') in the screen..:crying:
it also it change the symbol and language key to emoticon and symbol, but that's not a problem for me..
Click to expand...
Click to collapse
That's because you have use the romanian firmware. whitch has a qwerty layout keyboard.
you have to do it the right way:
first. find the firmaware for your region:
http://samsung-updates.com/device/?id=GT-B5330
second. find a linux machine and run the script from the thread.
It is unrealistic for me to just upload all the 40 version of the firmware patched.
That is why I've made the script.
If you don't have a linux machine then look for a virtual box ubuntu and run on it.
Cheers.

Root Mediapad/Honor X2 SuperSu (no kingroot)

All,
I've moved this to it's own thread just to keep thing separate.
In case you are uncomfortable with kingroot, or you want a less intrusive install (since we don't need any exploits to root this device - kudos Huawei!) I have built a modified version of the boot image that uses supersu by chainfire instead. This is based on the work done here http://cn.club.vmall.com/space-uid-5467988.html, so we still owe them thanks. All this does, is move the Superuser.apk package into the system partition so that it can be installed as an administrative application, add in a /sbin/su file, and copy /sbin/su into /sbin/xbin so we can use it. Here is a full diff for the 0012 version from the default boot.img supplied by Huawei:
Code:
diff: ./charger: No such file or directory
diff: ~/mediapad/dload.012/boot/filesystem/charger: No such file or directory
diff -r ./default.prop ~/mediapad/dload.012/boot/filesystem/default.prop
4c4
< ro.secure=0
---
> ro.secure=1
6,7c6,7
< ro.debuggable=1
< ro.adb.secure=0
---
> ro.debuggable=0
> ro.adb.secure=1
diff -r ./init.rc ~/mediapad/dload.012/boot/filesystem/init.rc
528,532d527
< service load_boot /sbin/load_boot
< class main
< seclabel u:r:install_recovery:s0
< oneshot
<
Only in ./sbin: load_boot
Only in ./sbin: su
load_boot contains the following:
Code:
#!/system/bin/sh
/sbin/su --auto-daemon &
if [ ! -e /system/app/Superuser.apk ];then
mount -o rw,remount /system
cp -rpf /data/local/tmp/Superuser.apk /system/app/Superuser.apk
chmod 644 /system/app/Superuser.apk
fi
if [ ! -e /system/xbin/su ];then
mount -o rw,remount /system
cp -rpf /sbin/su /system/xbin/
chmod 06755 /system/xbin/su
fi
The /sbin/su file has an md5sum:
Code:
md5sum sbin/su
cd029c6b8b7065ff8ff2860137aeff99 sbin/su
and that matches the md5sum of the su included with v2.46 of chainfires supersu ZIP file (in the link below). So from a security perspective, I think we are pretty clean.
To use this, do the following:
0) Make sure you have unlocked the bootloader first!!!
1) Download chainfires Superuser from here: https://download.chainfire.eu/696/SuperSU/UPDATE-SuperSU-v2.46.zip , and extract the Superuser.apk file from the common folder.
2) adb shell "rm -rf /data/local/tmp/*"
3) adb push <path_to>/Superuser..apk /data/local/tmp/Superuser.apk
4) adb reboot bootloader
( your device will restart)
5) fastboot flash boot <path_to>/super_boot.img
6) fastboot reboot
7) Open the supersu App and update su (otherwise you may have strange issues)
That's it! You're rooted!
This does not do any odd exploits or camera driver adjustments or anything so there shouldn't be any issues with the camera or sound, but, as always, no guarantees.
File is to big too upload here so grab it from here:
703L
b012:
https://www.dropbox.com/s/7wqs6qghphy42sl/super_boot.b012.img?dl=0
b013 - untested for now!!! Tested and works fine:
https://www.dropbox.com/s/9so1wdbofhlbcmo/super_boot.b013.img?dl=0
b015 - Tested and works fine:
https://www.dropbox.com/s/cs767z8yjyfsfku/super_boot.703L.B015.img?dl=0
b106 - Tested and works fine:
https://www.dropbox.com/s/4qvtvpemiko01ie/super_boot.703L.B106.img?dl=0
702L
b003 - Untested! - Potentially Insecure! - I got the link for the 702L image from xda, NOT from emui.com. So I can't speak to the security:
https://www.dropbox.com/s/fp1cj25m1zzqq0m/super_boot.702L.B003.img?dl=0
Root sucessfully without any problems.
Big thanks.
dfsteen said:
All,
I've moved this to it's own thread just to keep thing separate.
In case you are uncomfortable with kingroot, or you want a less intrusive install (since we don't need any exploits to root this device - kudos Huawei!) I have built a modified version of the boot image that uses supersu by chainfire instead. This is based on the work done here http://cn.club.vmall.com/space-uid-5467988.html, so we still owe them thanks. All this does, is move the Superuser.apk package into the system partition so that it can be installed as an administrative application, add in a /sbin/su file, and copy /sbin/su into /sbin/xbin so we can use it. Here is a full diff for the 0012 version from the default boot.img supplied by Huawei:
Code:
diff: ./charger: No such file or directory
diff: ~/mediapad/dload.012/boot/filesystem/charger: No such file or directory
diff -r ./default.prop ~/mediapad/dload.012/boot/filesystem/default.prop
4c4
< ro.secure=0
---
> ro.secure=1
6,7c6,7
< ro.debuggable=1
< ro.adb.secure=0
---
> ro.debuggable=0
> ro.adb.secure=1
diff -r ./init.rc ~/mediapad/dload.012/boot/filesystem/init.rc
528,532d527
< service load_boot /sbin/load_boot
< class main
< seclabel u:r:install_recovery:s0
< oneshot
<
Only in ./sbin: load_boot
Only in ./sbin: su
load_boot contains the following:
Code:
#!/system/bin/sh
/sbin/su --auto-daemon &
if [ ! -e /system/app/Superuser.apk ];then
mount -o rw,remount /system
cp -rpf /data/local/tmp/Superuser.apk /system/app/Superuser.apk
chmod 644 /system/app/Superuser.apk
fi
if [ ! -e /system/xbin/su ];then
mount -o rw,remount /system
cp -rpf /sbin/su /system/xbin/
chmod 06755 /system/xbin/su
fi
The /sbin/su file has an md5sum:
Code:
md5sum sbin/su
cd029c6b8b7065ff8ff2860137aeff99 sbin/su
and that matches the md5sum of the su included with v2.46 of chainfires supersu ZIP file (in the link below). So from a security perspective, I think we are pretty clean.
To use this, do the following:
0) Make sure you have unlocked the bootloader first!!!
1) Download chainfires Superuser from here: https://download.chainfire.eu/696/SuperSU/UPDATE-SuperSU-v2.46.zip , and extract the Superuser.apk file from the common folder.
2) adb shell "rm -rf /data/local/tmp/*"
3) adb push <path_to>/Superuser..apk /data/local/tmp/Superuser.apk
4) adb reboot bootloader
( your device will restart)
5) fastboot flash boot <path_to>/super_boot.img
6) fastboot reboot
7) Open the supersu App and update su (otherwise you may have strange issues)
That's it! You're rooted!
This does not do any odd exploits or camera driver adjustments or anything so there shouldn't be any issues with the camera or sound, but, as always, no guarantees.
File is to big too upload here so grab it from here:
b012:
https://www.dropbox.com/s/wlsjjixext9kbjf/super_boot.b012.img?dl=0
b013 - untested for now!!! Tested and works fine:
https://www.dropbox.com/s/wchc8w6d0qy1npv/super_boot.b013.img?dl=0
Click to expand...
Click to collapse
Would this method work on a GEM-701L as well?
if you point me to the firmware image for that device i can tell you for sure.
Sent from my GEM-703L using XDA Free mobile app
thank you very much, its working great on b013 !
What i did was restoring b012 from sdcard, then i installed directly b013 update, then i rooted the phone using your method and everything is working great.
Now, this probably sounds studip, but could you please explain point 2-6? My Honor X2 is bootloader unlocked but I have no idea what I have to do when you write adb shell.. etc... Do I need any software to do what you suggest or is there a visual guide somewhere to get me going?
Thanks
Can someone give me a link to the Windows drivers please .
dfsteen said:
All,
I've moved this to it's own thread just to keep thing separate.
In case you are uncomfortable with kingroot, or you want a less intrusive install (since we don't need any exploits to root this device - kudos Huawei!) I have built a modified version of the boot image that uses supersu by chainfire instead. This is based on the work done here http://cn.club.vmall.com/space-uid-5467988.html, so we still owe them thanks. All this does, is move the Superuser.apk package into the system partition so that it can be installed as an administrative application, add in a /sbin/su file, and copy /sbin/su into /sbin/xbin so we can use it. Here is a full diff for the 0012 version from the default boot.img supplied by Huawei:
Code:
diff: ./charger: No such file or directory
diff: ~/mediapad/dload.012/boot/filesystem/charger: No such file or directory
diff -r ./default.prop ~/mediapad/dload.012/boot/filesystem/default.prop
4c4
< ro.secure=0
---
> ro.secure=1
6,7c6,7
< ro.debuggable=1
< ro.adb.secure=0
---
> ro.debuggable=0
> ro.adb.secure=1
diff -r ./init.rc ~/mediapad/dload.012/boot/filesystem/init.rc
528,532d527
< service load_boot /sbin/load_boot
< class main
< seclabel u:r:install_recovery:s0
< oneshot
<
Only in ./sbin: load_boot
Only in ./sbin: su
load_boot contains the following:
Code:
#!/system/bin/sh
/sbin/su --auto-daemon &
if [ ! -e /system/app/Superuser.apk ];then
mount -o rw,remount /system
cp -rpf /data/local/tmp/Superuser.apk /system/app/Superuser.apk
chmod 644 /system/app/Superuser.apk
fi
if [ ! -e /system/xbin/su ];then
mount -o rw,remount /system
cp -rpf /sbin/su /system/xbin/
chmod 06755 /system/xbin/su
fi
The /sbin/su file has an md5sum:
Code:
md5sum sbin/su
cd029c6b8b7065ff8ff2860137aeff99 sbin/su
and that matches the md5sum of the su included with v2.46 of chainfires supersu ZIP file (in the link below). So from a security perspective, I think we are pretty clean.
To use this, do the following:
0) Make sure you have unlocked the bootloader first!!!
1) Download chainfires Superuser from here: https://download.chainfire.eu/696/SuperSU/UPDATE-SuperSU-v2.46.zip , and extract the Superuser.apk file from the common folder.
2) adb shell "rm -rf /data/local/tmp/*"
3) adb push <path_to>/Superuser..apk /data/local/tmp/Superuser.apk
4) adb reboot bootloader
( your device will restart)
5) fastboot flash boot <path_to>/super_boot.img
6) fastboot reboot
7) Open the supersu App and update su (otherwise you may have strange issues)
That's it! You're rooted!
This does not do any odd exploits or camera driver adjustments or anything so there shouldn't be any issues with the camera or sound, but, as always, no guarantees.
File is to big too upload here so grab it from here:
b012:
https://www.dropbox.com/s/wlsjjixext9kbjf/super_boot.b012.img?dl=0
b013 - untested for now!!! Tested and works fine:
https://www.dropbox.com/s/wchc8w6d0qy1npv/super_boot.b013.img?dl=0
Click to expand...
Click to collapse
Very nice guide. I followed your instructions and I rooted successfully. I am getting a Cell broadcasts has stopped error upon boot but it really doesn't affect anything so I'm going to freeze it. The good part of this whole process is I ordered my X2 from a seller (zomlong-trading) on eBay and they said they installed an "international" ROM which has all the GAPPS like the Play Store etc.... I had the phone within a week (It shipped on Monday and I got it on Thursday) and the phone came working perfectly. I emailed Huawei for the unlock code and had it within three hours. When I went to unlock apparently the phone was already unlocked so all i had to do was follow your root procedure and that worked like a charm. I can't wait for someone to port the Chinese TWRP to an English version. I'm excited about being able to flash anything AOSP based on this when and if it ever happens. Anyway, thanks for your help.
Bunkerstudio said:
Now, this probably sounds studip, but could you please explain point 2-6? My Honor X2 is bootloader unlocked but I have no idea what I have to do when you write adb shell.. etc... Do I need any software to do what you suggest or is there a visual guide somewhere to get me going?
Thanks
Click to expand...
Click to collapse
Adb and fastboot are tools that you use to interact with android from your PC. You can look here for beginner information:
http://forum.xda-developers.com/showthread.php?t=690362
Note that there are many many threads discussing these things on xda, and the above is only one example. Search around and you will find a whole lot more information.
Confirm: Worked well with GEM-703LT version (32Gb storage)
Didn't work. Rooted using another method
dfsteen said:
All,
I've moved this to it's own thread just to keep thing separate.
In case you are uncomfortable with kingroot, or you want a less intrusive install (since we don't need any exploits to root this device - kudos Huawei!) I have built a modified version of the boot image that uses supersu by chainfire instead. This is based on the work done here http://cn.club.vmall.com/space-uid-5467988.html, so we still owe them thanks. All this does, is move the Superuser.apk package into the system partition so that it can be installed as an administrative application, add in a /sbin/su file, and copy /sbin/su into /sbin/xbin so we can use it. Here is a full diff for the 0012 version from the default boot.img supplied by Huawei:
Code:
diff: ./charger: No such file or directory
diff: ~/mediapad/dload.012/boot/filesystem/charger: No such file or directory
diff -r ./default.prop ~/mediapad/dload.012/boot/filesystem/default.prop
4c4
< ro.secure=0
---
> ro.secure=1
6,7c6,7
< ro.debuggable=1
< ro.adb.secure=0
---
> ro.debuggable=0
> ro.adb.secure=1
diff -r ./init.rc ~/mediapad/dload.012/boot/filesystem/init.rc
528,532d527
< service load_boot /sbin/load_boot
< class main
< seclabel u:r:install_recovery:s0
< oneshot
<
Only in ./sbin: load_boot
Only in ./sbin: su
load_boot contains the following:
Code:
#!/system/bin/sh
/sbin/su --auto-daemon &
if [ ! -e /system/app/Superuser.apk ];then
mount -o rw,remount /system
cp -rpf /data/local/tmp/Superuser.apk /system/app/Superuser.apk
chmod 644 /system/app/Superuser.apk
fi
if [ ! -e /system/xbin/su ];then
mount -o rw,remount /system
cp -rpf /sbin/su /system/xbin/
chmod 06755 /system/xbin/su
fi
The /sbin/su file has an md5sum:
Code:
md5sum sbin/su
cd029c6b8b7065ff8ff2860137aeff99 sbin/su
and that matches the md5sum of the su included with v2.46 of chainfires supersu ZIP file (in the link below). So from a security perspective, I think we are pretty clean.
To use this, do the following:
0) Make sure you have unlocked the bootloader first!!!
1) Download chainfires Superuser from here: https://download.chainfire.eu/696/SuperSU/UPDATE-SuperSU-v2.46.zip , and extract the Superuser.apk file from the common folder.
2) adb shell "rm -rf /data/local/tmp/*"
3) adb push <path_to>/Superuser..apk /data/local/tmp/Superuser.apk
4) adb reboot bootloader
( your device will restart)
5) fastboot flash boot <path_to>/super_boot.img
6) fastboot reboot
7) Open the supersu App and update su (otherwise you may have strange issues)
That's it! You're rooted!
This does not do any odd exploits or camera driver adjustments or anything so there shouldn't be any issues with the camera or sound, but, as always, no guarantees.
File is to big too upload here so grab it from here:
b012:
https://www.dropbox.com/s/wlsjjixext9kbjf/super_boot.b012.img?dl=0
b013 - untested for now!!! Tested and works fine:
https://www.dropbox.com/s/wchc8w6d0qy1npv/super_boot.b013.img?dl=0
Click to expand...
Click to collapse
hi
thanks for your efforts, but do you have the stock recovery.img for b013 rom
thankyou
All,
As soon as b015 goes up on the website I will pull it apart and generate a rooted version. It usually goes up within a week of the OTA update so hang in there!
-Dan
Hi there... I wonder if u can take a look @ GEM-702L ???
theres only one FW for the 702.... but there no stable working boot.img could work with...T.T
While I mean all the 703 bxyz method could root...the 702... but probably theres some problems... like GPU driver sth like that... first.. it caused no sound problem.... random freezes.... n cheesy screen
lcw622 said:
Hi there... I wonder if u can take a look @ GEM-702L ???
theres only one FW for the 702.... but there no stable working boot.img could work with...T.T
While I mean all the 703 bxyz method could root...the 702... but probably theres some problems... like GPU driver sth like that... first.. it caused no sound problem.... random freezes.... n cheesy screen
Click to expand...
Click to collapse
Do you have a link to the firmware?
dfsteen said:
Do you have a link to the firmware?
Click to expand...
Click to collapse
http://forum.xda-developers.com/huawei-mediapad/general/mediapad-x2-firmware-702l-703l-t3168925
dfsteen said:
All,
As soon as b015 goes up on the website I will pull it apart and generate a rooted version. It usually goes up within a week of the OTA update so hang in there!
-Dan
Click to expand...
Click to collapse
Thanks and btw the b015 is already on the website. Excited now
Can't wait for the root of b015 [emoji18]
Gesendet von iPad mit Tapatalk
b015 rooted is now up on the initial posting. Enjoy!
lcw622 said:
http://forum.xda-developers.com/huawei-mediapad/general/mediapad-x2-firmware-702l-703l-t3168925
Click to expand...
Click to collapse
I've posted a rooted boot.img for 702l.b003 from the link you provided. I don't own this device, so it's not tested, but let me know if it works.

Categories

Resources