[TUT] How-To Root Fire HD 7, 8, and 10 6th, 7th, and 8th generation - Fire HD 8 and HD 10 General

Edit: Someone pointed out the title is not completely accurate, so I changed it to be more descriptive and I will add a list of devices this root method will work with here
Edit2: Thanks to @Rortiz2 for the automated method! You can download it here! Simply extract the files and run MTK-SU.bat to install the SuperSU app and root your device. Once you reboot after the batch script has completed, simply open SuperSU, go to settings, and ensure that default root access for apps is set to grant.
Fire HD 8 8th gen (2018) (thanks @xyz`)
Fire HD 8 7th gen (2017)
Fire HD 8 6th gen (2016) (thanks @bibikalka)
Fire HD 10 7th gen (2017) (thanks @bibikalka)
Fire TV 2 2015 (mt8173-based) (thanks @el7145) -- up to firmware 5.2.6.9
Fire 7 9th gen (2019) (thanks @Michajin)
Before trying this root method, please read through this entire post: 5 and make sure it will work for your device!
Note: I did not create these methods, all credit goes to @diplomatic and @dutchthomas
I simply wanted to put it into a single forum post with easy instructions.
With that out of the way, lets get started.
Only use this for Fire OS 5.x.x.x, I haven't tested it with the latest version, but it should still work.
First, follow these instructions by diplomatic:
After you have verified that you have access to a root shell (The '[email protected]:/ $' will change to '[email protected]:/ #) you can follow these steps by dutchthomas:
1. Install SuperSu from Playstore (if you do not have the playstore installed, you can follow the guide by @Gilly10 here https://forum.xda-developers.com/amazon-fire/general/how-to-install-google-play-store-fire-t3486603)
2. Download SuperSu and unzip somewhere (download the .zip from here)
3. Inside the UPDATE-SuperSU-v2.79-20161211114519.zip there should be an arm64 folder. Copy that folder to your platform-tools folder
Most of this is just going to be copy paste commands
4. adb push arm64/su arm64/supolicy arm64/libsupol.so /data/local/tmp
5. adb shell
6. cd /data/local/tmp
7. ./mtk-su
8. The $ after [email protected] should change to a #, if it doesn't, close the terminal and start again from step 5.
9. mount -o remount -rw /system
10. cp /data/local/tmp/su /system/xbin/su
11. cp /data/local/tmp/su /system/xbin/daemonsu
12. cp /data/local/tmp/supolicy /system/xbin/
13. cp /data/local/tmp/libsupol.so /system/lib/
14. cp /data/local/tmp/libsupol.so /system/lib64/
15. chmod 0755 /system/xbin/su
16.
Code:
chcon u:object_r:system_file:s0 /system/xbin/su
17.
Code:
chcon u:object_r:system_file:s0 /system/xbin/su
18.
Code:
chcon u:object_r:system_file:s0 /system/xbin/daemonsu
19. daemonsu --auto-daemon
20. Back on your device, open the SuperSU app and allow it to update its binaries.
After updating the SuperSU binaries, reboot your device. Once you are back to your main screen, open SuperSU, go to settings, Then scroll down to Access. Click the [Grant] option for Default Access. You need to do this because for unknown reasons the Kindle Fire is unable to show the root access popup. Your device is now fully rooted!

https://forum.xda-developers.com/showpost.php?p=79441935&postcount=629

The original thread is here: https://forum.xda-developers.com/hd8-hd10/orig-development/experimental-software-root-hd-8-hd-10-t3904595. The title of the current thread does not accurately reflect which tablets can rooted by this method. This information is in the first post of the original thread.

MontysEvilTwin said:
The original thread is here: https://forum.xda-developers.com/hd8-hd10/orig-development/experimental-software-root-hd-8-hd-10-t3904595. The title of the current thread does not accurately reflect which tablets can rooted by this method. This information is in the first post of the original thread.
Click to expand...
Click to collapse
Thanks for the feedback, I updated the post to be more informative!

Rortiz2 said:
https://forum.xda-developers.com/showpost.php?p=79441935&postcount=629
Click to expand...
Click to collapse
Added a link and credit to you on my post, thanks for the script!

SirHappyCatIII said:
Added a link and credit to you on my post, thanks for the script!
Click to expand...
Click to collapse
Ok.

Correction
I now realize it was obvious, but it took me a while to realize there shouldn't be two identical commands.
Instruction #17 should be #18
And #18 should be
Code:
chmod 0755 /system/xbin/daemonsu

Thanks got my Fire HD 8 (6th Gen) running Fire OS 5.3.6.4 (626536720) rooted

deleted

Hi, i followed the steps for my Fire HD 8 8th gen (2018), FireOS 6.3.0.0.
I was able to obtain temporary root access using mtk-su. Prompt is now #.
Step 9 (9. mount -o remount -rw /system) returns this error.
mount: '/dev/block/dm-0'->'/system' : Device or resource busy.
I also tried " "mount -o rw,remount /system"
And it returns this error '/dev/block/dm-0' is read-only.
So I cannot proceed any further. Your help is greatly appreciated.
PS: Your step 1 says install SuperSu from PlayStore. But it seems there isn't a ChianFire SuperSu available in PlayStore. And how is this related to the rest of the steps?

mxj_xda said:
Hi, i followed the steps for my Fire HD 8 8th gen (2018), FireOS 6.3.0.0.
I was able to obtain temporary root access using mtk-su. Prompt is now #.
Step 9 (9. mount -o remount -rw /system) returns this error.
mount: '/dev/block/dm-0'->'/system' : Device or resource busy.
I also tried " "mount -o rw,remount /system"
And it returns this error '/dev/block/dm-0' is read-only.
So I cannot proceed any further. Your help is greatly appreciated.
PS: Your step 1 says install SuperSu from PlayStore. But it seems there isn't a ChianFire SuperSu available in PlayStore. And how is this related to the rest of the steps?
Click to expand...
Click to collapse
what are you looking to do? If you have root access then you can unlock... This thread is kind of old....
https://forum.xda-developers.com/hd...nlock-fire-hd-8-2018-karnak-amonet-3-t3963496

i get this error when i try and download the release 22 zip file
C:\Users\cod3w\AppData\Local\Temp\kKb_tka2.zip.part could not be saved, because the source file could not be read.
Try again later, or contact the server administrator.

Can this be used on the Fire HD 10 8TH GEN?

This guide should be updated. There's no more SuperSU on the Play store. I believe that it hasn't been updated for quite a while before it was taken down. There should be a more updated guide somewhere.

Hi.
I have a Fire HD 8 (6th Generation) ...OS 5.6.8.0 (626542120).
please i use which prosedure for root?

I get a question mark after the 1st command.
PS C:\adb> adb push arm64/su arm64/supolicy arm64/libsupol.so /data/local/tmp
[ ?] /data/local/tmp/libsupol.so
If i continue, it will fail with:
[email protected]:/data/local/tmp $ ./mtk-su
/system/bin/sh: ./mtk-su: not found
Will keep digging, i'm on a fire hd 8 6th gen on 5.3.6.4
I'm only using a very small adb pack, maybe it's that, but i am able to commuinicate.
Will keep at it.
PS: Thank you so much for making this guide, hopefully i can breath some life into this now quite slow tablet.
EDIT: MTK was missing from all folders?
Heres the whole list of commands, now fails on the last part, daemon
PS C:\adb> adb push arm64/su arm64/supolicy arm64/libsupol.so /data/local/tmp
[ ?] /data/local/tmp/libsupol.so
PS C:\adb> adb shell
[email protected]:/ $ cd /data/local/tmp
[email protected]:/data/local/tmp $ ./mtk-su
UID: 0 cap: 3fffffffff selinux: permissive
[email protected]:/data/local/tmp # mount -o remount -rw /system
[email protected]:/data/local/tmp # cp /data/local/tmp/su /system/xbin/su
[email protected]:/data/local/tmp # cp /data/local/tmp/su /system/xbin/daemonsu
[email protected]:/data/local/tmp # cp /data/local/tmp/supolicy /system/xbin/
[email protected]:/data/local/tmp # cp /data/local/tmp/libsupol.so /system/lib/
[email protected]:/data/local/tmp # cp /data/local/tmp/libsupol.so /system/lib64/
[email protected]:/data/local/tmp # chmod 0755 /system/xbin/su
[email protected]:/data/local/tmp # chcon ubject_r:system_file:s0 /system/xbin/su
[email protected]:/data/local/tmp # chcon ubject_r:system_file:s0 /system/xbin/su
[email protected]:/data/local/tmp #
hcon ubject_r:system_file:s0 /system/xbin/daemonsu <
[email protected]:/data/local/tmp # daemonsu --auto-daemon
/system/bin/sh: daemonsu: can't execute: Permission denied
126|[email protected]:/data/local/tmp #
Need to allow permissions i guess but not sure how.
Have tried the other mtk method in the thread mentioned in the OP and have this in powershell, different response to the adb push.
PS C:\adb> adb push .\mtk-su /data/local/tmp
[100%] /data/local/tmp/mtk-su
PS C:\adb> adb shell
[email protected]:/ $ cd /data/local/tmp
[email protected]:/data/local/tmp $ chmod 755 mtk-su
[email protected]:/data/local/tmp $ ./mtk-su
UID: 0 cap: 3fffffffff selinux: permissive
[email protected]:/data/local/tmp #
help

Ok so i managed to root using the mtk-su app from here:
Releases · JunioJsv/mtk-easy-su
Get bootless root access with few clicks. Contribute to JunioJsv/mtk-easy-su development by creating an account on GitHub.
github.com
Now i do have magisk and super su installed but there is no prompt from any root request, however it does say i am rooted according the supersu root checker, plus magisk safetynet fails, so i'm at a loss now.

Related

Panasonic Eluga Power P-07D

Greetings,
I have received my shiny new Eluga Power and I am wondering if anybody else has this device and if anybody has rooted there's?
Sent from my P-07D using xda premium
Edit: moved to Q&A, lets see if you can get some help but do search for your device.
First welcome...
Next time post in the Q&A section for questions. To better serve you do a search for your device and look in the Dev section for your model device...also you will find a Q&A section there, Thank you.
Btw ensure you read the forum rules.
Sent from a closet, at Arkham Asylum using Forum Runner.
ianford10 said:
Greetings,
I have received my shiny new Eluga Power and I am wondering if anybody else has this device and if anybody has rooted there's?
Sent from my P-07D using xda premium
Click to expand...
Click to collapse
Where did you get it from?HOw much? How's it first impression?
mixmaster said:
Where did you get it from?HOw much? How's it first impression?
Click to expand...
Click to collapse
Had to import it from a Japanese eBay store with a cost of £560 with delivery. First impressions of the phone are very good, nice big clear screen, batter life is okay considering the screen size, calls are crisp and clear, feels good in the hand to hold. Will have more info as I use it over the next couple of weeks
Sent from my P-07D using xda premium
Rooting P-07D success...
I was able to root my Panasonic Eluga Power (P-07D) you can check the screenshot below. As of the moment I am re-writing the steps for others so they can easily follow the instructions as this was written in Japanese (Thanks to http://sithxi.blog49.fc2.com/blog-entry-51.html and goroh_kun. Hopefully this would help others root there device just like me. The only main problem for me now is SIM unlock the device.
Panasonic Eluga Power rooting instructions...
As promised here are the steps: (This seems to look like a temporary root, as you will loose it once the device rebooted) But still it's a good primary step. For the source code it can be downloaded from here. Panasonic Eluga Power Source Code
goroh_kun
2012/10/18
root privileges acquisition & tomoyo released experimental version in
the p-07d
things to do
Run:
1. >adb restore p-07d.ab
I press OK authentication
After the restore is finished
2. Open another command prompt and type the following:
>adb shell
$cd /data/data/com.android.settings/a/
$ls -l -d
drwxrwxrwx system system a
- check directory called A exists, it is world readable, writable as
show above
3. $ ls -l
⇒ file00 〜 file99 check if files exists
Delete all file from file00 ~ file99
run the command below
4. >adb shell
$cd /data/data/com.android.settings/
$rm -r a/*
change permissions to 777 /persist
This is the tricky part as you need to to do this using two command prompt, one running the adb restore p-07d.ab while the other on the shell command running ln -s /persist a/file99 command.
5. First run: >adb restore p-07d.ab while it is restoring on the other command prompt run in shell $ ln-s / persist a/file99
6. Now lets check the permission to folder /persist by typing on the command prompt that is already in shell.
$ ls -l -d /persist
drwxrwxrwx system system persist <--(you should see this)
Now move on your other command prompt window and run the following commands. (you can download the needed file at this link
Then run the command below to push the files needed for rooting:
>adb push init.cne.rc /data/local/tmp
>adb push p07dgetroot /data/local/tmp
>adb push xsh /data/local/tmp/
>adb push libQ.so /persist
>adb shell rm /persist/init.cne.rc
>adb shell ln -s /data/local/tmp/init.cne.rc /persist/init.cne.rc
>adb reboot
The next step is kinda hard to understand and I qoute: "/persist at Startup directory of the recovery process because it will not be restored and persist the only symbolic links should be a basic /data/local/tmp to keep the change."
After re-move environment variable is changed to check (LD_PRELOAD= /presist/libQ.so and be sure it is).
7. > adb shell
$echo $LD_PRELOAD
/persist/libQ.so <--(you should see this)
8. To Unlock Tomoyo, follow this steps:
> adb shell
$ cat /data/local/tmp/p07dgetroot > /tmp/xsh
$ ls -l /tmp/xsh
-rw-rw-rw- shell shell xsh <--(you should see this)
Make sure that wirelss LAN is ON before doing the command below:
9. WLAN ON / TURN OFF WLAN / TURN ON WLAN (wait to be connected before typing the below command or you will have to do it again)
$ ls -l /tmp/xsh
-rwsr-sr-x root root xsh <--(you should see this)
$ /tmp/xsh
/tmp/xsh
/tmp/.mem fd=3
read ret = 256
write ret = 256
At this stage, Tomoyo is now unlocked
10.
$rm /tmp/xsh
$cat /data/local/tmp/xsh > /tmp/xsh
11. WLAN ON / TURN OFF WLAN / TURN ON WLAN (wait to be connected before typing the below command or you will have to do it again)
$ls -l /tmp/xsh
-rwsr-sr-x root root xsh <--(you should see this)
12. $/tmp/xsh
$(precmd)[email protected]$HOSTNAME:${PWD:-?} $ <--(you should see
this)
Here is a shell with root privileges, so stand up and be able to work a variety. You can also install the su
13. $(precmd)[email protected]$HOSTNAME:${PWD:-?} $
$ mount -o remount,rw /system /system
$ chmod 777 /system/app/
$ chmod 777 /system/bin/
$ chmod 777 /system/xbin/
Open another command prompt:
adb push Superuser.apk /system/app/
adb push su /system/bin/
adb push busybox /system/xbin/
Go back to ($(precmd)[email protected]$HOSTNAME:${PWD:-?} $) window:
chown root.root /system/bin/su
chmod 6755 /system/bin/su
chmod 644 /system/app/Superuser.apk
chown root.shell /system/xbin/busybox
chmod 755 /system/xbin/busybox
chmod 755 /system/app/
chmod 755 /system/bin/
chmod 755 /system/xbin/
Verify root access by installing "Root Checker".
Note: each time you reboot your device you will need to run Tomoyo Unlock script to regain root access (Step 8 - 12) which I re-wrote below:
8. Tomoyo Unlock
> adb shell
$ cat /data/local/tmp/p07dgetroot > /tmp/xsh
$ ls -l /tmp/xsh
-rw-rw-rw- shell shell xsh <--(you should see this)
WLAN ON / OFF / ON
$ ls -l /tmp/xsh
-rwsr-sr-x root root xsh <--(you should see this)
$ /tmp/xsh
/tmp/xsh
/tmp/.mem fd=3
read ret = 256
write ret = 256
At this stage, tomoyo is released
$rm /tmp/xsh
$cat /data/local/tmp/xsh > /tmp/xsh
WLAN ON / OFF / ON
$ls -l /tmp/xsh
-rwsr-sr-x root root xsh <--(you should see this)
$/tmp/xsh
$(precmd)[email protected]$HOSTNAME:${PWD:-?} $ <---(you should end up here to regain root access, if not redo it again)
Proof:
ask questions
hi,
If it unlocked the device of sim by docomo, when i root it, the condition of unlock sim whether will cancel????
---------- Post added at 12:10 AM ---------- Previous post was at 12:06 AM ----------
dear zyper95,
Can you make the picture to show the process of root??
thank a lot
Panasonic P-07D
Hello, Someone tell me how to reset to factory settings "Android system recovery -> wipe data / factory reset -> Yes-delete all user data -> Please input password". What is the password to be entered? Help please.
Panasonic Eluga Power P-07D hard reset plz:crying::crying::crying:

[Q] ROOT For Noontec A9 ICS 4.0.4 Needed?

Hi, im new to this forum so please go easy guys....
I have a Noontec A9 that i have flashed with ICS 4.0.4 update_RK2918_Android4.0_DDR512M_456M_20120604.img
using RKBatchTool
Described in post #7 here:
http://forum.xda-developers.com/showthread.php?t=1526623The firmware is realy good BUT I cant get root access...
Tried installing superuser etc with no luck :'(
Does anyone know how to root this firmware or is there an alternitive rooted ICS 4.0.4 ROM out???
Verg0
Hi,
Not sure if I can help you with the root problem - but just wondering how you where you can get the ICS update as I can't seem to find this anywhere.
I've got root on the my Noontec A9 based on the previous firmware I installed but its only 2.3. Would much rather have ICS without root (although root is handy).
Thanks in advance.
bjingham said:
Hi,
Not sure if I can help you with the root problem - but just wondering how you where you can get the ICS update as I can't seem to find this anywhere.
I've got root on the my Noontec A9 based on the previous firmware I installed but its only 2.3. Would much rather have ICS without root (although root is handy).
Thanks in advance.
Click to expand...
Click to collapse
Read my top post there is a link to the thread its post number 7, i cant post external links as i dont have enough post counts
verg0 said:
Read my top post there is a link to the thread its post number 7, i cant post external links as i dont have enough post counts
Click to expand...
Click to collapse
Am wondering if there's any development for this? Post number 7 is meant for firmware v1.2.09 but mine is v1.2.10. Furthermore, will it upgrade to ICS? What about the performance since only got 512MB RAM?
So any update on ICS for this device? I dont want to rip apart my machine. Should be a way to do this with USB drive or SD media card.
damez2000 said:
So any update on ICS for this device? I dont want to rip apart my machine. Should be a way to do this with USB drive or SD media card.
Click to expand...
Click to collapse
(missing "www" in all links due to post restrictions...)
- First, regarding the upgrade to ICS 4.0.4 4 (shared.com/zip/UeXHOs6t/Noontec_A9.html), it is NOT necessary to open the device to manage to install the adb driver.
With android in debugging mode when you connect the usb "printer" cable to the PC it will ask for the adb driver.
Get the adb driver from the service page of nontec noontec.com/files/updAteforA9/A9%20software%20update%20guide.zip (it is inside the folder step one_install the driver > ADB_driver_r03-windows)
When you run the RKbatchtool now you should see a pink color in connected device 1. If you press the switch button, it will ask for rockusb driver. Get it from the rockusb_driver folder. After install the color turns blue and you are ready to upgrade to ICS 4.0.4.
- Now it is turn to root ICS 4.0.4
download the adb driver for ICS here mediafire.com/download.php?kmy55fhj9ab2kfe
download the script here multiupload.nl/83WWEZI22K
You get a general script that is NOT necessary to run in full because the adb shell already has root access when in debugging mode;
instead run this simplified "runme.bat" script :
Code:
@files\adb wait-for-device
@echo --- DEVICE FOUND
@echo --- remounting /system rw
@files\adb shell "mount -o remount,rw /system"
@echo --- pushing busybox
@files\adb push files\busybox /system/xbin/.
@echo --- correcting ownership
@files\adb shell "chown root.shell /system/xbin/busybox"
@echo --- correcting permissions
@files\adb shell "chmod 04755 /system/xbin/busybox"
@echo --- pushing SU binary
@files\adb push files\su /system/bin/su
@echo --- correcting ownership
@files\adb shell "chown root.shell /system/bin/su"
@echo --- correcting permissions
@files\adb shell "chmod 06755 /system/bin/su"
@echo --- correcting symlinks
@files\adb shell "rm /system/xbin/su"
@files\adb shell "ln -s /system/bin/su /system/xbin/su"
@echo --- pushing Superuser app
@files\adb push files\Superuser.apk /system/app/.
@echo --- remounting /system ro
@files\adb shell "mount -o remount,ro /system"
@echo --- rebooting
@files\adb reboot
@echo ALL DONE!!!
@pause
jmatbastos said:
(missing "www" in all links due to post restrictions...)
- First, regarding the upgrade to ICS 4.0.4 4 (shared.com/zip/UeXHOs6t/Noontec_A9.html), it is NOT necessary to open the device to manage to install the adb driver.
With android in debugging mode when you connect the usb "printer" cable to the PC it will ask for the adb driver.
Get the adb driver from the service page of nontec noontec.com/files/updAteforA9/A9%20software%20update%20guide.zip (it is inside the folder step one_install the driver > ADB_driver_r03-windows)
When you run the RKbatchtool now you should see a pink color in connected device 1. If you press the switch button, it will ask for rockusb driver. Get it from the rockusb_driver folder. After install the color turns blue and you are ready to upgrade to ICS 4.0.4.
- Now it is turn to root ICS 4.0.4
download the adb driver for ICS here mediafire.com/download.php?kmy55fhj9ab2kfe
download the script here multiupload.nl/83WWEZI22K
You get a general script that is NOT necessary to run in full because the adb shell already has root access when in debugging mode;
instead run this simplified "runme.bat" script :
Code:
@files\adb wait-for-device
@echo --- DEVICE FOUND
@echo --- remounting /system rw
@files\adb shell "mount -o remount,rw /system"
@echo --- pushing busybox
@files\adb push files\busybox /system/xbin/.
@echo --- correcting ownership
@files\adb shell "chown root.shell /system/xbin/busybox"
@echo --- correcting permissions
@files\adb shell "chmod 04755 /system/xbin/busybox"
@echo --- pushing SU binary
@files\adb push files\su /system/bin/su
@echo --- correcting ownership
@files\adb shell "chown root.shell /system/bin/su"
@echo --- correcting permissions
@files\adb shell "chmod 06755 /system/bin/su"
@echo --- correcting symlinks
@files\adb shell "rm /system/xbin/su"
@files\adb shell "ln -s /system/bin/su /system/xbin/su"
@echo --- pushing Superuser app
@files\adb push files\Superuser.apk /system/app/.
@echo --- remounting /system ro
@files\adb shell "mount -o remount,ro /system"
@echo --- rebooting
@files\adb reboot
@echo ALL DONE!!!
@pause
Click to expand...
Click to collapse
Thanks. Just used your method and got ICS rooted without opening the box. But the main reason for having this rooted is to have network drives mounted. Has anyone figured out a working cifs.ko configuration?
Noontec A9 ICS Problem
jmatbastos said:
(missing "www" in all links due to post restrictions...)
- First, regarding the upgrade to ICS 4.0.4 4 (shared.com/zip/UeXHOs6t/Noontec_A9.html), it is NOT necessary to open the device to manage to install the adb driver.
With android in debugging mode when you connect the usb "printer" cable to the PC it will ask for the adb driver.
Get the adb driver from the service page of nontec noontec.com/files/updAteforA9/A9%20software%20update%20guide.zip (it is inside the folder step one_install the driver > ADB_driver_r03-windows)
When you run the RKbatchtool now you should see a pink color in connected device 1. If you press the switch button, it will ask for rockusb driver. Get it from the rockusb_driver folder. After install the color turns blue and you are ready to upgrade to ICS 4.0.4.
- Now it is turn to root ICS 4.0.4
download the adb driver for ICS here mediafire.com/download.php?kmy55fhj9ab2kfe
download the script here multiupload.nl/83WWEZI22K
You get a general script that is NOT necessary to run in full because the adb shell already has root access when in debugging mode;
instead run this simplified "runme.bat" script :
Code:
@files\adb wait-for-device
@echo --- DEVICE FOUND
@echo --- remounting /system rw
@files\adb shell "mount -o remount,rw /system"
@echo --- pushing busybox
@files\adb push files\busybox /system/xbin/.
@echo --- correcting ownership
@files\adb shell "chown root.shell /system/xbin/busybox"
@echo --- correcting permissions
@files\adb shell "chmod 04755 /system/xbin/busybox"
@echo --- pushing SU binary
@files\adb push files\su /system/bin/su
@echo --- correcting ownership
@files\adb shell "chown root.shell /system/bin/su"
@echo --- correcting permissions
@files\adb shell "chmod 06755 /system/bin/su"
@echo --- correcting symlinks
@files\adb shell "rm /system/xbin/su"
@files\adb shell "ln -s /system/bin/su /system/xbin/su"
@echo --- pushing Superuser app
@files\adb push files\Superuser.apk /system/app/.
@echo --- remounting /system ro
@files\adb shell "mount -o remount,ro /system"
@echo --- rebooting
@files\adb reboot
@echo ALL DONE!!!
@pause
Click to expand...
Click to collapse
Hi,
many thanks for all your hard work in colating this info. Could you help me please? I have upgraded to ICS on the A9, and whilst it looks good and no doubt offers more scope for usage, it doesn't agree with simple movie watching and You Tube, causiing audio slippage. I have tried to connect again to the pc but try as I might, the PC doesn't want to know. The device is essentially on it's own. Any ideas how to ressurect the old firmware? I have tried the two pin shorting methods to no avail.
Many thanks in advance.
mcpherson35 said:
Hi,
many thanks for all your hard work in colating this info. Could you help me please? I have upgraded to ICS on the A9, and whilst it looks good and no doubt offers more scope for usage, it doesn't agree with simple movie watching and You Tube, causiing audio slippage. I have tried to connect again to the pc but try as I might, the PC doesn't want to know. The device is essentially on it's own. Any ideas how to ressurect the old firmware? I have tried the two pin shorting methods to no avail.
Many thanks in advance.
Click to expand...
Click to collapse
1- Get Rom Toolbox from Google Play Store
2- Run Rom Toolbox > Rebooter > Reboot Bootloader
3 - RKBatchTool and RKAndroidTool will now detect the device and you can flash another firmware
4 - run "step four_ Install Firmware" from
noontec.com/files/updAteforA9/A9%20software%20update%20guide.zip
to get back to Android 2.3

[GUIDE] Rooting Samsung Galaxy [email protected] GT-B5330

This might work on other devices.
WARNING: this might brick your phone use it at your own risk.
Warning you have to have some knowlage of linux to do this kind of stuff.
WARNING: actually you have to have _good_ knowlage of linux/gnu stuff to do it.
The idea is this is to make the /system/bin/toolbox from the stock rom suid (permision 6755, it originaly has 0755)
This is how I did it. It might be simpler.
get a stock rom that you want. for me it was B5330XWALH3
it is now available at samsung-updates.
You need odin (heimdal will not work with my phone) (my was 3.07)
unpack the zip.
you get a .tar.md5 file (the tar file has broken headers so tar from ubuntu 12.04 will not unpackit).
the tar file works in sectors of 512 bytes.
take out the md5sum at the end of file. (some thing like: head -c (the size up to the last md5sum) original.tar.md5 > file1)
split the file so you will have the system.img.md5 separated (some thing like: head -c (the size upto "system.img.md5") file1 > file2;
head -c (the size upto "dt-blob.md5") file1 | tail -c +(the size upto "system.img.md5" + 1) > file3;
tail -c +(the size upto "dt-blob.md5" + 1) file1 > file4
file3 now has the system.img.md5, trim the md5sum from the tail and the tar headr from head (ex.:
head -c (upto the md5sum output from the rear of the file) file3 | tail -c +513 > file5)
file5 is a sparce image file of an ext4 filesystem. run simg2img (from ext4fs_utils (search on xda)) (ex.:
simg2img file5 file6)
sudo mount -o loop,ro file6 /mnt
look for the file /mnt/bin/toolbox (ex.: ls -l /mnt/bin/toolbox) it will give you an output like this:
-rwxr-xr-x 1 root 2000 99068 Aug 9 07:59 /mnt/bin/toolbox
sudo umount /mnt
the permisions and the size of the file yield the following hex sequence that you get in the file (we will hexedit the ext4 fs): ED 81 00 00 FC 82 01 00
in file3 edit the sequence (it should be only one in the file) from ED 81 00 00 FC 82 01 00 to ED 8D 00 00 FC 82 01 00 (practically adding the suid guid bits to the inode of the toolbox)
we are almost done, now to pack our bags and go.
verify that you have indeed put suid guid to toolbox:
head -c (upto the md5sum output from the rear of the file) file3 | tail -c +513 > file5;
simg2img file5 file6;
sudo mount -o loop,ro file6 /mnt;
ls -l /mnt/bin/toolbox
It should give an output:
-rwsr-sr-x 1 root 2000 99068 Aug 9 07:59 /mnt/bin/toolbox
sudo umount /mnt
recalculate the md5sum to the _expanded_ image: md5sum file6 > file7
overide the md5sum at the end of file3 with the one from file7
now pack the pieces in one tar: cat file2 file3 file4 > myfirmware.tar
add the md5sum to it: md5sum myfirmware.tar >> myfirmware.tar
change the name to .tar.md5: mv myfirmware.tar myfirmware.tar.md5
copy the file on a windowze machine (that has odin and the samsung drivers intalled).
update with odin the new firmware (which you should put in the PDA section) (don't forget to un check the repartitioning).
you should have now a practivally rooted device.
in order to have su and Superuser.apk on it you have to do the following steps:
push with adb su, busybox and Superuser.apk into /data/local/tmp on device (you get the files from other forums here at xda)
the next steps are on device (use adb shell)
verify that indeed we have a suid toolbox: ls -l /system/bin/toolbox should give that wanderfull -rwsr-sr-x permission.
find a rw mount that has suid (in my case a tmpfs is mounted /mnt/obb)
copy su to /mnt/obb (remember that we have suid toolbox this means that toolbox now gives you root on any command):
dd if=/data/local/tmp/su of=/mnt/obb/su
give su suid and make it owned by root: chmod 6755 /mnt/obb/su; chown 0.0 /mnt/obb/su
run su now and enjoy the #: /mnt/obb/su -
Click to expand...
Click to collapse
Ofcorse after you get # you should remount /system as rw, copy su in /system/xbin, copy Superuser.apk in /system/app, copy busybox in /system/xbin, make symlinks to busybox for all the comands in /system/xbin.
You should also upon success remove suid from toolbox so as to not mistakely do damage to the system (for instance "rm /")
And here you have it.
If you do not understand what I have done, you should read more linux / tar / ext4 / md5sum.
This method should work for any phone provided that it has odin as bootloader and there is the stock rom available.
hello
I don't have knowledge about how you have rooted the firmware for b5330, the steps you made are waaaay to dificult for me . Could you provide here an already rooted firmware, to download and install. thanks in advance
ETTT said:
This might work on other devices.
WARNING: this might brick your phone use it at your own risk.
Warning you have to have some knowlage of linux to do this kind of stuff.
WARNING: actually you have to have _good_ knowlage of linux/gnu stuff to do it.
The idea is this is to make the /system/bin/toolbox from the stock rom suid (permision 6755, it originaly has 0755)
This is how I did it. It might be simpler.
Ofcorse after you get # you should remount /system as rw, copy su in /system/xbin, copy Superuser.apk in /system/app, copy busybox in /system/xbin, make symlinks to busybox for all the comands in /system/xbin.
You should also upon success remove suid from toolbox so as to not mistakely do damage to the system (for instance "rm /")
And here you have it.
If you do not understand what I have done, you should read more linux / tar / ext4 / md5sum.
This method should work for any phone provided that it has odin as bootloader and there is the stock rom available.
Click to expand...
Click to collapse
bogdan_rize said:
I don't have knowledge about how you have rooted the firmware for b5330, the steps you made are waaaay to dificult for me . Could you provide here an already rooted firmware, to download and install. thanks in advance
Click to expand...
Click to collapse
no need to upload 400M for this little modification.
I'm unable to post links, goto samsung-updates
go and download B5330XWALI2_B5330OXXALI2_B5330XWLH1_HOME stock firmware.
and apply this xdelta patch over it.
xdelta patch sGTB5330.patch B5330XWALI2_B5330OXXALI2_B5330XWLH1_HOME.tar.md5 myfrm.tar.md5
Click to expand...
Click to collapse
after that you have the firmware that I use to root my phone.
Still... this firmware will not have "su" install, it will just be a rootable firware because it has a suid'ed toolbox.
a suid'ed toolbox in android means that you can exec chown and chmod as a root.
So. After the patching of the stock rom and flashing it. you have to have this md5sum output:
032b4344ab503c8413db9127efaa3d83 myfrm.tar.md5
Click to expand...
Click to collapse
odin will accept it (I've used Oding 3.07).
after that you push the files from the attached tar.gz to /data/local/tmp
tar -xzf superuser_stuff.tar.gz
adb push su /data/local/tmp
adb push Superuser.apk /data/local/tmp
adb push busybox /data/local/tmp
Click to expand...
Click to collapse
after that you bassically have to run this commands in an android shell in order to get to a stardard rooted android:
adb shell # enter the in the phone
dd if=/data/local/tmp/su of=/mnt/obb/su # copy the su binary to a place that can be sudoed
chown 0.0 /mnt/obb/su # modify the owner
chmod 6755 /mnt/obb/su # set SUID flag.
/mnt/obb/su # becomes root !!
mount -o remount,rw /system # remount the system partition as readwrite.
dd if=/data/local/tmp/su of=/system/xbin/su #copy su in path
chown 0.0 /system/xbin/su
chmod 6755 /system/xbin/su
chmod 755 /system/bin/toolbox # close the security hole (toolbox is nologer with SUID)
dd if=/data/local/tmp/Superuser.apk of=/system/app/Superuser.apk # copy the superuser application
chown 0.0 /system/app/Superuser.apk
chmod 666 /system/app/Superuser.apk
#now this is done for busybox
dd if=/data/local/tmp/busybox of=/system/xbin/busybox
chown 0.0 /system/xbin/busybox
chmod 755 /system/xbin/busybox
Click to expand...
Click to collapse
have fun.
I downloaded this firmware: Samsung-Updates.com-GT-B5330_COA_1_20120913171601_pducfx5hbw.zip. Where, how, what???...i unzipped it and now how to apply the patch? The rest of the stept i think i get it....i think For you it's easy to say, for me it's hard to do. I've had sgs1, sgs2 and sgs3, and the root of those was sooooooo easy... but this piece of crap b5330 drives me crazy )
ETTT said:
no need to upload 400M for this little modification.
I'm unable to post links, goto samsung-updates
go and download B5330XWALI2_B5330OXXALI2_B5330XWLH1_HOME stock firmware.
and apply this xdelta patch over it.
after that you have the firmware that I use to root my phone.
Still... this firmware will not have "su" install, it will just be a rootable firware because it has a suid'ed toolbox.
a suid'ed toolbox in android means that you can exec chown and chmod as a root.
So. After the patching of the stock rom and flashing it. you have to have this md5sum output:
odin will accept it (I've used Oding 3.07).
after that you push the files from the attached tar.gz to /data/local/tmp
after that you bassically have to run this commands in an android shell in order to get to a stardard rooted android:
have fun.
Click to expand...
Click to collapse
bogdan_rize said:
I downloaded this firmware: Samsung-Updates.com-GT-B5330_COA_1_20120913171601_pducfx5hbw.zip. Where, how, what???...i unzipped it and now how to apply the patch? The rest of the stept i think i get it....i think For you it's easy to say, for me it's hard to do. I've had sgs1, sgs2 and sgs3, and the root of those was sooooooo easy... but this piece of crap b5330 drives me crazy )
Click to expand...
Click to collapse
I've used xdelta package.
if you are on win then you're on your own.
there is xdelta.org and it seems to have pachage for windows.
for sgs[123] was easy because are main streams. may hackers were working on it.
this device is very new/obscure.
I whould have made a script, but alas, "heimdal" firmware loader whould not work with this device.
I've used linux to patch the firmware and windowze to upload it.
So a script whould be imposible, but after you pach .tar.md5 file and load it on your phone is just about cut and paste form my previous post.
My hope is that a more android savy guy will take this concept and make it a script.
I am just happy that I can now have debian on my phone.
yes, i am on win....there is no way to patch that COA firmware (i am from romania) and upload somewhere to download???i know i am probably asking to much from you, but i dont't think i will manage by my own...this rooting busines is driving me crazyyyyy :crying::crying::crying: thank you so much for your answer!!!
ETTT said:
I've used xdelta package.
if you are on win then you're on your own.
there is xdelta.org and it seems to have pachage for windows.
for sgs[123] was easy because are main streams. may hackers were working on it.
this device is very new/obscure.
I whould have made a script, but alas, "heimdal" firmware loader whould not work with this device.
I've used linux to patch the firmware and windowze to upload it.
So a script whould be imposible, but after you pach .tar.md5 file and load it on your phone is just about cut and paste form my previous post.
My hope is that a more android savy guy will take this concept and make it a script.
I am just happy that I can now have debian on my phone.
Click to expand...
Click to collapse
bogdan_rize said:
yes, i am on win....there is no way to patch that COA firmware (i am from romania) and upload somewhere to download???i know i am probably asking to much from you, but i dont't think i will manage by my own...this rooting busines is driving me crazyyyyy :crying::crying::crying: thank you so much for your answer!!!
Click to expand...
Click to collapse
ok here it is the modified firmware.
http://dl.transfer.ro/myfrm-transfer_ro-29oct-8a4089.zip
Interesting, reading carefully
Sent from my GT-B5330 using xda app-developers app
Thank you so much, tomorow morning i know how i'll spend my time...installing and rooting my b5330, unfortunately this evening i don't have my laptop on me forgoted at work ), but i've downloaded the firmware from phone and now waiting to have it done...finally!!! I'll let you know what have i done. Have a nice day and once again thanks!!!
ETTT said:
ok here it is the modified firmware.
http://dl.transfer.ro/myfrm-transfer_ro-29oct-8a4089.zip
Click to expand...
Click to collapse
it's not working, when i'm trying to adb remont it says: remount failed: Opertaion not permited. After i flashed with odin the firmware you gave to me, i think i do not have permission to make any changes, and i don't know why
ETTT said:
ok here it is the modified firmware.
http://dl.transfer.ro/myfrm-transfer_ro-29oct-8a4089.zip
Click to expand...
Click to collapse
Can you make patch for dxlh3..? Thanks
Sent from my GT-B5330 using xda app-developers app
bogdan_rize said:
it's not working, when i'm trying to adb remont it says: remount failed: Opertaion not permited. After i flashed with odin the firmware you gave to me, i think i do not have permission to make any changes, and i don't know why
Click to expand...
Click to collapse
There commands are supposed to be given in a command line box (cmd on win).
where does it gives you error?
adb shell # enter the in the phone
dd if=/data/local/tmp/su of=/mnt/obb/su # copy the su binary to a place that can be sudoed
chown 0.0 /mnt/obb/su # modify the owner
chmod 6755 /mnt/obb/su # set SUID flag.
/mnt/obb/su # becomes root !!
mount -o remount,rw /system # remount the system partition as readwrite.
dd if=/data/local/tmp/su of=/system/xbin/su #copy su in path
chown 0.0 /system/xbin/su
chmod 6755 /system/xbin/su
chmod 755 /system/bin/toolbox # close the security hole (toolbox is nologer with SUID)
dd if=/data/local/tmp/Superuser.apk of=/system/app/Superuser.apk # copy the superuser application
chown 0.0 /system/app/Superuser.apk
chmod 666 /system/app/Superuser.apk
#now this is done for busybox
dd if=/data/local/tmp/busybox of=/system/xbin/busybox
chown 0.0 /system/xbin/busybox
chmod 755 /system/xbin/busybox
finally it worked
yeeeees, damn you're good!!!! i have managed to root my b5330, root checher tell me that i am rooted and busybox is instaled...the only problem is that it shows me that i do not have installed superuser and supersu. Is there a problem if i just copy paste the apk file (supersu.apk and superuser.apk -> i've downloaded the pro version of bouth of them ) straight into the directory /data/local/tmp where it should be? or to copy-paste in another directory. Thanks in advance, CMD(and adb shell) gave me headache, but i finally got it an succedeed )) :victory::good:
ETTT said:
There commands are supposed to be given in a command line box (cmd on win).
where does it gives you error?
adb shell # enter the in the phone
dd if=/data/local/tmp/su of=/mnt/obb/su # copy the su binary to a place that can be sudoed
chown 0.0 /mnt/obb/su # modify the owner
chmod 6755 /mnt/obb/su # set SUID flag.
/mnt/obb/su # becomes root !!
mount -o remount,rw /system # remount the system partition as readwrite.
dd if=/data/local/tmp/su of=/system/xbin/su #copy su in path
chown 0.0 /system/xbin/su
chmod 6755 /system/xbin/su
chmod 755 /system/bin/toolbox # close the security hole (toolbox is nologer with SUID)
dd if=/data/local/tmp/Superuser.apk of=/system/app/Superuser.apk # copy the superuser application
chown 0.0 /system/app/Superuser.apk
chmod 666 /system/app/Superuser.apk
#now this is done for busybox
dd if=/data/local/tmp/busybox of=/system/xbin/busybox
chown 0.0 /system/xbin/busybox
chmod 755 /system/xbin/busybox
Click to expand...
Click to collapse
bogdan_rize said:
yeeeees, damn you're good!!!! i have managed to root my b5330, root checher tell me that i am rooted and busybox is instaled...the only problem is that it shows me that i do not have installed superuser and supersu. Is there a problem if i just copy paste the apk file (supersu.apk and superuser.apk -> i've downloaded the pro version of bouth of them ) straight into the directory /data/local/tmp where it should be? or to copy-paste in another directory. Thanks in advance, CMD(and adb shell) gave me headache, but i finally got it an succedeed )) :victory::good:
Click to expand...
Click to collapse
1. I'm glad you got it.
2. You should give thanks (that button) if I helped you.
3. I'm you dont read instructions. Maybe it's a problem with us romanian engineers, or maybe engineers in general
look at item 11. from my previous post. maybe I just c&p here.
dd if=/data/local/tmp/Superuser.apk of=/system/app/Superuser.apk
So, when you are in adb shell and you go root (su command, you get the promt with #) and you have the /system mounted rw.
Then any apk that you copy to /system/app folder will get intalled and when you list your application (the button with 16 squares) you should see it.
Have fun.
i was having trouble understanding adb shell and cmd from the begining. I never used this command tool...ever ) and i think from yesterday to this day i managed really ok . Anyway i think i will just copy-paste the superuser.apk in "app" folder directly in the system (it's the same thing, isn't it??). I have done that in item 11., and after a restart supersu was instaled, only superuser.apk didn't, i think i wrote something wrong in adb shell
ETTT said:
1. I'm glad you got it.
2. You should give thanks (that button) if I helped you.
3. I'm you dont read instructions. Maybe it's a problem with us romanian engineers, or maybe engineers in general
look at item 11. from my previous post. maybe I just c&p here.
dd if=/data/local/tmp/Superuser.apk of=/system/app/Superuser.apk
So, when you are in adb shell and you go root (su command, you get the promt with #) and you have the /system mounted rw.
Then any apk that you copy to /system/app folder will get intalled and when you list your application (the button with 16 squares) you should see it.
Have fun.
Click to expand...
Click to collapse
hihihi
neeeah, my bad, i thought that in "superuser_stuff" is superuser and supersu files, it was just su->for superuser.apk, easy peasy, it worked and installed from the first time...it was just me verry verry dizzy and confused. Your guide is 100% OK, my phone is rooted and now i can enjoy !!!
ETTT said:
1. I'm glad you got it.
2. You should give thanks (that button) if I helped you.
3. I'm you dont read instructions. Maybe it's a problem with us romanian engineers, or maybe engineers in general
look at item 11. from my previous post. maybe I just c&p here.
dd if=/data/local/tmp/Superuser.apk of=/system/app/Superuser.apk
So, when you are in adb shell and you go root (su command, you get the promt with #) and you have the /system mounted rw.
Then any apk that you copy to /system/app folder will get intalled and when you list your application (the button with 16 squares) you should see it.
Have fun.
Click to expand...
Click to collapse
can you release xdelta patch for your XWALH3 because we have the same device..
phyxar said:
can you release xdelta patch for your XWALH3 because we have the same device..
Click to expand...
Click to collapse
I've started a new more universal thread:
http://forum.xda-developers.com/showthread.php?t=1965600
There you have the shell-script that will patch the firmware for you.
If you still want an xdelta patch I'll make one for you but:
Give a man a fish and it will be full for the day, teach him how to fish and it will never go hungry again.
Have fun.
ETTT said:
ok here it is the modified firmware.
dl.transfer.ro/myfrm-transfer_ro-29oct-8a4089.zip
Click to expand...
Click to collapse
Hello, i'm new here and i don't know about scripting, so need your help..
i downloaded your firmware and install it to my b5330 and did the cmd command, and it worked, thanks..:good:
but now i've a new problem that my b5330 can't type a question mark ('?').. can you help me please..
whenever i want to type a question mark it always typed a comma (',') in the screen..:crying:
it also it change the symbol and language key to emoticon and symbol, but that's not a problem for me..
andhikarogue said:
Hello, i'm new here and i don't know about scripting, so need your help..
i downloaded your firmware and install it to my b5330 and did the cmd command, and it worked, thanks..:good:
but now i've a new problem that my b5330 can't type a question mark ('?').. can you help me please..
whenever i want to type a question mark it always typed a comma (',') in the screen..:crying:
it also it change the symbol and language key to emoticon and symbol, but that's not a problem for me..
Click to expand...
Click to collapse
That's because you have use the romanian firmware. whitch has a qwerty layout keyboard.
you have to do it the right way:
first. find the firmaware for your region:
http://samsung-updates.com/device/?id=GT-B5330
second. find a linux machine and run the script from the thread.
It is unrealistic for me to just upload all the 40 version of the firmware patched.
That is why I've made the script.
If you don't have a linux machine then look for a virtual box ubuntu and run on it.
Cheers.

Can you root an XT925 without unlocking the bootloader?

Thinking about buying this phone, but don't wanna void my warranty. I've seen a wealth of information, but I am confused as to what is outdated or not.
timmytucker718 said:
Thinking about buying this phone, but don't wanna void my warranty. I've seen a wealth of information, but I am confused as to what is outdated or not.
Click to expand...
Click to collapse
My HD is rooted while bootloader is still locked
mr_5kool said:
My HD is rooted while bootloader is still locked
Click to expand...
Click to collapse
How did you do it?
timmytucker718 said:
How did you do it?
Click to expand...
Click to collapse
I use the method and files from my XT902 but it works. I don't remember the source of this method (Sorry). I made several changes. My HD is OTA updated from 4.0 to 4.1.2. Here is the method (The risk is yours):
1) Preparation
- SDK & USB Drivers
- Download file from the following address: http://www.mediafire.com/download/13htvihh6c2mhs2/HD.rar or scroll down
- Unzip the file to a specific folder (I put HD folder to the root of C drive)
2) Plug your HD to PC (connect as MTP, unknown source and debugging is on, of course)
3) Do these command (at the directory where you put and perform the adb commands)
- adb push C:\HD\su /data/local/tmp/su
- adb push C:\HD\Superuser.apk /data/local/tmp/Superuser.apk
- adb push C:\HD\busybox /data/local/tmp/busybox
- adb push C:\HD\auto_root.sh /data/local/tmp/auto_root.sh
- adb push C:\HD\unlock_security_module /data/local/tmp/unlock_security_module
- adb push C:\HD\break_setresuid /data/local/tmp/break_setresuid
- adb push C:\HD\mole-plough-ccsecurity.so /data/local/tmp/mole-plough-ccsecurity.so
- adb push C:\HD\mole-plough-lsm.so /data/local/tmp/mole-plough-lsm.so
If any file is pushed unsuccessfully, you have to re-push it, of course
4) Use unlock_security_module to obtain temporary root
- adb shell
- [email protected]:/ $ cd /data/local/tmp/
- [email protected]:/data/local/tmp $ chmod 777 *
- [email protected]:/data/local/tmp $ ./unlock_security_module
- [email protected]:/data/local/tmp $ ./break_setresuid
You’ll see messages about the process. If it fails, then I’m sorry, I don’t know why yet. If it works without “fail”, you success. Here you’ll something like: Unlocked LSM, Do setresuid… I don’t remember them exactly and after all, the command will change from shell ($) to su (#).
5) Load su, Superuser.apk busybox to system
- [email protected]:/data/local/tmp # mount -o rw,remount /system /system
- [email protected]:/data/local/tmp # cat /data/local/tmp/su > /system/xbin/su
- [email protected]:/data/local/tmp # cat /data/local/tmp/busybox > /system/xbin/busybox
- [email protected]:/data/local/tmp # cat /data/local/tmp/Superuser.apk > /system/app/Superuser.apk
- [email protected]:/data/local/tmp # chmod 644 /system/app/Superuser.apk
- [email protected]:/data/local/tmp # cd /system/xbin
- [email protected]:/system/xbin # chown root.root su
- [email protected]:/system/xbin # chown root.root busybox
- [email protected]:/system/xbin # chmod 6755 su
- [email protected]:/system/xbin # chmod 755 busybox
- [email protected]:/system/xbin # mount -o ro,remount /system /system
6) When it’s done, you can remove the cable from PC. Check and see if SuperSU was installed. If it wasn’t, you can download it (SuperSU) from Play Store. Install busybox from Play Store and do the Smart Install. Your HD is now temporary rooted so do not reboot your phone.
7) Install Script Manager – SManager (devwom) from Play Store. Run SManager and choose Browse as root.
- Navigate to /data/local/tmp/ and open auto_root.sh as Script/Excutable (touch and keep for a while).
- Toggle Su on (the icon will change colour to green) and save.
You can reboot and enjoy your permanent root now.
mr_5kool said:
I use the method and files from my XT902 but it works. I don't remember the source of this method (Sorry). I made several changes. My HD is OTA updated from 4.0 to 4.1.2. Here is the method (The risk is yours):
1) Preparation
- SDK & USB Drivers
- Download file from the following address: http://www.mediafire.com/download/13htvihh6c2mhs2/HD.rar or scroll down
- Unzip the file to a specific folder (I put HD folder to the root of C drive)
2) Plug your HD to PC (connect as MTP, unknown source and debugging is on, of course)
3) Do these command (at the directory where you put and perform the adb commands)
- adb push C:\HD\su /data/local/tmp/su
- adb push C:\HD\Superuser.apk /data/local/tmp/Superuser.apk
- adb push C:\HD\busybox /data/local/tmp/busybox
- adb push C:\HD\auto_root.sh /data/local/tmp/auto_root.sh
- adb push C:\HD\unlock_security_module /data/local/tmp/unlock_security_module
- adb push C:\HD\break_setresuid /data/local/tmp/break_setresuid
- adb push C:\HD\mole-plough-ccsecurity.so /data/local/tmp/mole-plough-ccsecurity.so
- adb push C:\HD\mole-plough-lsm.so /data/local/tmp/mole-plough-lsm.so
If any file is pushed unsuccessfully, you have to re-push it, of course
4) Use unlock_security_module to obtain temporary root
- adb shell
- [email protected]:/ $ cd /data/local/tmp/
- [email protected]:/data/local/tmp $ chmod 777 *
- [email protected]:/data/local/tmp $ ./unlock_security_module
- [email protected]:/data/local/tmp $ ./break_setresuid
You’ll see messages about the process. If it fails, then I’m sorry, I don’t know why yet. If it works without “fail”, you success. Here you’ll something like: Unlocked LSM, Do setresuid… I don’t remember them exactly and after all, the command will change from shell ($) to su (#).
5) Load su, Superuser.apk busybox to system
- [email protected]:/data/local/tmp # mount -o rw,remount /system /system
- [email protected]:/data/local/tmp # cat /data/local/tmp/su > /system/xbin/su
- [email protected]:/data/local/tmp # cat /data/local/tmp/busybox > /system/xbin/busybox
- [email protected]:/data/local/tmp # cat /data/local/tmp/Superuser.apk > /system/app/Superuser.apk
- [email protected]:/data/local/tmp # chmod 644 /system/app/Superuser.apk
- [email protected]:/data/local/tmp # cd /system/xbin
- [email protected]:/system/xbin # chown root.root su
- [email protected]:/system/xbin # chown root.root busybox
- [email protected]:/system/xbin # chmod 6755 su
- [email protected]:/system/xbin # chmod 755 busybox
- shell[email protected]:/system/xbin # mount -o ro,remount /system /system
6) When it’s done, you can remove the cable from PC. Check and see if SuperSU was installed. If it wasn’t, you can download it (SuperSU) from Play Store. Install busybox from Play Store and do the Smart Install. Your HD is now temporary rooted so do not reboot your phone.
7) Install Script Manager – SManager (devwom) from Play Store. Run SManager and choose Browse as root.
- Navigate to /data/local/tmp/ and open auto_root.sh as Script/Excutable (touch and keep for a while).
- Toggle Su on (the icon will change colour to green) and save.
You can reboot and enjoy your permanent root now.
Click to expand...
Click to collapse
is this a different method than the saferoot method I have since read about?
timmytucker718 said:
is this a different method than the saferoot method I have since read about?
Click to expand...
Click to collapse
I don't know the saferoot method
I've used this method when my M had failed to root by other method
It's worked on my M and HD

Root Mediapad/Honor X2 SuperSu (no kingroot)

All,
I've moved this to it's own thread just to keep thing separate.
In case you are uncomfortable with kingroot, or you want a less intrusive install (since we don't need any exploits to root this device - kudos Huawei!) I have built a modified version of the boot image that uses supersu by chainfire instead. This is based on the work done here http://cn.club.vmall.com/space-uid-5467988.html, so we still owe them thanks. All this does, is move the Superuser.apk package into the system partition so that it can be installed as an administrative application, add in a /sbin/su file, and copy /sbin/su into /sbin/xbin so we can use it. Here is a full diff for the 0012 version from the default boot.img supplied by Huawei:
Code:
diff: ./charger: No such file or directory
diff: ~/mediapad/dload.012/boot/filesystem/charger: No such file or directory
diff -r ./default.prop ~/mediapad/dload.012/boot/filesystem/default.prop
4c4
< ro.secure=0
---
> ro.secure=1
6,7c6,7
< ro.debuggable=1
< ro.adb.secure=0
---
> ro.debuggable=0
> ro.adb.secure=1
diff -r ./init.rc ~/mediapad/dload.012/boot/filesystem/init.rc
528,532d527
< service load_boot /sbin/load_boot
< class main
< seclabel u:r:install_recovery:s0
< oneshot
<
Only in ./sbin: load_boot
Only in ./sbin: su
load_boot contains the following:
Code:
#!/system/bin/sh
/sbin/su --auto-daemon &
if [ ! -e /system/app/Superuser.apk ];then
mount -o rw,remount /system
cp -rpf /data/local/tmp/Superuser.apk /system/app/Superuser.apk
chmod 644 /system/app/Superuser.apk
fi
if [ ! -e /system/xbin/su ];then
mount -o rw,remount /system
cp -rpf /sbin/su /system/xbin/
chmod 06755 /system/xbin/su
fi
The /sbin/su file has an md5sum:
Code:
md5sum sbin/su
cd029c6b8b7065ff8ff2860137aeff99 sbin/su
and that matches the md5sum of the su included with v2.46 of chainfires supersu ZIP file (in the link below). So from a security perspective, I think we are pretty clean.
To use this, do the following:
0) Make sure you have unlocked the bootloader first!!!
1) Download chainfires Superuser from here: https://download.chainfire.eu/696/SuperSU/UPDATE-SuperSU-v2.46.zip , and extract the Superuser.apk file from the common folder.
2) adb shell "rm -rf /data/local/tmp/*"
3) adb push <path_to>/Superuser..apk /data/local/tmp/Superuser.apk
4) adb reboot bootloader
( your device will restart)
5) fastboot flash boot <path_to>/super_boot.img
6) fastboot reboot
7) Open the supersu App and update su (otherwise you may have strange issues)
That's it! You're rooted!
This does not do any odd exploits or camera driver adjustments or anything so there shouldn't be any issues with the camera or sound, but, as always, no guarantees.
File is to big too upload here so grab it from here:
703L
b012:
https://www.dropbox.com/s/7wqs6qghphy42sl/super_boot.b012.img?dl=0
b013 - untested for now!!! Tested and works fine:
https://www.dropbox.com/s/9so1wdbofhlbcmo/super_boot.b013.img?dl=0
b015 - Tested and works fine:
https://www.dropbox.com/s/cs767z8yjyfsfku/super_boot.703L.B015.img?dl=0
b106 - Tested and works fine:
https://www.dropbox.com/s/4qvtvpemiko01ie/super_boot.703L.B106.img?dl=0
702L
b003 - Untested! - Potentially Insecure! - I got the link for the 702L image from xda, NOT from emui.com. So I can't speak to the security:
https://www.dropbox.com/s/fp1cj25m1zzqq0m/super_boot.702L.B003.img?dl=0
Root sucessfully without any problems.
Big thanks.
dfsteen said:
All,
I've moved this to it's own thread just to keep thing separate.
In case you are uncomfortable with kingroot, or you want a less intrusive install (since we don't need any exploits to root this device - kudos Huawei!) I have built a modified version of the boot image that uses supersu by chainfire instead. This is based on the work done here http://cn.club.vmall.com/space-uid-5467988.html, so we still owe them thanks. All this does, is move the Superuser.apk package into the system partition so that it can be installed as an administrative application, add in a /sbin/su file, and copy /sbin/su into /sbin/xbin so we can use it. Here is a full diff for the 0012 version from the default boot.img supplied by Huawei:
Code:
diff: ./charger: No such file or directory
diff: ~/mediapad/dload.012/boot/filesystem/charger: No such file or directory
diff -r ./default.prop ~/mediapad/dload.012/boot/filesystem/default.prop
4c4
< ro.secure=0
---
> ro.secure=1
6,7c6,7
< ro.debuggable=1
< ro.adb.secure=0
---
> ro.debuggable=0
> ro.adb.secure=1
diff -r ./init.rc ~/mediapad/dload.012/boot/filesystem/init.rc
528,532d527
< service load_boot /sbin/load_boot
< class main
< seclabel u:r:install_recovery:s0
< oneshot
<
Only in ./sbin: load_boot
Only in ./sbin: su
load_boot contains the following:
Code:
#!/system/bin/sh
/sbin/su --auto-daemon &
if [ ! -e /system/app/Superuser.apk ];then
mount -o rw,remount /system
cp -rpf /data/local/tmp/Superuser.apk /system/app/Superuser.apk
chmod 644 /system/app/Superuser.apk
fi
if [ ! -e /system/xbin/su ];then
mount -o rw,remount /system
cp -rpf /sbin/su /system/xbin/
chmod 06755 /system/xbin/su
fi
The /sbin/su file has an md5sum:
Code:
md5sum sbin/su
cd029c6b8b7065ff8ff2860137aeff99 sbin/su
and that matches the md5sum of the su included with v2.46 of chainfires supersu ZIP file (in the link below). So from a security perspective, I think we are pretty clean.
To use this, do the following:
0) Make sure you have unlocked the bootloader first!!!
1) Download chainfires Superuser from here: https://download.chainfire.eu/696/SuperSU/UPDATE-SuperSU-v2.46.zip , and extract the Superuser.apk file from the common folder.
2) adb shell "rm -rf /data/local/tmp/*"
3) adb push <path_to>/Superuser..apk /data/local/tmp/Superuser.apk
4) adb reboot bootloader
( your device will restart)
5) fastboot flash boot <path_to>/super_boot.img
6) fastboot reboot
7) Open the supersu App and update su (otherwise you may have strange issues)
That's it! You're rooted!
This does not do any odd exploits or camera driver adjustments or anything so there shouldn't be any issues with the camera or sound, but, as always, no guarantees.
File is to big too upload here so grab it from here:
b012:
https://www.dropbox.com/s/wlsjjixext9kbjf/super_boot.b012.img?dl=0
b013 - untested for now!!! Tested and works fine:
https://www.dropbox.com/s/wchc8w6d0qy1npv/super_boot.b013.img?dl=0
Click to expand...
Click to collapse
Would this method work on a GEM-701L as well?
if you point me to the firmware image for that device i can tell you for sure.
Sent from my GEM-703L using XDA Free mobile app
thank you very much, its working great on b013 !
What i did was restoring b012 from sdcard, then i installed directly b013 update, then i rooted the phone using your method and everything is working great.
Now, this probably sounds studip, but could you please explain point 2-6? My Honor X2 is bootloader unlocked but I have no idea what I have to do when you write adb shell.. etc... Do I need any software to do what you suggest or is there a visual guide somewhere to get me going?
Thanks
Can someone give me a link to the Windows drivers please .
dfsteen said:
All,
I've moved this to it's own thread just to keep thing separate.
In case you are uncomfortable with kingroot, or you want a less intrusive install (since we don't need any exploits to root this device - kudos Huawei!) I have built a modified version of the boot image that uses supersu by chainfire instead. This is based on the work done here http://cn.club.vmall.com/space-uid-5467988.html, so we still owe them thanks. All this does, is move the Superuser.apk package into the system partition so that it can be installed as an administrative application, add in a /sbin/su file, and copy /sbin/su into /sbin/xbin so we can use it. Here is a full diff for the 0012 version from the default boot.img supplied by Huawei:
Code:
diff: ./charger: No such file or directory
diff: ~/mediapad/dload.012/boot/filesystem/charger: No such file or directory
diff -r ./default.prop ~/mediapad/dload.012/boot/filesystem/default.prop
4c4
< ro.secure=0
---
> ro.secure=1
6,7c6,7
< ro.debuggable=1
< ro.adb.secure=0
---
> ro.debuggable=0
> ro.adb.secure=1
diff -r ./init.rc ~/mediapad/dload.012/boot/filesystem/init.rc
528,532d527
< service load_boot /sbin/load_boot
< class main
< seclabel u:r:install_recovery:s0
< oneshot
<
Only in ./sbin: load_boot
Only in ./sbin: su
load_boot contains the following:
Code:
#!/system/bin/sh
/sbin/su --auto-daemon &
if [ ! -e /system/app/Superuser.apk ];then
mount -o rw,remount /system
cp -rpf /data/local/tmp/Superuser.apk /system/app/Superuser.apk
chmod 644 /system/app/Superuser.apk
fi
if [ ! -e /system/xbin/su ];then
mount -o rw,remount /system
cp -rpf /sbin/su /system/xbin/
chmod 06755 /system/xbin/su
fi
The /sbin/su file has an md5sum:
Code:
md5sum sbin/su
cd029c6b8b7065ff8ff2860137aeff99 sbin/su
and that matches the md5sum of the su included with v2.46 of chainfires supersu ZIP file (in the link below). So from a security perspective, I think we are pretty clean.
To use this, do the following:
0) Make sure you have unlocked the bootloader first!!!
1) Download chainfires Superuser from here: https://download.chainfire.eu/696/SuperSU/UPDATE-SuperSU-v2.46.zip , and extract the Superuser.apk file from the common folder.
2) adb shell "rm -rf /data/local/tmp/*"
3) adb push <path_to>/Superuser..apk /data/local/tmp/Superuser.apk
4) adb reboot bootloader
( your device will restart)
5) fastboot flash boot <path_to>/super_boot.img
6) fastboot reboot
7) Open the supersu App and update su (otherwise you may have strange issues)
That's it! You're rooted!
This does not do any odd exploits or camera driver adjustments or anything so there shouldn't be any issues with the camera or sound, but, as always, no guarantees.
File is to big too upload here so grab it from here:
b012:
https://www.dropbox.com/s/wlsjjixext9kbjf/super_boot.b012.img?dl=0
b013 - untested for now!!! Tested and works fine:
https://www.dropbox.com/s/wchc8w6d0qy1npv/super_boot.b013.img?dl=0
Click to expand...
Click to collapse
Very nice guide. I followed your instructions and I rooted successfully. I am getting a Cell broadcasts has stopped error upon boot but it really doesn't affect anything so I'm going to freeze it. The good part of this whole process is I ordered my X2 from a seller (zomlong-trading) on eBay and they said they installed an "international" ROM which has all the GAPPS like the Play Store etc.... I had the phone within a week (It shipped on Monday and I got it on Thursday) and the phone came working perfectly. I emailed Huawei for the unlock code and had it within three hours. When I went to unlock apparently the phone was already unlocked so all i had to do was follow your root procedure and that worked like a charm. I can't wait for someone to port the Chinese TWRP to an English version. I'm excited about being able to flash anything AOSP based on this when and if it ever happens. Anyway, thanks for your help.
Bunkerstudio said:
Now, this probably sounds studip, but could you please explain point 2-6? My Honor X2 is bootloader unlocked but I have no idea what I have to do when you write adb shell.. etc... Do I need any software to do what you suggest or is there a visual guide somewhere to get me going?
Thanks
Click to expand...
Click to collapse
Adb and fastboot are tools that you use to interact with android from your PC. You can look here for beginner information:
http://forum.xda-developers.com/showthread.php?t=690362
Note that there are many many threads discussing these things on xda, and the above is only one example. Search around and you will find a whole lot more information.
Confirm: Worked well with GEM-703LT version (32Gb storage)
Didn't work. Rooted using another method
dfsteen said:
All,
I've moved this to it's own thread just to keep thing separate.
In case you are uncomfortable with kingroot, or you want a less intrusive install (since we don't need any exploits to root this device - kudos Huawei!) I have built a modified version of the boot image that uses supersu by chainfire instead. This is based on the work done here http://cn.club.vmall.com/space-uid-5467988.html, so we still owe them thanks. All this does, is move the Superuser.apk package into the system partition so that it can be installed as an administrative application, add in a /sbin/su file, and copy /sbin/su into /sbin/xbin so we can use it. Here is a full diff for the 0012 version from the default boot.img supplied by Huawei:
Code:
diff: ./charger: No such file or directory
diff: ~/mediapad/dload.012/boot/filesystem/charger: No such file or directory
diff -r ./default.prop ~/mediapad/dload.012/boot/filesystem/default.prop
4c4
< ro.secure=0
---
> ro.secure=1
6,7c6,7
< ro.debuggable=1
< ro.adb.secure=0
---
> ro.debuggable=0
> ro.adb.secure=1
diff -r ./init.rc ~/mediapad/dload.012/boot/filesystem/init.rc
528,532d527
< service load_boot /sbin/load_boot
< class main
< seclabel u:r:install_recovery:s0
< oneshot
<
Only in ./sbin: load_boot
Only in ./sbin: su
load_boot contains the following:
Code:
#!/system/bin/sh
/sbin/su --auto-daemon &
if [ ! -e /system/app/Superuser.apk ];then
mount -o rw,remount /system
cp -rpf /data/local/tmp/Superuser.apk /system/app/Superuser.apk
chmod 644 /system/app/Superuser.apk
fi
if [ ! -e /system/xbin/su ];then
mount -o rw,remount /system
cp -rpf /sbin/su /system/xbin/
chmod 06755 /system/xbin/su
fi
The /sbin/su file has an md5sum:
Code:
md5sum sbin/su
cd029c6b8b7065ff8ff2860137aeff99 sbin/su
and that matches the md5sum of the su included with v2.46 of chainfires supersu ZIP file (in the link below). So from a security perspective, I think we are pretty clean.
To use this, do the following:
0) Make sure you have unlocked the bootloader first!!!
1) Download chainfires Superuser from here: https://download.chainfire.eu/696/SuperSU/UPDATE-SuperSU-v2.46.zip , and extract the Superuser.apk file from the common folder.
2) adb shell "rm -rf /data/local/tmp/*"
3) adb push <path_to>/Superuser..apk /data/local/tmp/Superuser.apk
4) adb reboot bootloader
( your device will restart)
5) fastboot flash boot <path_to>/super_boot.img
6) fastboot reboot
7) Open the supersu App and update su (otherwise you may have strange issues)
That's it! You're rooted!
This does not do any odd exploits or camera driver adjustments or anything so there shouldn't be any issues with the camera or sound, but, as always, no guarantees.
File is to big too upload here so grab it from here:
b012:
https://www.dropbox.com/s/wlsjjixext9kbjf/super_boot.b012.img?dl=0
b013 - untested for now!!! Tested and works fine:
https://www.dropbox.com/s/wchc8w6d0qy1npv/super_boot.b013.img?dl=0
Click to expand...
Click to collapse
hi
thanks for your efforts, but do you have the stock recovery.img for b013 rom
thankyou
All,
As soon as b015 goes up on the website I will pull it apart and generate a rooted version. It usually goes up within a week of the OTA update so hang in there!
-Dan
Hi there... I wonder if u can take a look @ GEM-702L ???
theres only one FW for the 702.... but there no stable working boot.img could work with...T.T
While I mean all the 703 bxyz method could root...the 702... but probably theres some problems... like GPU driver sth like that... first.. it caused no sound problem.... random freezes.... n cheesy screen
lcw622 said:
Hi there... I wonder if u can take a look @ GEM-702L ???
theres only one FW for the 702.... but there no stable working boot.img could work with...T.T
While I mean all the 703 bxyz method could root...the 702... but probably theres some problems... like GPU driver sth like that... first.. it caused no sound problem.... random freezes.... n cheesy screen
Click to expand...
Click to collapse
Do you have a link to the firmware?
dfsteen said:
Do you have a link to the firmware?
Click to expand...
Click to collapse
http://forum.xda-developers.com/huawei-mediapad/general/mediapad-x2-firmware-702l-703l-t3168925
dfsteen said:
All,
As soon as b015 goes up on the website I will pull it apart and generate a rooted version. It usually goes up within a week of the OTA update so hang in there!
-Dan
Click to expand...
Click to collapse
Thanks and btw the b015 is already on the website. Excited now
Can't wait for the root of b015 [emoji18]
Gesendet von iPad mit Tapatalk
b015 rooted is now up on the initial posting. Enjoy!
lcw622 said:
http://forum.xda-developers.com/huawei-mediapad/general/mediapad-x2-firmware-702l-703l-t3168925
Click to expand...
Click to collapse
I've posted a rooted boot.img for 702l.b003 from the link you provided. I don't own this device, so it's not tested, but let me know if it works.

Categories

Resources