How to root stock 3.2

Ok, after messing around with 3.2 I decided to fix the rooting issues without downgrading. The problem with downgrading is it requires a SDCard and requires you to install a couple of programs and then to install an update.zip from the sdcard. I could not get half my ACER's to read and mount a sdcard, and some ACER's I have located in a remote office and trying to walk someone through the process was too painful. I tweaked the the downgrade tool's images to install 3.2 with root instead of downgrading it and jumping through hoops. All I did to the stock image is to copy the ash shell over to /system/xbin/su and set the sticky bit. Everything else is stock.


Update posted here, read thead http://xdaforums.com/showpost.php?p=20654298&postcount=129

New version V4

-- The instructions are in a PDF document inside the download --
== Version V4 ==
-- Added /system/subin/su which is a backup (backdoor) root in case an OTA deletes the /system/xbin/su
-- Set permissons on the su root(#) tool so OTA's shouldn't be able to break it.
-- Added drivers for XP

Summary:
Version V4 is the same as V3 with the only difference being that there is a NEW backdoor script which has some additional features to protect root(#) from getting broken when you do an OTA. I also applied these to this flash image so you wouldn't have to add the additional protection yourself. V4 also has the drivers for XP included. However, when taking an OTA you should also install the backdoor for additional protection. However, you cannot leave the backdoor installed as it turns off sound. So having a little more protection just might save your root in case you take an OTA and forget to install the backdoor.

Download it here: http://www.multiupload.com/NS0X5TK4D1

Alternative download location:
http://depositfiles.com/files/c6pr69ri6
http://www.fileserve.com/file/s2wCQpN/root-3.2.1-V4.7z
http://www.filesonic.com/file/jTA7AMN
http://www.filejungle.com/f/vRnfK5/root-3.2.1-V4.7z

Rooted 3.2.1 V2 -- Fixed versions added tools

Acer_A500_7.014.02_COM_GEN2 ROOTED
Here’s the link http://www.multiupload.com/VD0L5WLQKK
Version v2
There is a V3 release http://xdaforums.com/showpost.php?p=20680452&postcount=137
V3 installs all the tools for you

************** CHANGES ************************************
Instructions are in the readme.pdf inside the zip

I fixed the version numbers. When it flashed, it wasn’t setting the number correctly therefore it would redo the last update over again even though it was already on the tablet.

Added a busyBox tool in the folder called busyBox where you will find installTools.cmd. This command script will install the superuser.apx, busybox, and su tool. This is what most of you would want instead of just the command line #(root). This does what chrishohl recommends (http://www.chdcomputers.gr/en/mnu-k...en/mnu-kb-android-a500-en/254-art-kb000005-en) to finish out your Acer rooting.

==================================================
******************** BACKDOOR UPDATE *********************
==================================================
I added a little script that will build the backdoor for you. It is in the backdoor folder called backdoor.cmd. Just run this and it will set your adb shell to run as # (root).

Also NOTE, if you reset your tablet (factory restore) you will loose your backdoor. You just run the backdoor.cmd and it will reset the backdoor.

NO SOUND, when you have the backdoor enabled there appears to be no sound. So, you only want to use this before allowing a OTA to install.

==============================================
==Backdoor tool version 1.1 release notes===
==============================================

Inside the backdoor folder is command script called backdoor.cmd.
-------------------------------------------------------------------------
Please select a option.
Note: It is assumed you have su installed.
-------------------------------------------------------------------------
1. Turn ON backdoor (sound will be off).
2. Turn OFF backdoor.
3. Reset missing sticky bit on /system/xbin/su
(must have backdoor on and rebooted)

4. Quit (and reboot).
5. Exit (no reboot).
-------------------------------------------------------------------------

This tool can be used to toggle On/Off the backdoor. When you install OTA updates these OTA’s run scripts that reset all the security permissions thereby removing the ‘sticky bit’ on your installed SU and hence removing root. The idea behind the backdoor is to install an alternate # (root) that the scripts won’t know about. To do this, we set the ro.kernel.qemu=1 flag inside the data/local.prop file therefore when you enter the ‘adb shell’ you immediately have # (root).

This alternate # (root), I call a backdoor. Named such after the movie Wargames where the ‘geeks’ told Lightman that they install a backdoor into systems incase they ever want to get back into a system after someone changes security. And sense Lightman was trying to hack the WOPR (pronounced whopper) and staying one step ahead of Acer is a whopper of a challenge, it seemed appropriate.

The downside is that if you have the backdoor on, it seems to turn off sound on the Acer. Therefore, I turn it on only before I run an OTA and then turn it back off after the OTA.

So far, the backdoor has allowed me to get back in as root if the OTA changes security. However, it might too be plugged by the evil Acer empire. But for now it seems to work. If anyone has any other backdoor approaches then please share them (I have a couple more if Acer plugs this one), but making and using a backdoor has been my frontline defense.

==================================================
************** Toggle On/Off OTA version 1.1 *******************
==================================================

Inside the OTA-Toggle folder is a command program called toggle.cmd
-------------------------------------------------------------------------
Please select a option.
Note: It is assumed you have su installed or the backdoor.
-------------------------------------------------------------------------
1. Turn Off OTA.
2. Turn On OTA.

3. Quit.
-------------------------------------------------------------------------

So, if you’re like me and you do not like Acer hacking into your privately owned tablet and destroying data, you just might want to lock them out. This tool (assuming you have root or the backdoor installed), will allow you to turn off OTA’s.

Once turned off, you will not be nagged or bothered with OTA’s ever again until you turn them back on.

How to root stock 3.2 Extended

Hello to all,

I have created a nice How To about timmyDean's first post in this thread and extend it with the files and instructions needed in order to be completely root, not only in adb shell.

It is a little big so I posted it in my website here http://www.chdcomputers.gr/en/mnu-kb-fus-en/mnu-kb-android-en/mnu-kb-android-devices-en/mnu-kb-android-a500-en/99-art-kb000005-en

I have tested the whole procedure three times in three A500 that we have, for our development needs, with success.

The how to also answers many questions asked here about the procedure. So go ahead and read it and tell me what you think or if you have any questions.

Thank you,

Christos Hohlidakis

Rooted 3.2.1 V3 -- Released

Version V3 released
http://www.multiupload.com/MQ6V790WUX
V3
-- In this version I simplified getting the Serial number of your tablet making it easier to flash. Please read the instructions in the readme.pdf. Many people were struggling trying to load ADB drivers and the ADB tools which the instructions said you needed to load first so you could get your serial number. The flashing tool actually loads the drivers and tools therefore, all you have to do is run the test.cmd after the drivers are loaded to get the serial number. This is now documented better, also you should not have to save the serial number in the CPUID.txt file, so I removed it.

-- I fixed the checksums during the flashing therefore you do not need to boot to recovery mode and fix them using CWM. Now your tablet will just reboot correctly after the flash.

-- I added into the flash, Busybox and SU tools for you. No need to add them later.

Bottom-line, if you installed V2 there is nothing new. V3 is just for those that struggled getting ADB working for their serial number and those that struggled installing the tools. Also, many people 'freaked' when their tablet didn't boot after the flash, because they did not read. Or they struggled with pushing the correct buttons to get into recovery mode to fix the checksums.

Enjoy,
TD

Barafu Albino Cheetah said:

Do I get it right that this backdoor idea will not allow me to upgrade from rooted 3.1 to rooted 3.2 with OTA?

Click to expand...

Click to collapse

No, the backdoor idea is exactly what it says it is. It is a way to get back into a system after they change security when you install an OTA.

To understand what happens during an OTA, is that it is only doing an update. Meaning they update the /system folder and replace (sometimes only updating) everything in /system/app. They may also update the boot and other areas of the device such as / (root folder). However, they don't wipe it totally clean (or most don't). That's why when you get an OTA, for example, you don't have to type in all your contacts again etc. Or reload all your applications you installed from the Marketplace.

During this update process, the last thing they do is reset all the permissions recursively in the /system folder to their default and in doing so remove the 'sticky bit' that gives you root. Most people consider rooting as loading busybox, su, and a Superuser.apk. If you look after the update, you will see su and busybox (normally) are still loaded, just the permissions have the 'stick bit' removed. The Superuser.apk will be missing because they often replace the /system/app folder.

So, what happens in the Android market, is OEM's fix things and push updates. Fix to WiFi, GPS, NetFlex etc and push an update. After the update, the user finds root (#) not working. So they use the exploit that gave them root and re-root the device. Unfortunately, as fast as developers are finding exploits, OEM's are patching them.

In the ACER 3.0.1 there are several exploits to gain root(#) access that have been removed in 3.2.1. Therefore, if you do the OTA's you loose root and then you try to use your exploit to gain root, you get a surprise. The OEM has patched that hole.

So, what you do is create a backdoor that allows you to gain root access outside the normal /system folder and 'sticky bit'. Therefore, when an update occurs, you can get back in as root.

Now, for the ACER. If you have an a500 ACER 3.0.1 Stock, then you can gain root by simply using GingerBreak (Iconiaroot for example). However, if you take OTA's you will loose root and GingerBreak will no longer work. So, since you have root, you create a backdoor, now when you apply the OTA's and it removes the GingerBreak exploit; all you have to do is use your backdoor to get back in as root and set back up bussybox, su, and Superuser.apk.

== Now the current state of the a500 ACER ===
Earlier versions of the a500 had exploits that we used to gain root. These exploits were all removed in 3.2x. What people found out, was that if they had root they lost it once they upgraded. Or, if they bought it new, and it had 3.2x there was no way to root it.

Therefore, the only solution, at first was to rollback your device to an earlier version that allowed rooting and to stay there or use CWM to apply a modified update of 3.2x with root. Using CWM is a major tool used to replace ROM's or replace with custom ROM's.

However, now the catch 22. In 3.2x, ACER locked the bootloader and by doing so, it prevents you from installing CWM. Because you cannot install CWM, you cannot install custom ROM's or custom updates.

3.2x closed all known exploits, but ACER left the ability to rollback to an earlier version. If they would not have done that, then we'd be stuck (screwed). So, you basically have to rollback to a version you could exploit and then stay there, or load a custom ROM, or install CWM and install a modified update.zip to get you to 3.2x.

If you don't want to stay there and want to apply OTA's then you have to build a backdoor so you can get back in after the OTA's remove your normal root(#).

Hope this helps,
TD