[ROOT][HOWTO] WIP: Root the Verizon GSIII without flashing a ROM

---

UPDATE: I created a tool based on this method. Head over to the new thread.

---

WARNING: This is WIP for now. Don't run it if you aren't comfortable with the possibility of having something go wrong and having to re-Odin back to stock or worse. I was already rooted and had Busybox installed, so even though I temp-unrooted first, I don't know for certain if this will work on a stock device. If anyone wants to flash back to pure stock and give it a shot, I'd appreciate it. If it works, I'll try and make it easier to use.

NOTE: This may give you the custom unlock screen! I'm not 100% certain it was this root method that did it, though, as I had installed BusyBox and frozen several system apps with TiBu before my most recent reboot. I need someone willing to test. I don't have time to backup, flash to stock, and retry at the moment.

Background: Since some people seem to have mysterious issues after flashing the root66 image, I've been looking at existing ICS root methods which don't require flashing ROMs to see if any work on the GSIII. I think I've found one.

This is an adaptation of miloj's root method for the Asus TF300T. All credit goes to him and anyone else he mentioned in his post.

Instructions:

1. Install the USB drivers if you don't have them already: Verizon_Wireless_I535_GSIII_Samsung_USB_Driver_v1_ 4_6_0.exe
2. Download the attached binary package and extract them somewhere
3. Set up adb and make sure you can see your phone
4. Run the following commands in a shell. Red is a prompt you will see on the screen, black is something you type, blue is a comment.

adb push debugfs /data/local/
adb push su /data/local/
adb shell
$ cd /data/local/
$ mv tmp tmp.bak
$ ln -s /dev/block/mmcblk0p14 tmp
$ exit
adb reboot

... wait for phone to reboot ...

adb shell
$ cd /data/local
$ toolbox chmod 755 /data/local/debugfs
$ /data/local/debugfs -w /data/local/tmp
debugfs: cd xbin
debugfs: rm su
debugfs: write /data/local/su su
debugfs: set_inode_field su mode 0106755
debugfs: set_inode_field su uid 0
debugfs: set_inode_field su gid 0
debugfs: quit
$ rm /data/local/tmp
$ mv /data/local/tmp.bak /data/local/tmp
$ exit
adb reboot

... wait for phone to reboot ...

adb shell
$ /system/xbin/su
# id
You should see: id=0(root) gid=0(root) ....
# exit

$ rm /data/local/su
$ rm /data/local/debugfs
$ exit

This is using miloj's insecure su, so you should install the superuser app and immediately use its binary update feature to install a proper binary. Otherwise, you're just asking to get malware.

I very much like this root method. Would be interested to see if anyone else is able to get this successfully done on their stock devices.

Worst case, I'll be getting a replacement phone on Wednesday due to some minor screen issues, so I'll be forced to try it then.

Let US know if it works...I have slow connection that times out at 80% because of these huge Rom files

Sent from my SCH-I535 using xda app-developers app

Thanks for working on this Ninja, and thanks for sharing with us.

Sounds like it will be the cleanest root method yet.

$ mv /data/local/tmp.back /data/local/tmp

should be

$mv /data/local/tmp.bak /data/local/tmp

---------- Post added at 05:46 PM ---------- Previous post was at 05:38 PM ----------

This is CONFIRMED working on my VIRGIN SGS3 I got today. had to fix the one typo above. No problems yet. just don't break things freezing too many apps. Somone script up a one click root. If you dont, I will tonight. (In about 3 or four hours or so.)

Originally Posted by FlyingPoo

$ mv /data/local/tmp.back /data/local/tmp

should be

$mv /data/local/tmp.bak /data/local/tmp

The perils of copy/pasting half from the original post and half from my local shell.

Originally Posted by FlyingPoo

This is CONFIRMED working on my VIRGIN SGS3 I got today. had to fix the one typo above. No problems yet. just don't break things freezing too many apps. Somone script up a one click root. If you dont, I will tonight. (In about 3 or four hours or so.)

I'm working on one now. It's about 2/3 done. I have to go run a couple errands before I can finish it, though.

alrighty, cool beans!

FlyingPoo, did you get the "custom unlock" boot screen after adding the su binary?

May have to try this one out! Thanks