[ROOT][JB] New Easy Root Method For Jellybean

Search This thread
By:
Advanced…
jcase

jcase

Retired Forum Mod / Senior Recognized Developer
Feb 20, 2010
6,308
15,761
Raleigh NC
Tablechair

Tablechair

Senior Member
Feb 9, 2013
267
117
Waterbury CT
It doesn't work after reboot supersu says the binary cannot be installed and closes.( In ICS) sorry if my last post was worded poorly it was super late (or early?)

Sent from my LG-P769 using xda premium
 
Last edited:
jcase

jcase

Retired Forum Mod / Senior Recognized Developer
Feb 20, 2010
6,308
15,761
Raleigh NC
Tablechair said:
It doesn't work after reboot supersu says the binary cannot be installed and closes.( In ICS) sorry if my last post was worded poorly it was super late (or early?)

Sent from my LG-P769 using xda premium
Click to expand...
Click to collapse

adb shell ls -l /system/xbin/su
adb shell su -c "id"

And give me the output

Sent from my GT-I9500 using xda premium
 
  • Like
Reactions: heero884
captaincrook

captaincrook

Senior Member
Sep 17, 2010
246
126
jcase said:
adb shell ls -l /system/xbin/su
adb shell su -c "id"

And give me the output

Sent from my GT-I9500 using xda premium
Click to expand...
Click to collapse

Both outputs state su not found. This was the first thing I tried (so I thought maybe something got lost in the reboot?). I've checked for both before a restart (immediately after successful restoration of the crafted backup) and after the reboot.

I found stock images of my firmware in kdz format. Rapidshare link and Skydrive link

Is there anything you need? I can just upgrade and end everything with "upgrade to Jellybean first" if you wish to cease carrying on (in which I understand; you have better things to do than go out of your way to help with this specific issue).
 
Last edited:
jcase

jcase

Retired Forum Mod / Senior Recognized Developer
Feb 20, 2010
6,308
15,761
Raleigh NC
captaincrook said:
Both outputs state su not found. This was the first thing I tried (so I thought maybe something got lost in the reboot?). I've checked for both before a restart (immediately after successful restoration of the crafted backup) and after the reboot.

I found stock images of my firmware in kdz format. Rapidshare link and Skydrive link

Is there anything you need? I can just upgrade and end everything with "upgrade to Jellybean first" if you wish to cease carrying on (in which I understand; you have better things to do than go out of your way to help with this specific issue).
Click to expand...
Click to collapse

If updating to jellybean solves the problem, than that shall be the solution
 
  • Like
Reactions: Tablechair
Z

zenshir@

Member
Jan 10, 2013
15
2
Successfully Rooted L9 P768e Jelly bean_27-06-2013

Hi Jcase,

Thanks for the great app. Finally! i got my L9 P768e (JB) rooted! :laugh:

Also my thanks to captaincrook for sharing this info and link.

Android version: 4.1.2

Software version: P768E20A-SEA-XX

Model number: LG-P768E

Maybe you can add this to your list of devices.

Thank you all, yeah!:good:
 
R

Reynaldo2333

Member
Jun 4, 2012
28
3
it says that i dont have the binarys of su when i try to open supersu and that it cant install it.. that must be it didnt work right?

i did restore the lgpawn backup

i cant update to jellybean since im on p768 and its not from tmobile
kernel 3.0.21
4.0.4 - android
p768g10a-amx-xx
 
Last edited:
renegade37918

renegade37918

Senior Member
May 7, 2011
334
46
knox, tn
plus.google.com
ok i'm gonna be a noob and ask what are the steps to root? do i just download the apk and install it?

---------- Post added at 07:55 PM ---------- Previous post was at 07:54 PM ----------

gosh imiss my gnex

---------- Post added at 08:13 PM ---------- Previous post was at 07:55 PM ----------

ok i figured it out i have supersu now gotta find twrp

---------- Post added at 08:14 PM ---------- Previous post was at 08:13 PM ----------

ok i figured it out i have supersu now gotta find twrp
 
You must log in or register to reply here.

Similar threads

cmahendra
[GUIDE] Root L9 ICS/JB with New Lelus method & Offline Flashing [LOCKED BL] [31-Mar]
Replies
560
Views
266K
Lamba92
Lamba92
cmahendra
[GUIDE] [UNBRICK][ROOT] FLASH Any LG L9 Factory ROM (kdz) WITH OFFLINE FIX
Replies
1K
Views
661K
C
cgigate
cmahendra
[2in1GUIDE][JB] Unlock Bootloader and FASTER Root L9 Method
Replies
295
Views
191K
A
app freak
cmahendra
  • Poll
[INFOBANK] Collection of LG L9 FACTORY KDZ ROMS, ROOT, BB, BL, SOURCES, etc.
Replies
909
Views
511K
Q
qsiek
A
[TUTORIAL] ROOT LG Optimus L9 - EASY! (P760,P765,P768,P769)
Replies
141
Views
212K
S
SHAOLIN.DRAGON

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 82
    captaincrook
    captaincrook
    I present you all with a new root method provided by the the immaculate jcase. Rooting with this is fairly simple and the only requirement is that you have Jellybean for your device. This has proven to work with a variety of phones on Jellybean, with ICS turning up no rooted results. Thus, you must (!!) have Jellybean on your device.

    NOTE: The latest T-Mobile USA OTA update (ver. 20F) is confirmed to still work with this method.

    This has proven to work on a variety of phones across the P76* line including:

    P769

    Phones with the Canada WindMobile ROM

    P768e

    P768

    P760


    DO NOT THANK ME. INSTEAD THANK JCASE, WHO DID ALL THE WORK. I'M JUST A PARROT. BAWK.


    -----

    STEP 1

    First, we must make sure you have spritebud. No it isn't a soda/beer mix! You can check for this either via ADB or through the app Terminal Emulator. Unhide the code for your selected method.

    ADB:
    Code: 
    adb shell ls -l /system/xbin/spritebud

    Terminal Emulator:
    Code: 
    ls -l /system/xbin/spritebud

    If you get any error message along the lines of "no such file or directory", then you my friend are unable to root. Otherwise, you should be presented with information about spritebud, and that is your golden ticket to root.


    STEP 2

    Now that you know whether or not you are able to root, let us carry on for those who can.

    I have written a thin guide on achieving root based on the steps that jcase has provided. They are as follows:

    Download LGPwn.apk attached to this post
    Install LGPwn.apk on your device
    Launch LGPwn
    READ popup message
    Press "root me" to carry on the next part

    When Backup has launched, choose Restore
    Choose Internal storage
    Choose LGPwn
    Hit OK at the popup about Cross Model Restore
    Make sure the Applications checkbox is checked, then select Continue
    Let the app finish the restoring process[/code]

    STEP 3

    Once your decive has finished the restore process, you may ither reboot your phone from the current screen, or you may immediately head to the Play Store. Whichever choice you make, your next step is to download SuperSu from the Play Store and install it. When prompted, select normal install, and you sohuld be good to go with regards to root.

    Congratulations! New root get!



    ---


    APK Link: http://malware.asia/LGPwn.apk[/strike]

    Original post: http://xdaforums.com/showthread.php?p=42938989#post42938989

    Github

    Original post quoted:

    jcase said:
    Subject:
    Race condition in Sprite Software's backup software, installed by OEM on LG Android devices.

    Author:
    Justin Case - jcase@cunninglogic.com

    CVE ID:
    CVE-2013-3685

    Effect:
    Locally exploited vulnerability with minimal device user interaction which results in executing code as the root user. Under specific circumstances, it is possible to exploit this vulnerability without the device user's knowledge

    Products:
    "Backup"
    "spritebud"

    Vendors:
    Sprite Software
    LG Electronics
    Potentially other vendors

    Affected Versions:
    spritebud 1.3.24
    backup 2.5.4105
    Likely others versions as well

    Affected Devices (Subject to firmware configuration):
    LG-E971 LG Optimus G
    LG-E973 LG Optimus G
    LG-E975 LG Optimus G
    LG-E975K LG Optimus G
    LG-E975T LG Optimus G
    LG-E976 LG Optimus G
    LG-E977 LG Optimus G
    LG-F100K LG Optimus Vu
    LG-F100L LG Optimus Vu
    LG-F100S LG Optimus Vu
    LG-F120K LG Optimus Vu
    LG-F120L LG Optimus LTE Tag
    LG-F120S LG Optimus LTE Tag
    LG-F160K LG Optimus LTE 2
    LG-F160L LG Optimus LTE 2
    LG-F160LV LG Optimus LTE 2
    LG-F160S LG Optimus LTE 2
    LG-F180K LG Optimus G
    LG-F180L LG Optimus G
    LG-F180S LG Optimus G
    LG-F200K LG Optimus Vu 2
    LG-F200L LG Optimus Vu 2
    LG-F200S LG Optimus Vu 2
    LG-F240K LG Optimus G Pro
    LG-F240L LG Optimus G Pro
    LG-F240S LG Optimus G Pro
    LG-F260K LG Optimus LTE 3
    LG-F260L LG Optimus LTE 3
    LG-F260S LG Optimus LTE 3
    LG-L21 LG Optimus G
    LG-LG870 LG (Unknown)
    LG-LS860 LG Mach
    LG-LS970 LG Optimus G
    LG-P760 LG Optimus L9
    LG-P769 LG Optimus L9
    LG-P780 LG Optimus L7
    LG-P875 LG Optimus F5
    LG-P875h LG Optimus F5
    LG-P880 LG Optimus 4X HD
    LG-P940 LG Prada
    LG-SU540 LG Prada 3.0
    LG-SU870 LG Optimus 3D Cube
    LG-US780 LG Lollipop
    Potentially other devices as well.


    Product Information:

    "Backup" and "spritebud" are a setting and application backup/restore system written by Sprite Software and deployed on LG Android smartphones. "Backup" is the end user front end app, and "spritebud" is the service that preforms the backup and restore functions.


    Details:

    The "spritebud" daemon is started by the init scripts and runs as the root user. Listening on a unix socket, the daemon accepts instructions from the "Backup" app. Using a crafted backup, we can write to, change permission and change ownership of any file, being that "spritebud" is running under the root user.


    The crafted backup contains restore data for our exploiting application, "com.cunninglogic.lgpwn". The data includes a 50mb dummy file (a) used to increase our exploit window, su binary (b), a script (c) to install su, and a text file (d) containing the path to our script. All files are owned by the application, and are world write/read/execute. All files are restored in alphabetical order. The entire backup, after compress, is approximately 2mb. The structure of this backup is as follows:


    drwxrwxrwx u0_a114 u0_a114 2013-05-28 20:13 files


    ./files:
    - -rwxr-xr-x u0_a114 u0_a114 52428800 2013-05-22 20:06 a
    - -rwxr-xr-x u0_a114 u0_a114 91992 2013-05-22 20:07 b
    - -rwxr-xr-x u0_a114 u0_a114 251 2013-05-22 20:12 c
    - -rwxr-xr-x u0_a114 u0_a114 42 2013-05-22 20:07 d


    Prior to restoration, our exploit app runs, watches the process and waits. During restoration, the spritebud daemon first creates the files directory, then sets it's permission and owner. Next it decompresses and restores the "a" file, our 50mb dummy files. During the restoration of "a", our exploit application has time to symlink "d", our text file containing the full path to our script (c), to /sys/kernel/uevent_helper. Upon restoration of file "d", our path is written to uevent_helper. When a hotplug even occurs (which occur every few seconds), the path contained in uevent_helper is execute by the kernel and our script (c) is executed and installs the su binary (b).
    Click to expand...
    Click to collapse
    View
    36
    jcase
    jcase
    captaincrook said:
    Hasn't been posted here, but could be of some use if someone messes with it. I take no credit. All of it goes to JCase (who is an awesome dood ;]) and I'm simply posting here for people who are able to probably get us a much easier root method. Our phones are listed as compatible so I'm thinking a more knowledgeable person should try and see if it works.

    Just an FYI the compiled apk attached to the original post does not install for me (even through terminal) so someone will have to do some work on that if possible.

    Original post: http://xdaforums.com/showthread.php?p=42938989#post42938989

    Github

    For the lazy:
    Click to expand...
    Click to collapse

    adb shell ls -l /system/xbin/spritebud

    if spritebud exists on your firmware, then it will most likely work

    The apk is in my original post only works on API 16 and up, just because of how I built it. If you have the spritebud binary, I will rebuild it for you
    View
    8
    jcase
    jcase
    @Tablechair @captaincrook updated github and the apk, try this apk http://malware.asia/LGPwn.apk. It should support Andoid 2.3.3 and up, and check for spritebud before allowing you to continue.

    If this doesnt work, dump your stock system image and I will give you a different root
    View
    2
    jcase
    jcase
    Tablechair said:
    Spritebud is there. I've copied it from xbin and zipped it up for you here. Thanks http://db.tt/IPbe5O8w

    Sent from my LG-P769 using xda premium
    Click to expand...
    Click to collapse


    *edit* let me fix some bugs
    View
    2
    jcase
    jcase
    Tablechair said:
    Will unroot and give it a shot once I get home later thanks dude.

    Sent from my LG-P769 using xda premium

    ---------- Post added at 09:15 PM ---------- Previous post was at 08:57 PM ----------

    It occurred to me that I don't need my PC to try this so I did a full unroot in supersu. Installed and ran your apk then restored lgpwn backup when the menu came up. After a reboot I couldn't find the supersu or superuser app but I got superSU from the playstore and it installed and prompted me to update binary after that I'm back rooted again. Spread the good word I guess. Thanks a lot dude!

    Sent from my LG-P769 using xda premium
    Click to expand...
    Click to collapse

    Great, perhaps @captaincrook can change the title, and manage the thread here?
    View

New posts