• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

[Nook HD+] Nook HD and HD+ rooting instructions (now permanent)

Search This thread

verygreen

Senior Member
Feb 13, 2011
1,305
2,637
TN
linuxhacker.ru
How to root Nook HD+ (and Nook HD too, I guess).
(Thanks for some useful ideas to sparkym3: http://forum.xda-developers.com/member.php?u=4411543 )

(tested only on 2.0.0 version (as comes out of the box), also works on 2.0.2

Get one of the attached files: root_win.zip if you are on windows, or root_unix.tgz if you are on Linux or Mac.

unpack the file to some dir and run "makeroot" on Windows or "sh makeroot.sh" on Mac/Linux

After a couple of reboots you should be able to do
adb shell and issue a "su" command in the shell and get the root prompt (#).

Thanks to someone0 for his prior investigations here.

Known bugs:
Superuser.apk does not really install because package manager could not be contacted.

Oh, and I think you'll find this interesting too:
 

Attachments

  • root_win.zip
    1.3 MB · Views: 8,115
  • root_unix.tar.gz
    1.3 MB · Views: 2,223
Last edited:

verygreen

Senior Member
Feb 13, 2011
1,305
2,637
TN
linuxhacker.ru
I noticed that people see their Nook HDs restoring to factory settings after 8 unsuccessful reboots next time you boot after rooting, so possibly there's some extra check somewhere.
Very sneaky on the B&N side, I'd say.
 

roustabout

Senior Member
Feb 12, 2011
825
212
Hm, the 8 failed boot = wipe and restore has been true since the NC, and is valuable because it helps keep the device from getting bricked, also triggerable if the registration token doesn't match BN's reg token. I learned this early on by restoring a backup made before I'd erased and deregistered. I forget where the token lives, in /data/ somewhere.

I'll take a look at this on 2.0.2 this weekend - mine updated before I got ADB working so it restores to 2.0.2 now...

OK, so this approach does work with the 2.0.2 OS, and restarting the device does put it into a boot cycle. Very nasty.

Before I rebooted, I removed the post_boot_hook file and also got rid of the symlink; I'd say BN is doing some kind of inventory of what's in system and driving a reflash based on that.

My guess is it's not a very careful inventory, but it'll certainly be amenable to study now that we can get, at least temporarily, root.

Hm. Interesting -- my ability to mkdir /data/su is now gone after the restore. I wasn't able to do it the first time I tried, either - I suspect that there's something keeping some level of eye on that.

Oh, very uncool - in addition to resetting the system, they wipe personal data in the process. Losing the apps doesn't surprise me much. Losing the books I'd sideloaded surprises me.
 
Last edited:
  • Like
Reactions: gsutton

MrCamby

Senior Member
Apr 4, 2012
72
26
Hm, the 8 failed boot = wipe and restore has been true since the NC, and is valuable because it helps keep the device from getting bricked, also triggerable if the registration token doesn't match BN's reg token. I learned this early on by restoring a backup made before I'd erased and deregistered. I forget where the token lives, in /data/ somewhere.

I'll take a look at this on 2.0.2 this weekend - mine updated before I got ADB working so it restores to 2.0.2 now...

OK, so this approach does work with the 2.0.2 OS, and restarting the device does put it into a boot cycle. Very nasty.

Before I rebooted, I removed the post_boot_hook file and also got rid of the symlink; I'd say BN is doing some kind of inventory of what's in system and driving a reflash based on that.

My guess is it's not a very careful inventory, but it'll certainly be amenable to study now that we can get, at least temporarily, root.

Hm. Interesting -- my ability to mkdir /data/su is now gone after the restore. I wasn't able to do it the first time I tried, either - I suspect that there's something keeping some level of eye on that.

Oh, very uncool - in addition to resetting the system, they wipe personal data in the process. Losing the apps doesn't surprise me much. Losing the books I'd sideloaded surprises me.

Do the new HD & HD+ still allow you boot from the external sd card ?
 

krylon360

Retired Recognized Developer
May 10, 2010
2,226
3,102
Provo
www.teamwhiskey.com
Hm, the 8 failed boot = wipe and restore has been true since the NC, and is valuable because it helps keep the device from getting bricked, also triggerable if the registration token doesn't match BN's reg token. I learned this early on by restoring a backup made before I'd erased and deregistered. I forget where the token lives, in /data/ somewhere.

I'll take a look at this on 2.0.2 this weekend - mine updated before I got ADB working so it restores to 2.0.2 now...

OK, so this approach does work with the 2.0.2 OS, and restarting the device does put it into a boot cycle. Very nasty.

Before I rebooted, I removed the post_boot_hook file and also got rid of the symlink; I'd say BN is doing some kind of inventory of what's in system and driving a reflash based on that.

My guess is it's not a very careful inventory, but it'll certainly be amenable to study now that we can get, at least temporarily, root.

Hm. Interesting -- my ability to mkdir /data/su is now gone after the restore. I wasn't able to do it the first time I tried, either - I suspect that there's something keeping some level of eye on that.

