Post Reply

Tablet S 4.0.3 r1a rooted

OP WonderEkin

14th September 2012, 11:16 AM   |  #1  
OP Senior Member
Thanks Meter: 300
 
162 posts
Join Date:Joined: Jul 2007
Thanks Yupandra2012, my Tablet S 4.0.3 r1a finally rooted.
Ref: http://forum.xda-developers.com/show...1&postcount=12

The original steps(this link) was written in Japanese, I've just translate it into Eng. But sorry for my bad English.

UPDATE:
A semi automatic script can be found at here.


Files you need:
adb tools
SonyTabletICS-2.zip
Superuser-3.1.3-arm-signed.zip
VpnFaker.apk (Attachment)
For those who are no using the US firmware, the attached VpnFaker.apk may not suitable for your tablet.
Please follow this steps(click me) to resign the VpnFaker.apk. Thanks.



***Pls Execute the command line by line***

Unzip those files into a dir, Open cmd console, cd to that dir
Run the following command and press Restore on your tablet
Code:
adb restore settings.ab
Check the result
Code:
adb shell ls -ld /data/data/com.android.settings/a
	drwxrwxrwx system system    a
And continue, ignore the "rm -r a" permission denied error
Code:
adb shell
	cd /data/data/com.android.settings
	rm -r a
	while : ; do ln -s /data a/file99; done
While the loop is running, open another cmd console and run
Code:
adb restore settings.ab
Once the restore process is completed, you can press CTRL+C on the 1st cmd console to break the loop

Check the /data permission
Code:
adb shell ls -ld /data
	drwxrwxrwx system system    data
Then continue
Code:
adb push busybox /data/local/tmp
adb push rootkit.tar.gz /data/local/tmp
adb push Superuser.apk /data/local/tmp
adb push su /data/local/tmp
adb shell
	cd /data/local/tmp
	chmod 755 busybox
	./busybox tar zxf rootkit.tar.gz
	exit
Push the resigned VpnFaker.apk(resign by ZipSigner 2) and update the timestamp
Code:
adb push VpnFaker.apk /data/local/tmp
adb shell
	touch -t 1346025600 /data/local/tmp/VpnFaker.apk
	exit
Now, replace the VpnDialogs, ignore "cp: can't open 'system/xxxxxxx': Permission denied" while you execute "/data/local/tmp/busybox cp -r system system2"
Code:
adb shell
	cd /data
	/data/local/tmp/busybox cp -r system system2
	#Pls ignore "cp: can't open 'system/xxxxxxx': Permission denied"
	/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
	/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
	mv system system-
	mv system2 system

	mv app app-
	mkdir app
	mv /data/local/tmp/VpnFaker.apk /data/app
Make sure the datatime is 2012/08/27 00:00
Code:
	TZ=0 ls -l /data/app
		-rw-r--r-- shell shell 198580 2012-08-27 00:00 VpnFaker.apk
Generate the packages.xml
Code:
	/data/local/tmp/busybox sed -f /data/local/tmp/packages.xml.sed system-/packages.xml > system/packages.xml
And double check the result
Code:
	/data/local/tmp/busybox grep vpndialogs system/packages.xml
		<updated-package name="com.android.vpndialogs" codepath="/system/app/VpnDialogs.apk" nativelibrarypath="/data/data/com.android.vpndialogs/lib" flags="1" ft="136f14be668" it="136f14be668" ut="136f14be668" version="15" shareduserid="1000">
		<package name="com.android.vpndialogs" codepath="/data/app/VpnFaker.apk" nativelibrarypath="/data/data/com.android.vpndialogs/lib" flags="1" ft="1396560b400" it="1396560b400" ut="1396560b400" version="45" shareduserid="1000">
Exit adb shell and reboot, you should see something like "Android is updating" during startup.
Code:
	exit
	adb reboot
Start the injected Terminal Emulator
Code:
adb shell am start -n com.android.vpndialogs/.Term
Unlock your tabet, The Terminal Emulator should appeared. If not, post your "adb logcat".
Now, in the Terminal Emulator
Code:
id
You should see the uid is 1000(system)

Still in the Terminal Emulator, ignore the script error
Code:
/data/local/tmp/onload.sh
/data/local/tmp/onload2.sh
Now back to the cmd console
Code:
adb shell
	/dev/sh
	id
Check the uid is 2000(shell)

And
Code:
	chown 0.0 /data/local/tmp/_su
	chmod 6755 /data/local/tmp/_su
	/data/local/tmp/_su
	id
Check the root access uid 0(root)

Backup /system (you may just skip it)
Code:
	dd if=/dev/block/mmcblk0p3 of=/mnt/sdcard/system.ext4 bs=128K
Copy su & Superuser.apk to /system
Code:
	/data/local/tmp/busybox mount -o rw,remount /system
	/data/local/tmp/busybox cp /data/local/tmp/_su /system/xbin
	chown 0.0 /system/xbin/_su
	chmod 6755 /system/xbin/_su
	/data/local/tmp/busybox cp /data/local/tmp/su /system/xbin
	chown 0.0 /system/xbin/su
	chmod 6755 /system/xbin/su
	/data/local/tmp/busybox cp /data/local/tmp/Superuser.apk /system/app
	/data/local/tmp/busybox mount -o ro,remount /system
	sync
	exit
Check the /system _su is working or not
Code:
	_su
	id
Should be uid 0(root)

And move the original /data/app & /data/system back (the original steps will keep the VpnFaker.apk, but i skip it)
Code:
	cd /data
	mv app app2
	mv app- app
	mv system system2
	mv system- system
	exit
	exit
Now, you Tablet S should be rooted.
Attached Files
File Type: apk VpnFaker.apk - [Click for QR Code] (195.7 KB, 4228 views)
Last edited by WonderEkin; 19th September 2012 at 02:50 AM.
The Following 34 Users Say Thank You to WonderEkin For This Useful Post: [ View ]
14th September 2012, 12:21 PM   |  #2  
Senior Member
Thanks Meter: 130
 
1,183 posts
Join Date:Joined: Nov 2010
I'm getting permission denied rm -r a... hopefully someone can make a batch file for this.
The Following User Says Thank You to SWFlyerUK For This Useful Post: [ View ]
14th September 2012, 12:53 PM   |  #3  
OP Senior Member
Thanks Meter: 300
 
162 posts
Join Date:Joined: Jul 2007
Quote:
Originally Posted by SWFlyerUK

I'm getting permission denied rm -r a... hopefully someone can make a batch file for this.


You may just skip that error.
You can't delete that folder actually, just fake the system.
14th September 2012, 12:59 PM   |  #4  
Cat McGowan's Avatar
Senior Member
Thanks Meter: 350
 
792 posts
Join Date:Joined: Apr 2012
More
Quote:
Originally Posted by WonderEkin

Thanks Yupandra2012, my Tablet S 4.0.3 r1a finally rooted.
Ref: http://forum.xda-developers.com/show...1&postcount=12

The original steps(this link) was written in Japanese, I've just translate it into Eng. But sorry for my bad English.

Good job and thank you. You beat me to the finish line, I was also translating (slowly) the original Japanese post into English by tediously using http://www.bing.com/translator/ and http://translate.google.com/ as my translators.

For convenience, those who do this rooting method may also want to copy the ADB files adb.exe, AdbWinApi.dll, and AdbWinUsbApi.dll (or download and extract ADB_v1.0.29.zip) into the same directory where they put the rooting files SonyTabletICS-2.zip, Superuser-3.1.3-arm-signed.zip, and VpnFaker.apk.

Now I just need to get an unrooted Sony Tablet S to test this method on. Perhaps I will unrooted my granddaughter's tablet.
14th September 2012, 01:22 PM   |  #5  
Senior Member
Thanks Meter: 130
 
1,183 posts
Join Date:Joined: Nov 2010
This stopped working for me when I had to launch VpnDialogs, activity not found - also had permission denied which meant I couldn't go further, mkdir app said mkrdir not found:

Code:
/data/local/tmp/busybox cp -r system system2
= Permission Denied.
14th September 2012, 02:10 PM   |  #6  
daniel910821's Avatar
Member
Thanks Meter: 30
 
93 posts
Join Date:Joined: Jun 2012
A couple questions,
  • Couldthis method brick my tablet, or is safe try it?
  • Would this work doing it on Ubuntu Linux?

Thanks in advance!
14th September 2012, 02:33 PM   |  #7  
Member
Thanks Meter: 7
 
61 posts
Join Date:Joined: Feb 2011
More
Quote:
Originally Posted by SWFlyerUK

This stopped working for me when I had to launch VpnDialogs, activity not found - also had permission denied which meant I couldn't go further, mkdir app said mkrdir not found:

Code:
/data/local/tmp/busybox cp -r system system2
= Permission Denied.


Same Problem here, what to do now?
14th September 2012, 02:40 PM   |  #8  
rrlu21's Avatar
Junior Member
Flag Shanghai
Thanks Meter: 5
 
16 posts
Join Date:Joined: Aug 2012
Quote:
Originally Posted by WonderEkin

Thanks Yupandra2012, my Tablet S 4.0.3 r1a finally rooted.
Ref: http://forum.xda-developers.com/show...1&postcount=12

Now, you Tablet S should be rooted.

Thanks a lot for your hard work.
Before I start this root, I want to confirm with you whether this root will wipe out my installed app data?
Last edited by rrlu21; 14th September 2012 at 02:48 PM.
14th September 2012, 03:13 PM   |  #9  
OP Senior Member
Thanks Meter: 300
 
162 posts
Join Date:Joined: Jul 2007
Quote:
Originally Posted by SWFlyerUK

This stopped working for me when I had to launch VpnDialogs, activity not found - also had permission denied which meant I couldn't go further, mkdir app said mkrdir not found:

Code:
/data/local/tmp/busybox cp -r system system2
= Permission Denied.

Can you post the full command log?
14th September 2012, 03:16 PM   |  #10  
Member
Thanks Meter: 7
 
61 posts
Join Date:Joined: Feb 2011
More
Quote:
Originally Posted by WonderEkin

Can you post the full command log?

Sure, i tried it two times: (for any reason i can't copy the full log, sry)

C:\STS>adb shell
shell@android:/ $ cd /data
cd /data
shell@android:/data $ /data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox cp -r system system2
cp: can't create directory 'system2': Permission denied
1|shell@android:/data $ /data/local/tmp/busybox find system2 -type f -exec chmod
666 {} \
d system2 -type f -exec chmod 666 {} \ <
> /data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \
> mv system system-
mv system system-
find: -exec requires an argument
1|shell@android:/data $ mv system2 system
mv system2 system
failed on 'system2' - No such file or directory
255|shell@android:/data $ cd /data
/data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
mv system system-
mv system2 systemcd /data
/data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
mv system system-
shell@android:/data $ /data/local/tmp/busybox cp -r system system2
cp: can't create directory 'system2': Permission denied
Last edited by TomaHawk93; 14th September 2012 at 03:22 PM.

Post Reply Subscribe to Thread
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes


Top Threads in Tablet S General by ThreadRank