Related
NOTE: This is a work in progress. While I have completed this guide myself SEVERAL times to ensure accuracy, It is possible that typos or errors in understanding exist. Please use at your own risk, and expect NOTHING from me. I will do my best to update this guide and improve the formatting as I find time. Feel free to leave feedback!
I cannot stress this enough: always have backups of any important information. While we may not be able to do full image-based backups until after root, you can still make sure we aren't deleting needed data. While yes, Google should hold your most important data and allow you to sync at any time, what would you do if Google went down? And I've even had trouble using the "Offline" function for some of the Apps. Therefore, Make a copy of everything on your SD card and read this excellent guide from Lifehacker about how to backup Google Apps data: Lifehacker
You will need an SD card. I recommend AT LEAST an 8GB Class 4. Most actually recommend a Class 6 for use with apps2sd, but I just wanted to let you know that it would still work with a Class 4. For those unaware, apps2sd allows you to save internal phone memory by placing after-market applications onto your SD card. Most users notice a speed benefit from this.
If you would like to purchase a Class 6 SD card, you can get a one here with three sizes available (4GB, 8GB, 16GB):
A-DATA MicroSDHC Class 6 Turbo With SD Adapter
To ensure the best possible load, perform a factory reset, and WIPE your SD card!
Code:
Menu > Settings > Security > Factory data reset > Reset phone > Erase everything
TRUE FACTORY RESET (UN-ROOT)
If you, like me, have already rooted and are trying to perform this process over again, you will unfortunately have to download the original ROM and flash it in Windows.
Download: RUU_Hero_C_Sprint_1.29.651.1_signed_release.exe
Run in Windows (I used XP through VMWare Fusion), and this will return the phone to the TRULY factory loaded state. Any other Factory data reset will simply reload the last ROM image saved, which, if you rooted and loaded MoDaCo, would be MoDaCo. I am encouraging you to follow this process to avoid any problems that may exist while the phone is rooted or loaded with the unofficial ROM. And even if you perform this process as a first-time rooter, it certainly wont hurt!
ROOT HERO [MAC]
(This is the process that allows modifications to occur on your phone):
The guide I follow and can verify is this:
Rooting CDMA Hero [Mac]
I do not use Windows as a primary platform, so I would recommend following this guide if you are on Windows:
How to root the CDMA Hero (DETAILED Windows guide)
You should be able to return to this guide after you have successfully completed the root process on Windows. Continue from the section "NANDROID BACKUP" below.
Per the purpose of this guide, I will detail my exact steps from the "Rooting CDMA Hero [Mac]" post. Thanks ajones7279!
Plug in your phone
Download Android SDK: http://developer.android.com/sdk/index.html
Unpack, Rename the extracted folder to "AndroidSDK" (This is case sensitive!), and Move it to "Applications" (I consider the Android SDK a set of applications.)
Open TextEdit, Click Format>Make Plain Text, then copy and paste the following:
Code:
export PATH=${PATH}:/Applications/AndroidSDK/tools
Save as: ".bash_profile"
On Phone: Go to Settings > Applications > Development>USB Debugging and make sure the option is checked.
On your Mac: Download asroot2: http://zenthought.org/tmp/asroot2
Save this file into: /Applications/AndroidSDK/tools
Open Terminal and run the following commands (You can copy and paste):
Code:
cd /Applications/AndroidSDK/tools
adb push asroot 2 /data/local
adb shell chmod 0755 /data/local/asroot2
adb shell
/data/local/asroot2 /system/bin/sh
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
cd /system/bin
cat sh > su
chmod 4775 su
exit
exit
At this point, the phone has root access.
Download: http://rapidshare.com/files/303797523/recovery-RA-heroc-v1.2.3.img
Save this file into: /Applications/AndroidSDK/tools
Go back to your terminal and type:
Code:
adb push recovery-RA-heroc-v1.2.3.img /sdcard/
adb shell
su
flash_image recovery /sdcard/recovery-RA-heroc-v1.2.3.img
exit
exit
adb shell reboot recovery
Now, the phone will reboot into recovery mode. To preserve our freshly rooted state, we will make a Nandroid backup.
NANDROID BACKUP
*NOTE: These steps assume that you have already entered Recovery Mode on the phone through Terminal "adb shell reboot recovery" or the "Quick Boot" app.*
On phone: Using the trackball, scroll down and select "Nandroid v2.2 backup". This will create a backup of the phone in its freshly rooted state to your SD card, under the nandroid directory.
After it completes the backup, we want to make sure that we have the backup "backed up" by copying it to our Mac (Just in case anything happens to the SD card!).
Select "USB Mass storage on"
After your SD Card appears, copy the contents of the "nandroid" folder to anywhere you wish on your Mac (You are using Time Machine right?)
Once the copy is complete, eject the sdcard in mac and select "USB Mass storage off" on the phone.
NOTE: Nandroid does not backup the contents of your SD card. If you don't want to lose what's on your SD card, MAKE A BACKUP COPY!
From this point forward, if you do something that seems to really mess with the phones functionality, you can simply go back to your Nandroid backup!
RESTORE NANDROID BACKUPS
Select "Nandroid v2.2 restore" *THIS WILL ERASE EVERYTHING ON YOUR PHONE*
Your phone will be returned to the condition it was in as of the last Nandroid backup. You can control which backup is restored by deleting the unwanted, time-stamped folders within the "nandroid" directory on your SD card. If you leave only one time-stamped backup folder, that is the backup that will be restored.
Note that this will leave the custom Recovery ROM we loaded (recovery-RA-heroc-v1.2.3.img) in place.
I actually perform a Restore after every Backup. While this takes extra time, you know your Backup is intact and not corrupted in any way!
If you are looking for a complete factory reset, you will need to scroll up to "TRUE FACTORY RESET (UN-ROOT)"
PREPARE SD CARD FOR APPS2SD (A2SD)
For those unaware, apps2sd allows you to save internal phone memory by placing after-market applications onto your SD card. Most users notice a speed benefit from this.
Select "Wipe SD: fat32+ext2+swap" *THIS WILL ERASE EVERYTHING ON YOUR SDCARD*
Select "USB Mass storage on"
The mounted drive should now be empty. Double-check that it was partitioned correctly by opening Disk Utility and verifying 3 partitions on the sdcard: NONAME, disk1s2, and disk1s3. Close Disk Utility.
LOAD Unofficial MoDaCo 1.2c Core ROM
Forum Post: Unofficial MoDaCo 1.2
Download: Unofficial MoDaCo 1.2c Core
Save this file into: your SD card. (the root of your SD card, probably named "NONAME" if you didn't change it. You can change it to whatever you want though.)
Save the file as: "update.zip" (Or rename it)
Eject your sdcard and Select "USB Mass storage off"
Select "Apply sdcard:update.zip"
Select "Reboot system now"
If it successfully loaded, you now have a fresh load of the Unofficial MoDaCo 1.2c ROM! Congrats!
I would recommend that you create another Nandroid backup. Scroll back up to "NANDROID BACKUP" and follow the steps over again and come back to this point.
Now you are ready for the workarounds!
Guide: Workaround Issues (Unofficial MoDaCo 1.2c)
Why'd you make another guide?
nice guide man, no need to respond why you made another guide, the more the merry, nicely detailed as well
Shhhhhh.
I was just curious because there are like six...
I made another guide because while many of the forum posts acomplish bits and pieces, my guide provides the overall picture. Root, ROM, and Backup. And my upcoming "Workarond Issues" guide will collect scattered information in a similar fashion.
I find it ironic that I thanked you for your contribution and you find this guide excessive. Would you prefer that I removed the guide?
No not at all. Yours is nice and concise. There's just a lot, that's all. That's why I said it would be nice if a moderator could have merged all the ones that were already written at the end of mine. Didn't mean any harm.
Ah, I see what you mean. To be honest, I am also making this guide for self reference. If most all of the information I need is together its easier to help myself as well as my friends and the community. Thanks again for all your contributions.
Just to raise awareness, Nandroid does NOT back up your apps if you are using AppsToSD as in MoDaCo. You must back up your apps separately.
True, thanks for the heads up. I'll work on a separate guide that details how to backup your other apps. I believe that anything after-market can be backed up and restored through ASTRO though, and this is much easier for most than adb and Terminal commands (push/pull).
The whole 1.56.651.2 Firmware update is also making me wait to post any further guides, as some of my worksarounds may prove useless. It looks like we still have the Apps Renaming and Reverting issue though, and I didn't see the Sprint admin adress such issues specfically.
?
ok i did the update to the hero. and now found out about rooting(im new to all this) do i run that program you put in the beginning with windows? and then does that rom resolve the issue with battery with sms and other things the OTA update fixed? or should i get another rom or .img idk what to call it really and what does RUU stand for?
Alright,
A couple things to add to this guide, for the complete noob, as I can try to explain it a little more clear.
This should be done prior to doing anything within the guide.
First, connect your phone to your computer and mount your sd card. This can be done by connecting the usb cable, then on your phone, drop down the menu and chose, connect to p.c., Mount SD card. Make a folder and backup your entire sd card to this folder. Once done, delete everything off the card. if you don't, you will run into format and partitions errors later in the guide.
Eject the sd card on the computer, and end usb sharing on the phone. remove the USB cable from the computer.
Next, on the phone Go to Settings > Applications > Development>USB Debugging
Make sure that USB debugging is NOT CHECKED. If its checked later in the guide you will run into errors pushing the files onto the phone.
At this point you can start the guide from the beginning, under the main heading Root Hero [MAC]
I am running OSX 10.6.2 so i ran into a couple of issues.
Next. Under the part where you have to create the .bash file. This file should be saved in your user folder.
/Users/USERNAME where USERNAME is the name of your user account.
For instance my User account is Hamspiced so my user folder is:
/Users/Hamspiced/
when saving the file, uncheck "if no extension is provided, use .txt".
Next, I couldn't copy paste the code because it wasn't parsed properly. This is what i had to do.
And this should be a direct copy paste into terminal. If you don't know how to access terminal click the spyglass in the upper right hand of the screen, and type in terminal. then you should be able to directly copy paste this text.
Code:
cd /Applications/AndroidSDK/tools
./adb push asroot2 /data/local
./adb shell chmod 0755 /data/local/asroot2
./adb shell
/data/local/asroot2 /system/bin/sh
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
cd /system/bin
cat sh > su
chmod 4775 su
exit
exit
As stated you should have root access on the phone. you can verify this by downloading Terminal emulator from the Market, then running the app. Once inside the app if you hold Menu, you should bring up the onscreen keyboard. if you type in "su" (stands for super user) it will change the prompt from $ to #. If yours does not change, start over, something went wrong. If it did change then you can proceed to the next part of this guide.
Next the guide is trying to put the recovery Image to your phone. This doesnt restore your phone, it just puts the recovery portion to it, and it allows you to do all the cool things to your phone, like allow you to create backups, restore backups, and load customs roms.
again i ran into issues with parsing the correct format so these are copy pastes from terminal.
Code:
./adb push recovery-RA-heroc-v1.2.3.img /sdcard/
./adb shell
su
flash_image recovery /sdcard/recovery-RA-heroc-v1.2.3.img
exit
exit
adb shell reboot recovery
If you get an access denied error pushing the recovery image, its because you had debugging turned on prior to connecting your phone to the computer. it must be off, then turned on once the phone is connected.
This will result in headaches, and endless google searching with no results.
Follow the rest of the guide regarding the Nandroid backup this backs up the entire phone settings. you want to save the raw phone backup as well as the backup after you load the rom. both are incredibly important!
Prepare SD Card for Apps2sd….
If when you checked Disk Utility and your SD card didnt partition properly follow these steps.
You must erase everything on your sd card for these steps to work. I ran into errors creating the partition. What i had to do was in the recovery mode chose factory recovery. when the phone restarted i had to go to Settings>Security>Factory Data Reset.
This restored EVERYTHING. THe phone, Sd Card, Etc. Everything was lost, however since in the begining, we made a backup of the SD card, and then we made a backup of our phone, we are fine.
Restart the phone in recovery mode once this finishes and restarts. (Hold Home and Power to turn on)
Next chose Part SD: fat32+ext2+swap this will partition the card properly. Then choose restart phone.
Once the phone restarts, we have to go through the normal steps that we did once we first received the phone for its first bootup. connect it to the computer, transfer over the Nandroid backup that should be saved from the first time you saved it on your phone. then restart the phone again in recovery mode.
Now you need to restore the nandroid backup. since you transferred it over, its the only nandroid backup there is, it will restore the phones origional settings. from here you can load the official MoDaCO rom fine on the SD card that is now formatted properly.
These are about all the issues and resolutions i ran into. Hopefully it helps someone else.
Guess it's subjective. I think I haven't turned off USB Debugging since shortly after I got the phone and didn't run into any problems. It's always on before I plug it in and I haven't ran into any errors while pushing a file to my sd card. Also didn't erase my sd card before I formatted (did back it up though of course) and everything went smooth. Dunno. It's always good to hear from diff people though. Also just edited my thread, thanks for the heads up.
need help rooting htc hero from sprint
i have 1.5 firmware bb version is 1.04.01.09.21 kernel version 2.6.27-533ce29dhtc [email protected] build number1.56.651.2 cl85027software 1.56 cant get root on this device can someone please help me
quis5550 said:
i have 1.5 firmware bb version is 1.04.01.09.21 kernel version 2.6.27-533ce29dhtc [email protected] build number1.56.651.2 cl85027software 1.56 cant get root on this device can someone please help me
Click to expand...
Click to collapse
Try here
http://forum.xda-developers.com/showthread.php?t=581686&highlight=root+mac
First, excellent guide! Personally, I used Universal Androot (snipurl.com/uaroot) to root my Hero, but this was a huge help in getting the SDK installed!
I'm running into a problem while trying to do the Nandroid backup. When I try to flash the recovery image, I get the following error message....
AJBlue98$ ./adb shell
$ cd /sdcard/
$ su
# flash_image recovery recovery-RA-herocv1.6.2.img
flash_image: not found
Click to expand...
Click to collapse
I even try the command with the leading "./" and I get essentially the same thing...
# ./flash_image recovery recovery-RA-herocv1.6.2.img
./flash_image: not found
Click to expand...
Click to collapse
I'm running the latest official Sprint 2.1 ROM on my Hero and Terminal on Mac OS X Snow Leopard 10.6.4 on a late-2009, 17 in. MacBook Pro. Oh, and I installed the Android SDK into another directory (had it installed before I found this tutorial), so here's my $PATH...
-bash: type: /opt/local/bin:/opt/local/sbin:/Users/AJBlue98/soylatte/bin:/Users/AJBlue98/android-sdk-mac_86:/opt/local/bin:/opt/local/sbin:/opt/local/bin:/opt/local/sbin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin:/usr/texbin:/usr/X11/bin: not found
Click to expand...
Click to collapse
Am I missing something? I'll really appreciate the help!
—Adam
ajblue98 said:
First, excellent guide! Personally, I used Universal Androot (snipurl.com/uaroot) to root my Hero, but this was a huge help in getting the SDK installed!
I'm running into a problem while trying to do the Nandroid backup. When I try to flash the recovery image, I get the following error message....
I even try the command with the leading "./" and I get essentially the same thing...
I'm running the latest official Sprint 2.1 ROM on my Hero and Terminal on Mac OS X Snow Leopard 10.6.4 on a late-2009, 17 in. MacBook Pro. Oh, and I installed the Android SDK into another directory (had it installed before I found this tutorial), so here's my $PATH...
Am I missing something? I'll really appreciate the help!
—Adam
Click to expand...
Click to collapse
yeah, you're missing the "flash_image" binary on your phone lol search xda for it and push it to /system/bin, then try the command again.
regaw_leinad said:
yeah, you're missing the "flash_image" binary on your phone lol search xda for it and push it to /system/bin, then try the command again.
Click to expand...
Click to collapse
Thanks, regaw_leinad, for the lead! I found a copy of the flash_image file and copied it to my Android SDK folder, but when I try to push it to my phone, I get this:
AJBlue98$ ./adb push flash_image /system/bin
failed to copy 'flash_image' to '/system/bin/flash_image': Permission denied
failed to copy 'flash_image' to '/system/bin/flash_image': Read-only file system
Click to expand...
Click to collapse
(I rebooted the phone and tried again after my original post. The error message changed. BTW I'm connected via USB with debugging turned on and "Charge only" selected as my connection type.)
I've tried running adb as root, but I get this:
AJBlue98$ ./adb root
adbd cannot run as root in production builds
Click to expand...
Click to collapse
Again, any help will be greatly appreciated!
