Attend XDA's Second Annual Developer Conference, XDA:DevCon 2014!
5,769,208 Members 38,137 Now Online
XDA Developers Android and Mobile Development Forum

[ROOT] LG Intuition & LG Spectrum ICS

Tip us?
 
jcase
Old
(Last edited by jcase; 30th September 2012 at 03:51 PM.)
#1  
jcase's Avatar
Forum Moderator / Senior Recognized Developer - Taco Vendor - OP
Thanks Meter 7130
Posts: 3,617
Join Date: Feb 2010
Location: Sequim WA

 
DONATE TO ME
Default [ROOT] LG Intuition & LG Spectrum ICS

Source: http://www.androidpolice.com/2012/09...ectrum-on-ics/

If you find this useful please follow me (jcase) on twitter ( https://twitter.com/teamandirc/ ).

Here you go, root for both the new LG Intuition and the LG Spectrum running ICS. The vulnerability is a simple permission bug allowing us to setup a symlink to local.prop (yes yet again). While the bug is the same, the procedure is slightly different, so I will have the instructions separate.

With the LG Intuition, they did seem to attempt to mitigate this attack. Not by setting correct permissions, but by dropping adbD to the shell user if it runs as root, even if ro.kernel.qemu=1 is set. They failed, they give us enough time to run one command before dropping the root privileges, in our case a script to root the phone.

LG Spectrum ICS Root (for the leaked ICS rom):
Expect this to be patched in the release rom. Leaked ICS rom has locked bootlaoders, ie no recovery at this point.

Files needed:
su ( http://dl.dropbox.com/u/8699733/lgroot/su )

adb shell

$ rm /data/vpnch/vpnc_starter_lock
$ ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
$ exit

adb reboot

adb wait-for-device shell

$ echo 'ro.kernel.qemu=1' > /data/local.prop
$ exit

adb reboot

adb wait-for-device remount
adb push su /system/xbin/su
adb shell

# chown 0.0 /system/xbin/su
# chmod 06755 /system/xbin/su
# rm /data/local.prop
# rm /data/vpnch/vpnc_starter_lock
# reboot

Once rebooted, install Superuser from the market and enjoy.







LG Intuition Root

Files needed:
su ( http://dl.dropbox.com/u/8699733/lgroot/su )
lgroot.sh ( http://dl.dropbox.com/u/8699733/lgroot/lgroot.sh )

adb push su /data/local/tmp/su
adb push lgroot.sh /data/local/tmp/lgroot.sh

adb shell

$ chmod 777 /data/local/tmp/lgroot.sh
$ rm /data/vpnch/vpnc_starter_lock
$ ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
$ exit

adb reboot

You may have to unplug/replug your phone to get some computers to pick it up again after this reboot.

adb wait-for-device shell

$ echo 'ro.kernel.qemu=1' > /data/local.prop
$ exit

Here is the important part, you will have to execute the next to commands one after the other. We want the second command to be fired off as soon as adbD comes up, before it drops root privileges. This may take some a few minutes, and after the second command is complete you may have to unplug/replug you phone to get your computer to see it again.

adb reboot
adb wait-for-device /data/local/tmp/lgroot.sh

(Here is where you may have to unplug/replug, but only after the second command has ran).

adb wait-for-device shell


$ su
# rm /data/local.prop
# rm /data/vpnch/vpnc_starter_lock
# reboot

Once rebooted, install Superuser from the market and enjoy.
I'm taking a break of an undetermined length. Please don't contact me about exploits

Something important? jcase@cunninglogic.com
Like Android security topics? Join our G+ community -> https://plus.google.com/communities/...07618051049043
My Bitcoin address : 1Newifz6yETTmbziCsZZstmHHPH6ejNr75
The Following 2 Users Say Thank You to jcase For This Useful Post: [ Click to Expand ]
 
LostCauseSPM
Old
#2  
LostCauseSPM's Avatar
Junior Member
Thanks Meter 0
Posts: 6
Join Date: Jan 2012
Default Thanks!

Dude, it has been killing me not having root since I managed to get the leaked ICS installed. But I tried this, and just wasn't having any luck. I tried to make a .bat file for it, no go. So i tried inputting it line by line and i keep getting hung up at the $ echo 'ro.kernel.qemu=1' part. Just wondering if anyone else is having this problem.
Also, since yesterday whenever I check for a software update, I'm getting an "error occurred during download". I was wondering if I would even be able to get the final ICS OTA when it finally is available.
Thanks again jcase!
 
jcase
Old
#3  
jcase's Avatar
Forum Moderator / Senior Recognized Developer - Taco Vendor - OP
Thanks Meter 7130
Posts: 3,617
Join Date: Feb 2010
Location: Sequim WA

 
DONATE TO ME
Quote:
Originally Posted by LostCauseSPM View Post
Dude, it has been killing me not having root since I managed to get the leaked ICS installed. But I tried this, and just wasn't having any luck. I tried to make a .bat file for it, no go. So i tried inputting it line by line and i keep getting hung up at the $ echo 'ro.kernel.qemu=1' part. Just wondering if anyone else is having this problem.
Also, since yesterday whenever I check for a software update, I'm getting an "error occurred during download". I was wondering if I would even be able to get the final ICS OTA when it finally is available.
Thanks again jcase!
Which specific ICS version do you have, I had a couple different leaks to work with.
I'm taking a break of an undetermined length. Please don't contact me about exploits

Something important? jcase@cunninglogic.com
Like Android security topics? Join our G+ community -> https://plus.google.com/communities/...07618051049043
My Bitcoin address : 1Newifz6yETTmbziCsZZstmHHPH6ejNr75
 
LostCauseSPM
Old
#4  
LostCauseSPM's Avatar
Junior Member
Thanks Meter 0
Posts: 6
Join Date: Jan 2012
Quote:
Originally Posted by jcase View Post
Which specific ICS version do you have, I had a couple different leaks to work with.
build #: IMM76D
Still tweeking on it. Just updated all my drivers, too. I'm not a total newb, but I'm no pro, either.
 
lahegry
Old
#5  
Senior Member
Thanks Meter 87
Posts: 343
Join Date: Apr 2010
Location: fort campbell ky
Quote:
Originally Posted by jcase View Post
Source: http://www.androidpolice.com/2012/09...ectrum-on-ics/


LG Intuition Root

Files needed:
su ( http://dl.dropbox.com/u/8699733/lgroot/su )
lgroot.sh ( http://dl.dropbox.com/u/8699733/lgroot/lgroot.sh )

adb push su /data/local/tmp/su
adb push lgroot.sh /data/local/tmp/lgroot.sh

adb shell

$ chmod 777 /data/local/tmp/lgroot.sh
$ rm /data/vpnch/vpnc_starter_lock
$ ln -s /data/local.prop /data/vpnch/vpnc_starter_lock
$ exit

adb reboot

You may have to unplug/replug your phone to get some computers to pick it up again after this reboot.

adb wait-for-device shell

$ echo ‘ro.kernel.qemu=1’ > /data/local.prop
$ exit

Here is the important part, you will have to execute the next to commands one after the other. We want the second command to be fired off as soon as adbD comes up, before it drops root privileges. This may take some a few minutes, and after the second command is complete you may have to unplug/replug you phone to get your computer to see it again.

adb reboot
adb wait-for-device /data/local/tmp/lgroot.sh

(Here is where you may have to unplug/replug, but only after the second command has ran).

adb wait-for-device shell


$ su
# rm /data/local.prop
# rm /data/vpnch/vpnc_starter_lock
# reboot

Once rebooted, install Superuser from the market and enjoy.
i tried but as soon as i entered adb shell it kick me off and haven't been able to try since
Currently has LG Intuition
Speak Softly And Carry A Cool Phone
 
LostCauseSPM
Old
#6  
LostCauseSPM's Avatar
Junior Member
Thanks Meter 0
Posts: 6
Join Date: Jan 2012
Quote:
Originally Posted by jcase View Post
Which specific ICS version do you have, I had a couple different leaks to work with.
Ive got the spectrum, btw. Still trying to make a nice, clean, automated .bat, but it keeps failing now at the remount command.

---------- Post added at 07:37 PM ---------- Previous post was at 07:24 PM ----------

And now is saying "rm failed for /data/vpnch..."
When the remount fails, I get a "remount failed: operation not permitted" message.
Hope this is useful to you.
 
jcase
Old
#7  
jcase's Avatar
Forum Moderator / Senior Recognized Developer - Taco Vendor - OP
Thanks Meter 7130
Posts: 3,617
Join Date: Feb 2010
Location: Sequim WA

 
DONATE TO ME
Quote:
Originally Posted by LostCauseSPM View Post
Ive got the spectrum, btw. Still trying to make a nice, clean, automated .bat, but it keeps failing now at the remount command.

---------- Post added at 07:37 PM ---------- Previous post was at 07:24 PM ----------

And now is saying "rm failed for /data/vpnch..."
When the remount fails, I get a "remount failed: operation not permitted" message.
Hope this is useful to you.
add jcase@cunninglogic.com to gltak and hit me up.
I'm taking a break of an undetermined length. Please don't contact me about exploits

Something important? jcase@cunninglogic.com
Like Android security topics? Join our G+ community -> https://plus.google.com/communities/...07618051049043
My Bitcoin address : 1Newifz6yETTmbziCsZZstmHHPH6ejNr75
 
jcase
Old
#8  
jcase's Avatar
Forum Moderator / Senior Recognized Developer - Taco Vendor - OP
Thanks Meter 7130
Posts: 3,617
Join Date: Feb 2010
Location: Sequim WA

 
DONATE TO ME
Quote:
Originally Posted by lahegry View Post
i tried but as soon as i entered adb shell it kick me off and haven't been able to try since
unplug/replug, The intuition is very touchy. Might need to do it from another system or with another cable.
I'm taking a break of an undetermined length. Please don't contact me about exploits

Something important? jcase@cunninglogic.com
Like Android security topics? Join our G+ community -> https://plus.google.com/communities/...07618051049043
My Bitcoin address : 1Newifz6yETTmbziCsZZstmHHPH6ejNr75
 
lahegry
Old
#9  
Senior Member
Thanks Meter 87
Posts: 343
Join Date: Apr 2010
Location: fort campbell ky
Quote:
Originally Posted by jcase View Post
unplug/replug, The intuition is very touchy. Might need to do it from another system or with another cable.
i don't think i'm fast enough, i just can't type faster than it kicks me off
Currently has LG Intuition
Speak Softly And Carry A Cool Phone
 
jcase
Old
#10  
jcase's Avatar
Forum Moderator / Senior Recognized Developer - Taco Vendor - OP
Thanks Meter 7130
Posts: 3,617
Join Date: Feb 2010
Location: Sequim WA

 
DONATE TO ME
Quote:
Originally Posted by lahegry View Post
i don't think i'm fast enough, i just can't type faster than it kicks me off
Place the two commands into a batch file/shell script, or setup teamviewer and msg me on gtalk
I'm taking a break of an undetermined length. Please don't contact me about exploits

Something important? jcase@cunninglogic.com
Like Android security topics? Join our G+ community -> https://plus.google.com/communities/...07618051049043
My Bitcoin address : 1Newifz6yETTmbziCsZZstmHHPH6ejNr75

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes


Google Glass XE20.1 Update Brings Improved Contacts, Head Nudge, New Cards and Commands

Ever since Google unveiled Android Wear earlier this … more

Remote Control Your Android Device with Monitordroid

The Android OS showsgreat potential in many areas. One of most interesting things that … more

Intel Partners with Unity to Support Android on Intel-Based Devices

Intel, largely known for their long-standing reputation as the king of … more

Device Review: Samsung Gear Live

Recently, Google announced Android Wear to the world. Android Wear is the Android-based initiative from … more