Database Info

[ROOT] 1.85 - New, working method - ACT NOW, MAY NOT LAST FOREVER!

Silly HTC. THIS EXPLOIT MAY NOT LAST FOREVER. ATT COULD KILL THIS. DO IT NOW.
Warning: If something goes wrong, whatever you do, do NOT install the update that this process finds. If you DO, you will be stuck on 2.20 with no chance for root (currently)
What you need:
HOX on ATT 1.85
su binary from http://dl.dropbox.com/u/don'tusemeimabadsubinary
EDIT: The su binary above has issues. Use this one instead: http://dl.dropbox.com/u/9060692/su
Make sure HTC sync is NOT RUNNING (down in system tray)
Make sure phone is set to "charge only" and usb debugging is enabled!
Put su in same directory as ADB. Get to adb command prompt and cd into that directory
NEW - pull sim card
NEW - do factory reset
NEW - when reset is complete, do not replace sim, do NOT connect to wifi. Go through setup, go to settings, enable USB debugging. When that's done:
adb shell rm /data/data/com.redbend.vdmc/lib/libvd*
adb reboot
After the device reboots:
adb shell ln -s /data/local.prop /data/data/com.redbend.vdmc/lib/libvdmscomo.so
(If you get file doesn't exist after the FIRST command don't worry - they may not be there)
Now, on the phone, go to settings and check for software update. It will tell you you need to connect to network. Now, replace the SIM OR connect to wifi. Have it check for software update again. When it's done, do NOT click "yes" or "ok" on the phone. Simply:
adb shell ls -l /data/local.prop
IF AND ONLY IF you get "file not exists" or anything like that then set your phone's date 2 days ahead and reboot the phone and start over. If you get file info, you're golden. Proceed....
adb shell "echo 'ro.kernel.qemu=1' > /data/local.prop"
Now it's time to reboot
adb reboot
After phones reboots
adb remount
adb push su /system/xbin/su
adb shell chown 0.0 /system/xbin/su
adb shell chmod 06755 /system/xbin/su
adb shell rm /data/local.prop
adb reboot
Congrats, you have root. Install supersu and busybox installer from the market (or Play store).
If you pledged a bounty in the bounty thread, note the instructions here:
Please pay bounty to make a wish foundation
http://www.wish.org/help/donate
Please choose the "Make a Wish Foundation of America" (don't select a chapter). You can use Paypal as well.
Special thanks to designgears as well for being my tester and also writing the one click. He has several hours of work in this project as well. Consider a donation to him, too - http://rootzwiki.com/store
ADDED: Please let me know if this works for you!
ADDED: If you already pushed the wrong binary it's easiest just to start over with the correct binary.

SWEEEEEEEEEEET!
You have just made a lot of people. SCC/FGFD

where do we get the su binary. I have a supersu zip to gain root after unlock

Great job guys!!!

Do terminal apps need root to run? Can I do this with terminal and avoid ADB?

I got "no updates found" and permission denied...
-rw------- system system 1196598 2012-05-25 12:36 local.prop

beaups you are the ****ing best!!!

AWESOME. Thank you so much!
Where do we get su binary?
I'm thinking maybe from a rooted phone? I have a rooted HTC Inspire.

shgadwa said:
AWESOME. Thank you so much!
Where do we get su binary?
I'm thinking maybe from a rooted phone? I have a rooted HTC Inspire.
Click to expand...
Click to collapse
I added the link to op

shgadwa said:
AWESOME. Thank you so much!
Where do we get su binary?
I'm thinking maybe from a rooted phone? I have a rooted HTC Inspire.
Click to expand...
Click to collapse
It's in the op
Sent from my HTC One X using Tapatalk 2

2nd line after adb shell i get no device found. USB debugging is enabled.

Very awesome. Hard work and dedication finally paid off. Thanks to who all that contributed to this.

Omg. Awesome. Who discovered this exploit?

My brother, give us your PayPal so we can donate. This is awesome.

Anyway to put the setting up of ADB in lamens terms for some of us that aren't familiar? I am ok with the commands, I just don't know how to get ADB to command prompt and where to place the files.
---------- Post added at 05:52 PM ---------- Previous post was at 05:52 PM ----------
gunnyman said:
Omg. Awesome. Who discovered this exploit?
Click to expand...
Click to collapse
beaups and dg

I updated to op to fix a wrong instruction.

when I put in the first line it says device not found. It's weird I can boot into boot into bootloader and everything but can't do that line

gunnyman said:
Omg. Awesome. Who discovered this exploit?
Click to expand...
Click to collapse
Once we get a few success stories I'll be claiming bounty (charity).

OMG GOOD JOB!!!! Im already rooted but im proud of you guys!!! GOOD JOB!! Hopefully Me and a Simonsimons will be releasing S=OFF SOON! fingers crossed

SkizzMcNizz said:
when I put in the first line it says device not found.
Click to expand...
Click to collapse
Try again, updated instructions.

[Q] Firewater S-Off question

I cannot get the firewater file to take at all. Im getting the error in the picture and I am following the directions exactly. What am i missing?
maries-mbp:android Soundwave$ ./adb shell
126|[email protected]_m8wl:/ $ chmod 755 /data/local/tmp/firewater
[email protected]_m8wl:/ $ su
1|[email protected]_m8wl:/ $ /data/local/tmp/firewater
error, run firewater as root. su or FU!!!!!!

do you have weak and supersu installed? becus the $ should switch to # after you type su
should look like this after you type su
[email protected]_m8wl:/ #

Karl said:
do you have weak and supersu installed? becus the $ should switch to # after you type su
Click to expand...
Click to collapse
yes i have weak sauce and it reroots on boot

soundwavedj said:
yes i have weak sauce and it reroots on boot
Click to expand...
Click to collapse
do you have root checker insatlled? you should see root active pop up after bootup? and did you accept rsa key for debug?

Karl said:
do you have root checker insatlled? you should see root active pop up after bootup? and did you accept rsa key for debug?
Click to expand...
Click to collapse
I am rooted after the phone reboots but I don't know what the rsa key is...?

soundwavedj said:
I am rooted after the phone reboots but I don't know what the rsa key is...?
Click to expand...
Click to collapse
its in developer options it pops up when you plug in usb with debug active..
this might help you
https://www.youtube.com/watch?v=NV-kPOYKudc&feature=youtu.be
---------- Post added at 10:10 PM ---------- Previous post was at 10:03 PM ----------
go in to supersu setting and set default access to grant

Karl said:
its in developer options it pops up when you plug in usb with debug active..
this might help you
https://www.youtube.com/watch?v=NV-kPOYKudc&feature=youtu.be
---------- Post added at 10:10 PM ---------- Previous post was at 10:03 PM ----------
go in to supersu setting and set default access to grant
Click to expand...
Click to collapse
Thanks for the video. I followed the directions once again and now the teminal app hangs at the "su" step. It doesnt go any further
I am using Mac OSX 10.9.1 and have working adb

did you cahnge the super user settings?

Karl said:
did you cahnge the super user settings?
Click to expand...
Click to collapse
I set it to auto grant permission

im pretty sure its something to do with super since it hangs there each time maybe reinstall

Karl said:
im pretty sure its something to do with super since it hangs there each time maybe reinstall
Click to expand...
Click to collapse
and repeat the steps all over? or start from su again?

soundwavedj said:
and repeat the steps all over? or start from su again?
Click to expand...
Click to collapse
repeat all after reinstall :fingers-crossed:

Karl said:
repeat all after reinstall :fingers-crossed:
Click to expand...
Click to collapse
Same result. Just hangs right at the su command. and I did change the settings again before running it. I appreciate the help I have no idea what is going wrong here maybe OSX?

sorry i out of ideas could be a mac thing... you rebooted fone right

soundwavedj said:
Same result. Just hangs right at the su command. and I did change the settings again before running it. I appreciate the help I have no idea what is going wrong here maybe OSX?
Click to expand...
Click to collapse
Its not OSX cause I s-off'd using my MBP. When it hangs on the su command, look at your phone and grant SU permissions for firewater to execute. This happened to me as well.

gomorrah said:
Its not OSX cause I s-off'd using my MBP. When it hangs on the su command, look at your phone and grant SU permissions for firewater to execute. This happened to me as well.
Click to expand...
Click to collapse
I set SU to grant permission automatiaclly. It doesnt make a difference on my end still hanging at "su"

You could also do it In terminal emulator if you if comfortable enough
Sent from my HTC6525LVW using XDA Premium 4 mobile app

When you uninstalled did you uninstall weaksauce and su, hard reboot, and reinstall both again or just su? Maybe try that to start from a clean slate. I also noticed that you used the chmod command before su (which must have been how it appeared at first because that is how it shows up in some instructional videos) but the firewater site now has su before chmod and that is what I used. Not sure that the order matters but it was changed so who knows?
Sent from my HTC6525LVW using xda premium

That's eventually how I got it to work is by switching the order of the commands. I actually had to type in adb shell twice because it kicked me out of shell every time I just went by the old instructions
Sent from my HTC6525LVW using Tapatalk

Z5 Rooting & Recovery Boot Mode (UK Xperia Z5 E6653)

Morning All,
I've been looking around for a stock Lollipop 5.1.1 Rom for the Xperia Z5 but haven't come across one yet, are there preferred site to browse for stock roms?
Also, is anyone aware of how to boot into recovery mode? Does a stock Sony Rom for Lollipop have it enabled?

http://developer.sonymobile.com/201...for-a-range-of-unlocked-xperia-devices-video/

Could you call *#*#2673#*#* in dial app?
If it doesn't blocked by security, we can enable non-secure ADB thanks to new app in Z5 system.

Does anyone know if someone working on a root method

AndroPlus said:
Could you call *#*#2673#*#* in dial app?
If it doesn't blocked by security, we can enable non-secure ADB thanks to new app in Z5 system.
Click to expand...
Click to collapse
Hello AndroPlus, sorry if this is noob question but could you explain what is it non secure adb and for what exactly it is useful? I tried dial that number and i was able to get into core settings menu with option switch non secure adb on but im still not sure what does it mean exactly and google is pretty silent about this as i can't find any informations about it
Sent from my E6653 using XDA Free mobile app

flakac said:
Hello AndroPlus, sorry if this is noob question but could you explain what is it non secure adb and for what exactly it is useful? I tried dial that number and i was able to get into core settings menu with option switch non secure adb on but im still not sure what does it mean exactly and google is pretty silent about this as i can't find any informations about it
Sent from my E6653 using XDA Free mobile app
Click to expand...
Click to collapse
You can use # (root) in adb shell if non secure adb is enabled.
We have to find how to disable dm-verity and ric to mod system partition, though...

AndroPlus said:
You can use # (root) in adb shell if non secure adb is enabled.
We have to find how to disable dm-verity and ric to mod system partition, though...
Click to expand...
Click to collapse
Nice,that's interesting, I owned every single Xperia Z and red alot about rooting on each single model but never heard about non secure adb.
But now I am huge fan of non secure adb,i hope someone will find how to disable ric!
Sent from my E6653 using XDA Free mobile app

AndroPlus said:
You can use # (root) in adb shell if non secure adb is enabled.
We have to find how to disable dm-verity and ric to mod system partition, though...
Click to expand...
Click to collapse
Does that mean you can backup TA partition in adb shell using dd command?

shoey63 said:
Does that mean you can backup TA partition in adb shell using dd command?
Click to expand...
Click to collapse
Yes, if it works.
Sometimes security feature blocks root to do any actions (they are stronger than root...), so someone should try it first.

shoey63 said:
Does that mean you can backup TA partition in adb shell using dd command?
Click to expand...
Click to collapse
Could anyone with a Z5 or Z5 Compact try this, please?
I'd love to know before buying one.

non-secure ADB works on my Z5 (sim-free UK).
What is the command to backup partitions?

okgnew said:
non-secure ADB works on my Z5 (sim-free UK).
What is the command to backup partitions?
Click to expand...
Click to collapse
Code:
dd if=/dev/block/platform/msm_sdcc.1/by-name/TA of=/sdcard/TA.img

hm. it does not work.
I get 'permissions denied'

okgnew said:
hm. it does not work.
I get 'permissions denied'
Click to expand...
Click to collapse
If you type
Code:
id
, what do you get?

[email protected]:/ $ id
id
uid=2000(shell) gid=2000(shell) groups=1004(input),1007(log),1011(adb),1015(sdcard_rw),1026(drmrpc),1028(sdcard_r),2993(
trimarea),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats) context=u:r:shell:s0
---------- Post added at 09:48 PM ---------- Previous post was at 09:47 PM ----------
[email protected]:/ $ dd if=/dev/block/platform/msm_sdcc.1/by-name/TA of=/sdcard/TA.img
v/block/platform/msm_sdcc.1/by-name/TA of=/sdcard/TA.img <
dd: /dev/block/platform/msm_sdcc.1/by-name/TA: Permission denied
---------- Post added at 09:49 PM ---------- Previous post was at 09:48 PM ----------
W:\>adb push hosts /data/data
failed to copy 'hosts' to '/data/data/hosts': Permission denied

okgnew said:
[email protected]:/ $ id
id
uid=2000(shell) gid=2000(shell) groups=1004(input),1007(log),1011(adb),1015(sdcard_rw),1026(drmrpc),1028(sdcard_r),2993(
trimarea),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats) context=u:r:shell:s0
---------- Post added at 09:48 PM ---------- Previous post was at 09:47 PM ----------
[email protected]:/ $ dd if=/dev/block/platform/msm_sdcc.1/by-name/TA of=/sdcard/TA.img
v/block/platform/msm_sdcc.1/by-name/TA of=/sdcard/TA.img <
dd: /dev/block/platform/msm_sdcc.1/by-name/TA: Permission denied
---------- Post added at 09:49 PM ---------- Previous post was at 09:48 PM ----------
W:\>adb push hosts /data/data
failed to copy 'hosts' to '/data/data/hosts': Permission denied
Click to expand...
Click to collapse
You are not root, you are shell user.
You are using secure ADB.

I run 'adb root' but it did not change anything
And 'su' returns 'command not found'

After unsecuring ADB is it possible to push su and busybox via ADB with a computer

Thekjp95 said:
After unsecuring ADB is it possible to push su and busybox via ADB with a computer
Click to expand...
Click to collapse
Not that I could see. I tried a few commands which didn't work but even if you did dm-verity would have to be disabled otherwise the system would bootloop
Sent from my E6653 using Tapatalk

@DooMLoRD will you be willing to do work on the z5

[ROOT][Guide]Bypassing Android Password/Pattern/Face/PI (Lollipop-Marshmallow)

INSTRUCTIONS:
1. Connect phone to computer
2. Open a terminal/cmd window on computer
3. Type:
Code:
adb devices
adb shell
cd data/system
rm locksettings.db
rm locksettings.db-shm
Reboot, and boom! Removed

i dont have twrp then?

sohamsen said:
i dont have twrp then?
Click to expand...
Click to collapse
Fixed the guide, thanks for catching that!

Honestly Annoying said:
Fixed the guide, thanks for catching that!
Click to expand...
Click to collapse
nice guide
---------- Post added at 09:36 AM ---------- Previous post was at 09:35 AM ----------
what about 4.4.4 or less?

And for Non-Rooted devices.?
Sent from my SM-N930F using Tapatalk

[Root/TWRP/Rom]T-Mobile K428sg K10/MetroPCS ms428 K10[4/2/17]

i am in no way responsible if you brick, break or just plain blow up your device. it's your device and your responsibility. if you blame me i am gonna die laughing!
Disclaimer! the exploits in the rar may be flagged as a virus by your virus software. just add an exception for them! they are not a virus
T-Mobile/MetroPCS Root, TWRP and Deodexed Stock Roms
Cannot Stress this Enuff but Read this Entire Post, when done read it again, and finally read it once more for good measure​
ok all. this is dirtycow exploit for the t-mobile k428 - works on the 10g firmware(works for the metropcs ms428 as well - Must have 10c kdz flashed first). the exploit method is almost the same as the v20
i have personally done this multiple times on my t-mobile k10 without issues to make sure it is 100% working
all the needed files you need are in this rar. just extract it to the root of your C drive Download Me
this requires an unlocked bootloader and on the t-mo variant it's very easy to do. check this forum. you'll find instructions on how to do it
Now lets get started!!
copy the supersu file to your sdcard
open a command prompt window.
now copy and paste each line except the lines surrounded by "< >"
adb push dirtycow /data/local/tmp
adb push recowvery-applypatch /data/local/tmp
adb push recowvery-app_process32 /data/local/tmp
adb push recowvery-run-as /data/local/tmp
adb push twrp-3.1.0-0.img /sdcard/twrp.img
adb shell
cd /data/local/tmp
chmod 0777 *
./dirtycow /system/bin/applypatch recowvery-applypatch
"<Note! wait for to finish>"
./dirtycow /system/bin/app_process32 recowvery-app_process32
"<Note! wait for to finish, it should appear to crash, however
the crash will not happen, you have to force the crash.
to do this wait for the exploit to finish. now press and hold
the power button until you see the t-mo logo screen and hear
the jingle. now it's crashed and you can continue onto the next
step>"
exit
adb logcat -s recowvery
"<wait for it to tell you it was successful - Then Press>"
"[CTRL+C]"
adb shell reboot recovery
"<wait for phone to boot up again, your recovery will be reflashed to stock>"
adb shell
getenforce
"<it should say Permissive>"
cd /data/local/tmp
./dirtycow /system/bin/run-as recowvery-run-as
run-as exec ./recowvery-applypatch boot
"<wait for it to flash your boot image this time>"
run-as su
run-as exec dd if=/sdcard/twrp.img of=/dev/block/bootdevice/by-name/recovery
"<wait for it to complete>"
reboot recovery
"<once in twrp do the following>"
click install
select supersu 2.79-sr3.zip
reboot
setup your phone and enjoy
thats it. enjoy root!
Stock Deodexed Roms
Features:
Deodexed
Debloated(if thats what you want to call it) i've removed what i don't want so
Magisk v12.0 with magisk manager 4.3.0
Note! (make sure to enable hide magisk in magisk manager settings) - pass's safetynet check - android pay will work along with pokemon go and any other apps that look for root
Busybox 1.26.2 installed by default
dolby atmos 6.5
Viper4Android 2.5.0.5
Includes a custom app for a reboot menu that ties into the actual power button
As always to install either rom you'll want to wipe system, data, dalvik and cache(this is normal for any rom)
T-Mobile Rom
T-Mobile K10 K428sg 10h rom - Weather Widget has been removed due to deodexing issues. PLZ use an Alternate Weather Widget
K428sg10h Removed Files
MetroPCS Rom
MetroPCS K10 ms428 10h rom - Weather Widget has been removed due to deodexing issues. PLZ use an Alternate Weather Widget
MetroPCS Removed Files
for anyone interested you can freely use these rom as a starting point base for a custom rom.
Thanks to @pvineeth97 - for working twrp, @Chainfire - for supersu, @topjohnwu - for magisk, and everyone else i forgot to mention. sorry guys i'm tired!

reserved 1

OvrDriVE said:
reserved 1
Click to expand...
Click to collapse
I just didn't remember that dirtycow could be used to root MetroPCS 428! Thanks for the guide

actually the metropcs twrp you did works like a charm on the t-mo 428. ty for that btw.
i wasn't sure if this worked for metropcs or not but since you say it does i'll mention it as well

OvrDriVE said:
actually the metropcs twrp you did works like a charm on the t-mo 428. ty for that btw.
i wasn't sure if this worked for metropcs or not but since you say it does i'll mention it as well
Click to expand...
Click to collapse
I don't have a MetroPCS 428 phone but I compiled TWRP for it. I happy it works for you guys
---------- Post added at 03:14 PM ---------- Previous post was at 02:47 PM ----------
@OvrDriVE
Edit the guide properly whenever you are free.
Can you contact me on hangouts: [email protected].

