FORUMS
Remove All Ads from XDA
Post Reply Email Thread
I Rooted my New SONY XPERIA TABLET S SGPT121US ICS 4.0.3







Guide to Root your Xperia Tablet S
!! ATTENTION: I am not responsible if you brick or damage your device, use at your OWN RISK!!


Files you need:

All in one Xperia Tablet root.zip

OR

ADB Tools
SonyTabletICS-2.zip
Superuser-3.1.3-arm-signed.zip
VpnFaker.apk (Attachment)

ATTENTION: For those who are not using the US firmware, the attached VpnFaker.apk may not be suitable for your tablet.
Please follow these steps(click me) to resign the VpnFaker.apk. Thanks to WonderEkin

***Pls Execute the command line by line***

Unzip those files into a dir, Open cmd console, cd to that dir

Run the following command and press Restore on your tablet
Code:
Code:
adb restore settings.ab
Check the result
Code:
Code:
adb shell ls -ld /data/data/com.android.settings/a
	drwxrwxrwx system system    a
And continue, ignore the "rm -r a" permission denied error
Code:
Code:
adb shell
	cd /data/data/com.android.settings
	rm -r a
	while : ; do ln -s /data a/file99; done
While the loop is running, open another cmd console and run
Code:
Code:
adb restore settings.ab
Once the restore process is completed, you can press CTRL+C on the 1st cmd console to break the loop

Check the /data permission
Code:
Code:
adb shell ls -ld /data
	drwxrwxrwx system system    data
Then continue
Code:
Code:
adb push busybox /data/local/tmp
adb push rootkit.tar.gz /data/local/tmp
adb push Superuser.apk /data/local/tmp
adb push su /data/local/tmp
adb shell
	cd /data/local/tmp
	chmod 755 busybox
	./busybox tar zxf rootkit.tar.gz
	exit
Push the resigned VpnFaker.apk(resign by ZipSigner 2) and update the timestamp
Code:
Code:
adb push VpnFaker.apk /data/local/tmp
adb shell
	touch -t 1346025600 /data/local/tmp/VpnFaker.apk
	exit
Now, replace the VpnDialogs (ignore "cp: can't open 'system/xxxxxxx': Permission denied" while you execute "/data/local/tmp/busybox cp -r system system2")
Code:
Code:
adb shell
	cd /data
	/data/local/tmp/busybox cp -r system system2
	/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
	/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
	mv system system-
	mv system2 system

	mv app app-
	mkdir app
	mv /data/local/tmp/VpnFaker.apk /data/app
Make sure the datatime is 2012/08/27 00:00
Code:
Code:
TZ=0 ls -l /data/app
		-rw-r--r-- shell shell 198580 2012-08-27 00:00 VpnFaker.apk
Generate the packages.xml
Code:
Code:
/data/local/tmp/busybox sed -f /data/local/tmp/packages.xml.sed system-/packages.xml > system/packages.xml
And double check the result

Code:
Code:
/data/local/tmp/busybox grep vpndialogs system/packages.xml
		<updated-package name="com.android.vpndialogs" codepath="/system/app/VpnDialogs.apk" nativelibrarypath="/data/data/com.android.vpndialogs/lib" flags="1" ft="136f14be668" it="136f14be668" ut="136f14be668" version="15" shareduserid="1000">
		<package name="com.android.vpndialogs" codepath="/data/app/VpnFaker.apk" nativelibrarypath="/data/data/com.android.vpndialogs/lib" flags="1" ft="1396560b400" it="1396560b400" ut="1396560b400" version="45" shareduserid="1000">
Exit adb shell and reboot, you should see something like "Android is updating" during startup.
Code:
Code:
exit
	adb reboot
Start the injected Terminal Emulator
Code:
Code:
adb shell am start -n com.android.vpndialogs/.Term
In Terminal Emulator
Code:
Code:
id
You should see the uid is 1000(system)
Still in the Terminal Emulator, ignore the script error
Code:
Code:
/data/local/tmp/onload.sh
/data/local/tmp/onload2.sh
Now back to the cmd console
Code:
adb shell
	/dev/sh
	id
Check the uid is 2000(shell)

And
Code:
Code:
	chown 0.0 /data/local/tmp/_su
	chmod 6755 /data/local/tmp/_su
	/data/local/tmp/_su
	id
Check the root access uid 0(root)

Backup /system (you may just skip it)

Code:
Code:
dd if=/dev/block/mmcblk0p3 of=/mnt/sdcard/system.ext4 bs=128K
Copy su & Superuser.apk to /system
Code:
Code:
/data/local/tmp/busybox mount -o rw,remount /system
	/data/local/tmp/busybox cp /data/local/tmp/_su /system/xbin
	chown 0.0 /system/xbin/_su
	chmod 6755 /system/xbin/_su
	/data/local/tmp/busybox cp /data/local/tmp/su /system/xbin
	chown 0.0 /system/xbin/su
	chmod 6755 /system/xbin/su
	/data/local/tmp/busybox cp /data/local/tmp/Superuser.apk /system/app
	/data/local/tmp/busybox mount -o ro,remount /system
	sync
	exit
Check the /system _su is working or not

Code:
Code:
	_su
	id
Should be uid 0(root)

And move the original /data/app & /data/system back (the original steps will keep the VpnFaker.apk, but i skip it)
Code:
Code:
	cd /data
	mv app app2
	mv app- app
	mv system system2
	mv system- system
	exit
	exit
Reboot your tab

Code:
adb reboot
Now, your Sony Xperia Tablet S ICS 4.0.3 should be rooted.

Credits Yupandra2012 for link to Original Root Method.
& WonderEkin for his Translation from Japanese to English.
The Following 16 Users Say Thank You to zorbakun For This Useful Post: [ View ] Gift zorbakun Ad-Free
15th September 2012, 03:12 AM |#2  
TypoCorrecto's Avatar
Senior Member
Thanks Meter: 43
 
More
I have the Sony Tablet S and this is as far as I can get:

c:\SonyTablet>adb shell
[email protected]:/ $ cd /data
cd /data
[email protected]:/data $ /data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox cp -r system system2
cp: can't open 'system/entropy.dat': Permission denied
cp: can't open 'system/batterystats.bin': Permission denied
cp: can't open 'system/users/userlist.xml': Permission denied
cp: can't open 'system/users/0.xml': Permission denied
cp: can't open 'system/accounts.db': Permission denied
cp: can't open 'system/accounts.db-journal': Permission denied
cp: can't open 'system/called_pre_boots.dat': Permission denied
cp: can't open 'system/wallpaper_info.xml': Permission denied
cp: can't open 'system/appwidgets.xml': Permission denied
1|[email protected]ndroid:/data $

Any ideas?
15th September 2012, 03:28 AM |#3  
zorbakun's Avatar
OP Senior Member
Thanks Meter: 91
 
More
This Thread is for Xperia Tablet S, but anyways you ignore this error and complete the rest of the steps, I had the same error, ignored it and it worked for me.
15th September 2012, 03:41 AM |#4  
TypoCorrecto's Avatar
Senior Member
Thanks Meter: 43
 
More
Another road block:

c:\STS>adb shell
[email protected]:/ $ cd /data
cd /data
[email protected]:/data $ /data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox cp -r system system2
cp: can't open 'system/entropy.dat': Permission denied
cp: can't open 'system/batterystats.bin': Permission denied
cp: can't open 'system/users/userlist.xml': Permission denied
cp: can't open 'system/users/0.xml': Permission denied
cp: can't open 'system/accounts.db': Permission denied
cp: can't open 'system/accounts.db-journal': Permission denied
cp: can't open 'system/called_pre_boots.dat': Permission denied
cp: can't open 'system/wallpaper_info.xml': Permission denied
cp: can't open 'system/appwidgets.xml': Permission denied
1|[email protected]:/data $ /data/local/tmp/busybox find system2 -type f -exec chmod
666 {} \;
d system2 -type f -exec chmod 666 {} \; <
[email protected]:/data $ /data/local/tmp/busybox find system2 -type d -exec chmod 7
77 {} \;
system2 -type d -exec chmod 777 {} \; <
[email protected]:/data $ mv system system-
mv system system-
[email protected]:/data $ mv system2 system
mv system2 system
[email protected]:/data $ mv app app-
mv app app-
[email protected]:/data $ mkdir app
mkdir app
[email protected]:/data $ mv /data/local/tmp/VpnFaker.apk /data/app
mv /data/local/tmp/VpnFaker.apk /data/app
[email protected]:/data $ TZ=0 ls -l /data/app
TZ=0 ls -l /data/app
-rw-rw-rw- shell shell 200436 2012-08-27 00:00 VpnFaker.apk
[email protected]:/data $ /data/local/tmp/busybox sed -f /data/local/tmp/packages.xm
l.sed system-/packages.xml > system/packages.xml
tem-/packages.xml > system/packages.xml <
/system/bin/sh: cannot create system/packages.xml: Permission denied
1|[email protected]:/data $ /data/local/tmp/busybox grep vpndialogs system/packages.
xml
p vpndialogs system/packages.xml <
<package name="com.android.vpndialogs" codePath="/system/app/VpnDialogs.apk" nat
iveLibraryPath="/data/data/com.android.vpndialogs/lib" flags="1" ft="138eb7f41b0
" it="138eb7f41b0" ut="138eb7f41b0" version="15" sharedUserId="1000">
[email protected]:/data $ exit
exit

c:\STS>adb reboot

c:\STS>adb shell am start -n com.android.vpndialogs/.Term
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
Starting: Intent { cmp=com.android.vpndialogs/.Term }
Error type 3
Error: Activity class {com.android.vpndialogs/com.android.vpndialogs.Term} does
not exist.

c:\STS>

There were a few things that didn't match up along the way as well...

I am lost...
The Following User Says Thank You to TypoCorrecto For This Useful Post: [ View ] Gift TypoCorrecto Ad-Free
15th September 2012, 05:44 AM |#5  
Senior Member
Flag Porto Alegre
Thanks Meter: 863
 
Donate to Me
More
same here:

adb shell am start -n com.android.vpndialogs/.Term
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
Starting: Intent { cmp=com.android.vpndialogs/.Term }
Error type 3
Error: Activity class {com.android.vpndialogs/com.android.vpndialogs.Term} does
not exist.
15th September 2012, 02:58 PM |#6  
zorbakun's Avatar
OP Senior Member
Thanks Meter: 91
 
More
Guys the error you are facing means missing terminal emulator is not installed on your device. make sure you have terminal emulator downloaded and installed from Google play. Also note you will face errors with the onload scripts using the emulator just ignore it and resume normally.
20th September 2012, 05:53 AM |#7  
Junior Member
Flag Taipei
Thanks Meter: 0
 
More
Hi, I'm in the stage found the return message "cd: /data/local/tmp - Not a directory", is this normal??
Below is the console capture:

C:\Root>adb push busybox /data/local/tmp
1314 KB/s (1867568 bytes in 1.387s)

C:\Root>adb push rootkit.tar.gz /data/local/tmp
1247 KB/s (518024 bytes in 0.405s)

C:\Root>adb push Superuser.apk /data/local/tmp
1209 KB/s (1468798 bytes in 1.185s)

C:\Root>adb push su /data/local/tmp
1253 KB/s (380532 bytes in 0.296s)

C:\Root>adb shell
[email protected]:/ $ cd /data/local/tmp
cd /data/local/tmp
/system/bin/sh: cd: /data/local/tmp - Not a directory
1|[email protected]:/ $
22nd November 2012, 03:54 AM |#8  
psxpetey's Avatar
Senior Member
Thanks Meter: 124
 
More
Quote:
Originally Posted by tonybyatt

I have the Sony Tablet S and this is as far as I can get:

c:\SonyTablet>adb shell
[email protected]:/ $ cd /data
cd /data
[email protected]:/data $ /data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox cp -r system system2
cp: can't open 'system/entropy.dat': Permission denied
cp: can't open 'system/batterystats.bin': Permission denied
cp: can't open 'system/users/userlist.xml': Permission denied
cp: can't open 'system/users/0.xml': Permission denied
cp: can't open 'system/accounts.db': Permission denied
cp: can't open 'system/accounts.db-journal': Permission denied
cp: can't open 'system/called_pre_boots.dat': Permission denied
cp: can't open 'system/wallpaper_info.xml': Permission denied
cp: can't open 'system/appwidgets.xml': Permission denied
1|[email protected]:/data $

Any ideas?

restart your comp reset your tab to factory settings run CMD window as administrator and paste the code LINE BY LINE very important if you post multiple lines it wont work btw just disregard that error code it means nothing
24th November 2012, 06:15 PM |#9  
psxpetey's Avatar
Senior Member
Thanks Meter: 124
 
More
If your terminal emulator is not popping up on your tab try this fix. http://forum.xda-developers.com/show....php?t=2010074
26th November 2012, 05:46 PM |#10  
Junior Member
Thanks Meter: 0
 
More
doesn't work with 4.0.3 release6
ANY FIXES??????


c:\ROOT>adb restore settings.ab

c:\ROOT>adb shell ls -ld /data/data/com.android.settings/a
/data/data/com.android.settings/a: No such file or directory


c:\ROOT>adb shell ls -ld /data/data/
drwxrwx--x system system 2012-11-26 17:13

NO read/writze access for everyone.......


german xperia tablet s
Post Reply Subscribe to Thread

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes