Database Info

An Introduction to Android Rooting for the Complete Beginner

There are a few of these guides around, but I thought to write my own. Hope it will be helpful! I'll keep the most up-to-date version on my site.
Rooting Android: What Is it?
If you've heard about "rooting" your Android phone, and are confused by what exactly it does, or don't understand the instructions you found on an obscure forum or blog post somewhere, this guide might help you make sense of things.
What Is "Root"?
"Root" is the name of the default administrative user in Unix. The user named "root" can do absolutely anything: edit or delete any file, start or stop any system service, and also add, remove or change the privileges of other users, so that they, too, could perform the same operation.
So, user "root" can actually bestow administrative privileges on any Android user, including the default one you use normally on the phone.
When you buy an Android phone, it normally does not let you login as user "root".
What Can User "Root" Do?
Your phone is really a general-purpose hand-held computer. People have written apps for it that can do the things like this:
Turn it into a wireless internet router, connecting to your 3G/4G network on one end, and broadcasting a wifi hotspot on another. You can thus connect your laptop to the internet from anywhere. "Tethering," but without cables!
Lets you overwrite any of the Android system files, customizing it to your heart's content. This lets you customize the built-in fonts, colors, keyboards, etc.
Lets you install newer versions of Android, beyond what your phone's vendor has provided.
Why stop at standard Android? Because Android is an open source operating system, people have been able to modify it to add features far and beyond what Google has put in it, as well as offering better performance in some situations. With administrative privileges, you can just flash an entire new Android ROM to your phone. A very popular one is CynaogenMod, which is based on Android 2.3.
Install various networking servers and clients, such as QuickSSHd to allow logging in to your phone over the internet, or CifsManager, which lets you access Windows shared drives from your phone.
Who knows? People might think of new users for these hand-held computers, uses that would require full access to all features of the phone.
Why Won't My Phone Normally Let Me Login As "Root"?
First, for reliability -- as far as you're concerned.
Imagine if your phone automatically gave you administrative access. This means that any app you install can do anything it wants to it. Obviously, unacceptable.
An alternate solution is available in newer versions of Windows and other desktop operating systems, which require you to enter a special administrative password whenever a program is trying to access secure parts of your computer. This is annoying enough on a desktop computer: on a phone, it would again be unacceptable.
So, it makes sense -- for your sake -- to disallow any administrative privileges.
Second, for reliability -- as far the phone vendor is concerned.
A smartphone, unlike a PC, is an expensive consumer device with an explicit support contract. People normally and frequently return phones to the shop if they stop working properly, or call customer support to get assistance. There's a huge cost for the vendor to maintain this support network.
Think for a minute what would happen if any phone user could login as "root" and delete any system file: you would have broken phones everywhere, frustrated consumers, and clogged support networks. Indeed, "rooting" a phone pretty much voids your warranty as far the vendor is concerned.
I Understand the Risks and Am Willing to Void the Warranty, So Why Can't I Login As "Root"? It's My Phone!
Even if logging in as "root" were an advanced feature, hidden away somewhere in the menus with thousands of warnings about possible dangers, you can bet that many non-advanced users would find it. When their phone breaks, you bet they will be angry, and will not care that the warnings were there. As far as they would be concerned, this "root" thing is a feature of their phone, and if it can break the phone then it shouldn't even be there.
And there's a third party who has a business interest in denying you "root": the telecommunication carriers. Their business model is designed around typical consumer uses of the phone, and they do not want it to be too powerful. For example, a "rooted" phone can let you tether it to a laptop, so that your laptop gets its internet access. But, carriers typically sell special "laptop sticks" for that purpose specifically, and these usually are more expensive than phone plans, because they take into account the much heavier bandwidth that laptop users tend to use. If everybody could "root" their phone and tether it, this product -- and source of revenue -- would be irrelevant.
So, Phones Don't Come with a "Root" User?
Android is based on the Linux operating system, which requires the "root" user to function. It's there. However, the vendor has tried to hide all the normal ways to access it. The "root" user is there, it's just "locked."
What Is "Rooting"?
In the context of Android phone, rooting means more than just letting you log in as the "root" user: it means installing a set of tools so that any of your programs can access "root" when then need to and you allow them.
The result is that "rooted" phone works just like Windows, in that it will ask you for permission (but not a password) whenever an app is trying to get administrative privileges.
Fortunately, once you gain access to the "root" user, it's very easily to install a set of standard apps that let you implement this feature, specifically the Superuser app.
How Do I Root My Phone?
Nothing in software can be truly locked down, and hackers have found ways to get "root" access on any Android phone on the market. There are quite a few holes.
But, these methods vary a lot and are different per phone. It's easier on some phones than others. It's often risky, too, because a misstep could potentially "brick" your phone -- making it so that you cannot boot into Android. "Unbricking" is possible in some cases, but not in others. Take care!
Search the internet, and you will likely find various blog and forums posts with instructions for rooting your particular phone model.
This is not a guide for rooting your particular phone model. Instead, it is a general description of what rooting is and how it works. It can help you understand the rooting instructions you find.
Any Downsides?
Well, first of all, there is the risk of bricking your phone. You might want to make sure that someone you know with the same model phone as you have has used the method before. Or, read about it in the internet forums, and make sure that lots of other people have used this method successfully.
Also, you may void your warranty: of course, this would only happen if customer support looks closely at your phone and notices that it has been rooted. It's a good idea to look at these rooting guides to see if there is an easy way to un-root the phone, or at least return it to factory settings.
Finally, there's the issue of "firmware updates" coming from your carrier. Sometimes they will work fine with rooted phones (as long as custom Android ROM has not been installed on them), but depending on the rooting method it may mean that won't work fine anymore. "Not working fine" can mean that the upgrades simply won't run, but it can also mean that the upgrades would fail terribly and brick your phone. Generally, if you have rooted your phone and are getting an "Update Available, Do you want to download?" message from your carrier, don't just say "yes," instead check the forums to see the experience of other people with rooted phones with this update. Generally this problem seems rare, a result of a very poor upgrade package from the vendor -- the usual case is that the upgrade simply won't work.
Don't worry too much: with a rooted phone (and a good Recovery program, see below) you will likely be able to install the upgrade yourself, and possibly better upgrades to more advanced versions of Android than your vendor provides.
How Rooting Works
First, let's understand how the locking down happens.
Your phone actually has more than just Android installed on it. There are, at minimum, three and usually four "partitions" in which entirely different programs are installed. Android is just one of them.
The Boot Loader
The first partition has the boot loader, the very first program see when you turn on the phone normally. The boot loader's main job is simply to boot other partitions, and by default it just boots the Android partition, commonly called the ROM (described below). So, you don't really see the boot loader for very long.
However, all phones allow for a special way of turning them on -- for example, holding the volume up button while pressing the power on button -- that shows the boot loader menu.
When you're there, you can actually choose if you want to boot into the Android partition, or you can boot into the Recovery partition (described in detail below).
The interesting thing about the boot loader is that it is very, very simple. It has no mechanism for users and privileges. One way to look at it is that it always is "root," and in fact can't be anything else.
Sounds like a good place from which to unlock your phone! Unfortunately, most boot loaders are too simple.
One exception is the boot loader found in Google's Nexus phones, and in a few other developer-friendly phones. These boot loaders can actually communicate with a PC over USB, and support writing data to partitions ("flashing" them), as well as booting from them. With this feature, you can flash an unlocked Android ROM to the Android partition, and you're done! Well, the challenge is just to find such a ROM that works well with your phone...
Most phones don't have such a flexible boot loader. However, getting into the boot loader menu is important, because it lets you boot into the Recovery partition, detailed next.
The Recovery Partition
As its name can tell you, this partition is mostly for customer support: the Recovery program can be used to return the Android partition to its factory settings, which can solve a lot of problems with faulty phones, or phones that were infected by bad apps. It can also format the SD card partition.
Some Recovery programs can also install special phone upgrades from the SD card, that write directly to ("flash") the Android ROM partition. Obviously, free access for anyone would allow rooting, so vendors make sure that Recovery would only accept official upgrades. But, one way to root a phone would be for hackers to find a way to create such an "upgrade" that the Recovery program would accept.
There's quite a lot of variation in Recovery programs out there: every vendor has their own idea of which recovery features would be useful for their customer support team. Boot into yours and take a look! It's harmless, unless you actually choose one of the recovery options...
