Tablet S 4.0.3 r1a rooted

Search This thread

WonderEkin

Senior Member
Jul 7, 2007
162
306
Thanks Yupandra2012, my Tablet S 4.0.3 r1a finally rooted.
Ref: http://xdaforums.com/showpost.php?p=31408901&postcount=12

The original steps(this link) was written in Japanese, I've just translate it into Eng. But sorry for my bad English.

UPDATE:
A semi automatic script can be found at here.


Files you need:
adb tools
SonyTabletICS-2.zip
Superuser-3.1.3-arm-signed.zip
VpnFaker.apk (Attachment)
For those who are no using the US firmware, the attached VpnFaker.apk may not suitable for your tablet.
Please follow this steps(click me) to resign the VpnFaker.apk. Thanks.



***Pls Execute the command line by line***

Unzip those files into a dir, Open cmd console, cd to that dir
Run the following command and press Restore on your tablet
Code:
adb restore settings.ab

Check the result
Code:
adb shell ls -ld /data/data/com.android.settings/a
	[I][COLOR="DarkGreen"]drwxrwxrwx system system    a[/COLOR][/I]

And continue, ignore the "rm -r a" permission denied error
Code:
adb shell
	cd /data/data/com.android.settings
	rm -r a
	while : ; do ln -s /data a/file99; done

While the loop is running, open another cmd console and run
Code:
adb restore settings.ab
Once the restore process is completed, you can press CTRL+C on the 1st cmd console to break the loop

Check the /data permission
Code:
adb shell ls -ld /data
	[I][COLOR="DarkGreen"]drwxrwxrwx system system    data[/COLOR][/I]

Then continue
Code:
adb push busybox /data/local/tmp
adb push rootkit.tar.gz /data/local/tmp
adb push Superuser.apk /data/local/tmp
adb push su /data/local/tmp
adb shell
	cd /data/local/tmp
	chmod 755 busybox
	./busybox tar zxf rootkit.tar.gz
	exit

Push the resigned VpnFaker.apk(resign by ZipSigner 2) and update the timestamp
Code:
adb push VpnFaker.apk /data/local/tmp
adb shell
	touch -t 1346025600 /data/local/tmp/VpnFaker.apk
	exit

Now, replace the VpnDialogs, ignore "cp: can't open 'system/xxxxxxx': Permission denied" while you execute "/data/local/tmp/busybox cp -r system system2"
Code:
adb shell
	cd /data
	/data/local/tmp/busybox cp -r system system2
	[COLOR="DarkGreen"]#Pls ignore "cp: can't open 'system/xxxxxxx': Permission denied"[/COLOR]
	/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
	/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
	mv system system-
	mv system2 system

	mv app app-
	mkdir app
	mv /data/local/tmp/VpnFaker.apk /data/app
Make sure the datatime is 2012/08/27 00:00
Code:
	TZ=0 ls -l /data/app
		[I][COLOR="DarkGreen"]-rw-r--r-- shell shell 198580 2012-08-27 00:00 VpnFaker.apk[/COLOR][/I]

Generate the packages.xml
Code:
	/data/local/tmp/busybox sed -f /data/local/tmp/packages.xml.sed system-/packages.xml > system/packages.xml
And double check the result
Code:
	/data/local/tmp/busybox grep vpndialogs system/packages.xml
		[I][COLOR="DarkGreen"]<updated-package name="com.android.vpndialogs" codepath="/system/app/VpnDialogs.apk" nativelibrarypath="/data/data/com.android.vpndialogs/lib" flags="1" ft="136f14be668" it="136f14be668" ut="136f14be668" version="15" shareduserid="1000">
		<package name="com.android.vpndialogs" codepath="/data/app/VpnFaker.apk" nativelibrarypath="/data/data/com.android.vpndialogs/lib" flags="1" ft="1396560b400" it="1396560b400" ut="1396560b400" version="45" shareduserid="1000">[/COLOR][/I]

Exit adb shell and reboot, you should see something like "Android is updating" during startup.
Code:
	exit
	adb reboot

Start the injected Terminal Emulator
Code:
adb shell am start -n com.android.vpndialogs/.Term

Unlock your tabet, The Terminal Emulator should appeared. If not, post your "adb logcat".
Now, in the Terminal Emulator
Code:
id
You should see the uid is 1000(system)

Still in the Terminal Emulator, ignore the script error
Code:
/data/local/tmp/onload.sh
/data/local/tmp/onload2.sh

Now back to the cmd console
Code:
adb shell
	/dev/sh
	id
Check the uid is 2000(shell)

And
Code:
	chown 0.0 /data/local/tmp/_su
	chmod 6755 /data/local/tmp/_su
	/data/local/tmp/_su
	id
Check the root access uid 0(root)

Backup /system (you may just skip it)
Code:
	dd if=/dev/block/mmcblk0p3 of=/mnt/sdcard/system.ext4 bs=128K

Copy su & Superuser.apk to /system
Code:
	/data/local/tmp/busybox mount -o rw,remount /system
	/data/local/tmp/busybox cp /data/local/tmp/_su /system/xbin
	chown 0.0 /system/xbin/_su
	chmod 6755 /system/xbin/_su
	/data/local/tmp/busybox cp /data/local/tmp/su /system/xbin
	chown 0.0 /system/xbin/su
	chmod 6755 /system/xbin/su
	/data/local/tmp/busybox cp /data/local/tmp/Superuser.apk /system/app
	/data/local/tmp/busybox mount -o ro,remount /system
	sync
	exit

Check the /system _su is working or not
Code:
	_su
	id
Should be uid 0(root)

And move the original /data/app & /data/system back (the original steps will keep the VpnFaker.apk, but i skip it)
Code:
	cd /data
	mv app app2
	mv app- app
	mv system system2
	mv system- system
	exit
	exit

Now, you Tablet S should be rooted.
 

Attachments

  • VpnFaker.apk
    195.7 KB · Views: 6,314
Last edited:

Cat McGowan

Senior Member
Apr 28, 2012
823
374
Thanks Yupandra2012, my Tablet S 4.0.3 r1a finally rooted.
Ref: http://xdaforums.com/showpost.php?p=31408901&postcount=12

The original steps(this link) was written in Japanese, I've just translate it into Eng. But sorry for my bad English.
Good job and thank you. You beat me to the finish line, I was also translating (slowly) the original Japanese post into English by tediously using [B]http://www.bing.com/translator/[/B] and [B]http://translate.google.com/[/B] as my translators.

For convenience, those who do this rooting method may also want to copy the ADB files adb.exe, AdbWinApi.dll, and AdbWinUsbApi.dll (or download and extract ADB_v1.0.29.zip) into the same directory where they put the rooting files SonyTabletICS-2.zip, Superuser-3.1.3-arm-signed.zip, and VpnFaker.apk.

Now I just need to get an unrooted Sony Tablet S to test this method on. Perhaps I will unrooted my granddaughter's tablet. :D
 

SWFlyerUK

Senior Member
Nov 9, 2010
1,191
131
This stopped working for me when I had to launch VpnDialogs, activity not found - also had permission denied which meant I couldn't go further, mkdir app said mkrdir not found:

Code:
/data/local/tmp/busybox cp -r system system2
= Permission Denied.
 

daniel910821

Senior Member
Jun 3, 2012
148
52
A couple questions,

  • Couldthis method brick my tablet, or is safe try it?
  • Would this work doing it on Ubuntu Linux?

Thanks in advance!
 

TomaHawk93

Senior Member
Feb 22, 2011
66
7
Can you post the full command log?

Sure, i tried it two times: (for any reason i can't copy the full log, sry)

C:\STS>adb shell
shell@android:/ $ cd /data
cd /data
shell@android:/data $ /data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox cp -r system system2
cp: can't create directory 'system2': Permission denied
1|shell@android:/data $ /data/local/tmp/busybox find system2 -type f -exec chmod
666 {} \
d system2 -type f -exec chmod 666 {} \ <
> /data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \
> mv system system-
mv system system-
find: -exec requires an argument
1|shell@android:/data $ mv system2 system
mv system2 system
failed on 'system2' - No such file or directory
255|shell@android:/data $ cd /data
/data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
mv system system-
mv system2 systemcd /data
/data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
mv system system-
shell@android:/data $ /data/local/tmp/busybox cp -r system system2
cp: can't create directory 'system2': Permission denied
 
Last edited:

WonderEkin

Senior Member
Jul 7, 2007
162
306
A couple questions,

  • Couldthis method brick my tablet, or is safe try it?
  • Would this work doing it on Ubuntu Linux?

Thanks in advance!


Modify /data won't brick the device, you can wipe it if /data really corrupted.
For /system, those steps should be harmless

If you have and for Linux, then yes, should works on Linux
 

gordo79

Senior Member
Oct 29, 2011
230
50
I can't get the restore settings part to work. All the files are extracted to the same folder as adb any ideas

Sent from my Sony Tablet S using xda app-developers app
 

WonderEkin

Senior Member
Jul 7, 2007
162
306
Thanks a lot for your hard work.
Before I start this root, I want to confirm with you whether this root will wipe out my installed app data?

I'm not sure this root will keep the installed app or not, as i've wipe my tablet many times to test the VpnFaker.apk...
But the steps will rename the original app folder and rename it back in the final steps. Should be no data lost.
 

WonderEkin

Senior Member
Jul 7, 2007
162
306
Sure, i tried it two times: (for any reason i can't copy the full log, sry)

C:\STS>adb shell
shell@android:/ $ cd /data
cd /data
shell@android:/data $ /data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox cp -r system system2
cp: can't create directory 'system2': Permission denied
1|shell@android:/data $ /data/local/tmp/busybox find system2 -type f -exec chmod
666 {} \
d system2 -type f -exec chmod 666 {} \ <
> /data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \
> mv system system-
mv system system-
find: -exec requires an argument
1|shell@android:/data $ mv system2 system
mv system2 system
failed on 'system2' - No such file or directory
255|shell@android:/data $ cd /data
/data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
mv system system-
mv system2 systemcd /data
/data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
mv system system-
shell@android:/data $ /data/local/tmp/busybox cp -r system system2
cp: can't create directory 'system2': Permission denied

Seeme you paste multi lines of command at one time, am I correct?
Those command should execute one by one.

You can simple wipe the device and redo again
or
Can you execute the following code in adb shell so that I can give you the fallback command?
Code:
ls -la /data
 

TypoCorrecto

Senior Member
Mar 26, 2010
264
41
My brother has this tablet and I plan on attempting to root this evening...
 
Last edited:

ptexas

Member
Mar 17, 2009
28
2
Knonau
Resign VpnFaker.apk

Hi

Do I have to resign the file VpnFaker.apk? If yes can someone explain hoe this is done.
I can do all commands until the replacement of the VpnDialogs. Then I get stuck with 'permission denied'.

Regards Paul
 

excentra

Member
Dec 20, 2007
44
3
im stuck @ replace the VpnDialogs

i get Permission denied for all

c:\sony>adb shell
shell@android:/ $ cd /data
/data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
mv system system-
mv system2 system
c
d /data
mv app app-
mkdir app
mv /data/local/tmp/VpnFaker.apk /data/app /data/local/tmp/busybox
cp -r system system2
/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
mv system system-
mv system2 system

mv app app-
shell@android:/data $ /data/local/tmp/busybox cp -r system system2
mkdir app
cp: can't create directory 'system2': Permission denied
d system2 -type f -exec chmod 666 {} \; <
find: system2: No such file or directory
d system2 -type d -exec chmod 777 {} \; <
find: system2: No such file or directory
1|shell@android:/data $ mv system system-
failed on 'system' - Permission denied
255|shell@android:/data $ mv system2 system
failed on 'system2' - No such file or directory
255|shell@android:/data $
255|shell@android:/data $ mv app app-
failed on 'app' - Permission denied
255|shell@android:/data $ mkdir app
mkdir failed for app, File exists
255|shell@android:
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 34
    Thanks Yupandra2012, my Tablet S 4.0.3 r1a finally rooted.
    Ref: http://xdaforums.com/showpost.php?p=31408901&postcount=12

    The original steps(this link) was written in Japanese, I've just translate it into Eng. But sorry for my bad English.

    UPDATE:
    A semi automatic script can be found at here.


    Files you need:
    adb tools
    SonyTabletICS-2.zip
    Superuser-3.1.3-arm-signed.zip
    VpnFaker.apk (Attachment)
    For those who are no using the US firmware, the attached VpnFaker.apk may not suitable for your tablet.
    Please follow this steps(click me) to resign the VpnFaker.apk. Thanks.



    ***Pls Execute the command line by line***

    Unzip those files into a dir, Open cmd console, cd to that dir
    Run the following command and press Restore on your tablet
    Code:
    adb restore settings.ab

    Check the result
    Code:
    adb shell ls -ld /data/data/com.android.settings/a
    	[I][COLOR="DarkGreen"]drwxrwxrwx system system    a[/COLOR][/I]

    And continue, ignore the "rm -r a" permission denied error
    Code:
    adb shell
    	cd /data/data/com.android.settings
    	rm -r a
    	while : ; do ln -s /data a/file99; done

    While the loop is running, open another cmd console and run
    Code:
    adb restore settings.ab
    Once the restore process is completed, you can press CTRL+C on the 1st cmd console to break the loop

    Check the /data permission
    Code:
    adb shell ls -ld /data
    	[I][COLOR="DarkGreen"]drwxrwxrwx system system    data[/COLOR][/I]

    Then continue
    Code:
    adb push busybox /data/local/tmp
    adb push rootkit.tar.gz /data/local/tmp
    adb push Superuser.apk /data/local/tmp
    adb push su /data/local/tmp
    adb shell
    	cd /data/local/tmp
    	chmod 755 busybox
    	./busybox tar zxf rootkit.tar.gz
    	exit

    Push the resigned VpnFaker.apk(resign by ZipSigner 2) and update the timestamp
    Code:
    adb push VpnFaker.apk /data/local/tmp
    adb shell
    	touch -t 1346025600 /data/local/tmp/VpnFaker.apk
    	exit

    Now, replace the VpnDialogs, ignore "cp: can't open 'system/xxxxxxx': Permission denied" while you execute "/data/local/tmp/busybox cp -r system system2"
    Code:
    adb shell
    	cd /data
    	/data/local/tmp/busybox cp -r system system2
    	[COLOR="DarkGreen"]#Pls ignore "cp: can't open 'system/xxxxxxx': Permission denied"[/COLOR]
    	/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
    	/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
    	mv system system-
    	mv system2 system
    
    	mv app app-
    	mkdir app
    	mv /data/local/tmp/VpnFaker.apk /data/app
    Make sure the datatime is 2012/08/27 00:00
    Code:
    	TZ=0 ls -l /data/app
    		[I][COLOR="DarkGreen"]-rw-r--r-- shell shell 198580 2012-08-27 00:00 VpnFaker.apk[/COLOR][/I]

    Generate the packages.xml
    Code:
    	/data/local/tmp/busybox sed -f /data/local/tmp/packages.xml.sed system-/packages.xml > system/packages.xml
    And double check the result
    Code:
    	/data/local/tmp/busybox grep vpndialogs system/packages.xml
    		[I][COLOR="DarkGreen"]<updated-package name="com.android.vpndialogs" codepath="/system/app/VpnDialogs.apk" nativelibrarypath="/data/data/com.android.vpndialogs/lib" flags="1" ft="136f14be668" it="136f14be668" ut="136f14be668" version="15" shareduserid="1000">
    		<package name="com.android.vpndialogs" codepath="/data/app/VpnFaker.apk" nativelibrarypath="/data/data/com.android.vpndialogs/lib" flags="1" ft="1396560b400" it="1396560b400" ut="1396560b400" version="45" shareduserid="1000">[/COLOR][/I]

    Exit adb shell and reboot, you should see something like "Android is updating" during startup.
    Code:
    	exit
    	adb reboot

    Start the injected Terminal Emulator
    Code:
    adb shell am start -n com.android.vpndialogs/.Term

    Unlock your tabet, The Terminal Emulator should appeared. If not, post your "adb logcat".
    Now, in the Terminal Emulator
    Code:
    id
    You should see the uid is 1000(system)

    Still in the Terminal Emulator, ignore the script error
    Code:
    /data/local/tmp/onload.sh
    /data/local/tmp/onload2.sh

    Now back to the cmd console
    Code:
    adb shell
    	/dev/sh
    	id
    Check the uid is 2000(shell)

    And
    Code:
    	chown 0.0 /data/local/tmp/_su
    	chmod 6755 /data/local/tmp/_su
    	/data/local/tmp/_su
    	id
    Check the root access uid 0(root)

    Backup /system (you may just skip it)
    Code:
    	dd if=/dev/block/mmcblk0p3 of=/mnt/sdcard/system.ext4 bs=128K

    Copy su & Superuser.apk to /system
    Code:
    	/data/local/tmp/busybox mount -o rw,remount /system
    	/data/local/tmp/busybox cp /data/local/tmp/_su /system/xbin
    	chown 0.0 /system/xbin/_su
    	chmod 6755 /system/xbin/_su
    	/data/local/tmp/busybox cp /data/local/tmp/su /system/xbin
    	chown 0.0 /system/xbin/su
    	chmod 6755 /system/xbin/su
    	/data/local/tmp/busybox cp /data/local/tmp/Superuser.apk /system/app
    	/data/local/tmp/busybox mount -o ro,remount /system
    	sync
    	exit

    Check the /system _su is working or not
    Code:
    	_su
    	id
    Should be uid 0(root)

    And move the original /data/app & /data/system back (the original steps will keep the VpnFaker.apk, but i skip it)
    Code:
    	cd /data
    	mv app app2
    	mv app- app
    	mv system system2
    	mv system- system
    	exit
    	exit

    Now, you Tablet S should be rooted.
    8
    For those Tablet S firmware version is not US version, or got the error after execute "adb shell am start -n com.android.vpndialogs/.Term"
    Code:
    adb shell am start -n com.android.vpndialogs/.Term
    	[COLOR="DarkGreen"]Starting: Intent { cmp=com.android.vpndialogs/.Term }
    	Error type 3
    	Error: Activity class {com.android.vpndialogs/com.android.vpndialogs.Term} does not exist.[/COLOR]

    The VpnFaker.apk is needed to be resign.

    Here's the resign method: (Sorry that I don't have my Tablet S on hand today...)
    1. Install "ZipSigner 2" to your tablet. link
    2. On your PC, open VpnFaker.apk by 7zip, delete folder "META-INF"
      attachment.php
    3. copy the VpnFaker.apk to /sdcard, rename it
      Code:
      adb push VpnFaker.apk /sdcard/VpnFaker_unsign.apk
    4. Open "ZipSigner 2" on your tablet.
      Press the "Input" button and browse /sdcard/VpnFaker_unsign.apk
      Press the "Output" button and save it as /sdcard/VpnFaker.apk
      Key/mode select "platform"
      Press "Sign the file"
      2064219-1303424470834.jpg
    5. copy the resigned apk back to you PC
      Code:
      adb pull /sdcard/VpnFaker.apk

    For those who has already tried to inject the VpnFaker.apk, please rollback by the following command. Otherwise, skip this part.
    Code:
    adb shell
    	cd /data
    	mv system system3
    	mv system- system
    	mv app app3
    	mv app- app
    Redo the process again.
    7
    Seems your device does not set the settings from symlink. I am afraid i dont have idea gow to test myself without device, maybe the thread creator can check it for you guys and then i will ahve it included.

    Regards

    Hi Bin4ry,
    I've just take a look the batch file and did some changes. Hope you don't mind. :eek:


    For anyone who want to root the Tablet S by this script. Make sure the following options are enabled
    Enable "Unknown sources" in Settings -> Security
    Enable "USB debuging" in Settings -> Developer options
    If you've just wipe your device, please enable Wi-Fi and setup the Google account, open the Play Store(or Market) at least one time.

    This script will install "Android Terminal Emulator"(by Jack Palevich, I found it from here) to you /sdcard, you don't have to install by yourself.

    The script will guide you to root the device, read it carefully as there are some manual steps.
    5
    Added it to my "multi-script" now too:
    http://xdaforums.com/showthread.php?p=31545627

    Thanks WonderEkin for helping me out here ;)

    Regards
    Bin4ry
    2
    Rooted !!

    At last it worked .. here how I proceeded

    1. Reset Tablet to factory settings
    2. Enable "Unknown locations", "USB Debugging" and "Leave active"
    3 Install File Manager HD and Terminal Emulator and move to USB (in settings / Apps)
    4. Follow the Instructions of post 1 (ignore error messages at "rm -r a" and "busybox cp -r system system2")
    5 As I got stuck at starting the injected terminal I did a rollback
    - first get permissions for system and data (Step 1- 5)
    - execute the rollback commands
    - continue at instructions step 6 (adb push busybox ..)
    6. This time Android updated at reboot and terminal started
    7. Continue Instuctions with Terminal
    - ignore the error msgs while executing scripts in teminal window
    8 At the end of the instructions reboot tablet

    The only trouble I had was that Play Store disappeared and I had to install it manually (download apk and execute it with File Mnager HD)
    Then install Superuser and Root Explorer app and grant root permissions to apps

    Now I'm looking for a way to add my 32G SD Card to my 16G internal memory