[ROOT ICS] The hard way && Digging for roots

Search This thread
D

Deleted member 5132789

Guest
If you could send that udpate so we can put it online, it would be great.

I am working on a way to go around the bootloader... Not sure if it'll work. Will keep you all posted.

I have uploaded the update I received today - here it is: http://dl.dropbox.com/u/14212887/Acer_A100_2.008.03_PA_CA.zip

Getting back to rooting the ICS update - is there no way to add "su" and busybox apps with proper permissions to the update package so that when you apply the update you already have it in place? It seems there should be a way - of course you would have to sign the file before hand. I tried, modifying the updater-script file to include setting the permissions on su in /system/xbin... no luck - it failed to flash of course.
 
Last edited by a moderator:

masterpker2

Senior Member
Jan 28, 2012
53
28
found a useful tool for a500 works great for a100 1 click root tool for a500 leaked ics at tegra owners forum under a500 apps download the lite version and select a500 click root it and viola worked like a charm :)


Sent from my A100 using xda premium
 

ptesmoke

Senior Member
Sep 23, 2008
2,960
796
Cold Lake
found a useful tool for a500 works great for a100 1 click root tool for a500 leaked ics at tegra owners forum under a500 apps download the lite version and select a500 click root it and viola worked like a charm :)


Sent from my A100 using xda premium

serious? scampers to a500 forum...

edit: bummer...need pc. can someone make it into and apk tho? is that possible?
Sent from my SGH-I897 using xda premium
 
Last edited:
D

Deleted member 5132789

Guest
found a useful tool for a500 works great for a100 1 click root tool for a500 leaked ics at tegra owners forum under a500 apps download the lite version and select a500 click root it and viola worked like a charm :)


Sent from my A100 using xda premium

It appears to work - however, /system is still locked up tight. I upgraded from 3.2.1 rooted again tonight, then ran this process, then removed root toolbox from su permissions, ran the app, it prompted and i allowed. /System is still not mountable. Here's the link: http://forum.tegraowners.com/viewtopic.php?f=30&t=350
 
Last edited by a moderator:

crossix

Senior Member
Dec 6, 2007
408
232
Houston
Here's my attempt at a "double click" root for ics. I've included everything you might need including the usb drivers. It doesn't need anything special to run, just the usb driver installed and your tab with USB debugging enabled (go to settings -> developer options and check USB debugging.)

Download:
http://db.tt/77NSAPDs

Extract and install the usb driver if needed. Plug your tab in to your pc & Double click the .bat file. Check to see if your device id is listed, if its not close the window out and check that your device is connected and recognized by windows (also check that you have the drivers for the tab installed and that USB debugging is enabled).

If it is listed (should display a series of numbers) press any key to start the rooting scripts. It will load su and busybox to the loop mount for you. Once the script is done you may need to restart the tab and run the .bat file again to be able to write to the looped system (while the loop system is mounted you can modify the build.prop file and other files within /system by going to /data/local/rootme/loop/ but /system itself isnt r/w mounted. )

This was a pain to get working and it still may not work right, if it does work for you though, you can re-run the .bat file each time you reboot your tab to be able to write to the looped system. Eventually I'll integrate the commands into the install-recovery.bat file along with some sdcard tweaks so you won't have to re-run the bat file after reboot.

Thanks to eww245 for providing the commands initially (I used a variation of his and ones from the post on the toshiba forums to get this to work).

Sent from my MB860 using XDA App
 
Last edited:

aznmode

Senior Member
Jun 23, 2007
5,044
1,034
Thanks crossix going to try your method. Have you figured a way to edit build.prop to a500 yet? Buylt as long as I can get GL to SD working ill be happy.

Sent from my Transformer Prime TF201 using Tapatalk

EDIT:
was able to root yay! But still can edit build.prop since /system cannot be r/o
 
Last edited:

brendan802

Senior Member
Oct 4, 2010
277
187
thanks crossix

I have been lurking for awhile and waiting for a better root solution and I just tried crossix ics root bat and it works fabulously. I had to reboot to get it to work but now its working great and survived a few reboots. Thanks crossix you are the man.
 

jakob95

Senior Member
Sep 14, 2011
374
21
NYC
I used the 1 click method to root it from the Acer A500 one and it worked. Although I also pressed install Face Unlock, and now I have the option for it but it doesn't work.
 

pintek

Senior Member
May 10, 2011
372
43
Thanks will try it now....gonna do V2 with face unlock.

EDIT: Gets root but still cant R/O /system. Same result as crossix root. Are you able to change your /system to r/o or atleast edit build.prop in text editor?

face unlock doesn't work you can select it but it won't setup.
Sixaxis works this method \o/ that makes me sooooooo happy :D
 

crossix

Senior Member
Dec 6, 2007
408
232
Houston
Thanks crossix going to try your method. Have you figured a way to edit build.prop to a500 yet? Buylt as long as I can get GL to SD working ill be happy.

Sent from my Transformer Prime TF201 using Tapatalk

EDIT:
was able to root yay! But still can edit build.prop since /system cannot be r/o

You can edit the build.prop from /data/local/rootme/loop its a mirror image of /system using my root method.

I need a build.prop file from an a500 running ICS to get our tab more apps...

Sent from my MB860 using XDA App
 
Last edited:
  • Like
Reactions: aznmode and mugna91

aznmode

Senior Member
Jun 23, 2007
5,044
1,034
You can edit the build.prop from /data/local/rootme/loop its a mirror image of /system using my root method.

I need a build.prop file from an a500 running ICS to get our tab more apps...

Sent from my MB860 using XDA App

Gotcha! I requested the ICS build.prop at the a500 forum. Hopefully someone will reply back to me.

EDIT: I downloaded the ICS leak for a500 and extracted the build.prop file in the system folder. See attached.

Here's the source for the leak ICS
http://xdaforums.com/showthread.php?t=1510749

Here's the content:

# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=IML74K
ro.build.display.id=Acer_AV041_A500_0.009.00_WW_GEN1
ro.build.version.incremental=1328620975
ro.build.version.sdk=15
ro.build.version.codename=REL
ro.build.version.release=4.0.3
ro.build.date=Tue Feb 7 21:23:29 CST 2012
ro.build.date.utc=1328621009
ro.build.type=user
ro.build.user=pandora
ro.build.host=pandora03
ro.build.tags=release-keys
ro.build.sku=WW_GEN1
ro.product.model=A500
ro.product.brand=acer
ro.product.name=a500_ww_gen1
ro.product.device=picasso
ro.product.board=picasso
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.manufacturer=Acer
ro.product.locale.language=en
ro.product.locale.region=US
ro.wifi.channels=
ro.board.platform=tegra
# ro.build.product is obsolete; use ro.product.device
ro.build.product=picasso
# Do not try to parse ro.build.description or .fingerprint
ro.build.description=a500_ww_gen1-user 4.0.3 IML74K 1328620975 release-keys
ro.build.fingerprint=acer/a500_ww_gen1/picasso:4.0.3/IML74K/1328620975:user/release-keys
ro.build.characteristics=tablet
# end build properties
ro.opengles.version=131072
wifi.interface=wlan0
keyguard.no_require_sim=1

ro.dinfo.version=1.0
ro.cpu.vendor=nVidia
ro.cpu.speed=1.0 GHz
ro.cpu.version=T20

ro.sf.lcd_density=160

#
# ADDITIONAL_BUILD_PROPERTIES
#
ro.config.notification_sound=OnTheHunt.ogg
ro.config.alarm_alert=Alarm_Classic.ogg
ro.error.receiver.system.apps=com.acer.android.nidus
acer.sync.adb.mode=ENABLED
ro.setupwizard.mode=DISABLED
dalvik.vm.heapstartsize=5m
dalvik.vm.heapgrowthlimit=48m
dalvik.vm.heapsize=256m
 

Attachments

  • a500ICSbuildprop.zip
    1,013 bytes · Views: 12
Last edited:
  • Like
Reactions: crossix

aznmode

Senior Member
Jun 23, 2007
5,044
1,034
Good work, I had thought about that, but been too busy to check out their forum... now to tinker :)

Yay I did it. Replaced the following. Now I see the gameloft games again. Thanks man. I wouldnt have tried this if it werent for your mods. And thanks for pointing me to the build.prop location and you root method!

ro.product.model=A500
ro.product.brand=acer
ro.product.name=a500_ww_gen1
ro.product.device=picasso
ro.product.board=picasso

ro.build.description=a500_ww_gen1-user 4.0.3 IML74K 1328620975 release-keys
ro.build.fingerprint=acer/a500_ww_gen1/picasso:4.0.3/IML74K/1328620975:user/release-keys
 
Last edited:

ptesmoke

Senior Member
Sep 23, 2008
2,960
796
Cold Lake
is it possible yet crossix to have a script to run on the tablet itself to root? i am away for work for another 3 weeks with no pc :p

also on a side note....with a modded build.prop does anyone think "mars meltdown" or whatever its called that just got released on tegrazone would work? that game looks siiiiick brah....

Sent from my SGH-I897 using xda premium
 

crossix

Senior Member
Dec 6, 2007
408
232
Houston
Yay I did it. Replaced the following. Now I see the gameloft games again. Thanks man. I wouldnt have tried this if it werent for your mods. And thanks for pointing me to the build.prop location and you root method!

ro.product.model=A500
ro.product.brand=acer
ro.product.name=a500_ww_gen1
ro.product.device=picasso
ro.product.board=picasso

ro.build.description=a500_ww_gen1-user 4.0.3 IML74K 1328620975 release-keys
ro.build.fingerprint=acer/a500_ww_gen1/picasso:4.0.3/IML74K/1328620975:user/release-keys

Technically, you shouldn't have to change the brand, name, device or board. I'll be releasing an ICS custom build.prop soon with some tweaks in it.


is it possible yet crossix to have a script to run on the tablet itself to root? i am away for work for another 3 weeks with no pc :p

also on a side note....with a modded build.prop does anyone think "mars meltdown" or whatever its called that just got released on tegrazone would work? that game looks siiiiick brah....

Sent from my SGH-I897 using xda premium

I haven't found a directory yet that resides within the tabs file system that I can write to in ICS so unfortunately it's only runnable through a batch file for now. I have no idea about the game...
 

masterpker2

Senior Member
Jan 28, 2012
53
28
I believe I might have found the CPU I'd for the a100 (0388920743615157) if I run it through sbk generator it returns 0x2E26400 0x730CD401 0x3B463003 0x79522103 which seems to check out with nvflash if there is anyone else who knows more about what to do with these numbers any input would be greatly appreciated :)

Sent from my A100 using xda premium
 
  • Like
Reactions: smokku and crossix

aznmode

Senior Member
Jun 23, 2007
5,044
1,034
also on a side note....with a modded build.prop does anyone think "mars meltdown" or whatever its called that just got released on tegrazone would work? that game looks siiiiick brah....

Sent from my SGH-I897 using xda premium

I have meltdown on my transformer prime and copied the apk to the a100 but force closes either with stock or updated build.prop to a500. I also dont see it in the market with either build.prop.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 9
    Here's my attempt at a "double click" root for ics. I've included everything you might need including the usb drivers. It doesn't need anything special to run, just the usb driver installed and your tab with USB debugging enabled (go to settings -> developer options and check USB debugging.)

    Download:
    http://db.tt/77NSAPDs

    Extract and install the usb driver if needed. Plug your tab in to your pc & Double click the .bat file. Check to see if your device id is listed, if its not close the window out and check that your device is connected and recognized by windows (also check that you have the drivers for the tab installed and that USB debugging is enabled).

    If it is listed (should display a series of numbers) press any key to start the rooting scripts. It will load su and busybox to the loop mount for you. Once the script is done you may need to restart the tab and run the .bat file again to be able to write to the looped system (while the loop system is mounted you can modify the build.prop file and other files within /system by going to /data/local/rootme/loop/ but /system itself isnt r/w mounted. )

    This was a pain to get working and it still may not work right, if it does work for you though, you can re-run the .bat file each time you reboot your tab to be able to write to the looped system. Eventually I'll integrate the commands into the install-recovery.bat file along with some sdcard tweaks so you won't have to re-run the bat file after reboot.

    Thanks to eww245 for providing the commands initially (I used a variation of his and ones from the post on the toshiba forums to get this to work).

    Sent from my MB860 using XDA App
    4
    For anyone that doesn't want to root the hard way crossix has come up with a double click root for Windows xdaforums.com/showpost.php?p=23052186&postcount=105

    Update 2/26/12
    /system can now be mounted writable see the bottom of this post.

    So the old Honeycomb exploit has now been patched in ICS. But there was an exploit found in the newer ICS kernels. Written by saurik,: called mempodroid

    There is an offset needed as an argument to the binary, for the a100 we'll use what has worked for the a200 as noted in sauriks github linked above.

    The issue with this is mounting /system as writable. I'm not sure if it's something in ICS, but it appears to be write protected. As noted here and here we will loop mount the system partition.

    The tools needed are:

    1. mempodroid under Usage Instructions, download pre-compiled
    2. busybox 1.20 snapshot 3-10-12
    3. su the latest from androidsu.com, extract from system/bin
    4. mount.txt script

    After downloading and extracting place them all in a folder called tools.
    This must be done with adb. Issue the following from cmd or a terminal:
    Code:
    $ adb shell mkdir /data/local/tools
    $ adb push tools /data/local/tools ; adb shell
    $ cd /data/local ; chmod 755 tools/*
    $ cd tools ; ./mempodroid 0xd9f0 0xaf47 sh
    If all went well you should be at a hash # prompt. This is temp root.

    mount /system rw the new way:
    Code:
    # PATH=$PWD:$PATH
    # sh mount.txt -o remount,rw /system

    Copy su and busybox to /system
    Code:
    # ./busybox cp busybox /system/xbin; ./busybox cp su /system/xbin/
    # chmod 6755 /system/xbin/su

    Install busybox
    Code:
    # cd /system/xbin
    # for i in $(busybox --list); do ln -s busybox $i; done; sync
    Copy the mount script
    If busybox is updated this step must be run again
    Code:
    # cp /data/local/tools/mount.txt /system/bin/mount
    # cp /data/local/tools/mount.txt /system/xbin/mount

    Done your a100 should be rooted

    the old way:

    Now lets loop mount /system
    Code:
    [b]This is no longer needed[/b]
    # ./busybox losetup -o $((512 * 51200)) /dev/block/loop7 /dev/block/mmcblk0
    Code:
    # ./busybox losetup /dev/block/loop7 /dev/block/mmcblk0p3
    # mkdir loop ; mount -t ext4 /dev/block/loop7 loop

    Copy su and busybox to the new mount point.
    Code:
    # ./busybox cp su loop/xbin/ ; ./busybox cp busybox loop/xbin/
    # chmod 6755 loop/xbin/su ; sync
    If it worked your a100 is fully rooted. Make sure to install SuperUser from the Market.
    Either get busybox installer from the market, and install it to /data/local/tools/loop/xbin
    Or:
    Code:
    # cd loop/xbin
    # for i in $(busybox --list); do ln -s busybox $i; done; sync
    The mount point won't survive a reboot so in order to write to /system again run:
    Code:
    # busybox losetup /dev/block/loop7 /dev/block/mmcblk0p3
    # mount -t ext4 /dev/block/loop7 /data/local/tools/loop

    [update 2/26/12]
    To mount /system as writable do the following from adb. We'll just make a directory called /data/loop for easy access.
    Code:
    $ adb shell
    $ su
    # stop
    [b]your screen will go black[/b]
    # mkdir /data/loop
    [b]skip this if the loop is already set up
    # busybox losetup /dev/block/loop7 /dev/block/mmcblk0p3[/b]
    # mount -t ext4 /dev/block/loop7 /data/loop
    # mount -o bind /data/loop /system
    # start
    You can write to /system with any app but /system can't be remounted ro then back to rw.

    This can be added to /etc/install-recovery.sh to make it permanent
    Code:
    busybox losetup /dev/block/loop7 /dev/block/mmcblk0p3
    mount /dev/block/loop7 /data/loop
    mount -o bind /data/loop /system
    Thanks to crossix as the first to get temp root, and Icewyng for pointing out the exploit and helping with the magic number.
    3
    I got root using this method. http://xdaforums.com/showpost.php?p=22862959&postcount=306


    I used quick boot app and selected 'Bootloader'. May be useful?

    got this:
    2
    Not sure why the files aren't showing up. Maybe try busybox sync after copying them.

    [edit] I asssume you can get root manually and it's just a problem with your script?
    Let me know, hopefully the instructions are all correct now. I updated them several times yesterday.
    Also, there might be an easier way than what I posted, if you find one post it here or shoot me a PM.

    Thanks, I'm having to use a slightly different method since I can't pass arguments through adb shell and mempodroid. It's copying all the files to the tab and executing shell scripts for each step in the process based off a combo of your root method and the one found for the toshiba tab. Hopefully I'll get it figured out soon..
    2
    Thought that might happen, have to get some more ideas.

    [edit] So maybe using 'stop' will help, from adb

    # stop
    # mount -o bind /data/local/tools/loop /system
    # start

    There probably won't be a bootanimation, but if it gets to the lockscreen it should be ok without FCs. If it bootloops just hold in the power button or use the pinhole reset.

    I should just suck it up and upgrade just don't think I'm ready.

    bumping this^ could someone try it.


    Looks like the a500 got rooted with the same method. xdaforums.com/showpost.php?p=22862959&postcount=306 There's one difference with the loop mount. So can someone try this and see if it mounts writable. Just trying to make things simpler, Thanks

    busybox losetup /dev/block/loop7 /dev/block/mmcblk0p3
    mount -t ext4 /dev/block/loop7 /data/local/tools/loop

    Also looks like they ran memopdroid on the tablet, so maybe I can refine it some more.