—AJBlue98
ajblue98 said:
Thanks, regaw_leinad, for the lead! I found a copy of the flash_image file and copied it to my Android SDK folder, but when I try to push it to my phone, I get this:
(I rebooted the phone and tried again after my original post. The error message changed. BTW I'm connected via USB with debugging turned on and "Charge only" selected as my connection type.)
I've tried running adb as root, but I get this:
Again, any help will be greatly appreciated!
—AJBlue98
Click to expand...
Click to collapse
ok type
adb shell
then
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
to mount it as r/w
then try the flash image command again.
Adb root or adb remount won't work, because your boot.img isn't patched yet.
regaw_leinad said:
ok type
adb shell
then
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
to mount it as r/w
then try the flash image command again.
Adb root or adb remount won't work, because your boot.img isn't patched yet.
Click to expand...
Click to collapse
Okay, I did that. I'm still charge-only and debugging turned on, and here's what happened.
(N.B.: I'm on a Mac, so I have to include "./" before running an application in the current directory. Also, I'm including "AJBlue98" in front of my "$" prompts to differentiate my Mac's local prompts from the adb shell prompts.)
AJBlue98$ ./adb shell
$ mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
mount: Operation not permitted
Click to expand...
Click to collapse
So I tried these few things...
$ su
# mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
# cd /sdcard/
# mv flash_image /system/bin
failed on 'flash_image' - Cross-device link
# exit
$ exit
AJBlue98$ ./adb shell su mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
Permission denied
AJBlue98$ ./adb push flash_image /system/bin
failed to copy 'flash_image' to '/system/bin/flash_image': Permission denied
Click to expand...
Click to collapse
Now I'm completely flummoxed. As always, please help and thanks in advance!
Update: I got frisky, so I tried this, just for the heck of it...
AJBlue98$ ./adb shell
$ su
# cd /sdcard
# ./flash_image recovery /sdcard/recovery-RA-heroc_v1.2.3.img
./flash_image: permission denied
# chmod 755 ./flash_image
# ./flash_image recovery /sdcard/recovery-RA-heroc_v1.2.3.img
./flash_image: permission denied
# su ./flash_image recovery /sdcard/recovery-RA-heroc_v1.2.3.img
Permission denied
Click to expand...
Click to collapse
Update 2:
I got some help at irc.twit.tv from a good soul in the #twitlive channel, who pointed me to ROM Manager (downloadable from the Market). That just did the whole backup, hey-presto, no flash_image BS required.
Thanks for the help anyway, all!
ajblue98 said:
Okay, I did that. I'm still charge-only and debugging turned on, and here's what happened.
(N.B.: I'm on a Mac, so I have to include "./" before running an application in the current directory. Also, I'm including "AJBlue98" in front of my "$" prompts to differentiate my Mac's local prompts from the adb shell prompts.)
So I tried these few things...
Now I'm completely flummoxed. As always, please help and thanks in advance!
Update: I got frisky, so I tried this, just for the heck of it...
Update 2:
I got some help at irc.twit.tv from a good soul in the #twitlive channel, who pointed me to ROM Manager (downloadable from the Market). That just did the whole backup, hey-presto, no flash_image BS required.
Thanks for the help anyway, all!
Click to expand...
Click to collapse
sweet, glad you got it worked out
there were a few errors in what you did above, but looks like you got everything working without it, so that's good
I have an otherwise stock EVO that I need to remove a file from /data.
Can I do this using adb?
It looks like I need root access to do this?
mount gives "operation not permitted" error. Is this a major undertaking or can I just install a simple package to get me access to this folder?
Maybe it will help if I give more details.
I have my phone connected to my laptop via USB, and am using adb shell to gain shell access to the phone.
If I cd to /data, it looks empty. I know it's not empty, because one of my apps stores data there.
I have read elsewhere that there may be a version of su that I can download and install via adb push. Could I use this to gain root access via adb shell and then use that to remount the /data file system so that I could modify files there?
It just occured to me that maybe I could use adb push to overwrite the files. I'll look into that too, but I'm sure I would get permission problems with that too.
Update: One click root has been using this "simple" method since version 2.2.7. If you're rooting your phone for the first time, please try that first. Consider this thread to be purely informational for those who want step-by-step details of how the process works.
I've been suspicious of the joeykrim root method since it was first posted at SDX. I finally got my Epic yesterday and confirmed that is, indeed unnecessary. I don't fault joeykrim though, he ported the working root method from the Moment to the Epic without actually having access to an Epic himself.
Anyways, the joeykrim root method is unnecessarilly complex becuase it works around an RFS permissions bug which loses the setuid bit on the Moment. It appears the Galaxy S phones have this bug fixed, which is why the root methods on the I9000, Vibrant, Captivate, Fascinate, etc., are much simpler.
So, for the simple root:
First, make sure joeykrim root is not installed.
Upgrade to DI18 (not strictly necessary, but you'll want to do it).
Setup a working adb from the Android SDK and whatever drivers are necessary for your platform.
Download rageagainstthecage-arm5.bin from the C skills blog (link removed due to my newbieness) or from any of the one-click root packages.
Download su-2.3.6.1-ef-signed.zip and extract "system/bin/su" and "system/app/Superuser.apk" to a temporary directory you'll be working from.
Enable USB debugging on your phone and connect it to your computer.
Now, open a command prompt/shell on your computer and cd to the appropriate temporary directory. Run:
Code:
adb push rageagainstthecage-arm5.bin /data/local/tmp
adb shell chmod 755 /data/local/tmp/rageagainstthecage-arm5.bin
adb shell /data/local/tmp/rageagainstthecage-arm5.bin
and confirm you have a working root shell. Then continue with:
Code:
adb push su /system/xbin
adb shell chmod 4755 /system/xbin/su
adb install Superuser.apk
That's it! You should have a working root via su & the Superuser package. At least, I did.
Note that the preceeding steps installs Superuser.apk to /data, which is what I prefer to do. This means if you do a "Factory data reset" su will be temporarilly broken until you reinstall the Superuser.apk package. Since installing the package itself doesn't require root, this is easily done after a /data reset.
Also note that I did not perform a /system remount-rw anywhere. At least on my Epic, /system appears to always be mounted read-write so it's an unnecessary step. It's actually the "joeykrim-root.sh" script that remounts /system read-only during the boot process, which is why folks who don't use root kernels have run into this problem before. I'm not sure why joeykrim's script does that, I guess he probably assumed /system is mounted read-only by default. There's arguments that /system should be read-only, but I didn't touch it in case some Samsung stuff depends on it being read-write.
Finally, if you're already rooted via joeykrim or are running a root kernel, there's nothing really to be gained by doing this. I'm just throwing this out there as I perfer to make the minimum invasive changes possible to obtain root.
Wow, that was really informative. To check for Super user you:
Type: adb shell
then type: SU
You should get a # sign if you have root. Correct?
In the original Noobln post method would the Epic keep root even after a wipe therefore not needing to re-apply the superuser apk again? That might be a reason why folks would want to go the more invasive route (considering rooters seems to change ROMS fairly often which requires wipes sometimes). Either way, keeping a copy of the apk file on your SD card is no big deal.
mkasick said:
Also note that I did not perform a /system remount-rw anywhere. At least on my Epic, /system appears to always be mounted read-write so it's an unnecessary step. It's actually the "joeykrim-root.sh" script that remounts /system read-only during the boot process, which is why folks who don't use root kernels have run into this problem before. I'm not sure why joeykrim's script does that, I guess he probably assumed /system is mounted read-only by default. There's arguments that /system should be read-only, but I didn't touch it in case some Samsung stuff depends on it being read-write.
Click to expand...
Click to collapse
This explains a lot of problems! thanks
EDIT- another noob question- why do you prefer to have superuser installed to /system/data- why not put it in /system/app? Also if I want to install busybox where is the best location to put it?
ZenInsight said:
Wow, that was really informative. To check for Super user you:
Type: adb shell
then type: SU
You should get a # sign if you have root. Correct?
Click to expand...
Click to collapse
Once you run rageagainstthecage-arm5.bin, you should get a root-shell automatically every time you run "adb shell" after until you reboot the phone. Yes, you can tell it's a root shell since it uses the "#" prompt. This is the important part to check, since if the exploit doesn't work, you'll have to run it again. But I haven't seen it not work.
After su is installed and you reboot, your steps are correct: run "adb shell", run "su", then you'll be prompted on the phone scren to authorize access and once you allow it you'll end up with a "#" prompt.
ZenInsight said:
In the original Noobln post method would the Epic keep root even after a wipe therefore not needing to re-apply the superuser apk again?
Click to expand...
Click to collapse
noobnl installs Superuser.apk to /system, you can do that here too. Just replace the "adb install Superuser.apk" step with "adb push Superuser.apk /system/app". It's independent of the joeykrim scripts.
With my captivate we have many update.zip root methods to choose from. Any chance this will be coming to the epic? Have a friend with an epic and command lines would be too much and one click didn't work.
Sent from my SAMSUNG-SGH-I897 using XDA App
jimmyz said:
why do you prefer to have superuser installed to /system/data- why not put it in /system/app?
Click to expand...
Click to collapse
I prefer to keep consistent with the idea that user-installed applications go in /data, and stock-installed-and-unmodified applications remain in /system/app. This way, upgrading Superuser.apk doesn't require a root-shell/root-explorer, you can remove it or upgrade it the way you do with any user installed application--adb install, side-loading via an sdcard, or downloading it from the market.
Plus, in general I prefer to keep my /system as untouched as possible. For example, I don't remove stock apps either. The "su" binary has to be installed in /system to persist after a /data wipe, and busybox is best installed to /system so it's in PATH (haven't looked into modifying the default PATH yet). Otherwise I try to keep /system alone.
jimmyz said:
Also if I want to install busybox where is the best location to put it?
Click to expand...
Click to collapse
Android's default PATH provides four places for busybox to be installed: /sbin, /system/bin, /system/sbin, and /system/xbin. /sbin is part of the initramfs, in other words it's controlled by the kernel you're running. You can install busybox to any of the three /system/*bin directories, but I prefer /system/xbin.
In the traditional Unix conventions, "/usr/bin" is for user-runnable stock-installed programs, and "/usr/sbin" is for root-requiring (superuser-runnable) stock-installed programs. "xbin" isn't part of the standard convention, but I'd guess it's intended for "extra binaries" that are not part of the stock installation (much like /usr/local/bin), thus it seems like an appropriate location for a user-added "su" and "busybox" programs.
The second reason is that "xbin" is relatively empty, so if you want to create the applet symlinks (i.e., so that you can call "cp" instead of "buybox cp") it won't overwrite the stock toolbox symlinks. Also, since "xbin" is last on the default PATH, any programs provided by both toolbox and busybox will default to the toolbox version--which would be important for stock system scripts that might run into compatibility issues if they were to use the busybox versions instead.
To install busybox, grab a copy of the binary from somewhere (one click packages, a copy of stericson.busybox.apk, etc.). Then, once rooted run:
Code:
adb push busybox /data/local/tmp
adb shell
su # Authorize on phone screen
cat /data/local/tmp/busybox > /system/xbin/busybox
chown root.shell /system/xbin/busybox
chmod 755 /system/xbin/busybox
rm /data/local/tmp/busybox
/system/xbin/busybox --install -s /system/xbin
jhnstn00 said:
With my captivate we have many update.zip root methods to choose from. Any chance this will be coming to the epic?
Click to expand...
Click to collapse
I don't believe so. The I9000/Vibrant/Captivate have recoveries that don't check the signature of update.zip (as I understand, or maybe they do but only require test keys) which makes rooting-via-recovery possible. Unfortuntaely the Epic and Fascinate do perform signature checks, so we can't enable root via stock-recovery.
That said, the Fascinate one-click methods should also work on the Epic. Although depending on why your friend couldn't get the Epic one-click to work, the Fascinate one may not work either.
mkasick said:
I prefer to keep consistent with the idea that user-installed applications go in /data, and stock-installed-and-unmodified applications remain in /system/app. This way, upgrading Superuser.apk doesn't require a root-shell/root-explorer, you can remove it or upgrade it the way you do with any user installed application--adb install, side-loading via an sdcard, or downloading it from the market.
Plus, in general I prefer to keep my /system as untouched as possible. For example, I don't remove stock apps either. The "su" binary has to be installed in /system to persist after a /data wipe, and busybox is best installed to /system so it's in PATH (haven't looked into modifying the default PATH yet). Otherwise I try to keep /system alone.
Android's default PATH provides four places for busybox to be installed: /sbin, /system/bin, /system/sbin, and /system/xbin. /sbin is part of the initramfs, in other words it's controlled by the kernel you're running. You can install busybox to any of the three /system/*bin directories, but I prefer /system/xbin.
In the traditional Unix conventions, "/usr/bin" is for user-runnable stock-installed programs, and "/usr/sbin" is for root-requiring (superuser-runnable) stock-installed programs. "xbin" isn't part of the standard convention, but I'd guess it's intended for "extra binaries" that are not part of the stock installation (much like /usr/local/bin), thus it seems like an appropriate location for a user-added "su" and "busybox" programs.
The second reason is that "xbin" is relatively empty, so if you want to create the applet symlinks (i.e., so that you can call "cp" instead of "buybox cp") it won't overwrite the stock toolbox symlinks. Also, since "xbin" is last on the default PATH, any programs provided by both toolbox and busybox will default to the toolbox version--which would be important for stock system scripts that might run into compatibility issues if they were to use the busybox versions instead.
To install busybox, grab a copy of the binary from somewhere (one click packages, a copy of stericson.busybox.apk, etc.). Then, once rooted run:
Code:
adb push busybox /data/local/tmp
adb shell
su # Authorize on phone screen
cat /data/local/tmp/busybox > /system/xbin/busybox
chown root.shell /system/xbin/busybox
chmod 755 /system/xbin/busybox
rm /data/local/tmp/busybox
/system/xbin/busybox --install -s /system/xbin
Click to expand...
Click to collapse
You sir are a true gentleman! Thank you for the informative answers- its great to have you over here! I have one more question- why can't I usually push directly to /system ?
jimmyz said:
why can't I usually push directly to /system ?
Click to expand...
Click to collapse
Pushing directly to /system requires running the adb service on the phone as the root user, so that it has permissions to write to that directory. Usually adb runs on the phone unprivileged, so you can only push to world-writable directories.
Running rageagainstthecage-arm5.bin actually changes this. The exploit forces the adb service to run as the root user, which is why "adb shell" gives you a root shell and "adb push" to /system does work, until the phone is restarted.
Interesting enough, the adb service also runs as root by default in the Android emulator. So there's probably a configuration setting, somewhere, to make it do that. In general it's safer to run adb unprivileged though, and "su" to move files to /system once uploaded elsewhere on the phoe.
mkasick said:
Pushing directly to /system requires running the adb service on the phone as the root user, so that it has permissions to write to that directory. Usually adb runs on the phone unprivileged, so you can only push to world-writable directories.
Running rageagainstthecage-arm5.bin actually changes this. The exploit forces the adb service to run as the root user, which is why "adb shell" gives you a root shell and "adb push" to /system does work, until the phone is restarted.
Interesting enough, the adb service also runs as root by default in the Android emulator. So there's probably a configuration setting, somewhere, to make it do that. In general it's safer to run adb unprivileged though, and "su" to move files to /system once uploaded elsewhere on the phoe.
Click to expand...
Click to collapse
I am learning a lot!!! Could you take a look at koush's kernel here, with it I noticed that when using adb I got the # prompt right away and was able to push to /system- maybe he was able to figure out the config settings? Once again thanks!!!
one more ? (feel free to ignore this one) what actually happens when you do
Code:
adb shell /data/local/tmp/rageagainstthecage-arm5.bin
and how does that give you permanent root?
mkasick said:
Pushing directly to /system requires running the adb service on the phone as the root user, so that it has permissions to write to that directory. Usually adb runs on the phone unprivileged, so you can only push to world-writable directories.
Running rageagainstthecage-arm5.bin actually changes this. The exploit forces the adb service to run as the root user, which is why "adb shell" gives you a root shell and "adb push" to /system does work, until the phone is restarted.
Interesting enough, the adb service also runs as root by default in the Android emulator. So there's probably a configuration setting, somewhere, to make it do that. In general it's safer to run adb unprivileged though, and "su" to move files to /system once uploaded elsewhere on the phoe.
Click to expand...
Click to collapse
It is indeed a config option in default.prop. However, this is in the initramfs and you can't change it on the fly, so you need to rebuild the kernel to change it. With some work you can modify the stock kernel to do it, but I personally haven't tried it.
Sent from my Epic 4G using XDA App
Thank you, this worked perfectly for me, running stock DI18 ROM that I flashed tonight!!! I confirmed by installing the wireless tethering pre-9 apk, and successfully ran the wireless tethering without any errors.
Quick question: do we need to do this after root or is it not needed?
NEEDED?? ===> SuperUser App to help with Security Concerns for the Epic - h**p://forum.sdx-developers.com/epic-development/superuser-app-to-help-with-security-concerns/
Also, Titanium Backup failed to work - it gave an error of denied root access, and said busybox was not installed. What needs to be done to make it work? Do I need to install clockwork mod (not exactly sure what it does though) or a custom ROM?
AndroidSPCS said:
Quick question: do we need to do this after root or is it not needed?
Click to expand...
Click to collapse
Not sure exactly what you're asking. This is an alternative to the joeykrim-based one-click roots and rooted kernels. If you already have one of those this isn't really necessary.
AndroidSPCS said:
NEEDED?? ===> SuperUser App
Click to expand...
Click to collapse
Yes, the su binary used here requires the Supruser appto be installed to authorize su requests. Otherwise they'll always be denied. Other su binaries might not require it, but then all apps have root access which isn't really a good thing.
AndroidSPCS said:
Also, Titanium Backup failed to work - it gave an error of denied root access, and said busybox was not installed. What needs to be done to make it work?
Click to expand...
Click to collapse
Did you authorize Titanium Backup when the Superuser prompt came up (requies the Superuser app to be instald too)?
Titanium Backup has an option to download and install it's preferred version of busybox. Follow the prompts to do that.
mkasick said:
Not sure exactly what you're asking. This is an alternative to the joeykrim-based one-click roots and rooted kernels. If you already have one of those this isn't really necessary.
Click to expand...
Click to collapse
Thanks, actually this was referring to the thread where the instructions for going to adb shell or terminal and typing in the following commands:
adb shell
su
mount -t rfs -o remount,rw /dev/block/stl9 /system
cp /system/bin/su /system/bin/jk-su
exit
Yes, the su binary used here requires the Supruser appto be installed to authorize su requests. Otherwise they'll always be denied. Other su binaries might not require it, but then all apps have root access which isn't really a good thing.
Click to expand...
Click to collapse
Yes same as above, the question is not whether we need SU app (I know we do), but whether we needed to type the additional commands:
adb shell
su
mount -t rfs -o remount,rw /dev/block/stl9 /system
cp /system/bin/su /system/bin/jk-su
exit
What do these commands do? It seems to me my Superuser app is working fine with wifi tether - popping up with allow / disable permission boxes, etc. Do these commands add something else to Superuser?
Did you authorize Titanium Backup when the Superuser prompt came up (requies the Superuser app to be instald too)?
Titanium Backup has an option to download and install it's preferred version of busybox. Follow the prompts to do that.
Click to expand...
Click to collapse
There was no Superuser prompt during the install of the app, nor anytime when it said it had a failure with root access. However there is an option to install BusyBox, which I have not done yet, because I am not sure what busybox is, or what it does. I'd like to find out why I need it and what it does, so I can feel comfortable with installing it.
Thanks again.
echo "root::0:0:root:/data/local:/system/bin/sh" > /etc/passwd
echo "root::0:" > /etc/group
you need to do that in a shell to make sure su works properly.
I'm updating the one click root right now to be less silly.
http://forum.xda-developers.com/showpost.php?p=8543226&postcount=455
I just cleaned up the one click root to not do many of the silly things joeykrim's root does. It also means your system will be mounted as rw after a reboot and it won't overwrite your su with jk-su every boot (no more modified playlogo).
Cleaned up all the old stuff from the root so it should work fine even if you were using one of the older one clicks. I made sure su works, incl titanium backup.
I'm still installing superuser.apk to /system/app because I think it belongs there.
Thanks for doing the footwork, mkasick!
Firon said:
http://forum.xda-developers.com/showpost.php?p=8543226&postcount=455
I just cleaned up the one click root to not do many of the silly things joeykrim's root does. It also means your system will be mounted as rw after a reboot and it won't overwrite your su with jk-su every boot (no more modified playlogo).
Cleaned up all the old stuff from the root so it should work fine even if you were using one of the older one clicks. I made sure su works, incl titanium backup.
I'm still installing superuser.apk to /system/app because I think it belongs there.
Thanks for doing the footwork, mkasick!
Click to expand...
Click to collapse
Firon- why are these lines still needed?
Code:
adb push playlogo /system/bin/playlogo
what is playlogo? Does this just put the stock one back in case you used the joeykrim method in the past?
Code:
adb push remount /system/xbin/remount
Are the remount scripts still needed?
Code:
adb shell ln -s /system/xbin/su /system/bin/su
why is this link needed? why cant su just be in xbin
thanks in advance!
Code:
jimmyz said:
Firon- why are these lines still needed?
Code:
adb push playlogo /system/bin/playlogo
what is playlogo? Does this just put the stock one back in case you used the joeykrim method in the past?
Click to expand...
Click to collapse
This is just pushing the stock playlogo, since joeykrim's method overwrites it with some custom script.
Code:
adb push remount /system/xbin/remount
Are the remount scripts still needed?
Click to expand...
Click to collapse
The script allows you to easily remount system as ro or rw at will. Why not?
Code:
adb shell ln -s /system/xbin/su /system/bin/su
why is this link needed? why cant su just be in xbin
Click to expand...
Click to collapse
I don't know if any apps depend on it being in a particular location. It is in xbin, but I'm also linking it to /system/bin to be safe.
AndroidSPCS said:
What do these commands do? It seems to me my Superuser app is working fine with wifi tether - popping up with allow / disable permission boxes, etc. Do these commands add something else to Superuser?
Click to expand...
Click to collapse
These commands were necessary to get Superuser working with the old joeykrim root method. They're not necessary with this method (or the newly released one-click). In other words, if wifi-tethering is already working for you, nothing further is needed to be done.
AndroidSPCS said:
There was no Superuser prompt during the install of the app, nor anytime when it said it had a failure with root access.
Click to expand...
Click to collapse
I don't actually use TitaniumBackup. I'm not sure why its superuser-requirements would be different from other apps, but I guess it is. The new one-click appears to address this.
AndroidSPCS said:
However there is an option to install BusyBox, which I have not done yet, because I am not sure what busybox is, or what it does. I'd like to find out why I need it and what it does, so I can feel comfortable with installing it.
Click to expand...
Click to collapse
Busybox is a suite of "familar" Unix command-line utilites (things like cp (copy), mv (move), ls (list), etc.). It targets embedded platforms by being very featureful, yet relatively small. It's installed and used on a wide variety of embedded devices including wireless routers, print servers, phones, even televisions.
Oddly enough, Android does not include busybox by default. Instead it comes with it's own utility-programs-package called "toolbox" that isn't nearly as featureful, and quickly becomes a pain to use. Some programs, like TitaniumBackup depend on busybox programs/features, and thus require it's installation. It's safe.
The only problem with busybox is that there's not one single version of it. There's multiple builds of it from the same source code with different sets of features turned on and off. In the past, some folks had a version of busybox installed that didn't contain all the features necessary to support TitaniumBackup, so they added the option to install their own version. It's installed in a separate location, so it won't overwrite any version you do have installed, and it's safe to do. But if you've already installed another version of busybox that does work, then it may be unnecessary.
I did the Jokeyrim method a few days ago. I installed a new kernal and now a new ROM. All seems ok, but ow when I do the "whoami" command in adb shell I get whoami not found. I don't think I'm really rooted anymore. Any attempt to reinstall the Jokeyrim root script results in failure (mostly "device not found" errors). When in adb shell, most commands I type now are either "not found" or "permission denied", so I'm not confident that I'm really rooted now.
Since I have / had Jokeyrim installed, how can I "uninstall" it so that I can use this method of rooting instead? BTW, the newest Clockworkmod is installed and working.
Do I need to flash to stock first? Sorry, but I'm a VERY STOOPID NOOB.
Dear Sirs,
I have HTC Desire Z with CM 7.0.3 (superuser installed) and s-off. Posting here since the issue seems relevant to android in general rather than specific hardware...
I have already seen the following threads before opening this one but they do not help since I cannot issue any of the commands that they mention:
:http://forum.xda-developers.com/showthread.php?t=1364521
:http://forum.xda-developers.com/showthread.php?t=1087350
:http://forum.xda-developers.com/showthread.php?t=837102 (it says to use mount command but thats exactly where I get the permission denied)
When I boot the phone normally and "adb shell", I can get a root prompt (id command shows root user, "cd" shows "/"). But ANY command I run brings permission denied (even ls, chmod, mount). I literally can't do anything. Same whether I boot with/without S D card. I CAN however issue commands such as "adb pull /init.rc" if I exit and go back to DOS.
If I open a terminal session (with Superuser full permissions), I can SU as root, but again cannot issue any commands without getting "permission denied"/
However if I boot into clockworkmod recovery and mount /data and /system, and then open an adb shell via USB, I can connect as root and browse everything, everything is fine and all commands work OK. /etc/fstab shows all partitions would be mounted as rw.
So it looks like some application during boot, is resetting the permission for /system to be ro, and also removing root's privileges.
Please could you let us know if there is a method to determine what app is doing this during boot. I cannot see anywhere in init.rc where I can catch this application that is doing this and prevent it from making /system inaccessible after boot.
Preferably if someone could point me to the complete log of the boot process that shows each command that is run, I might have a clue as to where in the boot up process, the /system partition suddenly becomes ro and root loses all permissions.
The problem prevents busybox updating and other root apps that need to write to /system.
This was not a problem for months after installing and rooting CM 703, only recently it has become an issue, perhaps following some hidden Google update???
Thanks
A few weeks ago one of my important apps started crashing on open.
Since I have important informaiton saved on that app I need to obtain it.
Is there a way to access that package folder (and that app is not debuggable) with adb or shell?
When I try to access via adb and shell the result it Permission denied.
I can't root the phone, so this is out of the quesiton.
I'm using Google Pixel 1 with Android 10 Build - Build/QP1A.191005.007.A3)
There isn't any way to access /data/data/ as a normal user or shell user, the only user able to access that is root, at least according to the permissions.
You could try to backup using "adb backup package", then you could apply this backup back on another phone or on this same app after reinstalling it.
bystroy said:
A few weeks ago one of my important apps started crashing on open.
Since I have important informaiton saved on that app I need to obtain it.
Is there a way to access that package folder (and that app is not debuggable) with adb or shell?
When I try to access via adb and shell the result it Permission denied.
I can't root the phone, so this is out of the quesiton.
I'm using Google Pixel 1 with Android 10 Build - Build/QP1A.191005.007.A3)
Click to expand...
Click to collapse
Temporarily root phone's Android, means add su cmdlet what is suitable, and then mount the partition in question as RW by means of ADB applying su.
Example:
Code:
adb devices
adb push <SU-BINARY> / data/local/tmp/
adb shell "chmod +x /data/local/tmp/su"
adb shell "/data/local/tmp/su -c 'mount -t auto -o rw,remount <PARTITION-IN-QUESTION>'"
adb pull "<DIRECTORY-TO-PULL>" <LOCATION-ON-PC>