Post Reply Subscribe to Thread Email Thread

Rooting the Tattoo(its done!) - what we have got so far

20th February 2010, 01:24 PM   |  #1  
OP Member
Thanks Meter: 0
75 posts
Join Date:Joined: Jun 2005
Finally the race is over and some brave devs managed to get root on the tattoo and some were able to reproduce it on their own devices already. But notice: We are in an early stage of development. There is no one-klick-get-root app at the moment and there is still much work to be done until we get custom roms.
I will try to keep track of the ongoing development and update this post periodically. I've you find a mistake or get something new, let us know but we can't give support to every linux-nob at this point of development!
At the moment beeing root on the tattoo does NOT enable you to use the usual applications like Wifi Tethering that need root out of the box. You are also unable to write to /system by default. Now there is a new hack to make /system writable (look at the bottom of this post)

Last update: 26.02.2010 - 12:55 MEZ

The tattoo was successfully rooted the first time on 19.02.2010 ( ). It was reproduced by some other users already, there is some work to be done make the exploit work more easily.
Because it has been asked many times: If there will ever be an OFFICIAL update with android 2.1 by HTC for the Tattoo (nobody knows definitively), this root-exploit will NOT work! You will lose root then!

It was done by porting this exploit to the arm plattform and the tattoo. It uses a security hole in kernel 2.6.29 that wasn't patched in tattoos kernel. All began here on 10.2.2010 (the first post doesn't has to do anything with this):
Kudos to zanfur, bftb0, mainfram3, HT123 and others (sorry if I forgot an important one).
The exploit was tweaked to deliver root more reliable.

Flashing custom roms
To develop custom roms won't be the problem, but the tattoo has got some extra security mechanisms that don't make it trivial to flash a new rom even now we have root. There is work going on to solve this.

Howto get root-privileges
I think it is save to follow but this is done at your own risk. Don't blame me if you Tattoo explodes, eats your hamster or make your girlfriend leave you.
Remember: We're in an early state of development, this is no Klick-an-Run-app, linux knowledge is needed.
Newbis on Windows should follow this howto made by Coburn64, its much easier than this one:

Download this to your PC and unzip: Attachment 285070
(the older release was called m6 and can be found here:
m7 is the binary. Push m7 to your Tattoo using adb:
adb push m7 /data/local/bin/m7
adb chmod 755 /data/local/bin/m7
Start a shell:
adb shell
Start the exploit in the shell:
cd /data/local/bin
while `true` ; do /data/local/bin/m7; done
The new m7 is an improved version of the old m6, it now should bring you root much more reliable.
With the old m6 while it is running, bring up and close random apps via task manager on the tattoo. This might not be necessary with m7. After a while the exploit should report success and come up with a root-shell. The promt should change from
Sometime the exploit stopps but no shell ('#') comes up. Just terminate it with ^C and try again.

You did it, you should be root now!
Let's set some variables:
export LD_LIBRARY_PATH=/system/lib
export PATH=/system/bin
When you got your shell, check if you are really root:
You should get something like this:
# id
uid=0(root) gid=1000(shell) groups=1003(graphics),1004(input),1007(log),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet)
uid=0(root) is important.

To get a root-shell more easily next time, we have to make su work.

Take this su binary and push it in your tatto:
adb push su /data/local/bin/su
Remount /data without the nosuid-option
# mount -o rw,remount /dev/block/mtdblock3 /data
Change the owner to root and set the suid-bit
# chown root.root /data/local/bin/su
# chmod 4755 /data/local/bin/su

Now you don't have to run the exploit again, just open a normal shell and run
$ /data/local/bin/su
Now you should be root!
Attention: If you reboot your phone, you have to run the exploit and the mount command again because /data will be mounted nosuid again!

Thats it!

Some suggestions for going on. When you run mount, you will see that some partitions are mounted read-only and/or with the nosuid-option. You can change this by running:
mount -o rw,remount /dev/block/mtdblockYOUWANT /DIRtoREMOUNT
Other developer stuff
Here I will list all other thinks, more dangerous and not with all steps described in detail because you should know how to do this if you want to :)

New: Make /system writeable
This is a dangerous part, it might break you system forever unless you don't know what you are doing! Don't try it unless you are a dev! That is the reason why the steps you have to do are not described in a more detailed way. If you don't know what to type in, you shouldn't try this hack!

Download Attachment 286072
1. Copy tattoo-hack.ko from the zip to /data/local/bin
2. # insmod /data/local/bin/tattoo-hack.ko
3. Remount system partition to be writeable

Now you can do everything with /system until you reboot. /system is the only partition that is mounted without nosuid after reboot, so copy su over to /system/bin/ to keep root permanently. To be able to use programs like setcpu you have to replace /system/bin/su with this su:
Attachment 286154

Flashing a custom recovery image
This is in alpha-state but we are able to flash custom recovery images what is the determining step to flashing custom roms. Don't ask how to flash android 2.x (we didn't do it right now) or when it will be ready. It will bes sometimes...

Have a lot of fun!
Last edited by -bm-; 1st March 2010 at 06:38 AM.
20th February 2010, 01:32 PM   |  #2  
Junior Member
Thanks Meter: 0
12 posts
Join Date:Joined: Feb 2010
BTW.. In order for /data/local/bin to exist it's probably best you do the busybox install to there first.. also the busybox commands are very handy.
20th February 2010, 01:33 PM   |  #3  
HTCDevil's Avatar
Senior Member
Flag Caserta
Thanks Meter: 44
782 posts
Join Date:Joined: Mar 2009
Great - bm - thank you very much
20th February 2010, 01:34 PM   |  #4  
zipredictive's Avatar
Senior Member
Flag Milan
Thanks Meter: 75
470 posts
Join Date:Joined: May 2007
Originally Posted by -bm-


This is a great day, it's really amazing how people could work together searching the good way to root this awesome little phone. Just to say I've really appreciated your work... I followed all you guys day by day... Thank you everyone, sorry for the OT.
Anyway... risks of bricks?
20th February 2010, 01:35 PM   |  #5  
OP Member
Thanks Meter: 0
75 posts
Join Date:Joined: Jun 2005
Originally Posted by elvisior

BTW.. In order for /data/local/bin to exist it's probably best you do the busybox install to there first.. also the busybox commands are very handy.

Youre right, busybox makes further development more handy. But I think it isn't needed for /data/local/bin to exist, because for me it was there and I've got no busybox on my tattoo :)
20th February 2010, 02:48 PM   |  #6  
Thanks Meter: 0
n/a posts

chdir /data/local/bin

instead of


chdir to /data/local/bin

20th February 2010, 03:19 PM   |  #7  
svprm's Avatar
Senior Member
Flag Coimbatore
Thanks Meter: 399
1,349 posts
Join Date:Joined: Dec 2007
Donate to Me
Thanks Man.
Nice team work.
20th February 2010, 03:24 PM   |  #8  
zoko's Avatar
Senior Member
Flag Lisbon
Thanks Meter: 1
354 posts
Join Date:Joined: Aug 2007
stupid noobie question how Push m6 to your Tattoo using adb! can anyone possible make a noobie tutorial?!
20th February 2010, 03:26 PM   |  #9  
Thanks Meter: 0
n/a posts
@zoko : Use your favorite linux distribution.
20th February 2010, 03:34 PM   |  #10  
Thanks Meter: 0
76 posts
Join Date:Joined: Dec 2009
please can you help me?when I do .m6 in shell i get
[ Overwritten 0xb0000100
but no #, any help for me?

Post Reply Subscribe to Thread

exploit, root, rooting, status, tattoo
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes