Attend XDA's Second Annual Developer Conference, XDA:DevCon 2014!
5,739,536 Members 53,198 Now Online
XDA Developers Android and Mobile Development Forum

Rooting the Tattoo(its done!) - what we have got so far

Tip us?
 
-bm-
Old
(Last edited by -bm-; 1st March 2010 at 06:38 AM.)
#1  
Member - OP
Thanks Meter 0
Posts: 75
Join Date: Jun 2005
Default Rooting the Tattoo(its done!) - what we have got so far

Finally the race is over and some brave devs managed to get root on the tattoo and some were able to reproduce it on their own devices already. But notice: We are in an early stage of development. There is no one-klick-get-root app at the moment and there is still much work to be done until we get custom roms.
I will try to keep track of the ongoing development and update this post periodically. I've you find a mistake or get something new, let us know but we can't give support to every linux-nob at this point of development!
At the moment beeing root on the tattoo does NOT enable you to use the usual applications like Wifi Tethering that need root out of the box. You are also unable to write to /system by default. Now there is a new hack to make /system writable (look at the bottom of this post)

Status
Last update: 26.02.2010 - 12:55 MEZ


Rooting
The tattoo was successfully rooted the first time on 19.02.2010 ( http://forum.xda-developers.com/show...7&postcount=93 ). It was reproduced by some other users already, there is some work to be done make the exploit work more easily.
Because it has been asked many times: If there will ever be an OFFICIAL update with android 2.1 by HTC for the Tattoo (nobody knows definitively), this root-exploit will NOT work! You will lose root then!

It was done by porting this exploit http://www.milw0rm.com/exploits/8678 to the arm plattform and the tattoo. It uses a security hole in kernel 2.6.29 that wasn't patched in tattoos kernel. All began here on 10.2.2010 (the first post doesn't has to do anything with this): http://forum.xda-developers.com/showthread.php?t=631540
Kudos to zanfur, bftb0, mainfram3, HT123 and others (sorry if I forgot an important one).
The exploit was tweaked to deliver root more reliable.


Flashing custom roms
To develop custom roms won't be the problem, but the tattoo has got some extra security mechanisms that don't make it trivial to flash a new rom even now we have root. There is work going on to solve this.


Howto get root-privileges
I think it is save to follow but this is done at your own risk. Don't blame me if you Tattoo explodes, eats your hamster or make your girlfriend leave you.
Remember: We're in an early state of development, this is no Klick-an-Run-app, linux knowledge is needed.
Newbis on Windows should follow this howto made by Coburn64, its much easier than this one: http://forum.xda-developers.com/showthread.php?t=637927

Download this to your PC and unzip: Attachment 285070
(the older release was called m6 and can be found here: r00t.zip)
m7 is the binary. Push m7 to your Tattoo using adb:
Code:
Select Code
adb push m7 /data/local/bin/m7
adb chmod 755 /data/local/bin/m7
Start a shell:
Code:
Select Code
adb shell
Start the exploit in the shell:
Code:
Select Code
cd /data/local/bin
while `true` ; do /data/local/bin/m7; done
The new m7 is an improved version of the old m6, it now should bring you root much more reliable.
With the old m6 while it is running, bring up and close random apps via task manager on the tattoo. This might not be necessary with m7. After a while the exploit should report success and come up with a root-shell. The promt should change from
Code:
Select Code
$
to
Code:
Select Code
#
Sometime the exploit stopps but no shell ('#') comes up. Just terminate it with ^C and try again.

You did it, you should be root now!
Let's set some variables:
Code:
Select Code
export LD_LIBRARY_PATH=/system/lib
export PATH=/system/bin
When you got your shell, check if you are really root:
Code:
Select Code
id
You should get something like this:
Code:
Select Code
# id
uid=0(root) gid=1000(shell) groups=1003(graphics),1004(input),1007(log),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet)
uid=0(root) is important.

To get a root-shell more easily next time, we have to make su work.

Take this su binary and push it in your tatto: http://www.fileuploadx.de/45656
Code:
Select Code
adb push su /data/local/bin/su
Remount /data without the nosuid-option
Code:
Select Code
# mount -o rw,remount /dev/block/mtdblock3 /data
Change the owner to root and set the suid-bit
Code:
Select Code
# chown root.root /data/local/bin/su
# chmod 4755 /data/local/bin/su

Now you don't have to run the exploit again, just open a normal shell and run
Code:
Select Code
$ /data/local/bin/su
Now you should be root!
Attention: If you reboot your phone, you have to run the exploit and the mount command again because /data will be mounted nosuid again!

Thats it!

Some suggestions for going on. When you run mount, you will see that some partitions are mounted read-only and/or with the nosuid-option. You can change this by running:
Code:
Select Code
mount -o rw,remount /dev/block/mtdblockYOUWANT /DIRtoREMOUNT
Other developer stuff
Here I will list all other thinks, more dangerous and not with all steps described in detail because you should know how to do this if you want to :)

New: Make /system writeable
This is a dangerous part, it might break you system forever unless you don't know what you are doing! Don't try it unless you are a dev! That is the reason why the steps you have to do are not described in a more detailed way. If you don't know what to type in, you shouldn't try this hack!

Download Attachment 286072
1. Copy tattoo-hack.ko from the zip to /data/local/bin
2. # insmod /data/local/bin/tattoo-hack.ko
3. Remount system partition to be writeable

Now you can do everything with /system until you reboot. /system is the only partition that is mounted without nosuid after reboot, so copy su over to /system/bin/ to keep root permanently. To be able to use programs like setcpu you have to replace /system/bin/su with this su:
Attachment 286154


Flashing a custom recovery image
This is in alpha-state but we are able to flash custom recovery images what is the determining step to flashing custom roms. Don't ask how to flash android 2.x (we didn't do it right now) or when it will be ready. It will bes sometimes...
http://forum.xda-developers.com/showthread.php?t=639486


Have a lot of fun!
-bm-
 
elvisior
Old
#2  
Junior Member
Thanks Meter 0
Posts: 12
Join Date: Feb 2010
BTW.. In order for /data/local/bin to exist it's probably best you do the busybox install to there first.. also the busybox commands are very handy.
 
HTCDevil
Old
#3  
HTCDevil's Avatar
Senior Member
Thanks Meter 43
Posts: 782
Join Date: Mar 2009
Location: Caserta
Great - bm - thank you very much
LG G2
Rom: Stock 4.4.2 Italy
-------------
Nexus 7 (2012)
Rom: CM 11 Nightly
Kernel: M Kernel a67
 
zipredictive
Old
#4  
zipredictive's Avatar
Senior Member
Thanks Meter 74
Posts: 458
Join Date: May 2007
Location: Milan
Quote:
Originally Posted by -bm- View Post
-bm-
This is a great day, it's really amazing how people could work together searching the good way to root this awesome little phone. Just to say I've really appreciated your work... I followed all you guys day by day... Thank you everyone, sorry for the OT.
Anyway... risks of bricks?
HTC Tattoo > Nexus One > Nexus S > Galaxy Nexus
 
-bm-
Old
#5  
Member - OP
Thanks Meter 0
Posts: 75
Join Date: Jun 2005
Quote:
Originally Posted by elvisior View Post
BTW.. In order for /data/local/bin to exist it's probably best you do the busybox install to there first.. also the busybox commands are very handy.
Youre right, busybox makes further development more handy. But I think it isn't needed for /data/local/bin to exist, because for me it was there and I've got no busybox on my tattoo :)
ApotheoZ Old
#6  
Guest
Thanks Meter
Posts: n/a
Quote:
chdir /data/local/bin
instead of

Quote:
chdir to /data/local/bin
 
svprm
Old
#7  
svprm's Avatar
Senior Member
Thanks Meter 371
Posts: 1,274
Join Date: Dec 2007
Location: Salem-TamilNadu

 
DONATE TO ME
Thanks Man.
Nice team work.
If you like my works,please hit Thanks.

Mine:HTC One M7
Custom Rom

Dad: LG L90 Dual
Try my other works:
My Works:


My Other Android works at:www.CyBApps.com

Old:HTC Touch,HTC Tattoo,Xerpia Mini pro,Xperia X10i and HTC Desire,Xperia Neo V,Galaxy Nexus (Bricked) , Xolo Q700
 
zoko
Old
#8  
zoko's Avatar
Senior Member
Thanks Meter 1
Posts: 354
Join Date: Aug 2007
Location: Lisbon
stupid noobie question how Push m6 to your Tattoo using adb! can anyone possible make a noobie tutorial?!
ApotheoZ Old
#9  
Guest
Thanks Meter
Posts: n/a
@zoko : Use your favorite linux distribution.
 
chusen
Old
#10  
Member
Thanks Meter 0
Posts: 76
Join Date: Dec 2009
please can you help me?when I do .m6 in shell i get
Code:
Select Code
[ Overwritten 0xb0000100
but no #, any help for me?

Tags
exploit, root, rooting, status, tattoo
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes


XDA PORTAL POSTS

Return to Outer Space Outer Space with Ship Up Game

Since the release of Flappy Birds, we’ve had the “fortune” to see … more

Device Review: OnePlus One

Seemingly every day, there are a bunch of new devices being released. Some are budget devices and some are … more

Browse the Internet with the Innovative Atlas Web Browser

For the most part, Chrome, Firefox, and Dolphin Browser have no real rivals among … more

Choose from Over a Thousand Battery Styles with 3Minit Battery Mod

The battery style in stock Android looks pretty dull. It doesn’t … more