[ROOT]Sony Xperia Tablet S SGPT121US ICS 4.0.3 ROOTED!!

zorbakun · Sep 15, 2012

I Rooted my New SONY XPERIA TABLET S SGPT121US ICS 4.0.3 :cowboy:

Guide to Root your Xperia Tablet S

!! ATTENTION: I am not responsible if you brick or damage your device, use at your OWN RISK!!

Files you need:

All in one Xperia Tablet root.zip

OR

ADB Tools
SonyTabletICS-2.zip
Superuser-3.1.3-arm-signed.zip
VpnFaker.apk (Attachment)

ATTENTION: For those who are not using the US firmware, the attached VpnFaker.apk may not be suitable for your tablet.
Please follow these steps(click me) to resign the VpnFaker.apk. Thanks to WonderEkin

***Pls Execute the command line by line***

Unzip those files into a dir, Open cmd console, cd to that dir

Run the following command and press Restore on your tablet
Code:

Code:

adb restore settings.ab

Check the result
Code:

Code:

adb shell ls -ld /data/data/com.android.settings/a
	[COLOR="Green"]drwxrwxrwx system system    a[/COLOR]

And continue, ignore the "rm -r a" permission denied error
Code:

Code:

adb shell
	cd /data/data/com.android.settings
	rm -r a
	while : ; do ln -s /data a/file99; done

While the loop is running, open another cmd console and run
Code:

Code:

adb restore settings.ab

Once the restore process is completed, you can press CTRL+C on the 1st cmd console to break the loop

Check the /data permission
Code:

Code:

adb shell ls -ld /data
	[COLOR="Green"]drwxrwxrwx system system    data[/COLOR]

Then continue
Code:

Code:

adb push busybox /data/local/tmp
adb push rootkit.tar.gz /data/local/tmp
adb push Superuser.apk /data/local/tmp
adb push su /data/local/tmp
adb shell
	cd /data/local/tmp
	chmod 755 busybox
	./busybox tar zxf rootkit.tar.gz
	exit

Push the resigned VpnFaker.apk(resign by ZipSigner 2) and update the timestamp
Code:

Code:

adb push VpnFaker.apk /data/local/tmp
adb shell
	touch -t 1346025600 /data/local/tmp/VpnFaker.apk
	exit

Now, replace the VpnDialogs (ignore "cp: can't open 'system/xxxxxxx': Permission denied" while you execute "/data/local/tmp/busybox cp -r system system2")
Code:

Code:

adb shell
	cd /data
	/data/local/tmp/busybox cp -r system system2
	/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
	/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
	mv system system-
	mv system2 system

	mv app app-
	mkdir app
	mv /data/local/tmp/VpnFaker.apk /data/app

Make sure the datatime is 2012/08/27 00:00
Code:

Code:

TZ=0 ls -l /data/app
		[COLOR="green"]-rw-r--r-- shell shell 198580 2012-08-27 00:00 VpnFaker.apk[/COLOR]

Generate the packages.xml
Code:

Code:

/data/local/tmp/busybox sed -f /data/local/tmp/packages.xml.sed system-/packages.xml > system/packages.xml

And double check the result

Code:

Code:

/data/local/tmp/busybox grep vpndialogs system/packages.xml
		[COLOR="green"]<updated-package name="com.android.vpndialogs" codepath="/system/app/VpnDialogs.apk" nativelibrarypath="/data/data/com.android.vpndialogs/lib" flags="1" ft="136f14be668" it="136f14be668" ut="136f14be668" version="15" shareduserid="1000">
		<package name="com.android.vpndialogs" codepath="/data/app/VpnFaker.apk" nativelibrarypath="/data/data/com.android.vpndialogs/lib" flags="1" ft="1396560b400" it="1396560b400" ut="1396560b400" version="45" shareduserid="1000">[/COLOR]

Exit adb shell and reboot, you should see something like "Android is updating" during startup.
Code:

Code:

exit
	adb reboot

Start the injected Terminal Emulator
Code:

Code:

adb shell am start -n com.android.vpndialogs/.Term

In Terminal Emulator
Code:

Code:

id
You should see the uid is 1000(system)

Still in the Terminal Emulator, ignore the script error
Code:

Code:

/data/local/tmp/onload.sh
/data/local/tmp/onload2.sh
Now back to the cmd console
Code:
adb shell
	/dev/sh
	id

Check the uid is 2000(shell)

And
Code:

Code:

	chown 0.0 /data/local/tmp/_su
	chmod 6755 /data/local/tmp/_su
	/data/local/tmp/_su
	id

Check the root access uid 0(root)

Backup /system (you may just skip it)

Code:

Code:

dd if=/dev/block/mmcblk0p3 of=/mnt/sdcard/system.ext4 bs=128K

Copy su & Superuser.apk to /system
Code:

Code:

/data/local/tmp/busybox mount -o rw,remount /system
	/data/local/tmp/busybox cp /data/local/tmp/_su /system/xbin
	chown 0.0 /system/xbin/_su
	chmod 6755 /system/xbin/_su
	/data/local/tmp/busybox cp /data/local/tmp/su /system/xbin
	chown 0.0 /system/xbin/su
	chmod 6755 /system/xbin/su
	/data/local/tmp/busybox cp /data/local/tmp/Superuser.apk /system/app
	/data/local/tmp/busybox mount -o ro,remount /system
	sync
	exit

Check the /system _su is working or not

Code:

Code:

	_su
	id

Should be uid 0(root)

And move the original /data/app & /data/system back (the original steps will keep the VpnFaker.apk, but i skip it)
Code:

Code:

	cd /data
	mv app app2
	mv app- app
	mv system system2
	mv system- system
	exit
	exit

Reboot your tab

Code:

adb reboot

Now, your Sony Xperia Tablet S ICS 4.0.3 should be rooted.

Credits Yupandra2012 for link to Original Root Method.
& WonderEkin for his Translation from Japanese to English.

TypoCorrecto · Sep 15, 2012

I have the Sony Tablet S and this is as far as I can get:

c:\SonyTablet>adb shell
shell@android:/ $ cd /data
cd /data
shell@android:/data $ /data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox cp -r system system2
cp: can't open 'system/entropy.dat': Permission denied
cp: can't open 'system/batterystats.bin': Permission denied
cp: can't open 'system/users/userlist.xml': Permission denied
cp: can't open 'system/users/0.xml': Permission denied
cp: can't open 'system/accounts.db': Permission denied
cp: can't open 'system/accounts.db-journal': Permission denied
cp: can't open 'system/called_pre_boots.dat': Permission denied
cp: can't open 'system/wallpaper_info.xml': Permission denied
cp: can't open 'system/appwidgets.xml': Permission denied
1|shell@android:/data $

Any ideas?

zorbakun · Sep 15, 2012

This Thread is for Xperia Tablet S, but anyways you ignore this error and complete the rest of the steps, I had the same error, ignored it and it worked for me.

TypoCorrecto · Sep 15, 2012

Another road block:

c:\STS>adb shell
shell@android:/ $ cd /data
cd /data
shell@android:/data $ /data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox cp -r system system2
cp: can't open 'system/entropy.dat': Permission denied
cp: can't open 'system/batterystats.bin': Permission denied
cp: can't open 'system/users/userlist.xml': Permission denied
cp: can't open 'system/users/0.xml': Permission denied
cp: can't open 'system/accounts.db': Permission denied
cp: can't open 'system/accounts.db-journal': Permission denied
cp: can't open 'system/called_pre_boots.dat': Permission denied
cp: can't open 'system/wallpaper_info.xml': Permission denied
cp: can't open 'system/appwidgets.xml': Permission denied
1|shell@android:/data $ /data/local/tmp/busybox find system2 -type f -exec chmod
666 {} \;
d system2 -type f -exec chmod 666 {} \; <
shell@android:/data $ /data/local/tmp/busybox find system2 -type d -exec chmod 7
77 {} \;
system2 -type d -exec chmod 777 {} \; <
shell@android:/data $ mv system system-
mv system system-
shell@android:/data $ mv system2 system
mv system2 system
shell@android:/data $ mv app app-
mv app app-
shell@android:/data $ mkdir app
mkdir app
shell@android:/data $ mv /data/local/tmp/VpnFaker.apk /data/app
mv /data/local/tmp/VpnFaker.apk /data/app
shell@android:/data $ TZ=0 ls -l /data/app
TZ=0 ls -l /data/app
-rw-rw-rw- shell shell 200436 2012-08-27 00:00 VpnFaker.apk
shell@android:/data $ /data/local/tmp/busybox sed -f /data/local/tmp/packages.xm
l.sed system-/packages.xml > system/packages.xml
tem-/packages.xml > system/packages.xml <
/system/bin/sh: cannot create system/packages.xml: Permission denied
1|shell@android:/data $ /data/local/tmp/busybox grep vpndialogs system/packages.
xml
p vpndialogs system/packages.xml <
<package name="com.android.vpndialogs" codePath="/system/app/VpnDialogs.apk" nat
iveLibraryPath="/data/data/com.android.vpndialogs/lib" flags="1" ft="138eb7f41b0
" it="138eb7f41b0" ut="138eb7f41b0" version="15" sharedUserId="1000">
shell@android:/data $ exit
exit

c:\STS>adb reboot

c:\STS>adb shell am start -n com.android.vpndialogs/.Term
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
Starting: Intent { cmp=com.android.vpndialogs/.Term }
Error type 3
Error: Activity class {com.android.vpndialogs/com.android.vpndialogs.Term} does
not exist.

c:\STS>

There were a few things that didn't match up along the way as well...

I am lost...

Bazoocaze · Sep 15, 2012

same here:

adb shell am start -n com.android.vpndialogs/.Term
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
Starting: Intent { cmp=com.android.vpndialogs/.Term }
Error type 3
Error: Activity class {com.android.vpndialogs/com.android.vpndialogs.Term} does
not exist.

SWFlyerUK · Sep 15, 2012

Do you type this in?

Code:

 while : ; do ln -s /data a/file99; done

MarcioHomem · Sep 15, 2012

Now, can you please upload a system dump of Xperia Tablet S?

Thanks!

zorbakun · Sep 15, 2012

Guys the error you are facing means missing terminal emulator is not installed on your device. make sure you have terminal emulator downloaded and installed from Google play. Also note you will face errors with the onload scripts using the emulator just ignore it and resume normally.

txiangyang · Sep 15, 2012

could you upload the terminal emulator?

zorbakun said:
Guys the error you are facing means missing terminal emulator is not installed on your device. make sure you have terminal emulator downloaded and installed from Google play. Also note you will face errors with the onload scripts using the emulator just ignore it and resume normally.

I am a user in China,and my tablet S cant's download any app from googleplay.Can you upload the terminal emulator?
Thank you very much.

WonderEkin · Sep 15, 2012

txiangyang said:
I am a user in China,and my tablet S cant's download any app from googleplay.Can you upload the terminal emulator?
Thank you very much.

The Vpnfaker.apk has already injected with terminal emulator. Moreover, all installed apps will temporary missing during the process.

zorbakun · Sep 15, 2012

as WonderEkin pointed out, people with problem (Error: Activity class {com.android.vpndialogs/com.android.vpndialogs.Term} does
not exist.) don't have the US version of the device hence They will need to re-sign the VpnFaker.apk as described here and start all over again from the beginning.

Guide has been updated to reflect the same.

Credits to WonderEkin

crimilde · Sep 15, 2012

This method works like a charm. Yay for rooted Tablet S!

Thank you so much!

TypoCorrecto · Sep 15, 2012

I was getting this:

adb shell am start -n com.android.vpndialogs/.Term
Starting: Intent { cmp=com.android.vpndialogs/.Term }
Error type 3
Error: Activity class {com.android.vpndialogs/com.android.vpndialogs.Term} does not exist.

I have a Tablet S, US Tablet, US Firmware, what am I suppose to do with the VpnFaker.apk?

"ATTENTION: For those who are not using the US firmware, the attached VpnFaker.apk may not be suitable for your tablet.
Please follow these steps(click me) to resign the VpnFaker.apk. Thanks to WonderEkin"

Not clear to me...

Roscobigfoot · Sep 15, 2012

Is this only for new xperia tab s or does it work for the old tab s?

xMimyx · Sep 15, 2012

WOW so fast ..

Even though Sony Xperia Tablet S ain't Global out there yet ..

Great Job .

zorbakun · Sep 15, 2012

typo86 said:
I was getting this:

adb shell am start -n com.android.vpndialogs/.Term
Starting: Intent { cmp=com.android.vpndialogs/.Term }
Error type 3
Error: Activity class {com.android.vpndialogs/com.android.vpndialogs.Term} does not exist.

I have a Tablet S, US Tablet, US Firmware, what am I suppose to do with the VpnFaker.apk?

"ATTENTION: For those who are not using the US firmware, the attached VpnFaker.apk may not be suitable for your tablet.
Please follow these steps(click me) to resign the VpnFaker.apk. Thanks to WonderEkin"

Not clear to me...

If you don't have the US version of the tablet, then you may need to re-sign the VpnFaker.apk, but since you own the US version, then no need to resign it. just make sure you follow the procedure carefully one step at a time, and if possible have terminal emulator installed on your tab as well.

zorbakun · Sep 15, 2012

Roscobigfoot said:
Is this only for new xperia tab s or does it work for the old tab s?

Check this thread for old Sony Tablet S.

zorbakun · Sep 15, 2012

SWFlyerUK said:
Do you type this in?

Code:

while : ; do ln -s /data a/file99; done

Yes you do.

TypoCorrecto · Sep 15, 2012

Still no luck...

Tried it both ways, followed instructions and I still end up here:

adb shell am start -n com.android.vpndialogs/.Term
Starting: Intent { cmp=com.android.vpndialogs/.Term }
Error type 3
Error: Activity class {com.android.vpndialogs/com.android.vpndialogs.Term} does not exist.

US old Tablet S, US Firmware...Is there anyone with a US tablet that has been able to root this way?

zorbakun · Sep 15, 2012

Now you can use my new All in one Xperia Tablet Root.zip for easier process, just extract it to an easy path like C:/Xperia root/ then open CMD pointing to the same path and Follow the guide in the first page.

[ROOT]Sony Xperia Tablet S SGPT121US ICS 4.0.3 ROOTED!!

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Member

Senior Member

Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Similar threads

Top Liked Posts