[APP]SuperOneClick v2.3.3 - Motorola Exploit Added!

684 posts
Thanks Meter: 946
By CLShortFuse, Retired Recognized Developer on 9th October 2010, 07:56 AM
Thread Closed Email Thread


Downloads available at

Motorola ADB Patching
Checks for shell root before applying exploits
Unroot has been fixed to work more reliably
LG devices no longer need to use alternate ADB

Better LG phone support

Auto driver installation

v2.2 is up!
zergRush and Superuser 3.0.6 included

v2.1.1 is up!

Driver pack comes later!


I made it. I tested it. It works. You can get it from or use the links below (if you're a registered XDA member).

Here's a one-click root with almost all phones and all android versions. (including the i9000, Droid, Nexus One, etc)


The program requires Microsoft .NET Framework 2.0+ or Mono v1.2.6+
Operations systems with native support:
  • Windows Vista
  • Windows 7
  • Ubuntu Hardy (8.04 LTS)
  • Ubuntu Jaunty (9.04)
  • Ubuntu Karmic (9.10)
  • Ubuntu Lucid (10.04 LTS)
  • Ubuntu Maverick (10.10)
  • Debian Lenny (5.0)
  • Debian Squeeze (testing)
  • Debian Sid (unstable)
  • Debian Experimental

If you run Microsoft Windows XP, install .NET Framework v2.0 or above
If you run Mac or another Linux flavor, make sure you install Mono:

For more information about making it work in linux:
See here

You NEED to put your phone on USB Debugging mode
You NEED to install make sure the Android drivers for your phone are installed
Make sure you DO NOT mount your SD card.
If you still can't get something to run, try doing it in recovery mode.

I registered my website so you can grab SuperOneClick from there now.


Great news. -1Day roots AT&T Motorola Atrix4G!!! YAY!


I'm sorry I haven't been updating lately!!! The problem is, I no longer have an Android phone and I can't play around or test anymore. I'm going to see if I can find one on craiglist or ebay.

I finally figured out how to root without looping. After rooting 13 phones, this is how I did it on the first try.

Turn USB Debugging OFF

Click Root

When it says: Waiting for Device, Turn USB Debugging ON

It'll now run RATC

When it says: Starting ADB Server...
Turn USB Debugging OFF
Turn USB Debugging ON
Turn USB Debugging OFF
All BEFORE it says "Waiting for device..." again

Hey guys! I'm sorry I haven't been able to respond to lots of posts. I've been really busy lately with work. I've been reading some posts and I've made some changes in v1.5.2

Let me know what bugs and issues you guys have.

Thanks to all that donated! I was worried for a bit but you guys proved me wrong. So, I fixed the NMA (non market apps) button. It should now install sqlite3 and busybox into a temporary folder if you don't have it. I added an unroot (by popular demand). I did some major code clean up, so you can expect faster releases from here on out. Next version will add sqlite3 and busybox to the /system partition included in root.

If you're having issues with "wait for device" or if RATC is looping, try this
Unplug your USB Cable
Go to Settings > Applications > Development
Uncheck USB Debugging
Plug in your USB Cable
Unplug your USB Cable
Check USB Debugging
Plug in your USB Cable

I need people with issues to post their device model and if they tried rooting in recovery mode. All posts ignoring the read me will be ignored. (meaning nma complaints and those NAND locked devices).
I'm getting flooded with replies, PMs and emails. Seriously, try reading a few posts back.
The program has been downloaded over 5000 times and only 2 people have have donated. I see donations as signs of gratitude. Even if it's 25 cents, please donate.
When I find the time (and will) I will work on the v1.5 release.
The rageagainstthecage looping is by design. Bad usb cables and ports can cause ratc to not run properly so I have it loop until it works. The "waiting for device" hang is for the same reason. There's nothing wrong with my application. It's usually your usb cable or port. This is not a cop-out answer. This is not an excuse as if I didn't know why it happens. This has been investigated and the problem is USB connectivity. It happens with my Captivate as well.

Enabling market apps isn't working unless you have busybox installed. I plan to fix this in the next version. The problem is, different devices have different locations for the and I was using the 'find' command to find your settings.db location. I didn't realize this was a busybox command not internal. That will be fixed.

I also added some information about root that I think people should read and classified different root levels.

By classifying root levels, I make it easier for the users to know if certain options will work or not. For example, enabling non-market apps will only require a Level 1 root, meaning it will work with the HTC Aria


Donate if you wish... (:

Compatibility list
Please note that if you device is not listed here, it doesn't automatically make it incompatible. The list is definitely incomplete.
Use the search feature to search for your phone model:
Incompatibility list

With the absolutely beautiful ADB exploit I use, titled rageagainstthecage (ratc), absolute ALL devices can be rooted. This is because it exploit is ADB which all devices use. There is an issue though. Some devices have a NAND lock which does not allow you to write to the /system mount. Because of this, you can't copy su, sqlite or busybox to /system/bin. This creates some issues but there is a work around. For things that don't need access to /system (like enabling non-market apps) I can use the ratc exploit to make those changes. If your device cannot use su in /system/bin then you can simple select a checkbox (as of v1.5) that says to use ratc.

There are 3 levels of "root" we can define:
Level 1: Shell Root (with ratc rooting the adb shell but no /system write access)
Level 2: Temporary Root (/system/bin/su installed but lost on reboot)
Level 3: Full Root (/system/bin/su installed and sticks)

Some devices have a NAND lock. SuperOneClick will only give a Shell root until you remove this lock.
The following phones can use to remove this lock:
  • Sprint EVO 4G (HTC Supersonic)
  • Droid Incredible (HTC Incredible)
  • HTC Desire GSM
  • HTC Desire CDMA (HTC BravoC)
  • HTC Aria
  • Droid Eris (HTC DesireC)
  • HTC Wildfire (HTC Buzz)

THe HTC Legend and My Touch 3G 32A also have a NAND lock and need more specific methods to unlock.

The T-Mobile (HTC) G2 has something different which may or may not be a hardware flaw. I have yet to really research the device, but while it may root, it won't be permanent since copying /su to /system/bin/su has problems. I believe this is a Level 2 root, but to be honest, I need to research more.

All other devices has a Level 3 root via SuperOneClick

Version changes:
Driver Installation Fix
Force Administrator on Vista/Win7
Fixed Non-Market Apps not working for some devices

GingerBreak support! (I think)

Bug fixes!
Should work better now on XP systems and Linux

Automatic driver installation
Removed RageAgainstTheCage (no virus flags)
New folder structure
Major code clean up

Hopefully fixed Linux hangs
Theoretical honeycomb support (still needs testing)

Fixed major bug. Oops!

Installs busybox to /system/xbin and installs syslinks
Added a 30 second timeout check (should eliminate all lock ups)

Mounts with busybox first
Includes version in first line

Fixed wrong su version being sent
Fixed issue when getting OS version
Prints device info on failure.

Falls back to previous mount path method if busybox method fails

Uses psneuter for exploit instead of rageagainstthecage by default (should root Sony Ericsson devices easily now)
Added detection for 1.x Donut/Eclair kernels
Uses busybox for getting mount path
Updated Windows ADB to latest version (I'll update the Mac/Linux ones next build)

Unroot uninstalls Superuser from /data/app
Returned installation of Superuser to /system/app

Fixed superuser install issue
Added a prompt to tell you to allow superuser on your phone, for the test.
Fixed unroot.

Fixed ADB-pushing problem

Administrative rights in Windows Vista/7 are automatically requested.
Fixed the settings.db search. (Tries default two locations, then uses busybox is all else fails).
Set Superuser to install (to data/apps) instead of copy to /system/apps. You can manually remove it from your phone like any other app. (You can also update it with the Market).
Fixed NMA not working if you didn't have Shell Root

Untested Mac and Linux support (you need Mono)

Fixed Non Market Apps
Added Unroot
Added separate Shell Root (rageagainstthecage) button
Lots of internal code clean up.

Changed main form's name to SuperOneClick from RageAgainstTheCageGUI
Enabled Captivate - Get Unlock Code button
Added a messagebox to confirm if Non Market Applications are enabled
Made "Enable Non Market Apps" FULLY universal
Added initial message telling you to remember to allow superuser commands (when enabling Non-Market Apps)

Removed busybox for space reasons. Changed the layout. Fixed issue where application stayed running in the background. Added Non Market App button.

Added a detection to see if RATC was already working.

Universal device support. Application now finds your /system path.

Initial release.

Development Plan:

Scheduled for next major release
  • Linux support via mono-project
  • Add a check box to use su or rageagainstthecage for other scripts (like Enable NMA)
  • Better error handling for devices with NAND lock on /system
  • Have options show what level root is needed (0,1,2,3)

To do list:
  • Jupiter fixes
  • Custom scripts support
  • Plugin support
  • Mac support via mono-project
  • Linux support via mono-project

  • None
Thanks to basily, I have an Captivate v2.1 nv_data.bin I can test with to create the unlock button.
I need a mac/linux user to help me. PM so we can chat on AIM/Google

Courtesy of, here's a step-by-step video:
Mod Edit: this app will set off some anti virus's a small explanation by pulser_g2:


rageagainstthecage is a root exploit via a fork bomb.

It IS a potentially malicious payload, BUT it is being used with owner's consent to root the phone.

The DreamDroid malware use exactly same payload - they are trojans, but this is a helpful tool.

It IS a dangerous tool in the wrong hands, but this is a root exploit, so you should exercise common sense and a little understanding of what it does and how it works.

The Following 723 Users Say Thank You to CLShortFuse For This Useful Post: [ View ] Gift CLShortFuse Ad-Free
9th October 2010, 08:40 AM |#2  
Senior Member
Flag Vancouver
Thanks Meter: 108
First reply!

Thanks!!! Even I won't be needing them at the moment

Now the next project... ability to sign the so recovery mode works!
The Following 10 Users Say Thank You to killer23d For This Useful Post: [ View ] Gift killer23d Ad-Free
9th October 2010, 09:01 AM |#3  
pilot_xphile's Avatar
Senior Member
Flag Miami, FL, USA
Thanks Meter: 52
Cool!! Thank you! =)
The Following 4 Users Say Thank You to pilot_xphile For This Useful Post: [ View ] Gift pilot_xphile Ad-Free
9th October 2010, 09:04 AM |#4  
Thanks Meter: 5
Good job i cant wait to try this out
The Following User Says Thank You to Monarky For This Useful Post: [ View ] Gift Monarky Ad-Free
9th October 2010, 09:05 AM |#5  
drewfinkel's Avatar
Junior Member
Flag Dallas
Thanks Meter: 2
The Following User Says Thank You to drewfinkel For This Useful Post: [ View ] Gift drewfinkel Ad-Free
9th October 2010, 10:51 AM |#6  
Junior Member
Thanks Meter: 0
What does this mean(in bold).
Originally Posted by CLShortFuse

I made it. I tested it. It works.

Here's a one-click root that works with Froyo on our Captivates. It's not just the Captivate. It works with almost all phones and all android versions. (including the i9000, Droid, Nexus One)

I've included busybox and sqlite3 because i wanted to. I'll make a full-fledged UI later (where you can select what apk to install, with or without busybox, etc);

If you don't have your Google SDK path set, include adb.exe in your folder (or just copy it to the sdk\tools folder).

It's Windows only at the moment (and you need .NET Framework 2.0+) but I'll port it to mac/linux later on (if you guys are that interested).


9th October 2010, 11:40 AM |#7  
kamots's Avatar
Senior Member
Flag Atlanta
Thanks Meter: 327
Originally Posted by ziphoward

What does this mean(in bold).

yep im wondering the same as i dont have any adb or or sdk installed on computer, as i dont know how to use either one. can i still use this?
9th October 2010, 02:17 PM |#8  
Flag Minneapolis
Thanks Meter: 1
Couldn't have been easier. However when I launched TiB after seeing the successful ROOT message box from the unroot app, I am not rooted.

Update to my post: ran again and Busy Box states that I am rooted.

9th October 2010, 02:42 PM |#9  
Junior Member
Thanks Meter: 0
When i run this .. The GUI just hangs with a blank screen .. no errors.. if i go to task manager there are two adb.exe processes and if i force close one the GUI closes.

Any ideas?
9th October 2010, 02:53 PM |#10  
OP Retired Recognized Developer
Thanks Meter: 946
Donate to Me
Originally Posted by joelmassee

Couldn't have been easier. However when I launched TiB after seeing the successful ROOT message box from the unroot app, I am not rooted.

Update to my post: ran again and Busy Box states that I am rooted.


You should reboot the phone, but I didn't want to make it mandatory. I'll add a prompt asking if you want to reboot.

Originally Posted by aramsumair

When i run this .. The GUI just hangs with a blank screen .. no errors.. if i go to task manager there are two adb.exe processes and if i force close one the GUI closes.

Any ideas?

Plug in a device
The Following 8 Users Say Thank You to CLShortFuse For This Useful Post: [ View ] Gift CLShortFuse Ad-Free
9th October 2010, 03:03 PM |#11  
Thanks Meter: 0
Originally Posted by kamots

yep im wondering the same as i dont have any adb or or sdk installed on computer, as i dont know how to use either one. can i still use this?

Me too have no clue about that!! Can anyone just type a "Step by step" to use this please?

Thread Closed Subscribe to Thread

2.2, galaxy, galaxy s brazil, galaxy y s5360, root, superoneclick, uckb2, z4root
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes