How to Root the Sony Tablet S

Search This thread

rfreeman

Senior Member
Apr 4, 2009
110
13
Kernel builds > 8 currently not rootable.
Unfortunately Sony closed the leak in the latest version build#9 and build#10 and I see no progress of the developer side to find and/or publish a new root tool.
It sounds bad but this is the current status. :-(

I have 2.6.36.3 integ-build@build9 #1, rooted with your "Sony Tablet all in one sony tool"
 

Judah001

Senior Member
Dec 19, 2011
116
17
Kernel builds > 8 currently not rootable.
Unfortunately Sony closed the leak in the latest version build#9 and build#10 and I see no progress of the developer side to find and/or publish a new root tool.
It sounds bad but this is the current status. :-(

Maybe we should reach out to Djrbliss asking if he can find a way. I have visited his site several times looking at the devices he roots and it seems way too easy for him. Could we possibly start a thread with info on the unrootable builds? I am not nearly smart enough to understand the technical piece of it but I can help coordinate it. I know thomas.raines has been working on a custom recovery for the tab but has been unable to reroot his devise after reflashing an unrootable build. Any thoughts?
 

thomas.raines

Recognized Developer
Jun 23, 2011
2,200
3,914
Hutto
Maybe we should reach out to Djrbliss asking if he can find a way. I have visited his site several times looking at the devices he roots and it seems way too easy for him. Could we possibly start a thread with info on the unrootable builds? I am not nearly smart enough to understand the technical piece of it but I can help coordinate it. I know thomas.raines has been working on a custom recovery for the tab but has been unable to reroot his devise after reflashing an unrootable build. Any thoughts?

Yes, we do need someone who can figure out to exploit the krenel...
 

Nesquick95

Senior Member
Jan 31, 2009
86
45
Mail to M. Rosenberg

I've sent a mail today to M. Rosenberg, asking for some help :

"

Hello M. Rosenberg,

As an owner of a Sony Tablet S, I've successfuly used your exploit to gain root.
Unfortunatly, I bricked the device while deleting Sony bloatware on it. The tablet went back
to life after an OTA update that lead it from a #8 kernel build to a #10, no more rootable.

I've try to understand why and discovered that the /log directory now belongs to system group
so ADB could not write in it anymore. I've noticed that /dev/log directory, writable by ADB may
have something to do with the logging process you used and try a lot of (silly) things to adapt
your script without success.

So I've take a look at your other exploits and tought that the one provided for the LG Thrill / Optimus 3D
may work for the Sony Tablet. I've modified your script to match /dev/block/mmcblk0p3 and patched your block
binary to do so but the program failed to open the block device.

We are some people at XDA forum in the same situation, waiting for something to happend about root and
the newly released #10 kernel... It will be very kind from you to find some time for working again on the
Sony Tablet S, giving us some idea, some trick or... a new fully working script !

I'll publish this mail in XDA forum and join the mounts of the Sony Tablet kernel #10...

Best regards,

Nesquick95


----------------------------------------------------------------------------------------
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
/dev/block/mmcblk0p1 /configs ext2 ro,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/mmcblk0p3 /system ext4 ro,relatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p10 /data ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p4 /cache ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p9 /log ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered 0 0
/dev/block/svold/179:17 /mnt/sdcard2 vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/vold/179:11 /mnt/sdcard vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
/dev/block/vold/179:11 /mnt/secure/asec vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,batch_sync,utf8,comp_uni,avoid_dlink,errors=remount-ro 0 0
tmpfs /mnt/sdcard/.android_secure tmpfs ro,relatime,size=0k,mode=000 0 0
----------------------------------------------------------------------------------------

"
 
  • Like
Reactions: SuMiHe and sebarkh

agc93

Senior Member
Mar 14, 2011
347
83
Brisbane
Hi all,

This could just be me or may have been mentioned before, but I couldn't find it with search.

I successfully rooted my Tablet S with this exploit (directly, not through condi's tool) and my last rooted device (a Galaxy Tab) allowed me to remount the system partition as r-w through adb using "adb remount". On this tablet, this command returns Operation Not Permitted.

Has my root not fully worked? Or is this tablet just a bit more finicky with adb then others?

Thanks,
 

thomas.raines

Recognized Developer
Jun 23, 2011
2,200
3,914
Hutto
Hi all,

This could just be me or may have been mentioned before, but I couldn't find it with search.

I successfully rooted my Tablet S with this exploit (directly, not through condi's tool) and my last rooted device (a Galaxy Tab) allowed me to remount the system partition as r-w through adb using "adb remount". On this tablet, this command returns Operation Not Permitted.

Has my root not fully worked? Or is this tablet just a bit more finicky with adb then others?

Thanks,
Try mounting they busybox
mount -o remount rw /system


Sent from my BAMF SGH-T959V!
 

condi

Senior Member
Feb 13, 2007
744
989
Ostrów Wielkopolski
condiecu.pl
Hi all,

This could just be me or may have been mentioned before, but I couldn't find it with search.

I successfully rooted my Tablet S with this exploit (directly, not through condi's tool) and my last rooted device (a Galaxy Tab) allowed me to remount the system partition as r-w through adb using "adb remount". On this tablet, this command returns Operation Not Permitted.

Has my root not fully worked? Or is this tablet just a bit more finicky with adb then others?

Thanks,

Code:
mount -o rw,remount -t ext4 /dev/block/mmcblk0p2 /system
or if you need via adb then:
Code:
adb shell "su -c 'mount -o rw,remount -t ext4 /dev/block/mmcblk0p2 /system'"

br
condi
 

sapphire88

Senior Member
Oct 12, 2010
268
27
my tablet just came back from service (no warranty problem), but it came with build#10 and it says that it is unrootable for now...

Edit: wait wait wait...today when i checked my tablet version it says build@build6 #1...how can it change??

FANTASTIC! just as i said, my tablet changed it's version from build 10 to build 6 and i can root now!! believe me, i really don't know how...
 
Last edited:

Aspire4520

Member
Jul 24, 2010
43
0
my tablet just came back from service (no warranty problem), but it came with build#10 and it says that it is unrootable for now...

Edit: wait wait wait...today when i checked my tablet version it says build@build6 #1...how can it change??

FANTASTIC! just as i said, my tablet changed it's version from build 10 to build 6 and i can root now!! believe me, i really don't know how...

:eek:How come?
 

sapphire88

Senior Member
Oct 12, 2010
268
27
I don't know how but it's true, in fact with build 10 the all in one root program said that that kernel build couldn't be rooted, and yesterday my kernel version became build 6 #1...so with the aio program...
 

Elsydeon

Senior Member
Feb 10, 2010
371
191
Hilo
my tablet just came back from service (no warranty problem), but it came with build#10 and it says that it is unrootable for now...

Edit: wait wait wait...today when i checked my tablet version it says build@build6 #1...how can it change??

FANTASTIC! just as i said, my tablet changed it's version from build 10 to build 6 and i can root now!! believe me, i really don't know how...


It's strange but I can confirm this also. I just received my brand new Tablet S straight from Sony 2 days ago, immediately updated it to the latest firmware, and attempted to root it last night. Could not get it to work because it was on build #10. I gave up and left it overnight, came back today, messed with it here and there all day...then ran across this post. I thought what the heck, went in to take a look at my kernal version and I'll be damned, it now says it's 2.6.36.4, build5 #1! I went ahead and retried the rooting and it worked!!! I'm not going to question what happened and am just counting my lucky stars. So happy it worked as this tablet finally being rooted and all the tweaking options that brings was what swayed me to go ahead and pick it up over the new iPad.


So, for those of you that were on build 10 and thought you were out of luck...might just want to check in with your kernel version again. Who knows, it might've changed on you to an older one somehow without you knowing it...
 

sapphire88

Senior Member
Oct 12, 2010
268
27
Nothing special, just checked the firmware version (just to be sure) and it was (and still is) build6 #1...hope that the same happens to all of you!
 

zlowram

Member
Jul 10, 2008
6
0
Hi there!

Since I'm not a windows user, I took the freedom to port the rooting script to Unix. I rooted my Sony Tablet S with it and it works flawlessly.

Just download the root pack on the first post, put the "run.sh" script (it is attached to this post) inside it and go!

I do not claim any copyright for this, you can find the copyright of the original author in the script. Just added that I made the port.

Enjoy!

- zlOwram

P.S: If anyone had done this before, my apologies :)
 

Attachments

  • runsh_unix_version.zip
    1.3 KB · Views: 148

dantheman122

Senior Member
Sep 20, 2011
539
146
Brisbane
Hi there!

Since I'm not a windows user, I took the freedom to port the rooting script to Unix. I rooted my Sony Tablet S with it and it works flawlessly.

Just download the root pack on the first post, put the "run.sh" script (it is attached to this post) inside it and go!

I do not claim any copyright for this, you can find the copyright of the original author in the script. Just added that I made the port.

Enjoy!

- zlOwram

P.S: If anyone had done this before, my apologies :)


Anyone else tried this? Will it work with build 10?
 

obicom

Senior Member
Nov 9, 2010
283
81
Cologne
I didn't try it .. but he used exactly the same security vulnerability, so that I must guess it will not work with build#10 too. He adapted only the batch file to an unix compatible one (thanks for that, great job).
 

Top Liked Posts

  • There are no posts matching your filters.
  • 59
    As promised, I've published my root exploit. It's possible that this exploit will wipe your /data partition. This did not happen on the two devices that have been successfully rooted, but I don't want any nasty surprises. Please back up your applications and data if you're worried about this. There is no risk of permanent damage to the device, but by running this exploit, you assume all responsibilty.

    You can root your device with the following steps:

    1. Ensure your device is in USB debugging mode, is connected to your PC, and that ADB works. Instructions on this are available in this thread:
    http://xdaforums.com/showthread.php?t=1327139

    2. Download the exploit here:
    http://vulnfactory.org/public/Sony_Tablet_S_Root_Windows.zip

    3. Unzip the full contents of the zip.

    4. Run "run.bat"

    ---

    Full details on how the exploit works are posted here:
    http://vulnfactory.org/blog/2012/02/08/rooting-the-sony-tablet-s/

    I can't guarantee that this exploit will work after receiving an OTA update, including ICS. As always, when rooted, be cautious of accepting OTA updates unless you have received confirmation that the root exploit has not been patched.

    If you pledged towards the bounty, details on how to donate are at the bottom of the above blog post.

    Enjoy,
    Dan Rosenberg (@djrbliss)

    P.S. For those interested in reposting this, I have no affiliation with any forum (including XDA).
    5
    Thanks, this helped with the com.pwn.me issue, but now I'm getting the same error message as you.

    Code:
    [*] Attemping persistence...
    remount failed: Operation not permitted

    Edit:
    SOLVED IT!
    disabled Tablet S in the device manager, ran the exploit, and enabled the Tablet S again in the device manager after the first reboot. Then the remount succeeded and everything went fine. Tablet rooted.
    4
    For all those having issues with the ADB drivers, I've created a fully automated driver installer.

    No more need for the complicated and time-consuming Android SDK.

    http://xdaforums.com/showthread.php?t=1488822
    3
    Weird that it just succeeded in 1 try for me, it might have to do with different firmware versions. Mine runs on the model SGPT111NL/S.
    Can you guys tell me what model number it displays beneath the SONY logo on the back? That might give a small indication, or not. Who knows.

    ANYWAY.
    I promised to make a vid, here it is:
    Note: Quality sucks (not screen quality, but quality quality. It does display the process)
    2
    When I run the bat file the second time, I get an error related to the files that the exploit handles:

    Code:
    [+] System package com.google.android.location has uid 10029
    [+] Flooding log...
    failed on '/data/data/com.google.android.location/lib' - Permission denied
    link failed File exists[*]

    I just uploaded a new version of the exploit that should fix this problem. Just unzip it, execute "run.bat", and let me know how it goes.

    If anyone has been having any problems with the exploit, please try the new version here:
    http://vulnfactory.org/public/Sony_Tablet_S_Root_Windows.zip