Like the boot loader, the Recovery program is always in "root". A hacked Recovery program could let you flash an unlocked Android ROM, or run any "upgrade" you like. So, in addition to just "recovering" an unusable phone, it can help you "recover" the "root" user that has been locked from you!
A good Recovery program is very useful for customizing your phone, beyond just rooting it. By far the most popular Recovery program is Clockwork Recovery, also called ClockworkMod.
Some rooting methods begin by finding a way to flash ClockworkMod to your Recovery partition, from which you can then run an "upgrade" that roots your phone. Other rooting method find another way in, but still recommend you flash ClockwordMod as soon as possible, because it's just so useful for customizers.
You will not find a homepage or an "official" way to download ClockwordMod: carriers obviously do not want you get have easy access to it. But, search around, and you will find one appropriate for your phone. The ROM Manager app can also flash it for you, assuming you are already rooted.
The SD Card
This is another partition, entirely for you. It is not protected in any way, and you have full access to reading and writing files on it.
For many phones, this partition does not exist unless you physically install an SD card. Some phones have a built-in SD card.
The Android ROM
Finally, the most important partition on your phone! When the boot loader starts the Linux operating system (the "kernel") that sits underneath Android, one of the first subsystems to come up is the security system. From then on, the "root" user will be used to start various user-level subsystems required for the phone to function.
Eventually, the default user will be started, and that will be used to run your apps: the status and notification bar that appears on the top of the screen, the settings manager, the virtual keyboards, etc. Finally you get the home launcher, from which you can launch all the other apps on your phone. None of these programs run as "root", so you are effectively locked from administrative privileges.
The Linux operating system can set security permissions per file. So, indeed large parts of this partition are restricted to be read-only by any user except "root". So, if you boot into Android, none of the apps you run will be able to change these system files. The rest of the partition is readable-and-writeable, and generally functions just like the SD card partition, though it's usually much smaller.
Of course, if you boot into Recovery instead, you will be able to write to these files, because you are "root" there. That's why ClockworkMod is so useful for rooting your phone!
Most Android apps run on yet another layer, a virtual machine called Dalvik, which is a heavily modified version of the Java virtual machine found on previous generations of cell phones, as well as on desktop computers, servers, and many other devices. Definitely, everything you install from an app store will run on Dalvik. Dalvik is a tightly controlled environment in which privileges are carefully controlled per program, beyond what the Linux operating system provides. Not only do apps not have administrative access to the phone, but they can be limited in access to wifi, cellular access, and your data.
Except... that Android does provide a way for apps to request administrative privileges. In locked phones, this is automatically and silently denied. However, the Superuser app can hook into these requests and let any app switch to the "root" user, from which they have full administrative access. A friendly dialog box will pop up, asking you if you want to give the app full permissions. Say yes, and there you go!
A phone in which the Superuser app is running properly is rooted.
Summary: Rooting Methods
The rooting instructions you find will likely be one of these, or a combination of these steps:
Phones with boot loaders that can be unlocked (such as Google's Nexus) will let you flash other partitions. You can flash a whole Android ROM that is already rooted, such as CynaogenMod, and you're done! Or, if you don't want to replace your entire Android ROM, you can flash ClockworkMod into the Recovery partition, and move from there to the next method.
Some rooting methods start with a hacked way to flash ClockworkMod into the Recovery partition. With ClockworkMod, you can run your own special "upgrade" from the SD card. This "upgrade" will vary a lot per phone model, but at the minimum it will involve installing the Superuser app. For some phones, it will modify a few Linux configuration settings to make sure that Superuser app can login as "root." Other, more heavily locked-down phone models might require replacing certain locked parts of Linux and the Android system, sometimes much of the Linux "kernel" itself.
Other rooting methods use the phone's existing Recovery program, but the hackers found a way to create an "upgrade" that can fool the Recovery program into believing it's official. From there on, it's identical to the previous step.
Some rooting methods start straight from Android. Hackers found a way to login as root while Android is running. Of course, logging in as root is not the same rooting, but once you are logged in as root you can run a similar "upgrade" as is used in the previous steps.
Need More Help?
Don't ask me, please! Seriously, I spent a lot of time writing this long article specifically so I would not have to keep answering questions about the process. There are many internet forums and bloggers that welcome questions from noobs. I've generally found the Android hacker community to be extremely generous and welcoming.
Happy rooting!

Nice - but clarification requested
I like the article as it answers some questions.
One thing I'm curious about - you seem to use the terms Recovery Partition and Recovery Program interchangeably. Is that your intent? I'm not trying to split hairs - I just want to understand. I would have expected booting into the recovery partition loads the recovery program.
Also, you talk about how vendors choose features of their recovery program. CWM is then a replacement for the vendor supplied recovery program, correct? If you root then install CWM, are you in effect replacing the recovery program after rooting (as opposed to forcing CWM to overwrite the existing recovery program via flash)?
Thx

Thanks!
A very useful guide for android beginners like me!
Sorry for the bump . This post deserves a thanks and a bump

Thanks! A very useful guide for beginner. I've forwarded this to my colleague who just switched from Windows to Android phone.

Much appreciation!
Thank you so much. I have just purchased a rooted phone & have a ton of questions. Have spent hours here tonight searching for basic info. Finally found this & it really helped this total "noob".
Thank you again.

thanks (very2 usefull) from iphone4 user

Good work..
Sent from my Galaxy Mini using xda-premium

Thanks. It helped very much

how to root sony xperia u
How to root sony xperia U..?
please give me detailed and simple procedure to follow...
i would also happy to know should i have pc drivers to run this rooting process..?

thanks

Thx for taking the time to write the article helped me understand a lot of things

Why isn't there Linux style root on Android?

This is something I have been wondering for a while and after searching the forums and Google I have not been able to find a clear answer. As a long time Linux user the idea of running your system as root all the time is appalling. It is a huge security risk. But for some reason that is really the only way to gain root access on an Android device (as far as i am aware). Apps like SuperSU allow you to pick the apps that are allowed to run as root, but there is no password or verification that the entity approving the access actually has the authority to do so. I hear all the time that rooting your phone is a trade-off between customizability and security, but every Linux system has a root user and it is incredibly secure when properly administered. What is the reason for the difference?
From what I have read, it sounds like part of the issue has to do with Android handling users differently. I would love to be able to maintain a more limited root function on my devices. Thanks.

funkbuqet said:
This is something I have been wondering for a while and after searching the forums and Google I have not been able to find a clear answer. As a long time Linux user the idea of running your system as root all the time is appalling. It is a huge security risk. But for some reason that is really the only way to gain root access on an Android device (as far as i am aware). Apps like SuperSU allow you to pick the apps that are allowed to run as root, but there is no password or verification that the entity approving the access actually has the authority to do so. I hear all the time that rooting your phone is a trade-off between customizability and security, but every Linux system has a root user and it is incredibly secure when properly administered. What is the reason for the difference?
From what I have read, it sounds like part of the issue has to do with Android handling users differently. I would love to be able to maintain a more limited root function on my devices. Thanks.
Click to expand...
Click to collapse
You can set a passcode with SuperSU....

Thanks for the reply. That is good to know. Does that really fill the security gap though? I guess if I set My non-background root permissions to expire every 15 minutes that does help for apps that do not need to run as root in the background.
I am more referring to the distinction between regular user land and the root user. Titanium Backup for example; If I want it to be able to run a full backup (including system apps and settings) of my phone every night I have to give it permanent root permissions. That root permission applies to both the automatic process and anything that I as a user (or any entity that can get control of TB) to act as root as well. Ideally there would be 2 separate instances of the program; the back-up process (a daemon perhaps) initiated by the root user and a second available in regular user space. This sort of thing is common on Linux systems.
My knowledge of Android is not particularly deep. I cannot tell if there is actually a separate root user or how user/group permissions work. It seems that the Android framework is designed around the user not having root access. Which is a bit confusing for an OS that prides itself on customization and "Be together not the same". I can't imagine buying a desktop PC that didn't allow me to have system level (root) access. Why should it be any different on a mobile device?

[DISCUSSION] Root safety, phone migration solutions & alternatives to Titanium Backup

[DISCUSSION] Root safety, phone migration solutions & alternatives to Titanium Backup
So, I've finally received a shiny and new S8 (Exynos).
And quickly enough, I searched XDA & Google to see if there's a stable root solution.
The main reasons I'd like root (& TWRP recovery) for are:
Topmost priority: to properly migrate my apps & data from my current phone (S6) using Titanium backup, so I can start using the new one as my main device.
Giving me the option to choose a custom ROM, when/if I'll find the right one for me.
You can never know when you'll need an app that requires root access.
Having the option to always have a full image backup of the entire device (TWRP).
Debloating the device by freezing/removing unwanted apps (freezing them with Titanium Backup)
I remember that I had to root my device in order to record phone calls (which is very important for me) - I'm not even sure what its like with the S8, but this could also be a reason to root.
After reading, and watching several videos, I understand that there are quite a few things to be worried about:
The chance of bricking your device, as the current rooting solution is immature (Is it? this one scares me the most)
Losing secure folders/Samsung Pay/Samsung Health, etc. (I'd hate to lose Secure Folders - but I'm sure that I can find alternative solutions, I'd prefer not to lose Samsung Pay & Samsung health, but I can live without them).
Losing warranty - not even sure if that's true, read here: https://motherboard.vice.com/en_us/...iphone-rooting-android-does-not-void-warranty (Although I can live without the warranty, always rooted my phones while knowing I'll lose warranty).
I also read this discussion: https://www.reddit.com/r/GalaxyS8/comments/6bgu7n/psa_do_not_attempt_to_root_your_s8s8/
Since I really want to migrate to the new phone, I've looked for options to safely copy the data without having root:
CloneIT: Didnt migrate the apps' data.
Helium: Apps were backuped, but couldnt restore them. many of my apps are not supported by Helium.
Smart Switch: Not even sure if it can migrate apps' data or not, but unfortunately - it didnt even run properly on my S6, once installed - there's a splash screen coming up, that vanishes after couple of seconds. I've read posts of other users complaining about this very same behavior. couldn't find a solution to make it run. it works find on the S8.
I googled, and found that there are a bunch of companies that sell complete migration tools (that require PC/Mac), did anyone check any of these, and can share a honest review?
None of them is free for use/download.
Here are some that I've found (there are more out there):
https://www.phonetransfer.org/
https://www.recovery-android.com/android-data-backup-restore.html
https://www.coolmuster.com/mobile-transfer.html
https://www.gihosoft.com/mobile-phone-transfer.html
https://www.android-data-recovery.org/phone-transfer
https://mobiletrans.wondershare.com/
I've always rooted my phones, so being root-less is a bit new to me. should I just take the chance and root it?
Both Android and TouchWiz are quite mature now, allowing us to enjoy a smooth and slick operation - when combined with the powerful hardware the S8 is equipped with, right out of the box.
What are your reasons for rooting?
How did all of your migrate your phones? started everything from scratch?
If not - how did you migrate from your previous phone?
Is the current rooting solution safe enough? And if its not - and we'll wait until a 'safe' rooting solution is out - how can we keep our apps & data continuously (in my case: S6--> Non rooted S8 --> Rooted S8)?
Does any of the paid solutions I listed above really work?
Would love to hear your thoughts and advises.

I rooted my phone because I would like to customize my own phone as it is mine. DriveDroid, FolderMount, Titanium Backup, smartdisk, and so on. It doesn't matter how good a phone is without root, for me, it is garbage if I cannot customize it. Get a unrootable phone just as powerful as the desktop PC, and I'll find it garbage regardless of smoothness.

Well put me down for wondering if any of these without root will restore app data....

Android Backup directly to PC

Hello everyone,
i searched for this topic and found several threads without an answer, but all of them were years old, so heres my hope that things have changed over the years (And that Android finally catches up with what i would consider basic functionality and damn, even iPhones can do it...)
Im looking for a backupsolution directly to my PC. A tool for either my PC (Both Windows of Linux would be fine) or my phone (which is a rooted LG G4 with the last, and therefore very old, official Lineage OS (i intend to upgrade to something newer.) I want to backup every app including appdata, my contacs, sms and mediafiles.
I dont have a lot of space left on my phone which rules out any backupsolution that backs up to my phone. Which means Titanium Backup (which besides looking ugly and not very userfriendly by my usual standards for a user interface but the Pro version can apparently otherwise do everything i want) or Nandroidbackups (assuming that they dont fully backup my phone including the rom and therefore would be unusuable for migration to a new Rom) are out. Also the need to manually copy this over after the backup smacks me as slighly cobbled together, but well that might be just me.
I also dont want to use any internetbased solution. Both for ideological and paranoia reasons. Its my data and i dont intend to giving it to others. Therefore any cloudbased services are out.
Which leaves me with backing up directly to my PC. When i started looking for such a soltion i thought that would be easyly solved since it is such a basic usecase. But oh boy how wrong i was.
What i have found so far:
Syncdroid: Cant backup Apps+Appdata.
Helium: endless spinning wheel while checking root (even though i triplechecked, helium HAS root) and without root i cant backup two thirds of the apps i want to backup like all my instant messaging apps). Apparently the issues with root are known but the Devs are silent.
Apowersoft ApowerManager: Is supposedly able to do what i want BUT doesnt have a trial so i could test it (the free version only allows backups but no restore or anything which comes down to a trust issue) and its simply to expensive (20$ per month with the current superduperspecialpricejustforyouandjustnowoffer) to just buy blindfolded. Also again Trustissues for a tool this expensive without a way to fully try before...
So in conclusion: Do i have to throw away my LG G4 and switch to an iPhone to get this basic functionality or did i just overlook something (maybe a hidden feature in Titanium Backup)?
Bonuspoints if this works over wifi and can be automated (like PC is running, PC suite pings phone, finds phone and updates the backup)

The real use of TA (drm keys) vs. DrmFix

I was researching to see if it is cost effective to root my XZP (global). I ran into a thousand problems and probable (documented) bugs.
For the moment I'm still on stock (locked bootloader). But without a doubt, of all the devices I've been fortunate enough to root, this is by far the most complicated.
Not so much for opening the bootloader and flashing things (in that it is very similar to the other devices). But for the fact of losing many features (Cameras, HDR, Widevine L1, LDAC and Hi-Res sound, not to mention more hidden things like Triluminos).
My understanding is that unlocking the bootloader makes you lose the TA (drm / what makes most unique things work). That there are methods for backing up the TA (which I personally find the guide Horrible in the sense that it suffers from information overdose. It is too technical and is full of details that are in principle useless for most cases, as well as too many references, which also loses the focus of the guide. Which is good to mention, but not in the middle of the guide, but at the end or at the beginning). and that there is the drmfix patch.
All this does not really matter (a complaint maybe). But I want to know if there is really a use for backing up the TA. More than just having a backup for the sake of it.
I mention this because (based on the comments on the forum)
1. The roms do not occupy the official drm/ta, but completely occupy the drmfix.
2. Flashing TA removes root and doesn't work beyond stock roms (which there are even pre-assembled versions with drmfix).
3. YOU CANNOT CLOSE THE BOOTLOADER again (even if you manage to close it, the TA is inaccessible, I'm not sure about this, I'm just basing this on forum comments)
4. Flashing TA closes the bootloader (didn't we agreed that the bootloader can't be closed?)
5. Having to downgrade, put a thousand things to have "temporary root" to backup TA is very complicated (the guide is overloaded with irrelevant information. I'm sorry if you think it's rude that I consider the mentions as not relevant. It is not my intention to hide the work of other people, but I think it would be better if these mentions are made at the beginning or at the end of the guide, and not in the middle of the guide).