Develop Bugs

[Q] Rooting the Creative Zio

Hi there!
I'm trying to root Ziio 7 unit I got for a review for PurePC.pl, and so far so good I installed SuperUser app and su and busybox binaries. Now using terminal I can su without any problems. But the thing is, SU only seems to be working in terminal emulator. I've tried using some apps that should use root like ShootMe and ScreenshotIt, SetCPU and they just doesn't work.
ShootMe says "Starting Server failed", plus info that i need to have root access and enabled access to lower graphics (whatever it is).
ScreenshotIt just doesn't work without any information why, and SetCPU FC's after selecting profile. Although it gets me a nice SuperUser dialog, but that's as far as it goes, cause it crashes right after that.
Am I missing something to have a complete root? Interesting thing is that on this device, preferred PATH for executable binaries is /data/busybox/, and not a usual /system/bin. Interestingly, my su binaries refused to work from /data/busybox directory, so I moved them to /system/bin. Rest of the utilities and such are still in /data/busybox, but I don't know if this information is important in any way Have I missed something along the way? Please help. Cheers.

OK, I know why su gave me permission denied when running from /data/busybox. The /data partition was mounted with nosuid. But still the applications such as ShootMe won't work.

I waiting for. If who has a good new. Please tell me to private message.

Have you made any progress on this bagienny?

Lost shell root access

Hi,
i have a rooted Desire Z currently running CM9 RC2, and I've noticed recently that my # shell has been replaced by a [email protected]:/ and it seems like I don't have root access there. I can't ls in /data/ for example, and su throws a permission denied error. However, apps that require root access(such as Titanium Backup) still seem to work. I noticed this happen right after I installed and ran Busybox. I did not even install busybox from the app as I already have it. I was just trying to get the apk file for another device with no internet access. I'm not sure if this app is what caused it, but it was when I noticed it.
In any case, short of a nandroid restore how do I get back shell root access and the proper shell?
Thanks.

Most likely your root access under System Settings -> Development was changed from "ADB and Apps" to "Apps Only".
PS: why would you be installing busybox, CM9 came with it (likewise with superuser and su).

Thanks. That worked.
Like I mentioned in my original post
I did not even install busybox from the app as I already have it. I was just trying to get the apk file for another device with no internet access.
Click to expand...
Click to collapse

goister said:
Thanks. That worked.
Like I mentioned in my original post
Click to expand...
Click to collapse
Though your quote here conflicted so wasn't sure :
I noticed this happen right after I installed and ran Busybox.
Click to expand...
Click to collapse

Sorry for the confusion, by running busybox I meant simply launching the Busybox app(which is just an installer, not busybox itself), but not clicking the "install busybox" button in the app to actually install busybox on my phone.

Problems with GBTweaked and R800x

Hi,
Last night I installed the latest CDMA version of GBTweaked for my locked R800x. I am running into the standard no wifi issue, however, when I tried to install the wifi modules, I found myself unable to access CWM.... I tried to reinstall CWM with no luck. Flashtool isn't helping much with restoring to a previod nandroid backup either. Help would be greatly appreciated.

Maybe the button assigned to enter cwm has changed?
Last time i use kernel that assign back button for cwm, but since i have cwm on my system that use volume button to enter recovery mode, so the back button function is nullified automatically
Sent from my R800x using xda app-developers app

otonieru said:
Maybe the button assigned to enter cwm has changed?
Last time i use kernel that assign back button for cwm, but since i have cwm on my system that use volume button to enter recovery mode, so the back button function is nullified automatically
Sent from my R800x using xda app-developers app
Click to expand...
Click to collapse
Well, I don't even get the blue light on boot to indicate it is waiting for me to push the button...
Additionally, I keep finding a lot of chmod/rm/ls permission denies whenever I tried to reinstall superuser, or use the PC installer for CWM and Titanium keeps FC whenever I try to start it.

I just ran rootchecker and got this:
Congratulations! You have root access!
Superuser Application Status:
Superuser application - version 3.0.7 - is installed!
System File Properties for Root Access:
Alternative Location
Check Command: ls -l /sbin/su:
Result: exec: ls: permission denied
Analysis: Setuid attribute NOT present and root user ownership is NOT present. Root access is NOT correctly configured for this file!
Standard Location
Check Command: ls -l /system/bin/su:
Result: exec: ls: permission denied
Analysis: Setuid attribute NOT present and root user ownership is NOT present. Root access is NOT correctly configured for this file!
Standard Location
Check Command: ls -l /system/xbin/su:
Result: exec: ls: permission denied
Analysis: Setuid attribute NOT present and root user ownership is NOT present. Root access is NOT correctly configured for this file!
Alternative Location
Check Command: ls -l /system/xbin/sudo:
Result: exec: ls: permission denied
Analysis: Setuid attribute NOT present and root user ownership is NOT present. Root access is NOT correctly configured for this file!
Root User ID and Group ID Status:
Root user id:
uid=0(root)
Root group id:
gid=0(root)
System Environment PATH: /sbin /vendor/bin /system/sbin /system/bin /system/xbin
ADB Shell Default User:
ADB shell setting for standard access, stored in default.prop, is configured as: shell (non root) user - ro.secure=1
Results provided on your R800x device by Root Checker Pro version 1.2.1 from joeykrim in the Android Market -
Any thoughts?

edwinen said:
Hi,
Last night I installed the latest CDMA version of GBTweaked for my locked R800x. I am running into the standard no wifi issue, however, when I tried to install the wifi modules, I found myself unable to access CWM.... I tried to reinstall CWM with no luck. Flashtool isn't helping much with restoring to a previod nandroid backup either. Help would be greatly appreciated.
Click to expand...
Click to collapse
I am assuming you have root access. Download an app called x-parts from the googleplay store that will install the CWM for you. I don't remember how to get into recovery by using the app but I think it is pressing the volume d-rocker down or up. Play with your xperia play buttons a little and you will be able to get into recovery.

chery2k said:
I am assuming you have root access. Download an app called x-parts from the googleplay store that will install the CWM for you. I don't remember how to get into recovery by using the app but I think it is pressing the volume d-rocker down or up. Play with your xperia play buttons a little and you will be able to get into recovery.
Click to expand...
Click to collapse
I do have root, or at least it still seems like I do, with the exception of the errors root checker is giving me. X-parts never worked for me before I changed roms, and it isn't working now. The only way I could get into recovery was by using CWM v. 5.
Whenever I try to install now however, it says it installed, and to reboot, however, when it is rebooting, I never get the blue light like I used to, and when it loads all the way into the system and go back into CWM/x-parts it tells me recovery isn't installed, and that my phone is supported.

edwinen said:
I do have root, or at least it still seems like I do, with the exception of the errors root checker is giving me. X-parts never worked for me before I changed roms, and it isn't working now. The only way I could get into recovery was by using CWM v. 5.
Whenever I try to install now however, it says it installed, and to reboot, however, when it is rebooting, I never get the blue light like I used to, and when it loads all the way into the system and go back into CWM/x-parts it tells me recovery isn't installed, and that my phone is supported.
Click to expand...
Click to collapse
Do not use an auto-installing app for CWM.
If you are on windows, use RecoveryX.
Sent from my Kindle Fire

Sounds like you need to download the su binaries. In the superuser app, go to your settings menu and look for the option to update your su binaries.

lightningdude said:
Sounds like you need to download the su binaries. In the superuser app, go to your settings menu and look for the option to update your su binaries.
Click to expand...
Click to collapse
Hmm.. any way of doing this without an internet connection? Right now I have no wireless functionality, additionally my reception is very minimal here (no 3G atm)

edwinen said:
Hmm.. any way of doing this without an internet connection? Right now I have no wireless functionality, additionally my reception is very minimal here (no 3G atm)
Click to expand...
Click to collapse
yeah, it involves pushing to the su folder via adb, but I don't remember the steps involved. Searching for a manual way to root any phone should turn that bit up.

lightningdude said:
yeah, it involves pushing to the su folder via adb, but I don't remember the steps involved. Searching for a manual way to root any phone should turn that bit up.
Click to expand...
Click to collapse
Yeah... well, whenever I try to do anything with adb shell, i get permission denied, I can't even ls!!!

how about re-flashing kernel? doom kernel should bring along CWM as well...

otonieru said:
how about re-flashing kernel? doom kernel should bring along CWM as well...
Click to expand...
Click to collapse
Hmm.. well looks like my only option is to wait for my bootloader unlock... but I have not heard back from them in about 5 days.

They r quite slow in replying email, contact them via gTalk directly.. or just pay 1st (like what i did), when they receive the money they will feel more responsible to finish the service, LoL
Sent from my R800x using xda app-developers app
---------- Post added at 11:28 PM ---------- Previous post was at 11:27 PM ----------
For now i will suggest to falshback to original stock via flashtool..
Sent from my R800x using xda app-developers app

Well.. ended up unlocking the phone, and been messing with various options. Nothing seems to be working quite well, although it is because I am trying to use CM10 and CM9 which dont seem TOO stable.. but eh... Thanks for all the help everyone!

[NOW WORKS] Obtaining root with master key vulnerability

One click root with impactor now works. Works on <4.3. No need for unlocked bootloader. Does not wipe data.
http://www.saurik.com/id/17

Copy over the superuser.apk and the such binary onto your phone, then use the MV command to move it to /system/app and /system/xbin respectively.
Beamed from my Grouper

Mach3.2 said:
Copy over the superuser.apk and the such binary onto your phone, then use the MV command to move it to /system/app and /system/xbin respectively.
Beamed from my Grouper
Click to expand...
Click to collapse
What should the permissions on each be?
EDIT: Can you alternatively only push the su binary and download superuser from gplay?

krackers said:
What should the permissions on each be?
EDIT: Can you alternatively only push the su binary and download superuser from gplay?
Click to expand...
Click to collapse
If the binary is wrong, the one from play store may not work.
Permission should be rw-r-r(0644) for the su.apk and rwsr-sr-x(0645) for the su binary.
Beamed from my Maguro.

I tried it myself and while it appears that commands do run, they don't appear to work. I think it might have to do with running as system vs running as root. Why else would saurik use an indirect method of gaining root (using ro.kernel.quemu) as opposed to directly pushing the su binaries.

krackers said:
I tried it myself and while it appears that commands do run, they don't appear to work. I think it might have to do with running as system vs running as root. Why else would saurik use an indirect method of gaining root (using ro.kernel.quemu) as opposed to directly pushing the su binaries.
Click to expand...
Click to collapse
This is correct: sometime in the Android 4.1 release cycle, they removed the ability to use /data/local.prop as an attack vector to go from system->root. The signature bug lets you modify the code of any APK, but the most powerful user an app can ever run as is system, not root.
However, in an update to Impactor today, I've added a system->root escalation. This allows one-click rooting, and even though the system->root I'm using has already been patched in AOSP (the idea was not to waste something to go along with a shell->system that is already long burned) it works on my 4.2.2 Nexus 4 (and so I'd imagine will also work fine on a Galaxy Nexus) as Android sucks at getting patches to real devices ;P.

Using Impactor on my Panasonic Eluga dl01 does somehow not work.
(Android 4.0.4)
I get following error message:
/data/local/tmp/impactor-6[3]: /data/local/tmp/impactor-4: Operation not permitted
I also tried and played around with the command line in Impactor.
"adb devices" won't list my phone
But when I use the adb from the current Android SDK I just installed, it will display my phone with "adb devices".
I also downloaded a ICS 4.04 root zip file with a script and adb files inside. When using that adb version, my phone won't be displayed too. Now when I run adb from the android SDK, it will say something like "server is outdated" then something like "kill and restart with new server" --> "adb devices" lists my phone correctly again.
May be the adb version used in Impactor is outdated and responsible for the error message?
I would really appreciate any help with this topic, because the Panasonic Eluga phone was never rooted until now and no known root method is available. I always kinda hoped that someone would use the masterkey thing to make a universal rooting tool

saurik said:
This is correct: sometime in the Android 4.1 release cycle, they removed the ability to use /data/local.prop as an attack vector to go from system->root. The signature bug lets you modify the code of any APK, but the most powerful user an app can ever run as is system, not root.
However, in an update to Impactor today, I've added a system->root escalation. This allows one-click rooting, and even though the system->root I'm using has already been patched in AOSP (the idea was not to waste something to go along with a shell->system that is already long burned) it works on my 4.2.2 Nexus 4 (and so I'd imagine will also work fine on a Galaxy Nexus) as Android sucks at getting patches to real devices ;P.
Click to expand...
Click to collapse
Do you need to have an unlocked bootloader for the root exploit to work? I am hoping to get root without having to wipe the device by unlocking.
To the poster above me: Try using a different computer and if that doesn't work, switch operating systems.

krackers said:
Do you need to have an unlocked bootloader for the root exploit to work? I am hoping to get root without having to wipe the device by unlocking.
Click to expand...
Click to collapse
That's the whole point in securing Android, not that people have easier ways instead of unlocking a device.

Tested and works great. I now have root. Yay!

Does it show any of the problems that chainfire's superSU 1.41 shows?
Sent from my Galaxy Nexus using xda app-developers app

The root exploit only places the su binary and sets the right permissions. You can use any root manager you want (I used clockworkmod's superuser app).

mercuriussan said:
Using Impactor on my Panasonic Eluga dl01 does somehow not work.
(Android 4.0.4)
Click to expand...
Click to collapse
The feature of installing su will not work on every device: a lot of emphasis is put on "rooting" Android devices, but on many devices even root can't do things like modify the files in /system; I'd use the term "jailbreak" as to being what people really want to do with their device, but Android people seem to have that term ;P. What this means is that you really need a kernel exploit, not just a shell->system->root escalation.
mercuriussan said:
I get following error message:
/data/local/tmp/impactor-6[3]: /data/local/tmp/impactor-4: Operation not permitted
Click to expand...
Click to collapse
This error message actually indicates that Impactor succeeded in obtaining root control over your phone. However, when it tried to then, as root, remount /system writable so it could copy the su binary in place, it wasn't allowed to do so. A future version of Impactor will make it easier to drop to a root shell so you can test things out manually, but this means that while you can run code as root, you won't be able to install su.
However, if you have the time to play with it, get a copy of busybox and use adb to push it to /data/local/tmp (this is also something Impactor should help you do, but does not yet). (You will also need to make it executable, don't forget: "chmod 755 /data/local/tmp/busybox".) Then run the suggested Impactor command involving telnetd. Finally, via a shell, run "/data/local/tmp/busybox telnet 127.0.0.1 8899": you are now root.
You can verify that you are root because you will now have a # as a prompt instead of a $. Then run "mount -o remount,rw '' /system" (<- note, that's two single quotation marks as an argument between remount,rw and /system). This is the command that should fail with the "Operation not permitted" message. You are, however, root, so maybe there's something you want to do on the device at that point ;P.
mercuriussan said:
I also tried and played around with the command line in Impactor.
"adb devices" won't list my phone
But when I use the adb from the current Android SDK I just installed, it will display my phone with "adb devices".
Click to expand...
Click to collapse
The "Open Shell" in Impactor connects you to the device via adb: if you run adb on the device and ask for a list of devices attached to the device--something I didn't even realize was possible until you pointed it out here ;P I tested it, though, and wow: that actually is possible--you will get a blank list. However, suffice it to say that if you were able to type that at all, it can see your device.

Thanks for the suggestion, I'll try my luck in finding some exploit I can use...

So since Google patched this in 4.3, does this mean almost all devices before 4.2.2 can be rooted with this method?

bmg1001 said:
So since Google patched this in 4.3, does this mean almost all devices before 4.2.2 can be rooted with this method?
Click to expand...
Click to collapse
Yup - assuming they haven't been patched against the methods used (most haven't been).

Very interesting read. Thanks saurik & OP.

Eluga DL1
Hi there,
this post is in some ways a duplicate but different people seem to follow this thread because it is directly involving sauriks impactor.
Is there anything available that i can throw at Elugas 4.0.4 kernel to get r/w on the system partition?
I will try everything that is suggested to me.

[Guide] AdAway for systemless hosts file

About the only reason I root my phone is to install AdAway. I'd prefer to not modify the system partition to help make OTA's easier to get and to allow Android Pay to work. AdAway has a flashable .zip file that preps the hosts file to use the systemless root structure that comes along with SuperSU. Unfortunately, that script depends on being able to access the /data partition inside of TWRP which isn't going to happen any time soon on the HTC 10. Fortunately, it is easy for us to manually replicate what the flashable .zip is trying to do.
This isn't a detailed how-to, but more of a set of guidelines. Don't blame me if your phone explodes.
Root the phone with the latest SuperSU.
Download the AdAway_systemless_hosts_v2.zip file from the Unofficial AdAway thread.
Extract the files from inside the zip. We are only interested in two files in the support folder.
Connect the phone to your PC and turn on file transfer mode.
Copy "hosts" and "0000adaway.script" that you just extracted to the internal storage of your phone.
Use a program file Root Explorer to move "hosts" into /su/etc and move "0000adaway.script" into /su/su.d (this probably could have been done with ADB push, but I got permission errors when I tried it that way and I'm impatient and lazy).
Chmod 0755 /su/su.d/0000adaway.script (I used a root shell on the phone via ADB)
Install AdAway (I used the link in the Unofficial AdAway thread.)
Reboot the phone.
Run AdAway like normal. By default it should use /system/etc/hosts which is what you want.
If something doesn't work, figure out why and fix it. I'm happy to answer questions to the best of my ability.

AdAway works without problems here, with simple press activate button.

starbase64 said:
AdAway works without problems here, with simple press activate button.
Click to expand...
Click to collapse
Yup
Sent from my HTC 10 using Tapatalk

starbase64 said:
AdAway works without problems here, with simple press activate button.
Click to expand...
Click to collapse
Yes, but it modifies the /system partition unless you do the trick in OP. If I'm correct, you will have problems with OTA updates and Google Pay if you let AdAway directly modify the hosts file on /system.

Now that TWRP can access /data, can we just flash the zip?

goodtimes50 said:
Now that TWRP can access /data, can we just flash the zip?
Click to expand...
Click to collapse
Yes, you can. I downloaded that zip and apk from the Unofficial AdAway thread linked above. Booted into TWRP, flashed the newest betaSuperSU2.74-2-forceencrypt (not related to this, just so I'd be on the latest version), then the AdAway_systemless_hosts_v2.zip, rebooted and installed the apk and let it run. Rebooted. Showing hosts location as /system32/etc/hosts as the OP says is a good thing, and both files mentioned are in their correct places per Root Browser. [emoji106]
Sent from my HTC 10 using XDA-Developers mobile app

Sorry that it doesn't completely match the thread here but I think my question could fit in here anyway.
Do I suggest correctly that with systemless root, systemless AdAway and the stock recovery OTAs should be fully usable? Since there's no other modification to /system then.

bmwbasti said:
Sorry that it doesn't completely match the thread here but I think my question could fit in here anyway.
Do I suggest correctly that with systemless root, systemless AdAway and the stock recovery OTAs should be fully usable? Since there's no other modification to /system then.
Click to expand...
Click to collapse
I believe that is correct. There hasn't been a new OTA for my phone yet so I can't verify. However, when I do the check for new software it tells me no new updates (as opposed to the message about the files system being corrupt). I believe Android Pay should also work. I have it installed and added a new card, but I haven't tested making a purchase yet.

Thanks for the guide.
My device is rooted, but I didn't found su folder in anywhere when I use Root Explorer with root access, does anyone tell me how to get su folder and make AdAway work?

Fix for AdAway.
matif525 said:
Thanks for the guide.
My device is rooted, but I didn't found su folder in anywhere when I use Root Explorer with root access, does anyone tell me how to get su folder and make AdAway work?
Click to expand...
Click to collapse
Your device may use su, & still not have an su folder (at all) that is used for hosts file (ie systemless root). Just do this..
Download... Terminal emulator.
https://play.google.com/store/apps/details?id=jackpal.androidterm
Open terminal
Then enter these commands.. "Quote"
su
mount -orw,remount /system
rm /system/etc/hosts
ln -s /data/data/hosts /system/etc/hosts
mount -orw,remount /system
Now open AdAway go to preferences and select option to " Target hosts file"
Select /data/data/hosts
Enjoy..
If you still have ads in apps do this!!!
githyanki said:
Open the 3 dot menu in adaway, chose log DNS request. Enable TCP dump.
Open the app with ads, when ad loads, go back to adaway, and open log.
Long press any entries and chose black list.
Profit
Click to expand...
Click to collapse
All credit where credit is due. I just shared what I read else where.
Read here for more details..
https://github.com/AdAway/AdAway/issues/770
&
http://forum.xda-developers.com/showthread.php?t=2190753&page=143#post68988079
There is a known issue in HTC devices involves S-off. If the above doesn't solve this for you message here I'll follow. Or pm me. I work wierd hours be patient.

Rom Maximus 3.0.0 ( Android 7 ).Any instruction don't works,adaway no blocked ads.

regarding su folder to move files to
FreydNot said:
About the only reason I root my phone is to install AdAway. I'd prefer to not modify the system partition to help make OTA's easier to get and to allow Android Pay to work. AdAway has a flashable .zip file that preps the hosts file to use the systemless root structure that comes along with SuperSU. Unfortunately, that script depends on being able to access the /data partition inside of TWRP which isn't going to happen any time soon on the HTC 10. Fortunately, it is easy for us to manually replicate what the flashable .zip is trying to do.
This isn't a detailed how-to, but more of a set of guidelines. Don't blame me if your phone explodes.
Root the phone with the latest SuperSU.
Download the AdAway_systemless_hosts_v2.zip file from the Unofficial AdAway thread.
Extract the files from inside the zip. We are only interested in two files in the support folder.
Connect the phone to your PC and turn on file transfer mode.
Copy "hosts" and "0000adaway.script" that you just extracted to the internal storage of your phone.
Use a program file Root Explorer to move "hosts" into /su/etc and move "0000adaway.script" into /su/su.d (this probably could have been done with ADB push, but I got permission errors when I tried it that way and I'm impatient and lazy).
Chmod 0755 /su/su.d/0000adaway.script (I used a root shell on the phone via ADB)
Install AdAway (I used the link in the Unofficial AdAway thread.)
Reboot the phone.
Run AdAway like normal. By default it should use /system/etc/hosts which is what you want.
If something doesn't work, figure out why and fix it. I'm happy to answer questions to the best of my ability.
Click to expand...
Click to collapse
Hi there, ive got a mate 8, not sure if this adblocker will work on it but i want to try it out anyway. Ive unzipped the file but which folder in su do i move the files to? screenshot of the folders i have in su