[Q] Root method discovered for NEC Terrain?

Search This thread

jasonmerc

Senior Member
Dec 14, 2012
1,875
942
www.ixquick.com
So I saw network unlocked NEC Terrain up on Amazon for about $85 or so, and I was thinking of getting one. However, the fact that root permissions haven't been obtained on this phone is really what is holding me back from purchasing it, and the last time I checked, the devs still have not found a PERMANENT root method for it...

I saw an app called Towelroot by geohot that can (maybe) not only root the Galaxy S5, but ANY recent Android phone, AS LONG AS it does not have 3.4.0 kernel or newer (at least that's what the article said regarding the Note 3 anyway).

Since I do not have the Terrain, I can't test this towelroot app to see if it works. So I was wondering if anyone out there with a Terrain would be willing to test this out to see if it works,and then report back the results. This device came out last year, and has not had software updates since October of 2013 because NEC doesn't want to do Androids anymore, so I am going to assume it does not have the 3.4.0 kernel. So maybe, just maybe, it will work. And who knows, if by some chance it does work, that could even lead to greater things being done with this device...

EDIT: I just read an article from ATT regarding the software on the Terrain on what I think is the latest firmware update. It said the kernel version was 3.0.8. I probably shouldn't, but I'm getting my hopes up. I kinda want this phone :)

http://www.att.com/esupport/article.jsp?sid=KB421350&cv=820#fbid=ex0inqn4h0e

Sent from my MB855 from the free version of xda app because cheap
 
Last edited:

FFDA

Senior Member
Aug 24, 2014
60
24
It does not work

Hello,

Towelroot doesn't work on NEC Terrain. I've tried it with different configurations. I've also tried: labda root, poot, framaroot, z4root, vroot, baidu root, saferoot. Moreover I've tried manually root phone using this guide, tried dd modified boot.img, but that didn't stick and after reboot there wasn't any changes.

Problem is that one can't remount /system partition to rw. It just says “invalid argument”. Furthermore there is not any fastboot support (locked out I guess).

I can get temp root using method discribed by justDave, remount / and /data (maybe others partitions too, nether tried) partitions, mount ././tmp/xbin (with busybox and su in it) over /system/xbin, but that doesn't get me anywhere.

I'm thinking about dd custom recovery, but I need to read on it thirst. If you have any suggestions or other rooting methonds, manual rooting guides etc., please post them here and I will try them if my knowledge lets me.

Off topic: NEC closed their mobile devision. Just google “NEC Pulls the Plug on Smartphones” (I can't post links form outside). So there isn't any good news for peaple with NEC Terrain.
 
  • Like
Reactions: 0x29a

jasonmerc

Senior Member
Dec 14, 2012
1,875
942
www.ixquick.com
Well that sucks, towelroot was pretty much my only suggestion. I'll look into others. But just as a heads up, I don't think I'll be buying one anymore, so I won't be taking a LOT of time to research root methods.

And yes, I am aware that NEC stopped with smartphones. I assume that is why they are so cheap on Amazon?

Edit: bin4ry universal root for 4.0/4.1: http://m.ibtimes.co.uk/root-android-smartphone-tablet-universal-tool-install-385487 Chances are low that this will actually work, but I posted it anyway.

Sent from my MB855 using XDA Free mobile app
 
Last edited:

FFDA

Senior Member
Aug 24, 2014
60
24
Yeah... no.

Personally I don't think you should buy it if there isn't permanent root method and I don't think there will be any. NEC Terrain isn't popular so nobody with know-how will join the effort to root it. Also at least my phone has problems with battery (from the moment I got it). It holds charge for 8 hours max. "Wakelock Detector" says it's always awake. Something with suspend_backoff, but because I can't uninstall bloatware I can't find out which app actually causes it. Furthermore without the root one can't turn off "Fast Dormancy", which in my country drains battery. At this point I'm not afraid to hard brick it or nailed it to the wall, because without the root it is good as paperweight for me.

bin4ry universal root for 4.0/4.1 don't worked either. When I ran RunMe.sh (I'm on linux) nothing happens. Script is using commands like "am start -a android.intent.action.MAIN -n com.sonyericsson.android.servicemenu/.ServiceMainMenu" and moving folders which phone doesn't have.
 

jasonmerc

Senior Member
Dec 14, 2012
1,875
942
www.ixquick.com
Personally I don't think you should buy it if there isn't permanent root method and I don't think there will be any. NEC Terrain isn't popular so nobody with know-how will join the effort to root it. Also at least my phone has problems with battery (from the moment I got it). It holds charge for 8 hours max. "Wakelock Detector" says it's always awake. Something with suspend_backoff, but because I can't uninstall bloatware I can't find out which app actually causes it. Furthermore without the root one can't turn off "Fast Dormancy", which in my country drains battery. At this point I'm not afraid to hard brick it or nailed it to the wall, because without the root it is good as paperweight for me.

bin4ry universal root for 4.0/4.1 don't worked either. When I ran RunMe.sh (I'm on linux) nothing happens. Script is using commands like "am start -a android.intent.action.MAIN -n com.sonyericsson.android.servicemenu/.ServiceMainMenu" and moving folders which phone doesn't have.

Yeah, I don't think I'm going to buy it anymore. I mean, that $80 price tag on Amazon looks good, but if no one can even get it ROOTED, then even for that price it's not worth it. I've been looking at another cheap, rugged phone to get, the Kyocera Hydro Life which is $125 at Wal-Mart for T-Mobile. At least that phone has a root method.

But maybe one day, if I see a Terrain for like $40 or something ridiculously cheap like that on an online store, I'll pick one up. Yes, smartphones can get that cheap. I saw a Motorola Bravo (not a bad phone, I have one myself with a 4.4.4 ROM) for $40 new on eBay.

But anyway, if I find a new root method, I'll be sure to post it here. Chances are really slim for anything actualy working, but hey, it's worth a try.
 

jasonmerc

Senior Member
Dec 14, 2012
1,875
942
www.ixquick.com
*BUMP* *BIG NEWS*

Just spoke with the very generous Kemonine96, a developer who I came to know through his work on the Rugby Smart. What started out as a half-sarcastic post made by me regarding Towelroot and the Terrain turned into what looks like a solution to this device's root issues! He thinks he has a solution to finally root this Terrain. And I believe him, because it sounds like he knows what he is talking about. Here are his exact words regarding some of my questions:

You're welcome to borrow my work. All I'd ask is a note that it was adapted from the work done on the Rugby Pro.

He ran into a similar problem with the Galaxy Rugby where the /system would not mount as read/write. He made a root update.zip that fixed this issue. We are welcome to use it/modify it for the Terrain. But BE SURE TO GIVE HIM CREDIT IF YOU RELEASE SOMETHING BASED ON HIS ROOT.ZIP!!!! Please continue reading for more information:

As for using it outright on the terrain: you likely need to adjust it some. Each device varies some and you'll need to hunt down the exact details. Fortunately the d2 familiy are all very similar so modifications should be minimal if necessary. I'd start by trying it and going from there.


You can use the following root (see OP root instructions). Dig through the update script and look for the file I'm renaming. You'll likely need something similar for the terrain. I developed this by gaining temporary root, unpacking an image I took of the boot partition and walking through the init scripts to see if they were calling anything "interesting" on /system. Managed to track down the file that was paving root/custom recovery. Once I knew the file I setup the update.zip to move the file out of the way so the call to it during boot would fail.

https://nuskunetworks.box.com/s/f1h6murg79lcoavvg0fk


The update.zip root stuff I've published requires a custom recovery to be available. The current "best way" prior to towel root was to flash a custom recovery with ODIN, immediately boot into recovery after the ODIN flash, applying the root update.zip and then booting into system. I came up with the exact procedure after much trial, error and chasing down ghosts.


If you have temporary root I'd do something similar to the following for permanent root
  1. Setup busybox somewhere (/data maybe?) and use dd from it to copy off the whole emmc to an external sd card (use OTG + usb key if necessary). Do a full dd of the emmc disk under /dev and do a full dd of each partition under /dev
  2. Start going through the partition images (BACKUPS are important here) using loopback mounts (or similar) and see where everything is at
  3. Create a rough partition map (/dev/emmc0p1 maps to boot, /dev/emmc0p12 maps to recovery, etc [note these are contrived examples, look at the Rugby Pro stuff I've published for a starting point] -- This is a huge help to get others invovled and so you can figure out what is where quickly.
  4. Once you find recovery/boot/system start looking for ways to adjust to get a developer version permanent root. It doesn't have to be pretty, It just needs to work to aid development along. The initial root method for the Rugby Pro was devloped by using a temp root to pull the boot partition, slip permanent root into the boot image, re-flash the updated boot image using dd. Once I had this I was able to start work on custom recovery and a saner root method.
  5. Once you find a permanent root that can be used by developer types start looking at a proper custom recovery and get TWRP/CWM working
  6. Ensure custom recovery (TWRP is a win all around at this point) is 100% and figure out if it's ever blown away during boot by some goofy script in /system (test by flashing custom recovery, booting it, rebooting into normal android, reboot back into recovery)
  7. Get custom recovery mostly situated and work on an update.zip that sets up permanent root in a way that can be used by others easily (see my update.zip as a starting point)
  8. Release custom recovery image, update.zip root and good instructions

This could be it. Thanks, Kemonine96. Thanks for not only this, but for your Rugby work as well ;)

EDIT: To see the whole conversation, or in case I am leaving out information, please visit the Samsung Galaxy Rugby Pro Super Thread and go to the latest post. It should be somewhere around there.

Sent from my MB855 using XDA Free mobile app
 
Last edited:

kemonine96

Inactive Recognized Developer
Jan 27, 2011
1,349
1,288
Michigan
You may also want to look at the root methods for other msm8960 and msm8660 devices. HTC, Sony and Samsung all used the platform prior to JB and there may be other examples floating around.

The Terrain was late to the party compared to some so it'll likely be trickier.
 

jasonmerc

Senior Member
Dec 14, 2012
1,875
942
www.ixquick.com
You may also want to look at the root methods for other msm8960 and msm8660 devices. HTC, Sony and Samsung all used the platform prior to JB and there may be other examples floating around.

The Terrain was late to the party compared to some so it'll likely be trickier.

Since NEC gave up on smartphones after they made the Terrain, I doubt we will be getting any official drivers/kernels or anything of the sort from them.

Sent from my MB855 using XDA Free mobile app
 

kemonine96

Inactive Recognized Developer
Jan 27, 2011
1,349
1,288
Michigan
Since NEC gave up on smartphones after they made the Terrain, I doubt we will be getting any official drivers/kernels or anything of the sort from them.

Sent from my MB855 using XDA Free mobile app
As long as you can get the 3.0 kernel (it's GPL after all) you should be able to get newer releases going. It'll be a pita, but it's doable if you've got a starting point.

The real pain will likely be the keyboard / screen drivers since they are non standard compared to other devices.
 

jasonmerc

Senior Member
Dec 14, 2012
1,875
942
www.ixquick.com
As long as you can get the 3.0 kernel (it's GPL after all) you should be able to get newer releases going. It'll be a pita, but it's doable if you've got a starting point.

I'd LOVE to be able to do these things myself, but alas, I am but a script kiddie as of now. I will begin my Android-modding studies as of now. Give me about 100 years and I should be good to go!

Sent from my MB855 using XDA Free mobile app
 

kemonine96

Inactive Recognized Developer
Jan 27, 2011
1,349
1,288
Michigan
I'd LOVE to be able to do these things myself, but alas, I am but a script kiddie as of now. I will begin my Android-modding studies as of now. Give me about 100 years and I should be good to go!

Sent from my MB855 using XDA Free mobile app
Guess where we all started, including myself?

The key is to keep smashing your face on your desk till you get through. ;)
 

FFDA

Senior Member
Aug 24, 2014
60
24
Best way to proceed

If you have temporary root I'd do something similar to the following for permanent root

Setup busybox somewhere (/data maybe?) and use dd from it to copy off the whole emmc to an external sd card (use OTG + usb key if necessary). Do a full dd of the emmc disk under /dev and do a full dd of each partition under /dev
Start going through the partition images (BACKUPS are important here) using loopback mounts (or similar) and see where everything is at
Gaining temp shell root and setting up busybox isn't a problem, we already have that (again thanks to justDave). I have almost all partitions as *.img files (one was too big for sdcard file system). Tomorrow I plan to buy an OTG cable and get the last one. But it is impossible to mount most of the partitions. I'm thinking that like boot image, one must to "unzip" other partitions with special program to look inside. Anyone has any advice on this?

Create a rough partition map (/dev/emmc0p1 maps to boot, /dev/emmc0p12 maps to recovery, etc [note these are contrived examples, look at the Rugby Pro stuff I've published for a starting point] -- This is a huge help to get others invovled and so you can figure out what is where quickly.
Partition maps already in [DEV][REF]El Grande Partition Table Reference thread. I think there is enough information there or I had missed something?

Once you find recovery/boot/system start looking for ways to adjust to get a developer version permanent root. It doesn't have to be pretty, It just needs to work to aid development along. The initial root method for the Rugby Pro was devloped by using a temp root to pull the boot partition, slip permanent root into the boot image, re-flash the updated boot image using dd. Once I had this I was able to start work on custom recovery and a saner root method.

This is where my problems begins. I don't know what exactly change in boot to gain a root. I tried the simplest thing, that is changing ro.secure=1 to ro.secure=0 but that didn't stick. Maybe I did something wrong (used two different methods to create boot.img files. One image was made with mkbootimg another with abootimg), but at least other two people (aluminumx & MrMEEE) tried dd their custom boot.img without any luck. Maybe I should try dd custom recovery first? Or boot.img the way to go?

Just as reminder I want to say that there is not any fastboot support.
Can someone tell me what I should focus on? boot.img or recovery mode?
 

swordguy8

Member
Aug 21, 2014
14
2
You could try it again. Just remember that ro.secure exists in multiple places. default.prop, and some inits as far as I remember. I'll check later on and repost. Had you tried to change all of them? I've also read that the image being written has to be the same size as the image being overwritten. I don't know if that's relevant for this though.
 

aluminumx

Senior Member
Mar 20, 2008
50
11
I can definitely give kemonie's suggestion a try. However, I am still not confident that we can get permanent root without unlocking/bypassing the nand lock first. I was able to identify the boot and recovery partitions relatively easily, and dd their contents out post no problem as well. Dd a new image back on was the problem... for testing purpose, using the stock boot image as base, I just added a zero length file to the folder, wrap it back up, and dd it back to boot, the file never made it thru even though dd didn't give any error. Which prompted me to think the nand was locked. So the other way of patching the boot partition would be applying an update.zip file in recovery mode, but we need a code as well, see screen shots. And yeah, no fastboot mode neither. It's very frustrating to hit all possible road blocks there can ever be to root this thing. But I do believe that the key lies in my terrain though, because reading from everyone who has posted so far, mine seems to be the only one that is confirmed unlocked. So yeah, if we can get some expert hackers to help in this effort, I wouldn't mind donating my time or even my phone to help.

1410379989917.jpg1410380012256.jpg1410380034566.jpg

Sent from my SGH-I547C using XDA Free mobile app
 

laserdrome

Member
Aug 19, 2007
19
0
But I do believe that the key lies in my terrain though, because reading from everyone who has posted so far, mine seems to be the only one that is confirmed unlocked.

What do you mean by that? In case you bought your phone from cellforce on eBay, I doubt your phone is special in any way. Some weeks ago in the light of discussions going on here I asked the seller how he unlocks the phone, whether he tampers with the software or if he just enters unlock codes. He claims he just uses unlock-codes. If that is true then your terrain should not be special, right?
 

aluminumx

Senior Member
Mar 20, 2008
50
11
What do you mean by that? In case you bought your phone from cellforce on eBay, I doubt your phone is special in any way. Some weeks ago in the light of discussions going on here I asked the seller how he unlocks the phone, whether he tampers with the software or if he just enters unlock codes. He claims he just uses unlock-codes. If that is true then your terrain should not be special, right?

hmmm, if that is truly the case, i.e, the seller just entered the code to unlock mine before he sold it, then yeah, mine won't be any special. However, from talking to the multiple other dealers, AT&T support and also NEC support, the unlock codes are not available for this phone at all, which would mean my seller got his batch already unlocked. I could be wrong though since I have talked to them almost a year ago and it maybe true that AT&T or NEC has released the code database. Anyway, the fact is that I haven't been able to find another owner on these forums who has their Terrain unlocked. The hope is that if we can successfully get it permanent root, then we can compare files and settings between the locked and unlocked ones. I do wish you good luck getting the code though, that would definitely be good news for a few people here :)
 
Last edited:

timekiller_9

Member
Nov 9, 2013
40
7
I have both a locked and unlocked NEC Terrain. And, if it were to be helpful, in the box of the unlocked one was a little slip of paper that says "CODE" and has a number on it. The phone was unlocked when I received it, so I can't confirm that the code on the paper is the unlock code for the phone.

I'd be happy to pull whatever files would be helpful from either device and post them. Give me a process and I'll get what you need.

hmmm, if that is truly the case, i.e, the seller just entered the code to unlock mine before he sold it, then yeah, mine won't be any special. However, from talking to the multiple other dealers, AT&T support and also NEC support, the unlock codes are not available for this phone at all, which would mean my seller got his batch already unlocked. I could be wrong though since I have talked to them almost a year ago and it maybe true that AT&T or NEC has released the code database. Anyway, the fact is that I haven't been able to find another owner on these forums who has their Terrain unlocked. The hope is that if we can successfully get it permanent root, then we can compare files and settings between the locked and unlocked ones. I do wish you good luck getting the code though, that would definitely be good news for a few people here :)
 

aluminumx

Senior Member
Mar 20, 2008
50
11
Hey timkiller, good that your vendor gave you the code as well. My guess is that it's the sim unlock code, which you probably don't need anymore as once your phone is unlocked, it "shouldn't" get relocked, but just in case, you should save it somewhere. However, if it's not the sim code but the maintenance code, that would be helpful for the rest of us. If you can try the following and let me know if that works. I am not exactly sure how familiar you are with android, so I will be a bit more detailed here, hope you are not insulted. I am by no means any expert, I basically just want to see If the code you got is the maintenance code or not.

1. power down the phone

2. hold the volume down button, and then the power button to turn on the phone, hold on to the keys until you see the android maintenance picture

3. press up volume, then down volume button, and a menu should show up. You are now in recovery mode. In this mode, you have to use the volume down to cycle through the menu items, the volume up to select it. You should see the following choices, if the menu is different from below, please let us know
a. reboot system now
b. wipe data/factory reset
c. wipe cache partition
d. repair software by sdcard
e. maintenance

4. use the volume down key to move to maintenance, then use volume up to select it. You should now be asked to enter the password. Again, use the volume buttons to enter the code you got. Remember to select OK at the end. If you got kicked out back to the original menu, then the code didn`t work, and proceed to step 5 below. I have no idea what it would look like if the code works though, but I imagine you will have a new menu system. Please let us know either way.

5. Las thing to try is the repair software by sdcard option. Use the volume buttons to select that, it will first ask you to confirm, volume down to yes and you will be prompted to enter password once again. Enter your code and let us know if it works.



Well, I won`t hold much hope on it, but it`s worth a try. if either option works, then we can compare your IMEI with the code, and maybe derive a pattern out of it. I know another NEC phone model is like that. :)

thanks for your help, crossing fingers :)



I have both a locked and unlocked NEC Terrain. And, if it were to be helpful, in the box of the unlocked one was a little slip of paper that says "CODE" and has a number on it. The phone was unlocked when I received it, so I can't confirm that the code on the paper is the unlock code for the phone.

I'd be happy to pull whatever files would be helpful from either device and post them. Give me a process and I'll get what you need.
 

timekiller_9

Member
Nov 9, 2013
40
7
I'm not insulted at all. I'm not an Android expert per say, but I am very tech savvy and can get around the device quite well. I can run a temporary root via adb, extract a partition, whatever it is that would be useful.

The recovery mode menu appears exactly as you describe it.

I tried the code I have to try to get into the maintenance and repair modes. Unfortunately neither worked, both kicked me back out to the previous menu. I suspect it's the unlock code that I have, or possibly even just a code for something else all together that the seller accidentally included in the box. It's a hand written slip of paper with just the word "CODE" and an 8 digit number on it, so we cannot be certain it's even for this device.

I'm happy to try any other ideas, or extract something for you to compare on either the locked or unlocked phone. I will be travelling for the next week so I will only have the unlocked phone with me.

Hey timkiller, good that your vendor gave you the code as well. My guess is that it's the sim unlock code, which you probably don't need anymore as once your phone is unlocked, it "shouldn't" get relocked, but just in case, you should save it somewhere. However, if it's not the sim code but the maintenance code, that would be helpful for the rest of us. If you can try the following and let me know if that works. I am not exactly sure how familiar you are with android, so I will be a bit more detailed here, hope you are not insulted. I am by no means any expert, I basically just want to see If the code you got is the maintenance code or not.

1. power down the phone

2. hold the volume down button, and then the power button to turn on the phone, hold on to the keys until you see the android maintenance picture

3. press up volume, then down volume button, and a menu should show up. You are now in recovery mode. In this mode, you have to use the volume down to cycle through the menu items, the volume up to select it. You should see the following choices, if the menu is different from below, please let us know
a. reboot system now
b. wipe data/factory reset
c. wipe cache partition
d. repair software by sdcard
e. maintenance

4. use the volume down key to move to maintenance, then use volume up to select it. You should now be asked to enter the password. Again, use the volume buttons to enter the code you got. Remember to select OK at the end. If you got kicked out back to the original menu, then the code didn`t work, and proceed to step 5 below. I have no idea what it would look like if the code works though, but I imagine you will have a new menu system. Please let us know either way.

5. Las thing to try is the repair software by sdcard option. Use the volume buttons to select that, it will first ask you to confirm, volume down to yes and you will be prompted to enter password once again. Enter your code and let us know if it works.



Well, I won`t hold much hope on it, but it`s worth a try. if either option works, then we can compare your IMEI with the code, and maybe derive a pattern out of it. I know another NEC phone model is like that. :)

thanks for your help, crossing fingers :)
 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    It does not work

    Hello,

    Towelroot doesn't work on NEC Terrain. I've tried it with different configurations. I've also tried: labda root, poot, framaroot, z4root, vroot, baidu root, saferoot. Moreover I've tried manually root phone using this guide, tried dd modified boot.img, but that didn't stick and after reboot there wasn't any changes.

    Problem is that one can't remount /system partition to rw. It just says “invalid argument”. Furthermore there is not any fastboot support (locked out I guess).

    I can get temp root using method discribed by justDave, remount / and /data (maybe others partitions too, nether tried) partitions, mount ././tmp/xbin (with busybox and su in it) over /system/xbin, but that doesn't get me anywhere.

    I'm thinking about dd custom recovery, but I need to read on it thirst. If you have any suggestions or other rooting methonds, manual rooting guides etc., please post them here and I will try them if my knowledge lets me.

    Off topic: NEC closed their mobile devision. Just google “NEC Pulls the Plug on Smartphones” (I can't post links form outside). So there isn't any good news for peaple with NEC Terrain.