Hello,
So I did something stupid. Not sure what, but I managed to get my phone into a state where NO shell commands work other than cd and su.
./adb shell
$ su
# ls
# top
# free
free: not found
# cat
# df
# more
more: not found
# less
less: not found
# busybox
busybox: not found
# sh
# ssh
ssh: not found
# vi
vi: not found
#
The phone is a Motorola MB502 (Charm), rooted using Universal Androot 1.63.
Currently running the stock Telus ROM (don't really have a choice there...)
Any way I can get this working ?
There is a market app that will attempt to install busybox, if you want to try that.
Do you mean
stericson.busybox ?
because I can't seem to find it on the market, and can't use MarketEnabler since my shell is broken.
With a bit of searching I noticed that all the files in /system/bin seem to be 0-byte files. Perhaps someone who has a Charm could post these files?
$adb pull /system/bin/top
$ls -l
total 0
-rw-r--r-- 1 root root 0 2011-01-18 17:25 top
$
Source: http://www.androidpolice.com/2012/0...root-the-lg-intuition-and-lg-spectrum-on-ics/
If you find this useful please follow me (jcase) on twitter ( https://twitter.com/teamandirc/ ).
Here you go, root for both the new LG Intuition and the LG Spectrum running ICS. The vulnerability is a simple permission bug allowing us to setup a symlink to local.prop (yes yet again). While the bug is the same, the procedure is slightly different, so I will have the instructions separate.
With the LG Intuition, they did seem to attempt to mitigate this attack. Not by setting correct permissions, but by dropping adbD to the shell user if it runs as root, even if ro.kernel.qemu=1 is set. They failed, they give us enough time to run one command before dropping the root privileges, in our case a script to root the phone.
LG Spectrum ICS Root (for the leaked ICS rom):
Expect this to be patched in the release rom. Leaked ICS rom has locked bootlaoders, ie no recovery at this point.
Files needed:
su ( http://dl.dropbox.com/u/8699733/lgroot/su )
adb shell
$ rm /data/vpnch/vpnc_starter_lock
$ ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
$ exit
adb reboot
adb wait-for-device shell
$ echo 'ro.kernel.qemu=1' > /data/local.prop
$ exit
adb reboot
adb wait-for-device remount
adb push su /system/xbin/su
adb shell
# chown 0.0 /system/xbin/su
# chmod 06755 /system/xbin/su
# rm /data/local.prop
# rm /data/vpnch/vpnc_starter_lock
# reboot
Once rebooted, install Superuser from the market and enjoy.
LG Intuition Root
Files needed:
su ( http://dl.dropbox.com/u/8699733/lgroot/su )
lgroot.sh ( http://dl.dropbox.com/u/8699733/lgroot/lgroot.sh )
adb push su /data/local/tmp/su
adb push lgroot.sh /data/local/tmp/lgroot.sh
adb shell
$ chmod 777 /data/local/tmp/lgroot.sh
$ rm /data/vpnch/vpnc_starter_lock
$ ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
$ exit
adb reboot
You may have to unplug/replug your phone to get some computers to pick it up again after this reboot.
adb wait-for-device shell
$ echo 'ro.kernel.qemu=1' > /data/local.prop
$ exit
Here is the important part, you will have to execute the next to commands one after the other. We want the second command to be fired off as soon as adbD comes up, before it drops root privileges. This may take some a few minutes, and after the second command is complete you may have to unplug/replug you phone to get your computer to see it again.
adb reboot
adb wait-for-device /data/local/tmp/lgroot.sh
(Here is where you may have to unplug/replug, but only after the second command has ran).
adb wait-for-device shell
$ su
# rm /data/local.prop
# rm /data/vpnch/vpnc_starter_lock
# reboot
Once rebooted, install Superuser from the market and enjoy.
Thanks!
Dude, it has been killing me not having root since I managed to get the leaked ICS installed. But I tried this, and just wasn't having any luck. I tried to make a .bat file for it, no go. So i tried inputting it line by line and i keep getting hung up at the $ echo 'ro.kernel.qemu=1' part. Just wondering if anyone else is having this problem.
Also, since yesterday whenever I check for a software update, I'm getting an "error occurred during download". I was wondering if I would even be able to get the final ICS OTA when it finally is available.
Thanks again jcase!
LostCauseSPM said:
Dude, it has been killing me not having root since I managed to get the leaked ICS installed. But I tried this, and just wasn't having any luck. I tried to make a .bat file for it, no go. So i tried inputting it line by line and i keep getting hung up at the $ echo 'ro.kernel.qemu=1' part. Just wondering if anyone else is having this problem.
Also, since yesterday whenever I check for a software update, I'm getting an "error occurred during download". I was wondering if I would even be able to get the final ICS OTA when it finally is available.
Thanks again jcase!
Click to expand...
Click to collapse
Which specific ICS version do you have, I had a couple different leaks to work with.
jcase said:
Which specific ICS version do you have, I had a couple different leaks to work with.
Click to expand...
Click to collapse
build #: IMM76D
Still tweeking on it. Just updated all my drivers, too. I'm not a total newb, but I'm no pro, either.
jcase said:
Source: http://www.androidpolice.com/2012/0...root-the-lg-intuition-and-lg-spectrum-on-ics/
LG Intuition Root
Files needed:
su ( http://dl.dropbox.com/u/8699733/lgroot/su )
lgroot.sh ( http://dl.dropbox.com/u/8699733/lgroot/lgroot.sh )
adb push su /data/local/tmp/su
adb push lgroot.sh /data/local/tmp/lgroot.sh
adb shell
$ chmod 777 /data/local/tmp/lgroot.sh
$ rm /data/vpnch/vpnc_starter_lock
$ ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
$ exit
adb reboot
You may have to unplug/replug your phone to get some computers to pick it up again after this reboot.
adb wait-for-device shell
$ echo ‘ro.kernel.qemu=1’ > /data/local.prop
$ exit
Here is the important part, you will have to execute the next to commands one after the other. We want the second command to be fired off as soon as adbD comes up, before it drops root privileges. This may take some a few minutes, and after the second command is complete you may have to unplug/replug you phone to get your computer to see it again.
adb reboot
adb wait-for-device /data/local/tmp/lgroot.sh
(Here is where you may have to unplug/replug, but only after the second command has ran).
adb wait-for-device shell
$ su
# rm /data/local.prop
# rm /data/vpnch/vpnc_starter_lock
# reboot
:crying:
Once rebooted, install Superuser from the market and enjoy.
Click to expand...
Click to collapse
i tried but as soon as i entered adb shell it kick me off and haven't been able to try since
jcase said:
Which specific ICS version do you have, I had a couple different leaks to work with.
Click to expand...
Click to collapse
Ive got the spectrum, btw. Still trying to make a nice, clean, automated .bat, but it keeps failing now at the remount command.
---------- Post added at 07:37 PM ---------- Previous post was at 07:24 PM ----------
And now is saying "rm failed for /data/vpnch..."
When the remount fails, I get a "remount failed: operation not permitted" message.
Hope this is useful to you.
LostCauseSPM said:
Ive got the spectrum, btw. Still trying to make a nice, clean, automated .bat, but it keeps failing now at the remount command.
---------- Post added at 07:37 PM ---------- Previous post was at 07:24 PM ----------
And now is saying "rm failed for /data/vpnch..."
When the remount fails, I get a "remount failed: operation not permitted" message.
Hope this is useful to you.
Click to expand...
Click to collapse
add [email protected] to gltak and hit me up.
lahegry said:
i tried but as soon as i entered adb shell it kick me off and haven't been able to try since
Click to expand...
Click to collapse
unplug/replug, The intuition is very touchy. Might need to do it from another system or with another cable.
jcase said:
unplug/replug, The intuition is very touchy. Might need to do it from another system or with another cable.
Click to expand...
Click to collapse
i don't think i'm fast enough, i just can't type faster than it kicks me off
lahegry said:
i don't think i'm fast enough, i just can't type faster than it kicks me off
Click to expand...
Click to collapse
Place the two commands into a batch file/shell script, or setup teamviewer and msg me on gtalk
so this is just I've come up with tonight, the exploit still fails line by line, so I made a batch file just for that command, and I think I may be misunderstanding that "adb mount - o" command you recomended.
Wow, this chrome is NOT liking this txt box, keeps jumping backwards for some reason. C'mon Google...
I've got the intuition and here is what I'm coming up with using cmd prompt in windows:
C:\android-sdk\platform-tools>adb push su /data/local/tmp/su
2642 KB/s (380532 bytes in 0.140s)
C:\android-sdk\platform-tools>adb push lgroot.sh /data/local/tmp/lgroot.sh
10 KB/s (164 bytes in 0.015s)
C:\android-sdk\platform-tools>adb shell
[email protected]:/ $ chmod 777 /data/local/tmp/lgroot.sh
chmod 777 /data/local/tmp/lgroot.sh
[email protected]:/ $ rm /data/vpnch/vpnc_starter_lock
rm /data/vpnch/vpnc_starter_lock
[email protected]:/ $ ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
[email protected]:/ $ exit
exit
C:\android-sdk\platform-tools>adb reboot
C:\android-sdk\platform-tools>adb wait-for-device shell
[email protected]:/ $ echo `ro.kernel.qemu=1' > /data/local.prop
echo `ro.kernel.qemu=1' > /data/local.prop
> exit
exit
> adb reboot
adb reboot
> adb wait-for-device /data/local/tmp/lgroot.sh
adb wait-for-device /data/local/tmp/lgroot.sh
> adb wait-for-device shell
adb wait-for-device shell
>
I believe I see where the mistake is, but don't know how to fix it.
---------- Post added 30th September 2012 at 12:02 AM ---------- Previous post was 29th September 2012 at 11:57 PM ----------
actually I don't see my mistake and I should be doing all this in PTP mode correct?
Try now, something was altering my post
arnshrty said:
I've got the intuition and here is what I'm coming up with using cmd prompt in windows:
C:\android-sdk\platform-tools>adb push su /data/local/tmp/su
2642 KB/s (380532 bytes in 0.140s)
C:\android-sdk\platform-tools>adb push lgroot.sh /data/local/tmp/lgroot.sh
10 KB/s (164 bytes in 0.015s)
C:\android-sdk\platform-tools>adb shell
[email protected]:/ $ chmod 777 /data/local/tmp/lgroot.sh
chmod 777 /data/local/tmp/lgroot.sh
[email protected]:/ $ rm /data/vpnch/vpnc_starter_lock
rm /data/vpnch/vpnc_starter_lock
[email protected]:/ $ ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
[email protected]:/ $ exit
exit
C:\android-sdk\platform-tools>adb reboot
C:\android-sdk\platform-tools>adb wait-for-device shell
[email protected]:/ $ echo `ro.kernel.qemu=1' > /data/local.prop
echo `ro.kernel.qemu=1' > /data/local.prop
> exit
exit
> adb reboot
adb reboot
> adb wait-for-device /data/local/tmp/lgroot.sh
adb wait-for-device /data/local/tmp/lgroot.sh
> adb wait-for-device shell
adb wait-for-device shell
>
I believe I see where the mistake is, but don't know how to fix it.
---------- Post added 30th September 2012 at 12:02 AM ---------- Previous post was 29th September 2012 at 11:57 PM ----------
actually I don't see my mistake and I should be doing all this in PTP mode correct?
Click to expand...
Click to collapse
Correction needed for Intuition
First of all, thank you!!!
For Intuition, where the 'important part' is, the second command returns an error.
I was able to succeed by running
adb reboot
adb wait-for-device shell
then wait for the # to appear, and quickly paste and execute:
/data/local/tmp/lgroot.sh
took a few tries, but I am rooted! :laugh:
krapman said:
First of all, thank you!!!
For Intuition, where the 'important part' is, the second command returns an error.
I was able to succeed by running
adb reboot
adb wait-for-device shell
then wait for the # to appear, and quickly paste and execute:
/data/local/tmp/lgroot.sh
took a few tries, but I am rooted! :laugh:
Click to expand...
Click to collapse
Just wondering how you guys like this device? I was just debating on switching to verizon and this device stands out as the most interesting to me... so I had to look here to see if anybody rooted it.
Anybody try any different roms? or think there may be a Jelly Bean update for it?
/system/bin/sh su not found
any help with this was having an issue with the echo command but got past that but now it's giving me this error
davieslacker said:
Just wondering how you guys like this device? I was just debating on switching to verizon and this device stands out as the most interesting to me... so I had to look here to see if anybody rooted it.
Anybody try any different roms? or think there may be a Jelly Bean update for it?
Click to expand...
Click to collapse
It's an amazing device I love it and im rooted. used the steps above and it worked. I am sure it will get jelly bean love eventually. No roms yet. But LG added a lot of customization to the device form what developers usually add as mods.
Will there be a single click method for root on the intuition. I can't seem to get this method to work
Exploit still works on the final version of ICS for the LG Spectrum
Just updated my phone. Couldn't wait for the OTA rollout, updated via the Verizon Wireless Update Util on my comp. Root worked no problem. Thanks again Jcase!
What did you update your phone to?
Sent from my VS950 4G using xda app-developers app
[originally posted in galaxy tab 1 forum by mistake...]
I used clockworkmod recovery and the cwm-root-gtab2.zip package to root my Tab 2. su appears to be installed ok, and I can get root permissions by running it from an adb shell:
~ $ adb shell
[email protected]:/ $ id
uid=2000(shell) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1009(m ount),1011(adb),1015(sdcard_rw),1028(sdcard_r),300 1(net_bt_admin),3002(net_bt),3003(inet),3006(net_b w_stats)
[email protected]:/ $ su
[email protected]:/ # id
uid=0(root) gid=0(root) groups=1003(graphics),1004(input),1007(log),1009(m ount),1011(adb),1015(sdcard_rw),1028(sdcard_r),300 1(net_bt_admin),3002(net_bt),3003(inet),3006(net_b w_stats)
[email protected]:/ # ls -la /system/bin/su
-rwsr-sr-x root shell 22364 2008-08-01 12:00 su
[email protected]:/ #
So the su binary is present and has setuid bit set on its permissions. But if I run it from a SSH session, or via a terminal emulator on the Tab itself, I get permission error:
[email protected]:/ $ su
Permission denied
1|[email protected]:/ $
Various root checking apps report similar problems. What am I doing wrong? Other threads suggest steps to recreate the su binary with the correct 6755 permissions, but as far as I can see, everything is already as it should be permissions-wise.
Thanks.
First off ran in to the same problem as you I could not get that root to work through cwm method so i did some more research and found my answers here http://androidjinn.com/how-to-root-galaxy-tab-2-p3113-on-ueclk7-android-4-1-1-firmware.html assuming that you are on the gtp3113 model and on stock jb like i am and not looking to flash other roms lol i havent been able to find a way to load cwm without loosing my root again
aj9507 said:
First off ran in to the same problem as you I could not get that root to work through cwm method so i did some more research and found my answers here xxxxxxx assuming that you are on the gtp3113 model and on stock jb like i am and not looking to flash other roms lol i havent been able to find a way to load cwm without loosing my root again
Click to expand...
Click to collapse
Thanks, but unfortunately my model is P3110.
Hi,
First of all: I am using Linux and generally bash scripts since years.
On my phone I made a bash script to toggle (enable or disable) an application:
Code:
#!/bin/bash
checkstatus=$(adb shell cmd package list packages | grep -o "com.miui.cleaner")
if [[ ! -z "$checkstatus" ]] ; then
adb shell pm disable-user --user 0 com.miui.cleaner
else
adb shell pm enable com.miui.cleaner
fi
exit 0
But works only once: it only disable the package and doesn't reactivate it; I tried such script on my laptop (obviously using another application) and works as expected.
Why doesn't properly works on Android?
I hooked this script on a Termux Widget, but the situation is the same if I execute such script inside Termux: it only disable the package and doesn't reactivate it.
EDIT:
I forget to say that if I manually execute adb shell pm enable com.miui.cleaner or adb shell pm enable --user 0 com.miui.cleaner, the package is re-enabled as expected: this operation won't work inside the script.
SOLUTION:
I was wrong about getting the package status (enabled or disabled); the following is the proper mode:
Code:
checkstatus=$(adb shell pm list packages -d 2>/dev/null | grep -o com.miui.cleaner)
if [[ "$checkstatus" == "com.miui.cleaner" ]] ; then
adb shell pm enable com.miui.cleaner
else
adb shell pm disable-user com.miui.cleaner
fi