T-Mobile HTC One M8 Gets Selfie-Friendly Android 4.4.4 OTA

The T-Mobie variant of HTC One (M8) just now received an over-the-air update … more

Android L is for Lockdown

Root is, without a doubt, the (un)holy grail of the Android world. Those wonderful permissions that allow you as … more

XDA Xposed Tuesday: XHangouts Will Improve Your Hangouts

Ever since Google started supporting text messaging in Hangouts many people have … more

Shattered Screen? Turn Your Broken Device into a Complete Media Center!

A cracked screen usually means you’ll have to spend a hefty … more
Post Reply

Rooting the Tattoo(its done!) - what we have got so far

OP -bm-

20th February 2010, 01:24 PM   |  #1  
OP Member
Thanks Meter: 0
 
75 posts
Join Date:Joined: Jun 2005
More
Finally the race is over and some brave devs managed to get root on the tattoo and some were able to reproduce it on their own devices already. But notice: We are in an early stage of development. There is no one-klick-get-root app at the moment and there is still much work to be done until we get custom roms.
I will try to keep track of the ongoing development and update this post periodically. I've you find a mistake or get something new, let us know but we can't give support to every linux-nob at this point of development!
At the moment beeing root on the tattoo does NOT enable you to use the usual applications like Wifi Tethering that need root out of the box. You are also unable to write to /system by default. Now there is a new hack to make /system writable (look at the bottom of this post)

Status
Last update: 26.02.2010 - 12:55 MEZ


Rooting
The tattoo was successfully rooted the first time on 19.02.2010 ( http://forum.xda-developers.com/show...7&postcount=93 ). It was reproduced by some other users already, there is some work to be done make the exploit work more easily.
Because it has been asked many times: If there will ever be an OFFICIAL update with android 2.1 by HTC for the Tattoo (nobody knows definitively), this root-exploit will NOT work! You will lose root then!

It was done by porting this exploit http://www.milw0rm.com/exploits/8678 to the arm plattform and the tattoo. It uses a security hole in kernel 2.6.29 that wasn't patched in tattoos kernel. All began here on 10.2.2010 (the first post doesn't has to do anything with this): http://forum.xda-developers.com/showthread.php?t=631540
Kudos to zanfur, bftb0, mainfram3, HT123 and others (sorry if I forgot an important one).
The exploit was tweaked to deliver root more reliable.


Flashing custom roms
To develop custom roms won't be the problem, but the tattoo has got some extra security mechanisms that don't make it trivial to flash a new rom even now we have root. There is work going on to solve this.


Howto get root-privileges
I think it is save to follow but this is done at your own risk. Don't blame me if you Tattoo explodes, eats your hamster or make your girlfriend leave you.
Remember: We're in an early state of development, this is no Klick-an-Run-app, linux knowledge is needed.
Newbis on Windows should follow this howto made by Coburn64, its much easier than this one: http://forum.xda-developers.com/showthread.php?t=637927

Download this to your PC and unzip: Attachment 285070
(the older release was called m6 and can be found here: r00t.zip)
m7 is the binary. Push m7 to your Tattoo using adb:
Code:
adb push m7 /data/local/bin/m7
adb chmod 755 /data/local/bin/m7
Start a shell:
Code:
adb shell
Start the exploit in the shell:
Code:
cd /data/local/bin
while `true` ; do /data/local/bin/m7; done
The new m7 is an improved version of the old m6, it now should bring you root much more reliable.
With the old m6 while it is running, bring up and close random apps via task manager on the tattoo. This might not be necessary with m7. After a while the exploit should report success and come up with a root-shell. The promt should change from
Code:
$
to
Code:
#
Sometime the exploit stopps but no shell ('#') comes up. Just terminate it with ^C and try again.

You did it, you should be root now!
Let's set some variables:
Code:
export LD_LIBRARY_PATH=/system/lib
export PATH=/system/bin
When you got your shell, check if you are really root:
Code:
id
You should get something like this:
Code:
# id
uid=0(root) gid=1000(shell) groups=1003(graphics),1004(input),1007(log),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet)
uid=0(root) is important.

To get a root-shell more easily next time, we have to make su work.

Take this su binary and push it in your tatto: http://www.fileuploadx.de/45656
Code:
adb push su /data/local/bin/su
Remount /data without the nosuid-option
Code:
# mount -o rw,remount /dev/block/mtdblock3 /data
Change the owner to root and set the suid-bit
Code:
# chown root.root /data/local/bin/su
# chmod 4755 /data/local/bin/su

Now you don't have to run the exploit again, just open a normal shell and run
Code:
$ /data/local/bin/su
Now you should be root!
Attention: If you reboot your phone, you have to run the exploit and the mount command again because /data will be mounted nosuid again!

Thats it!

Some suggestions for going on. When you run mount, you will see that some partitions are mounted read-only and/or with the nosuid-option. You can change this by running:
Code:
mount -o rw,remount /dev/block/mtdblockYOUWANT /DIRtoREMOUNT
Other developer stuff
Here I will list all other thinks, more dangerous and not with all steps described in detail because you should know how to do this if you want to :)

New: Make /system writeable
This is a dangerous part, it might break you system forever unless you don't know what you are doing! Don't try it unless you are a dev! That is the reason why the steps you have to do are not described in a more detailed way. If you don't know what to type in, you shouldn't try this hack!

Download Attachment 286072
1. Copy tattoo-hack.ko from the zip to /data/local/bin
2. # insmod /data/local/bin/tattoo-hack.ko
3. Remount system partition to be writeable

Now you can do everything with /system until you reboot. /system is the only partition that is mounted without nosuid after reboot, so copy su over to /system/bin/ to keep root permanently. To be able to use programs like setcpu you have to replace /system/bin/su with this su:
Attachment 286154


Flashing a custom recovery image
This is in alpha-state but we are able to flash custom recovery images what is the determining step to flashing custom roms. Don't ask how to flash android 2.x (we didn't do it right now) or when it will be ready. It will bes sometimes...
http://forum.xda-developers.com/showthread.php?t=639486


Have a lot of fun!
-bm-
Last edited by -bm-; 1st March 2010 at 06:38 AM.
20th February 2010, 01:32 PM   |  #2  
Junior Member
Thanks Meter: 0
 
12 posts
Join Date:Joined: Feb 2010
BTW.. In order for /data/local/bin to exist it's probably best you do the busybox install to there first.. also the busybox commands are very handy.
20th February 2010, 01:33 PM   |  #3  
HTCDevil's Avatar
Senior Member
Flag Caserta
Thanks Meter: 44
 
782 posts
Join Date:Joined: Mar 2009
More
Great - bm - thank you very much
20th February 2010, 01:34 PM   |  #4  
zipredictive's Avatar
Senior Member
Flag Milan
Thanks Meter: 75
 
459 posts
Join Date:Joined: May 2007
More
Quote:
Originally Posted by -bm-

-bm-

This is a great day, it's really amazing how people could work together searching the good way to root this awesome little phone. Just to say I've really appreciated your work... I followed all you guys day by day... Thank you everyone, sorry for the OT.
Anyway... risks of bricks?
20th February 2010, 01:35 PM   |  #5  
OP Member
Thanks Meter: 0
 
75 posts
Join Date:Joined: Jun 2005
More
Quote:
Originally Posted by elvisior

BTW.. In order for /data/local/bin to exist it's probably best you do the busybox install to there first.. also the busybox commands are very handy.

Youre right, busybox makes further development more handy. But I think it isn't needed for /data/local/bin to exist, because for me it was there and I've got no busybox on my tattoo :)
ApotheoZ
20th February 2010, 02:48 PM   |  #6  
Guest
Thanks Meter: 0
 
n/a posts
Quote:

chdir /data/local/bin

instead of

Quote:

chdir to /data/local/bin

20th February 2010, 03:19 PM   |  #7  
svprm's Avatar
Senior Member
Flag Salem-TamilNadu
Thanks Meter: 374
 
1,280 posts
Join Date:Joined: Dec 2007
Donate to Me
More
Thanks Man.
Nice team work.
20th February 2010, 03:24 PM   |  #8  
zoko's Avatar
Senior Member
Flag Lisbon
Thanks Meter: 1
 
354 posts
Join Date:Joined: Aug 2007
More
stupid noobie question how Push m6 to your Tattoo using adb! can anyone possible make a noobie tutorial?!
ApotheoZ
20th February 2010, 03:26 PM   |  #9  
Guest
Thanks Meter: 0
 
n/a posts
@zoko : Use your favorite linux distribution.
20th February 2010, 03:34 PM   |  #10  
Member
Thanks Meter: 0
 
76 posts
Join Date:Joined: Dec 2009
please can you help me?when I do .m6 in shell i get
Code:
[ Overwritten 0xb0000100
but no #, any help for me?

Post Reply Subscribe to Thread

Tags
exploit, root, rooting, status, tattoo
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes