Attend XDA's Second Annual Developer Conference, XDA:DevCon 2014!
5,802,957 Members 38,468 Now Online
XDA Developers Android and Mobile Development Forum

Rooting the Tattoo(its done!) - what we have got so far

Tip us?
(Last edited by -bm-; 1st March 2010 at 06:38 AM.)
Member - OP
Thanks Meter 0
Posts: 75
Join Date: Jun 2005
Default Rooting the Tattoo(its done!) - what we have got so far

Finally the race is over and some brave devs managed to get root on the tattoo and some were able to reproduce it on their own devices already. But notice: We are in an early stage of development. There is no one-klick-get-root app at the moment and there is still much work to be done until we get custom roms.
I will try to keep track of the ongoing development and update this post periodically. I've you find a mistake or get something new, let us know but we can't give support to every linux-nob at this point of development!
At the moment beeing root on the tattoo does NOT enable you to use the usual applications like Wifi Tethering that need root out of the box. You are also unable to write to /system by default. Now there is a new hack to make /system writable (look at the bottom of this post)

Last update: 26.02.2010 - 12:55 MEZ

The tattoo was successfully rooted the first time on 19.02.2010 ( ). It was reproduced by some other users already, there is some work to be done make the exploit work more easily.
Because it has been asked many times: If there will ever be an OFFICIAL update with android 2.1 by HTC for the Tattoo (nobody knows definitively), this root-exploit will NOT work! You will lose root then!

It was done by porting this exploit to the arm plattform and the tattoo. It uses a security hole in kernel 2.6.29 that wasn't patched in tattoos kernel. All began here on 10.2.2010 (the first post doesn't has to do anything with this):
Kudos to zanfur, bftb0, mainfram3, HT123 and others (sorry if I forgot an important one).
The exploit was tweaked to deliver root more reliable.

Flashing custom roms
To develop custom roms won't be the problem, but the tattoo has got some extra security mechanisms that don't make it trivial to flash a new rom even now we have root. There is work going on to solve this.

Howto get root-privileges
I think it is save to follow but this is done at your own risk. Don't blame me if you Tattoo explodes, eats your hamster or make your girlfriend leave you.
Remember: We're in an early state of development, this is no Klick-an-Run-app, linux knowledge is needed.
Newbis on Windows should follow this howto made by Coburn64, its much easier than this one:

Download this to your PC and unzip: Attachment 285070
(the older release was called m6 and can be found here:
m7 is the binary. Push m7 to your Tattoo using adb:
adb push m7 /data/local/bin/m7
adb chmod 755 /data/local/bin/m7
Start a shell:
adb shell
Start the exploit in the shell:
cd /data/local/bin
while `true` ; do /data/local/bin/m7; done
The new m7 is an improved version of the old m6, it now should bring you root much more reliable.
With the old m6 while it is running, bring up and close random apps via task manager on the tattoo. This might not be necessary with m7. After a while the exploit should report success and come up with a root-shell. The promt should change from
Sometime the exploit stopps but no shell ('#') comes up. Just terminate it with ^C and try again.

You did it, you should be root now!
Let's set some variables:
export LD_LIBRARY_PATH=/system/lib
export PATH=/system/bin
When you got your shell, check if you are really root:
You should get something like this:
# id
uid=0(root) gid=1000(shell) groups=1003(graphics),1004(input),1007(log),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet)
uid=0(root) is important.

To get a root-shell more easily next time, we have to make su work.

Take this su binary and push it in your tatto:
adb push su /data/local/bin/su
Remount /data without the nosuid-option
# mount -o rw,remount /dev/block/mtdblock3 /data
Change the owner to root and set the suid-bit
# chown root.root /data/local/bin/su
# chmod 4755 /data/local/bin/su

Now you don't have to run the exploit again, just open a normal shell and run
$ /data/local/bin/su
Now you should be root!
Attention: If you reboot your phone, you have to run the exploit and the mount command again because /data will be mounted nosuid again!

Thats it!

Some suggestions for going on. When you run mount, you will see that some partitions are mounted read-only and/or with the nosuid-option. You can change this by running:
mount -o rw,remount /dev/block/mtdblockYOUWANT /DIRtoREMOUNT
Other developer stuff
Here I will list all other thinks, more dangerous and not with all steps described in detail because you should know how to do this if you want to :)

New: Make /system writeable
This is a dangerous part, it might break you system forever unless you don't know what you are doing! Don't try it unless you are a dev! That is the reason why the steps you have to do are not described in a more detailed way. If you don't know what to type in, you shouldn't try this hack!

Download Attachment 286072
1. Copy tattoo-hack.ko from the zip to /data/local/bin
2. # insmod /data/local/bin/tattoo-hack.ko
3. Remount system partition to be writeable

Now you can do everything with /system until you reboot. /system is the only partition that is mounted without nosuid after reboot, so copy su over to /system/bin/ to keep root permanently. To be able to use programs like setcpu you have to replace /system/bin/su with this su:
Attachment 286154

Flashing a custom recovery image
This is in alpha-state but we are able to flash custom recovery images what is the determining step to flashing custom roms. Don't ask how to flash android 2.x (we didn't do it right now) or when it will be ready. It will bes sometimes...

Have a lot of fun!
Junior Member
Thanks Meter 0
Posts: 12
Join Date: Feb 2010
BTW.. In order for /data/local/bin to exist it's probably best you do the busybox install to there first.. also the busybox commands are very handy.
HTCDevil's Avatar
Senior Member
Thanks Meter 43
Posts: 782
Join Date: Mar 2009
Location: Caserta
Great - bm - thank you very much
Rom: Stock 4.4.2 Italy
Nexus 7 (2012)
Rom: CM 11 Nightly
Kernel: M Kernel a67
zipredictive's Avatar
Senior Member
Thanks Meter 75
Posts: 458
Join Date: May 2007
Location: Milan
Originally Posted by -bm- View Post
This is a great day, it's really amazing how people could work together searching the good way to root this awesome little phone. Just to say I've really appreciated your work... I followed all you guys day by day... Thank you everyone, sorry for the OT.
Anyway... risks of bricks?
HTC Tattoo > Nexus One > Nexus S > Galaxy Nexus
Member - OP
Thanks Meter 0
Posts: 75
Join Date: Jun 2005
Originally Posted by elvisior View Post
BTW.. In order for /data/local/bin to exist it's probably best you do the busybox install to there first.. also the busybox commands are very handy.
Youre right, busybox makes further development more handy. But I think it isn't needed for /data/local/bin to exist, because for me it was there and I've got no busybox on my tattoo :)
ApotheoZ Old
Thanks Meter 0
Posts: n/a
chdir /data/local/bin
instead of

chdir to /data/local/bin
svprm's Avatar
Senior Member
Thanks Meter 373
Posts: 1,280
Join Date: Dec 2007
Location: Salem-TamilNadu

Thanks Man.
Nice team work.
If you like my works,please hit Thanks.

Mine:HTC One M7
Custom Rom

Dad: LG L90 Dual
Try my other works:
My Works:

My Other Android works

Old:HTC Touch,HTC Tattoo,Xerpia Mini pro,Xperia X10i and HTC Desire,Xperia Neo V,Galaxy Nexus (Bricked) , Xolo Q700
zoko's Avatar
Senior Member
Thanks Meter 1
Posts: 354
Join Date: Aug 2007
Location: Lisbon
stupid noobie question how Push m6 to your Tattoo using adb! can anyone possible make a noobie tutorial?!
ApotheoZ Old
Thanks Meter 0
Posts: n/a
@zoko : Use your favorite linux distribution.
Thanks Meter 0
Posts: 76
Join Date: Dec 2009
please can you help me?when I do .m6 in shell i get
[ Overwritten 0xb0000100
but no #, any help for me?

exploit, root, rooting, status, tattoo
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes