Thanks Yupandra2012, my Tablet S 4.0.3 r1a finally rooted.
Ref: http://xdaforums.com/showpost.php?p=31408901&postcount=12
The original steps(this link) was written in Japanese, I've just translate it into Eng. But sorry for my bad English.
UPDATE:
A semi automatic script can be found at here.
Files you need:
adb tools
SonyTabletICS-2.zip
Superuser-3.1.3-arm-signed.zip
VpnFaker.apk (Attachment)
For those who are no using the US firmware, the attached VpnFaker.apk may not suitable for your tablet.
Please follow this steps(click me) to resign the VpnFaker.apk. Thanks.
***Pls Execute the command line by line***
Unzip those files into a dir, Open cmd console, cd to that dir
Run the following command and press Restore on your tablet
Check the result
And continue, ignore the "rm -r a" permission denied error
While the loop is running, open another cmd console and run
Once the restore process is completed, you can press CTRL+C on the 1st cmd console to break the loop
Check the /data permission
Then continue
Push the resigned VpnFaker.apk(resign by ZipSigner 2) and update the timestamp
Now, replace the VpnDialogs, ignore "cp: can't open 'system/xxxxxxx': Permission denied" while you execute "/data/local/tmp/busybox cp -r system system2"
Make sure the datatime is 2012/08/27 00:00
Generate the packages.xml
And double check the result
Exit adb shell and reboot, you should see something like "Android is updating" during startup.
Start the injected Terminal Emulator
Unlock your tabet, The Terminal Emulator should appeared. If not, post your "adb logcat".
Now, in the Terminal Emulator
You should see the uid is 1000(system)
Still in the Terminal Emulator, ignore the script error
Now back to the cmd console
Check the uid is 2000(shell)
And
Check the root access uid 0(root)
Backup /system (you may just skip it)
Copy su & Superuser.apk to /system
Check the /system _su is working or not
Should be uid 0(root)
And move the original /data/app & /data/system back (the original steps will keep the VpnFaker.apk, but i skip it)
Now, you Tablet S should be rooted.
Ref: http://xdaforums.com/showpost.php?p=31408901&postcount=12
The original steps(this link) was written in Japanese, I've just translate it into Eng. But sorry for my bad English.
UPDATE:
A semi automatic script can be found at here.
Files you need:
adb tools
SonyTabletICS-2.zip
Superuser-3.1.3-arm-signed.zip
VpnFaker.apk (Attachment)
For those who are no using the US firmware, the attached VpnFaker.apk may not suitable for your tablet.
Please follow this steps(click me) to resign the VpnFaker.apk. Thanks.
***Pls Execute the command line by line***
Unzip those files into a dir, Open cmd console, cd to that dir
Run the following command and press Restore on your tablet
Code:
adb restore settings.ab
Check the result
Code:
adb shell ls -ld /data/data/com.android.settings/a
[I][COLOR="DarkGreen"]drwxrwxrwx system system a[/COLOR][/I]
And continue, ignore the "rm -r a" permission denied error
Code:
adb shell
cd /data/data/com.android.settings
rm -r a
while : ; do ln -s /data a/file99; done
While the loop is running, open another cmd console and run
Code:
adb restore settings.ab
Check the /data permission
Code:
adb shell ls -ld /data
[I][COLOR="DarkGreen"]drwxrwxrwx system system data[/COLOR][/I]
Then continue
Code:
adb push busybox /data/local/tmp
adb push rootkit.tar.gz /data/local/tmp
adb push Superuser.apk /data/local/tmp
adb push su /data/local/tmp
adb shell
cd /data/local/tmp
chmod 755 busybox
./busybox tar zxf rootkit.tar.gz
exit
Push the resigned VpnFaker.apk(resign by ZipSigner 2) and update the timestamp
Code:
adb push VpnFaker.apk /data/local/tmp
adb shell
touch -t 1346025600 /data/local/tmp/VpnFaker.apk
exit
Now, replace the VpnDialogs, ignore "cp: can't open 'system/xxxxxxx': Permission denied" while you execute "/data/local/tmp/busybox cp -r system system2"
Code:
adb shell
cd /data
/data/local/tmp/busybox cp -r system system2
[COLOR="DarkGreen"]#Pls ignore "cp: can't open 'system/xxxxxxx': Permission denied"[/COLOR]
/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
mv system system-
mv system2 system
mv app app-
mkdir app
mv /data/local/tmp/VpnFaker.apk /data/app
Code:
TZ=0 ls -l /data/app
[I][COLOR="DarkGreen"]-rw-r--r-- shell shell 198580 2012-08-27 00:00 VpnFaker.apk[/COLOR][/I]
Generate the packages.xml
Code:
/data/local/tmp/busybox sed -f /data/local/tmp/packages.xml.sed system-/packages.xml > system/packages.xml
Code:
/data/local/tmp/busybox grep vpndialogs system/packages.xml
[I][COLOR="DarkGreen"]<updated-package name="com.android.vpndialogs" codepath="/system/app/VpnDialogs.apk" nativelibrarypath="/data/data/com.android.vpndialogs/lib" flags="1" ft="136f14be668" it="136f14be668" ut="136f14be668" version="15" shareduserid="1000">
<package name="com.android.vpndialogs" codepath="/data/app/VpnFaker.apk" nativelibrarypath="/data/data/com.android.vpndialogs/lib" flags="1" ft="1396560b400" it="1396560b400" ut="1396560b400" version="45" shareduserid="1000">[/COLOR][/I]
Exit adb shell and reboot, you should see something like "Android is updating" during startup.
Code:
exit
adb reboot
Start the injected Terminal Emulator
Code:
adb shell am start -n com.android.vpndialogs/.Term
Unlock your tabet, The Terminal Emulator should appeared. If not, post your "adb logcat".
Now, in the Terminal Emulator
Code:
id
Still in the Terminal Emulator, ignore the script error
Code:
/data/local/tmp/onload.sh
/data/local/tmp/onload2.sh
Now back to the cmd console
Code:
adb shell
/dev/sh
id
And
Code:
chown 0.0 /data/local/tmp/_su
chmod 6755 /data/local/tmp/_su
/data/local/tmp/_su
id
Backup /system (you may just skip it)
Code:
dd if=/dev/block/mmcblk0p3 of=/mnt/sdcard/system.ext4 bs=128K
Copy su & Superuser.apk to /system
Code:
/data/local/tmp/busybox mount -o rw,remount /system
/data/local/tmp/busybox cp /data/local/tmp/_su /system/xbin
chown 0.0 /system/xbin/_su
chmod 6755 /system/xbin/_su
/data/local/tmp/busybox cp /data/local/tmp/su /system/xbin
chown 0.0 /system/xbin/su
chmod 6755 /system/xbin/su
/data/local/tmp/busybox cp /data/local/tmp/Superuser.apk /system/app
/data/local/tmp/busybox mount -o ro,remount /system
sync
exit
Check the /system _su is working or not
Code:
_su
id
And move the original /data/app & /data/system back (the original steps will keep the VpnFaker.apk, but i skip it)
Code:
cd /data
mv app app2
mv app- app
mv system system2
mv system- system
exit
exit
Now, you Tablet S should be rooted.
Attachments
Last edited: