Google Invites Selected Devs to Buy Project Tango Development Kit

Just about a month ago, the curious Project Tango development kit was … more

Micromax Yureka: Indian Handset with CyanogenMod

Thesoap opera involving Cyanogen Inc., OnePlus, and Micromax is one of the most talked about … more

Chainfire Turns Your Bootanimation into a Logging Center

Having a nice boot animation certainly adds a little bit of aesthetic polish to your … more

Android TV Launcher Pushed to Google Play

Over the past decade, the tech universe has seen two drastic and widely contrasting changes with … more

Welcome to XDA

Search to go directly to your device's forum

Register an account

Unlock full posting privileges

Ask a question

No registration required
Post Reply

Thumbs up [HOW-TO] Lenovo IdeaTab A1000 Rooting

OP sammymaddog

15th August 2013, 04:15 PM   |  #1  
OP Junior Member
Surabaya
Thanks Meter: 12
 
9 posts
Join Date:Joined: Mar 2011
HOW TO ROOT YOUR LENOVO IDEATAB A1000



<DISCLAIMER>


By attempting these steps, your warranty will be void. Even worse than that, it might cause crashes, freezes, random explosions, 2nd degree burns, or even turn your beloved tab into $100+ paperweight. What works on mine might not work on yours, so don't attempt if you don't know what you're doing. Do at your own risk. Corrections are welcome. I must admit that I'm not an expert, so any info I posted might be wrong, and I can't offer you much help. I'm not responsible for anything arising from the use of this how-to. I can only wish you good luck.

<WHY ROOT?>


- Without root or OTA upgrades (at time of writing, Indonesian customers still can't get it), you'll be stuck with ~500MB internal memory. That's annoying.
- You're stuck with the default IO scheduler (cfq) and governor (hybrid, haven't heard that one..)
- You have an incredibly large amount of bloatware you can't get rid of, in that already cramped up internal storage
- Did I mention freedom?

<REQUIREMENTS>


This method is originally used to root Acer Iconia B1-A71. Somehow I noticed that the two actually has the same chipset, MTK8317 (if it really was relevant ). So I tried the method, and through sheer n00b's luck, it worked like a charm!
  • Lenovo IdeaPad A1000-G --> 4GB storage, 2G/EDGE. This method haven't been tested on A1000-T/F, different storage cap (16GB, etc.) or other variants, but it should work with slight modification. Screenshots of my specs are attached below. Remember, proceed at your own risk!
  • A Linux System. Never tried on Windows or Mac. I personally used Linux Mint 15. The source post uses Ubuntu.
  • working ADB (android-tools-adb). You can get this from synaptics, apt-get, etc. If your system can detect adb devices, you should be fine.
  • Superuser Binary
  • Busybox Binary (You can get these two from the links on original post. XDA says noobs can't post links :'( )

ORIGINAL THREAD

<CREDITS>


XDA Senior Member entonjackson, for writing such a noob-friendly how-to for rooting Acer Iconia B1-A71 and for allowing me to use it for this how-to.
XDA Member alba81, for discovering the method as acknowledged on the original post by entonjackson
All awesome gurus on XDA which I can't mention one by one.

<THE STEPS>


1. Extract the android sdk to your home folder, e.g. a user named Bob will use like /home/bob
2. Open a terminal
3. Now plug your A1000 into your machine and turn on Debugging Mode (Go into Settings -> Developer Tools, turn on Developer tools, then turn on USB Debugging Mode)
4. Now back at the keyboard of your Linux machine in your terminal type:
Code:
sudo adb devices
The output should be something like:

Code:
123456789ABCDEF    device
If it's not, google for it. Somehow your Linux hasn't detected the A1000, although the android sdk for Linux brings all needed drivers with it.
If your device was found, congratulations. The adb connection between your linux machine and your tablet is intact.

5. Now extract the downloaded busybox archive to your home folder, in it there should be a busybox binary. So Bob does:
Code:
sudo ./adb push /home/bob/busybox /data/local/tmp
Code:
sudo ./adb shell
Code:
chmod 755 /data/local/tmp/busybox
6. You should copy the busybox binary into a directory where you can access it as a plain non-root user on the tablet. We need this binary. so we can apply unix tools like telnet, dd, cat, etc. But for now we need it to establish a telnet session between our tablet and our linux machine.

(This point is written on original post. Seems important, but as soon as I finished step 5, I can use those tools)

7. Dial *#*#3646633#*#* to enter Engineer Mode

8. Go to Connectivity -> CDS Information -> Network Utility

9. type the following command:
Code:
/data/local/tmp/busybox telnetd -l /system/bin/sh -p 1234
Advice from original poster: copy and paste it from the browser on your tablet, because dependent on which keyboard app installed, this can be freakin tricky. In the next step you will learn, why it's so important why this command should be correct.

10. Tap on Run. You won't get any feedback, so you will never know if the entered command runs properly or not. That's why you should make sure the command is ok.
Now we have started our telnet server on the tablet.

11. Back in the terminal type:
Code:
/data/local/tmp/busybox telnet 127.0.0.1 1234
If you now get an error like couldn't find busybox or something, then either adb push failed or you forgot to chmod, in step 5

12. Now enter:
Code:
cat /proc/dumchar_info
You should get a bunch of lines, try to find a line containing the partition named android

{..... partition list .....}

android 0x0000000028A00000 0x00000000020E8000 2 /dev/block/mmcblk0p3

{..... partition list .....}

13. We will create a dump of our android system. This is the point where different variants *MIGHT* have different parameters. This step is important, as wrong parameter will result in unmountable image.

Stop. Take a deep breath. If you're not familiar with dd, find a good doc of it. There's a plethora of them.
Get yourself a programmer's calculator (Linux Mint 15 has one built in).

Here's what you'll do :

Convert the hex number on the 3rd column into decimal. In my case (0x20E8000) will yield 34504704. Divide by 4096. The result (8424) goes to the skip parameter.
Convert the hex number on the 2nd column. In my case (0x28A00000) will yield 681574400. Divide by 4096. The result (166400) goes to the count parameter.

So the full dd command will look like :

Code:
dd if=/dev/block/mmcblk0 bs=4096 skip=8424 count=166400 | gzip > /cache/system.img.gz
Do a full sanity check before hitting enter! It will take about 5 minutes.

14. After it's finished we must make the image readable for adb, so we do:
Code:
chmod 777 /cache
and
Code:
chmod 777 /cache/system.img.gz
15. Leave the telnet, and then adb shell session by:
Code:
exit
Code:
exit
16. Now we pull our image by
Code:
sudo adb pull /cache/system.img.gz
wait 1-2 minutes.
It should be then located inside /home/bob. It did for me. If not, do a search . It should be a .gz, extract it right there (or /home/bob if it isn't there)

17. Now we need to modify our system image by adding the tiny but helpful su binary. Extract the SU binary to /home/bob.

18. We create a folder where we will mount our system image to. To create it do:
Code:
sudo mkdir /media/a1000
19. Now we mount it:
Code:
sudo mount -o loop /home/bob/system.img /media/a1000
if it fails, then you entered wrong parameters on step 13

20. Now we copy our SU binary to our mounted system image:
Code:
sudo cp /home/bob/su /media/a1000/bin
21. the su binary needs to have the proper rights to make it usable, so we 'suid' it with:
Code:
sudo chmod 06755 /media/a1000/bin/su
22. Let's unmount our baby by:
Code:
sudo umount /media/a1000
and because bob doesn't like a messed up system, he does:
Code:
sudo rm -rf /media/a1000
because he hopefully won't need it anymore.

23. We have to gzip it again to bring it back to where it belongs to. this we do by:
Code:
cd /home/bob
Code:
gzip /home/bob/system.img
24. So here we are now, we made it to the final Boss fight! The next steps are dangerous and should be performed with caution. We copy back our modified system image, which can brick your device, if you do a mistake! Enter adb shell again :
Code:
sudo adb shell
25. Remove the old boring image:
Code:
rm /cache/system.img.gz
26. Leave adb shell
Code:
exit
27. copy our cool new system image containing the su binary:
Code:
sudo adb push /home/bob/system.img.gz /cache
28. Enter adb shell again
Code:
sudo adb shell
29. Usually the telnet server on the tablet is still running, at least in my case it's been like that. That's why we can directly connect to the telnet server with:
Code:
/data/local/tmp/busybox telnet 127.0.0.1 1234
If this doesn't work, then obviously your telnet server isn't running anymore. So on your tablet if the telnet command is still entered (see step 9), tap on Run again and repeat step 29.

30. Now this is the most dangerous step in this how to (no it wasn't the mkdir one). You can copy following command to make sure everything is fine and paste it into your telnet session on your linux terminal.

<WARNING! SANITY CHECK! MAKE SURE *ALL* THE DD PARAMETERS MATCH THE FIRST DD (STEP 13) OR YOUR A1000 WILL TURN INTO A VERY EXPENSIVE PAPERWEIGHT!>

Code:
/data/local/tmp/busybox zcat /cache/system.img.gz | dd of=/dev/block/mmcblk0 bs=4096 seek=8424 count=166400
After 1-2 minutes you're done, if your tablet or pc or yourself didn't catch fire, everything's fine.

31. Leave telnet / adb shell by doing
Code:
exit
Code:
exit
32. Reboot your A1000 via ADB, then exit
Code:
sudo adb reboot
Code:
exit
33. Unplug your tablet from PC

34. Install Superuser (No, not SuperSU, cause it won't work!). I personally use Superuser by ChainsDD, from Play Store

35. Be lucky. Your tablet and thus you are now free!

Don't forget to hit thanks, if this helps
Attached Thumbnails
Click image for larger version

Name:	ss1.png
Views:	2696
Size:	55.8 KB
ID:	2190620   Click image for larger version

Name:	ss2.png
Views:	2487
Size:	35.7 KB
ID:	2190621  
The Following 10 Users Say Thank You to sammymaddog For This Useful Post: [ View ]
17th August 2013, 10:20 PM   |  #2  
Junior Member
Thanks Meter: 1
 
2 posts
Join Date:Joined: Jan 2012
hi, after step 13 (i double checked the command), i get this error

Code:
/system/bin/sh: can't create /cache/system.img.gz: Permission denied
/dev/block/mmcblk0: cannot open for read: Permission denied
I have the WiFi 4G version
The Following User Says Thank You to ulisez For This Useful Post: [ View ]
18th August 2013, 07:30 AM   |  #3  
Junior Member
Thanks Meter: 0
 
2 posts
Join Date:Joined: Aug 2013
Im too stuck in step 13.....nothing wrong with the script, can u give me a solution?

Im using A1000G also
18th August 2013, 11:30 AM   |  #4  
Junior Member
Thanks Meter: 0
 
2 posts
Join Date:Joined: Aug 2013
@ts
Your guide work perfectl, in windows enviroment but mount step still need linux,
I've question are you using DirectoryBinding? Mine always close when playing Real Racing, its very annoying

You have suggeztion or alternative for DirectoryBinding?
18th August 2013, 01:07 PM   |  #5  
Junior Member
Thanks Meter: 0
 
2 posts
Join Date:Joined: Aug 2013
Root with Windows ?
Hi,

I am a new member because i bought this tblet but i can't root. I don't have a linux environment, so there is a solution with W8 Pro 64 ?

Thanks a lot for you help,
18th August 2013, 02:17 PM   |  #6  
OP Junior Member
Surabaya
Thanks Meter: 12
 
9 posts
Join Date:Joined: Mar 2011
Quote:
Originally Posted by ulisez

hi, after step 13 (i double checked the command), i get this error

Code:
/system/bin/sh: can't create /cache/system.img.gz: Permission denied
/dev/block/mmcblk0: cannot open for read: Permission denied
I have the WiFi 4G version

have you chmod-ed the busybox (or is the chmod successful without error)? Try chmod-ing the /cache before attempting step 13. It seems that you still don't have access to the NAND device (mmcblk0). Have you updated firmware via OTA?

Quote:
Originally Posted by artonelico

Im too stuck in step 13.....nothing wrong with the script, can u give me a solution?

Im using A1000G also

Do you encounter the same error message like ulisez had? Could you post the screenshot of the partition list (the lines after you execute dumchar_info)?

Quote:
Originally Posted by rmage

@ts
Your guide work perfectl, in windows enviroment but mount step still need linux,
I've question are you using DirectoryBinding? Mine always close when playing Real Racing, its very annoying

You have suggeztion or alternative for DirectoryBinding?

I personally use Link2SD by Bulent Akpinar to link apps to 2nd partition on my SDcard.

Quote:
Originally Posted by Letsar

Hi,

I am a new member because i bought this tblet but i can't root. I don't have a linux environment, so there is a solution with W8 Pro 64 ?

Thanks a lot for you help,

The original developer who posted the method (entonjackson) plans to integrate the method in the next release his toolkit, the Acer Iconia Toolkit. I think you should check his thread : http://forum.xda-developers.com/show....php?t=2240029
19th August 2013, 04:13 AM   |  #7  
Junior Member
Thanks Meter: 0
 
2 posts
Join Date:Joined: Aug 2013
Unhappy
Quote:
Originally Posted by sammymaddog

have you chmod-ed the busybox (or is the chmod successful without error)? Try chmod-ing the /cache before attempting step 13. It seems that you still don't have access to the NAND device (mmcblk0). Have you updated firmware via OTA?



Do you encounter the same error message like ulisez had? Could you post the screenshot of the partition list (the lines after you execute dumchar_info)?



I personally use Link2SD by Bulent Akpinar to link apps to 2nd partition on my SDcard.



The original developer who posted the method (entonjackson) plans to integrate the method in the next release his toolkit, the Acer Iconia Toolkit. I think you should check his thread : http://forum.xda-developers.com/show....php?t=2240029

Link2SD doesn't link app data, do you have any option?
19th August 2013, 02:56 PM   |  #8  
Junior Member
Thanks Meter: 0
 
2 posts
Join Date:Joined: Aug 2013
yes i had same message with ulyses, by the way im from indonesia too can i contact you through chat client?
oh yeah im using windows 7 and using cmd as a terminal in linux

thx before bro
20th August 2013, 10:18 PM   |  #9  
Junior Member
Thanks Meter: 0
 
2 posts
Join Date:Joined: Aug 2013
Quote:
Originally Posted by sammymaddog

The original developer who posted the method (entonjackson) plans to integrate the method in the next release his toolkit, the Acer Iconia Toolkit. I think you should check his thread : http://forum.xda-developers.com/show....php?t=2240029

Ok, i see his toolkit. It's very good. I'll wait
22nd August 2013, 01:49 AM   |  #10  
OP Junior Member
Surabaya
Thanks Meter: 12
 
9 posts
Join Date:Joined: Mar 2011
Quote:
Originally Posted by rmage

Link2SD doesn't link app data, do you have any option?

I'm not sure whether the stock kernel of our devices supports init.d, thus supports CronMod/Data2SD. Lenovo locked our bootloader, and currently there's no way around it. So I personally think, Link2SD method are the best option for now.

Let's give it several months until our dev gurus bring their miracles upon this device

Post Reply Subscribe to Thread
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes