Related
This howto is for those people who are unable to root their Galaxy Tab using any of the automated procedures and do not suffer from CLPS (command-line-phobia-syndrome).
My story: After upgrading my EURO (GSM) Galaxy Tab to JM6 my persistent efforts to root the device using either the z4root or SuperOnClick methods have all been unsuccessful. z4root (v1.3.0) kept crashing at different stages, apparently depending on which and how many background apps were running. With SuperOneClick I never managed to get beyond the "changing permissions" stage.
Since both methods are basically wrappers of the rageagainstthecage application, I tried to perform the rooting procedure manually. Guess what, that worked without any problem and it is pretty easy to do.
The basic steps of the rooting process are:
1) use rageagainstthecage to get a temporary root shell
2) use the temporary root shell to copy three files to the read-only system partition the device
While I find the outlined procedure straightforward, you may not. Anyhow, try this at your own risk.
==== Prerequisites ====
I used Ubuntu 10.10 for this, but it should work on any other distro and on Windows just as well. Whatever OS you use, you need a working adb connection to your Galaxy Tab. Odin or Kies are of no use here.
You need the following binaries
* su
* busybox
* Superuser.apk
* rageagainstthecage
To get the all required files, simply download "SuperOneClickv1.5.5-ShortFuse.zip". That's what I used.
Get it here: http://forum.xda-developers.com/showthread.php?t=803682
Extract the contents of the ZIP, open a command-prompt on your computer and change to the directory where the extracted files are located.
Some advice if shell commands are not your regular cup of tea.
The following instructions show the shell commands. Some are executed on the host computer. Others are executed on the Galaxy Tab. You can differentiate between the two easily: All commands which start with "> " need to be executed in a shell on the host computer. Commands which are prefixed with "$ " are executed on the Galaxy Tab. In both case the ">" and the "$" must not be typed. If you copy+paste from this howto, make sure only to copy the commands and leave out the prompt.
==== Step 1: getting a temporary root shell ====
Copy the rageagainstthecage exploit to a temporary directory.
Code:
> adb push rageagainstthecage /data/local/tmp
263 KB/s (5392 bytes in 0.020s)
Change the file permissions and execute the exploit.
Code:
> adb shell
$ cd /data/local/tmp
$ chmod 777 rageagainstthecage
$ ./rageagainstthecage
[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C
(other output truncated)
Your shell session will be terminated which will throw you back to the regular command prompt of your host computer.
==== Step 2: restart adb server ====
Now stop and restart the adb server process.
Code:
> adb kill-server
> adb start-server
* daemon not running. starting it now *
* daemon started successfully *
Now reconnect to the Galaxy Tab again. Notice the '#' prompt. This means you have a temporary root shell now. We use this to execute some privileged commands which make the rooting permanent.
==== Step 3: making it permanent ====
First, make the system partition writeable. We need this to be able to copy su, busybox and Superuser.apk to the required locations. Then exit the android shell again.
Code:
> adb shell
# mount -o remount,rw -t rfs /dev/block/stl9 /system
# exit
Now we push busybox and su via adb. Then we install Superuser.apk.
Code:
> adb push busybox /system/bin
> adb push su /system/bin
> adb install Superuser.apk
The final steps are to change the file permissions for su and busybox and then remount the system partition as read-only again.
Code:
> adb shell
# chmod 4755 /system/bin/busybox
# chmod 4755 /system/bin/su
# mount -o remount,ro -t rfs /dev/block/stl9 /system
# exit
That should be all. Try a reboot and some apps which require root, like Titanium Backup. The Superuser.apk should popup a dialog requesting permission.
Hope this helps. Happy rooting.
[update]
This process worked for JMA and JMD as well.
"adb install" Superuser.apk instead of "adb push"
[/update]
It will help me !
Merci ;-)
Fantastic! This is just what I was looking for, thank you! I feel dumb now, because I started a thread of my own right as you posted this. You must just type faster than me
I ran a quick test, and it all looks good. One quick question actually. Why do you mount like this:
Code:
# mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
When most instructions for the Galaxy Tab have you doing something like this:
Code:
# mount -o remount,rw -t rfs /dev/block/stl9 /system
I'm not saying it is wrong, in fact, it actually worked for me. I'm just curious as to why it works like that? My understanding of mounting partitions and such in Linux is a little bit weak, so I like to indulge my curiousity by bugging fine people like yourself
Anyway, thanks again, this did exactly what I needed it to. Well done, I appreciate it.
DavidThompson256 said:
One quick question actually. Why do you mount like this:
Code:
# mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
When most instructions for the Galaxy Tab have you doing something like this:
Code:
# mount -o remount,rw -t rfs /dev/block/stl9 /system
I'm not saying it is wrong, in fact, it actually worked for me. I'm just curious as to why it works like that? My understanding of mounting partitions and such in Linux is a little bit weak, so I like to indulge my curiousity by bugging fine people like yourself
Click to expand...
Click to collapse
Thanks for pointing that out! Actually both the filesystem type and blockdevice name were totally wrong. Apparently the mount command ignores both parameters - at least when they are wrong.
I just verified this as self-punishment for not paying attention:
Code:
# mount
(...)
/dev/block/stl9 /system rfs ro,relatime,vfat,log_off,check=no,gid/uid/rwx,iocharset=utf8 0 0
(...)
/system is mounted read-only to /dev/block/stl9. This is the normal state of things.
Now I remount this without the fstype parameter and using a wrong blockdevice name:
Code:
# mount -o remount,rw /dev/block/xyz /system
# mount
(...)
/dev/block/stl9 /system rfs rw,relatime,vfat,llw,check=no,gid/uid/rwx,iocharset=utf8 0 0
(...)
Surprise, this actually remounts /system in read-write mode. This is why my original howto worked despite using the wrong parameters.
Thanks again. I corrected the HOWTO.
It works for me, but i get now error message: The application calendar save (proces com.android.providers.calendar) is unexpecly stopt. Try again. Forced closing
I had this also with SuperOneClick.
When i want to start the calender in the applications i get it also.
The application wil not run anymore.
How can i resolved this.
Thnx
leonreijnders said:
It works for me, but i get now error message: The application calendar save (proces com.android.providers.calendar) is unexpecly stopt. Try again. Forced closing
I had this also with SuperOneClick.
When i want to start the calender in the applications i get it also.
The application wil not run anymore.
How can i resolved this.
Thnx
Click to expand...
Click to collapse
That is strange. The result of the rooting process is just adding three files to the system partition. I find it hard to believe that this could lead to the problem you describe. However, while experimenting with z4root I had the the effect that there were many rageagainstthecage processes running in the background and the Galaxy Tab slowed down considerably. Perhaps there is something similar going on.
Have you tried rebooting after completing the rooting process?
Try shutting down the Tab completely.After rebooting get a shell on the Tab with "adb shell" and execute "ps". That shows the process list. If that looks normal, I would try a factory reset of the device. Which ROM version are you running?
BlackLevel: Thank you soooooooooo much... I don't get how to hit the Thanks Meter thing, but here is the old fashioned way. I used a MacBook to accomplish your perfect, step by step rooting of an AT&T Galaxy Tab i987. It helps that I'm more comfortable at the command line than with most GUI systems.
I could put this into a bash script, but that could be dangerous. People really need to look at whats happening with 'adb' and have some idea of what adb is for. I did renamed your 'adbmac' to 'adb', then I could cut and paste from your instructions except for adding ./ before the adb... ie. ./adb shell
Again, wonderful work at pulling this all together in one place.
Jeff
This guide worked perfectly! I love a nice quiet clean root and it doesn't get any better than this. You my friend deserve a cookie!
Hi Guys,
I flashed to JMA, rooted it with One Click Root, and everxthing seemdet to be okay, but activating OCLF failed....is there anybody with the same problem?
Jan
Thanks a lot !. It's clean and doesn't need a kies ...
Just a question : after reboot I have to use "su" after "adb shell" to become root.
Is there any way to be root directly after adb shell ?
And thanks again ...
Mike
mbaroukh said:
Just a question : after reboot I have to use "su" after "adb shell" to become root.
Is there any way to be root directly after adb shell ?
Click to expand...
Click to collapse
The reason is that "/sbin/adbd" (the adb daemon) is running as the shell user. It would need to run as root user instead. This requires changes to the initial ram disk where adbd the relevant settings are stored.
Dealing with "insufficient permissions for device"
Thanks, this worked for me.
One small thing: running from a Linux sustem (Ubuntu 9.04), to overcome a "insufficient permissions for device" problem, I had to put my Ubuntu terminal session into su mode and restart the ADB server -- cf. groups.google.com /group/android-discuss/browse_thread/thread/f85a795644e65b59?pli=1 :
[[
adb kill-server
sudo adb start-server
adb devices
]]
gklyne said:
One small thing: running from a Linux sustem (Ubuntu 9.04), to overcome a "insufficient permissions for device" problem, I had to put my Ubuntu terminal session into su mode and restart the ADB server -- cf. groups.google.com /group/android-discuss/browse_thread/thread/f85a795644e65b59?pli=1 :
[[
adb kill-server
sudo adb start-server
adb devices
]]
Click to expand...
Click to collapse
Thanks for the feedback. On my Ubuntu 10.10 adb runs under my regular user-id (1000) and I do not have to use sudo or run the local adb server as root. That might be due to the way the udev rules are set up. Mine are rather unrestrictive and look like this:
Code:
$ cat /etc/udev/rules.d/51-android.rules
SUBSYSTEMS=="usb", SYSFS{idVendor}=="0bb4", MODE="0666"
SUBSYSTEMS=="usb", SYSFS{idVendor}=="04e8", MODE="0666"
How do yours look like?
Which is the more simple method for root of galaxy tab euro ?are there ?
the incredible said:
Which is the more simple method for root of galaxy tab euro ?are there ?
Click to expand...
Click to collapse
Try z4root or SuperOneClick. Both methods are wrappers of the rageagainstthecage exploit and try to automate the manual process outlined here.
This thread should be a sticky. Worked like a charm.
z4root is very simple method..thanks.
thanks to Germany...
I agree, this thread should be sticky. Finaly some sense in android devel section...
Thank you very much for your guide!
I followed all the instructions in your guide, everything seems fine until I try to push the busybox and su to my Galaxy Tab.
blacklevel said:
Now we push busybox and su via adb. Then we install Superuser.apk.
Code:
> adb push busybox /system/bin
> adb push su /system/bin
> adb install Superuser.apk
[/update]
Click to expand...
Click to collapse
I received an error: "failed to copy 'busybox' to '/system/bin/busybox' : No space left on device\"
the same error for the 'su' too
(No space left on device) is impossible, my tab is brand new sealed when i got it.
I have been trying the z4root and SuperOneClick procedure to root this tab but are all unsuccessful.
I am not sure if it is because of my tab needed a "NAND unlock" (I cannot find any guide about the NAND unlock) because I received this message when I tried to install busybox from the market.
Please help! My tab is carrier locked to Bell Canada, I really wanna to unlock it and root it~
Thanks!
gummo6869 said:
I received an error: "failed to copy 'busybox' to '/system/bin/busybox' : No space left on device\"
the same error for the 'su' too,
Click to expand...
Click to collapse
The `no space left on device` message indicates that the /system partition is still read-only. That means the mount command in step 3 was unsuccessful. Did you get any error message when you executed it?
SOLVED: The file had Windows EOL formatting. *nix no likely that.
In the init script there are several instances of if statements like this:
Code:
testvar=1
if [ "$testvar" = "1" ] ; then
echo "Testvar is equal to one"
fi
Yet, when I put if statements exactly like this into a shell script and execute them in an adb shell (or connectbox shell), I get the following error:
line 4: syntax error: unexpected "fi" (expecting "then")
I've also taken if statements directly from init and they throw the same error.
Any busybox gurus here know what's up with this?
toadlife said:
In the init script there are several instances of if statements like this:
Code:
testvar=1
if [ "$testvar" = "1" ] ; then
echo "Testvar is equal to one"
fi
Yet, when I put if statements exactly like this into a shell script and execute them in an adb shell (or connectbox shell), I get the following error:
line 4: syntax error: unexpected "fi" (expecting "then")
I've also taken if statements directly from init and they throw the same error.
Any busybox gurus here know what's up with this?
Click to expand...
Click to collapse
Remove the ; and enter the then
Code:
testvar=1
if [ "$testvar" = "1" ]
then
echo "Testvar is equal to one"
fi
Nope. Still throws the same error.
This is driving me nuts. What I'm doing is editing the /init script. The loops work just fine when executed at bootup in / init, but remounting the filesystem, editing /init and rebooting just the test a change takes forever.
For now I've got my changes to init working, but it would be nice to be able to test before editing /init
I just realized that I forgot to put `#!/bin/sh` at the top of my script. But doing so doesn't seem to help. Instead I get not found error.
Weird!
toadlife said:
Nope. Still throws the same error.
This is driving me nuts. What I'm doing is editing the /init script. The loops work just fine when executed at bootup in / init, but remounting the filesystem, editing /init and rebooting just the test a change takes forever.
For now I've got my changes to init working, but it would be nice to be able to test before editing /init
Click to expand...
Click to collapse
Code:
testvar=1
if [ $testvar = `1` ] (`=~ key)
then
echo "Testvar is equal to one"
fi
[/QUOTE]
It gives the echo, but also 1: not found.
Here is the actual code I put into my init:
(this works)
Code:
#Super cool battery thingy
RUNSCBS=`/bin/grep -o "run.scbs=.*" /proc/cmdline | /bin/sed -e "s/.*run.scbs=//g" -e "s/ .*//g"`
if [ "$RUNSCBS" = "1" ] ; then
dev=$(cat /sys/class/scbs/0/dev | sed -e "s/:/ /g")
mknod /dev/scbs0 c $dev
scbs -d -co /sdcard/scbs.conf
fi
# Debug logs
TAKELOGS=`/bin/grep -o "take.logs=.*" /proc/cmdline | /bin/sed -e "s/.*take.logs=//g" -e "s/ .*//g"`
if [ "$TAKELOGS" = "1" ] ; then
logfiledate=`expr substr \`date -Iseconds|tr -d :|tr -d \+|tr -d \-|tr -d T\` 1 14`
tar -cz -f "$card"/debuglogs_"$logfiledate".tar.gz "$card"/debuglogs_*.txt
cat /proc/kmsg>"$card"/debuglogs_kmsg_"$logfiledate".txt &
logcat -v time >"$card"/debuglogs_logcat_time_"$logfiledate".txt &
logcat -v time -b radio>"$card"/debuglogs_logcat_time_radio_"$logfiledate".txt &
fi
Ooooo I really like the idea of having logging running from init. Does that work well? Do the logs ever 'loop' and you end up missing things, or do they just keep on churnin?
arrrghhh said:
Ooooo I really like the idea of having logging running from init. Does that work well? Do the logs ever 'loop' and you end up missing things, or do they just keep on churnin?
Click to expand...
Click to collapse
AFAIK, they go forever. I started doing it last night by just putting the static command in the /init and the logging was still going when I got up this morning.
This morning wanted to see if I could make logging and scbs triggerable by an option in the command line.
Both are working for me now.
Know if where talking about scripts, i have a question too.
This is my RIL logs script:
Code:
#! /system/bin/sh
i="0"
while [ $i -lt 2 ]
do
date=`date +%Y%m%d%H%M`
if [ -d /sdcard/logs/ril/$date/ ]
then
echo "/sdcard/logs/ril/$date/ exists!"
else
mkdir /sdcard/logs/ril/$date/
echo " Made direction /sdcard/logs/ril/$date!"
fi
logcat -v time > /sdcard/logs/ril/$date/logcat-time.txt &
logcat -v time -b radio > /sdcard/logs/ril/$date/logcat-time.txt &
sleep 18000 && kill -0 $! && kill $!
cd /sdcard/logs/ril/
tar -czf ril$date.tar.gz $date
rm -r $date
cd /
done
The thing, i believe, is that only the logcat -v time -b radio is killed and when it's sleeping it's not doing that in the background.
Sleeping for 18000 seconds (5h), because if it's running for a day the logcat log will be more than 10 mb or so.
lol.
Your date string...
Code:
date +%Y%m%d%H%M
...is a bit simpler than mine...
Code:
expr substr `date -Iseconds|tr -d :|tr -d \+|tr -d \-|tr -d T` 1 14
(I couldn't figure out the `date` syntax)
Christiaan91 said:
Know if where talking about scripts, i have a question too.
This is my RIL logs script:
Code:
#! /system/bin/sh
i="0"
while [ $i -lt 2 ]
do
date=`date +%Y%m%d%H%M`
if [ -d /sdcard/logs/ril/$date/ ]
then
echo "/sdcard/logs/ril/$date/ exists!"
else
mkdir /sdcard/logs/ril/$date/
echo " Made direction /sdcard/logs/ril/$date!"
fi
logcat -v time > /sdcard/logs/ril/$date/logcat-time.txt &
logcat -v time -b radio > /sdcard/logs/ril/$date/logcat-time.txt &
sleep 18000 && kill -0 $! && kill $!
cd /sdcard/logs/ril/
tar -czf ril$date.tar.gz $date
rm -r $date
cd /
done
The thing, i believe, is that only the logcat -v time -b radio is killed and when it's sleeping it's not doing that in the background.
Sleeping for 18000 seconds (5h), because if it's running for a day the logcat log will be more than 10 mb or so.
Click to expand...
Click to collapse
Hmm. I haven't set up gscript myself yet, but you might need to nohup the logcats to get them to stay once gscript shuts down.
arrrghhh said:
Ooooo I really like the idea of having logging running from init. Does that work well? Do the logs ever 'loop' and you end up missing things, or do they just keep on churnin?
Click to expand...
Click to collapse
I have found one issue. It's seems that whenever scbs runs, locat fails to open the log devices. I just disabled scbs and logcat worked. I'm going to try swapping the code around so scbs runs after the logging starts.
It seems scbs blows up logcat, even when it is triggered after logging starts. Ughhh.
Entropy512 said:
Hmm. I haven't set up gscript myself yet, but you might need to nohup the logcats to get them to stay once gscript shuts down.
Click to expand...
Click to collapse
logcat will be going, even when you close the terminal, but when you deleted the files they stop. So that's not a problem, cuz i won't delete.
BTW: is it possible to silently run scripts? Like this one?
./pathtoscript1 & ./pathtoscript2 & ./pathtoscript3
Christiaan91 said:
logcat will be going, even when you close the terminal, but when you deleted the files they stop. So that's not a problem, cuz i won't delete.
BTW: is it possible to silently run scripts? Like this one?
./pathtoscript1 & ./pathtoscript2 & ./pathtoscript3
Click to expand...
Click to collapse
What do you mean "silently run" - do you mean disable any printing to stdout?
./pathtoscript1 &>/dev/null & ; ./pathtoscript2 &>/dev/null &
should do the trick The &>/dev/null routes all output to /dev/null
Man, you guys go way overboard on this stuff. This is my gscript logging script.
Code:
cd /sdcard
mv logg.txt logg.0.txt
mv logr.txt logr.0.txt
nohup logcat -v time > logg.txt &
nohup logcat -v time -b radio > logr.txt &
nohup klogd > klog.txt
highlandsun said:
Man, you guys go way overboard on this stuff. This is my gscript logging script.
Code:
cd /sdcard
mv logg.txt logg.0.txt
mv logr.txt logr.0.txt
nohup logcat -v time > logg.txt &
nohup logcat -v time -b radio > logr.txt &
nohup klogd > klog.txt
Click to expand...
Click to collapse
Yeah, well we don't all have kung-fu coding ablities like you, so we go overboard with what we can overboard with.
Besides, I think it might be beneficial to put something like the code I wrote into the official init, so noobs can more easily provide debug logs.
One thing to keep in mind, busybox = /bin/sh, statically compiled sh is /system/bin/sh. I got tired of not having arrow key support whenever I su'ed (since /bin/su spawns a root /system/bin/sh regardless of what's in /etc/passwd) so I bind mounted /bin/sh (which is a symlink to busybox) over the one in /system in my user.conf. I haven't come across any ill effect, but if you feel that the shell difference may be causing issues, you could try that route, since it's very easy to undo.
-- Starfox
Starfox said:
One thing to keep in mind, busybox = /bin/sh, statically compiled sh is /system/bin/sh. I got tired of not having arrow key support whenever I su'ed (since /bin/su spawns a root /system/bin/sh regardless of what's in /etc/passwd) so I bind mounted /bin/sh (which is a symlink to busybox) over the one in /system in my user.conf. I haven't come across any ill effect, but if you feel that the shell difference may be causing issues, you could try that route, since it's very easy to undo.
-- Starfox
Click to expand...
Click to collapse
Thanks for the tip. I'll give that a shot.
LOL. I'm an idiot
Figured out what the problem was. The file had Windows EOL formatting.
That's what I get for using Windows to edit shell scripts.
Hello,
I have a question about linux shell command aliases in Android:
Is it possible to set up permanent aliases that can be used from both a terminal emulator on the device as well as ADB?
When I define an alias using adb, its gone as soon as I exit that session... but I would really like to have some permanent aliases for things I often use...
For example: "ls -la --color=never" is a bit tough to type everytime, but otherwise the color codes will screw up the adb shell output...
Any help appreciated!
Found a solution.
If anyone is interested:
Download bash posted in this thread: http://forum.xda-developers.com/showthread.php?t=537827
Adb push this bash to /system/bin, set permissions to 755 and symlink ./sh to ./bash...
Actually, instructions are all in the other thread
Then you can put your bashrc file to /sdcard/bash_profile, done!
It took me some searching but I found out how. Just add your aliases to the bottom of /system/etc/mkshrc
Hey all -
I have a corrupted extSd card and trying to save it if possible. I've tried windows chkdsk etc but it freezes and unmounts while running the check, and from the commandline I get a I/O error timeout. I know it's iffy... but trying to see if I can fix it from the android side.
I found the e2fsck command that I can most easily run from the adb shell / su route, but it's stuck when I do it, so not sure if it's running or (most likely) I'm running it wrong.
What I'm doing is, from a windows command prompt:
Code:
adb shell
su
e2fsck -fv /extSdCard
Then it's frozen.
Does it take a long time to run or am I doing it wrong? Thanks!
The Android Shell
A "shell" is a program that listens to keyboard input from a user and performs actions as directed by the user. Android devices come with a simple shell program. This shell program is mostly undocumented. Since many people are curious about it I thought I'd write up some documentation for it.
Currently this documentation is incomplete, sorry!
Common problems
The built-in shell has very limited error handling. When you type a command name incorrectly it will say "permission denied", even though the real problem is that it couldn't find the command:
$ dir
dir: permission denied <---- this is a misleading error message, should say 'dir: not found'
$ ls
... listing of current directory
The PATH variable
The Android shell will run any program it finds in its PATH. The PATH is a colon (':') seperated list of directories. You can find out what your shell's PATH is set to by using the built-in echo command:
$ echo $PATH
/data/local/bin:/sbin:/vendor/bin:/system/sbin:/system/bin:/system/xbin
Depending upon your shell, you may see a different result.
Built in Commands
Every shell has a few built-in commands. Some common built-in commands are:
echo -- prints text to stdout.
set -- sets shell variables
export -- makes shell variables available to command-line programs
cd -- change the current directory.
pwd -- print name of the current directory.
Commands
To find out what commands you have available to you, use the "ls" command on each of the directories in the PATH variable.
Finding documentation for the Android commands.
Many of the Android commands are based on standard Linux (or bsd) commands. If you're curious about a command, you can sometimes learn how it works by using the "man" command on a desktop Linux or OSX (Apple Macintosh) computer. The Linux or OSX version of the command may be different in details, but much of the documentation will still apply to the Android version of the command.
Another source of documentation for people without a Linux or OSX machine handy is to use a web browser and use a web search engine to search for the text: "man Linux command-name".
List of commands
The following is a list of the commands that are present on a Nexus S phone running an Android 2.3.3 "user-debug" build. Many of these commands are not present on a "user" phone. (They are missing from a "user" phone because they are specific to developing or debugging the Android operating system.)
$ ls /data/local/bin
/data/local/bin: No such file or directory
Notice that by default there is no /data/local/bin directory. You can create this directory using the "mkdir" command if you like.
$ ls /sbin
opendir failed, Permission denied
The /sbin directory exists, but you don't have permission to access it. You need root access. If you have a developer phone, or otherwise have root access to your phone you can see what's in this directory.
$ su
# ls /sbin
ueventd
adbd
# exit
$
Notice that the shell prompt changes from a '$' to a '#' to indicate that you have root access.
Notice also that neither of the /sbin commands are useful to the shell -- the adb and ueventd files are 'daemon' programs used to implement the Android Debugger "adb" program that is used by developers.
$ ls /vendor/bin
gpsd
pvrsrvinit
Vendor/bin is where device vendors can put device-specific executables. These files are from a Nexus S.
$ ls /system/sbin
/system/sbin: No such file or directory
This directory does not exist on a Nexus S.
$ ls /system/bin
am
am is the Android Activity Manager. It's used to start and stop Android activities (e.g. applications) from the command line. Type am by itself to get a list of options.
amix
aplay
Command line audio file player.
app_process
applypatch
Used to apply patches to android files.
arec
Command line audio recorder.
audioloop
bluetoothd
BlueTooth daemon
bmgr
Backup manager - type command by itself to get documentation.
bootanimation
Draws the boot animation. You may have to reset your phone to get out of this.
brcm_patchram_plus
bugreport
cat
Copy the contents of a file to standard output.
chmod
Change the mode of a file (e.g. whether it can be read or written.)
chown
Change the owner of a file.
cmp
Compare two files byte-by-byte
dalvikvm
The dalvik virtual machine. (Used to run Android applications.)
date
Prints the current date and time
dbus-daemon
dd
Convert and copy a file. By default copies standard in to standard out.
debuggerd
dexopt
df
Shows how much space is free on different file systems on your device.
dhcpcd
dmesg
dnsmasq
dumpstate
dumpsys
dvz
fsck_msdos
gdbserver
getevent
getprop
gzip
hciattach
hd
id
ifconfig
Shows the current configuration of network interfaces (IP, MAC address etc)
iftop
Shows the current processes using the network interfaces (top, but for networks)
ime
input
insmod
installd
ioctl
ionice
iptables
Manage the firewall
keystore
keystore_cli
kill
Send signals to processes.
linker
ln
Used to set up a file system link.
log
logcat
Prints the Android runtime log.
logwrapper
ls
Lists files.
lsmod
lsof
make_ext4fs
mediaserver
mkdir
Make a directory.
monkey
A program that sends random events, used to test applications. (Like having a monkey playing with the device.)
mount
mtpd
mv
Move a file from one directory to another. (Only on the same file system. Use "cat a > b" to copy a file between file systems.
nandread
ndc
netcfg
netd
netstat
newfs_msdos
notify
omx_tests
pand
ping
pm
pppd
printenv
ps
List active processes.
qemu-props
qemud
racoon
radiooptions
reboot
Reboot the device.
record
renice
rild
rm
Remove a file.
rmdir
Remove a directory.
rmmod
route
rtp_test
run-as
schedtest
schedtop
sdcard
sdptool
sendevent
service
servicemanager
setconsole
setprop
setup_fs
sh
showlease
sleep
smd
stagefright
start
Starts the Android runtime.
stop
Stops the Android runtime.
surfaceflinger
svc
sync
system_server
tc
testid3
toolbox
top
Shows which processes are currently using the most CPU time.
umount
uptime
Prints how long your device has been running since it was last booted.
vdc
vmstat
vold
watchprops
wipe
wpa_cli
wpa_supplicant
$ ls /system/xbin
add-property-tag
btool
check-lost+found
dexdump
dhdutil
hcidump
latencytop
librank
opcontrol
oprofiled
procmem
procrank
rawbu
scp
Secure copy program. (Used to copy files over the network.)
showmap
showslab
sqlite3
Used to administer SQLite databases.
strace
System trace command - use to see what system calls a program makes.
su
Start a shell with root privileges.
Versions of the Android Shell
Android 1.0 used a shell that had no tab completion or history editing.
Android 2.3 added history editing. You can for example use the up/down arrows to edit previous commands.