On the very first command I'm already facing issues:
Code:
adb push dirtycow /data/local/tmp
adb: error: cannot stat 'dirtycow': No such file or directory

GuyInDogSuit said:
On the very first command I'm already facing issues:
Code:
adb push dirtycow /data/local/tmp
adb: error: cannot stat 'dirtycow': No such file or directory
Click to expand...
Click to collapse
make sure your running cmd from the adb dir. also you need to make sure usb debugging is enabled in dev options along with oem unlock

OvrDriVE said:
make sure your running cmd from the adb dir. also you need to make sure usb debugging is enabled in dev options along with oem unlock
Click to expand...
Click to collapse
I am running it from the adb directory. And USB debugging and OEM unlock are enabled.

GuyInDogSuit said:
I am running it from the adb directory. And USB debugging and OEM unlock are enabled.
Click to expand...
Click to collapse
then it should work as the file is in that folder if you grabbed my zip at the top of OP

OvrDriVE said:
then it should work as the file is in that folder if you grabbed my zip at the top of OP
Click to expand...
Click to collapse
I got it! The "dirtycow" file was being removed by ESET. You should add a disclaimer in the OP about it possibly being flagged by antivirus software.

GuyInDogSuit said:
I got it! The "dirtycow" file was being removed by ESET. You should add a disclaimer in the OP about it possibly being flagged by antivirus software.
Click to expand...
Click to collapse
yeah it's a false positive. anyway disclaimer added.

OK, now I'm stuck. The part where I'm supposed to hold the power button? It doesn't reboot. It just brings up the power menu and stays there.

GuyInDogSuit said:
OK, now I'm stuck. The part where I'm supposed to hold the power button? It doesn't reboot. It just brings up the power menu and stays there.
Click to expand...
Click to collapse
redo the exploit line right before your supposed to hold the power button. wait for it to finish then hold the power button to crash the phone

It takes about 2-3 minutes for the "./dirtycow /system/bin/app_process32 recowvery-app_process32" command to finish. It doesn't appear to crash. I'm still waiting for it to happen.

GuyInDogSuit said:
It takes about 2-3 minutes for the "./dirtycow /system/bin/app_process32 recowvery-app_process32" command to finish. It doesn't appear to crash. I'm still waiting for it to happen.
Click to expand...
Click to collapse
ok, make sure your screen is on and doesn't shutoff. that may help. the crash that happens on the v20 doesn't happen on the k10 unless ypou hold the power button to force it
and you'll know you crashed it because the white t-mo logo screen will pop up and you'll hear part of the t-mo jingle and then phone will appear to be froze

OvrDriVE said:
ok, make sure your screen is on and doesn't shutoff. that may help. the crash that happens on the v20 doesn't happen on the k10 unless ypou hold the power button to force it
and you'll know you crashed it because the white t-mo logo screen will pop up and you'll hear part of the t-mo jingle and then phone will appear to be froze
Click to expand...
Click to collapse
I set the screen to stay on. I'm actually using an MS428, the MetroPCS variant. Nothing happening, still. I've run the command four times now.
---------- Post added at 09:53 AM ---------- Previous post was at 09:47 AM ----------
I think I'll need to downgrade. I let the phone update once since I got it. And there's a new 57.1 MB update today.

GuyInDogSuit said:
I set the screen to stay on. I'm actually using an MS428, the MetroPCS variant. Nothing happening, still. I've run the command four times now.
---------- Post added at 09:53 AM ---------- Previous post was at 09:47 AM ----------
I think I'll need to downgrade. I let the phone update once since I got it. And there's a new 57.1 MB update today.
Click to expand...
Click to collapse
you may need to. i did this on a k428 t-mo version with 10g and i havn't tryed on 10h yet but i gaurentee it works on t-mo. was told it works on metropcs however they could have been wrong on that.

Once rooted, will I lose root if I update? I kinda figure I will.

GuyInDogSuit said:
Once rooted, will I lose root if I update? I kinda figure I will.
Click to expand...
Click to collapse
it actually shouldn't update because of the modified recovery. although it may still complain about there being an update you can just ignore it

OvrDriVE said:
it actually shouldn't update because of the modified recovery. although it may still complain about there being an update you can just ignore it
Click to expand...
Click to collapse
Oh, right, the recovery. Yeah. Alright.
---------- Post added at 10:46 AM ---------- Previous post was at 10:10 AM ----------
I'm on 10g already and it's not working. I tried downgrading, which said it completed, but I'm still on the same version. WTF. And this still isn't working.