Oh, very uncool - in addition to resetting the system, they wipe personal data in the process. Losing the apps doesn't surprise me much. Losing the books I'd sideloaded surprises me.

if you put your books into /system/media, it will back them up to the cloud
 
  • Like
Reactions: meteorrock

leapinlar

Senior Member
Oct 18, 2006
8,873
3,876
Is it possible to push a new recovery with adb after rooting? The 8 failed boot repair is only possible with the stock recovery. But then again you may end up in an endless bootloop without it there to finish it's task. But maybe you can find and delete the trigger flag that starts the process.
 

krylon360

Retired Recognized Developer
May 10, 2010
2,226
3,102
Provo
www.teamwhiskey.com
Is it possible to push a new recovery with adb after rooting? The 8 failed boot repair is only possible with the stock recovery. But then again you may end up in an endless bootloop without it there to finish it's task. But maybe you can find and delete the trigger flag that starts the process.

stuff is best to be not mentioned. :) /sarcasm.....
 
  • Like
Reactions: meteorrock

roberc567

New member
Apr 23, 2011
2
0
verygreen:

I just want to thank you for your all your work on the Nook series. I've been using your "size-agnostic method ..." tools and process to run from the SD card on my Nook Color since you created the method, and now I'm excited to use your work on my new Nook HD+ (just received yesterday) !
 

someone0

Senior Member
May 5, 2010
711
280
Something is interesting, eventhough mine originally got automatically updated to 2.0.2, but after the factory reset, it went back to 2.0.0. But for some weird reason I can't get root.

Maybe this will help, the build number is 2.0.0.1031.lithium01.ovation.rldp.s68403 with the manufactured date 10/22/2012
please compare mine to your.

I also rewrote your code into a batch file. You can double check it I guess.
Code:
@echo off
cls
@echo .
@echo wait for it
@echo .
adb devices
@echo .
@echo if you do not see you device listed above hit ctrl+c and exit the script
@echo then check adb on your PC and device then try again.
@echo .
@echo reroute /data/local/tmp
adb wait-for-devices shell rm -r /data/local/tmp
adb shell ln -s /data/ /data/local/tmp
@echo .
@echo Now rebooting
@echo .
adb reboot
@echo .
@echo waiting for reboot to finish and making directory /data/su
adb wait-for-devices shell mkdir /data/su
@echo uploading su
adb push su /data/su/
@echo uploading busybox
adb push busybox /data/su/
@echo uploading boot_complete_hoot
adb push boot_complete_hook.txt /data/boot_complete_hook.sh
adb shell chmod 755 /data/boot_complete_hook.sh /data/su/*
@echo .
@echo Now rebooting again
@echo .
adb reboot
@echo .
@echo waiting for reboot to finish and getting shell
adb wait-for-devices shell
 
Last edited:

verygreen

Senior Member
Feb 13, 2011
1,305
2,637
TN
linuxhacker.ru
Something is interesting, eventhough mine originally got automatically updated to 2.0.2, but after the factory reset, it went back to 2.0.0. But for some weird reason I can't get root.

Maybe this will help, the build number is 2.0.0.1031.lithium01.ovation.rldp.s68403 with the manufactured date 10/22/2012
please compare mine to your.

I also rewrote your code into a batch file. You can double check it I guess.
so, when you run this, after the final adb shell, what are the permissions on /system/xbin/su?

run su and you should get the root prompt.
 

someone0

Senior Member
May 5, 2010
711
280
I don't get root prompt, su never get copied to /system/xbin/su
here is the list of my finding.
Code:
/data/
-rwxr-xr-x shell    shell         167 2012-11-10 05:52 boot_complete_hook.sh
/data/su
-rwxr-xr-x shell    shell      586212 2012-11-10 06:07 busybox
-rwxr-xr-x shell    shell       22364 2012-11-10 06:07 su
/data/local
lrwxrwxrwx shell    shell             2012-11-10 06:20 tmp -> /data/

cat boot_complete_hook.sh
#!/system/bin/sh
/data/su/busybox mount /system -o remount,rw
/data/su/busybox cp /data/su/su /system/xbin/su
chown 0.0 /system/xbin/su
everything is in place and correct, but no dice. either boot_complete_hook.sh didn't get executed or it did but never get launched with root permission.
 
Last edited:

verygreen

Senior Member
Feb 13, 2011
1,305
2,637
TN
linuxhacker.ru
I don't get root prompt, su never get copied to /system/xbin/su
here is the list of my finding.
Code:
/data/
-rwxr-xr-x shell    shell         167 2012-11-10 05:52 boot_complete_hook.sh
/data/su
-rwxr-xr-x shell    shell      586212 2012-11-10 06:07 busybox
-rwxr-xr-x shell    shell       22364 2012-11-10 06:07 su
/data/local
lrwxrwxrwx shell    shell             2012-11-10 06:20 tmp -> /data/

cat boot_complete_hook.sh
#!/system/bin/sh
/data/su/busybox mount /system -o remount,rw
/data/su/busybox cp /data/su/su /system/xbin/su
chown 0.0 /system/xbin/su
everything is in place and correct, but no dice.
well, there should be more stuff in the shell file, you miss the final chown line: chmod 06755 /system/xbin/su
 

someone0

Senior Member
May 5, 2010
711
280
It did, I just didn't copy and paste the output correctly. But regardless, since the foulder /system/xbin don't have the su file, this mean as I suspected earlier, either it wasn't executed or lauched w/ root permission.
 

someone0

Senior Member
May 5, 2010
711
280
check if your /system/bin/clrbootcount.sh calls /data/boot_complete_hook.sh

This is interesting, it look as if it won't launch the /data/boot_complete_hook.sh
Code:
cat /data/boot_complete_hook.sh
#!/system/bin/sh
/data/su/busybox mount /system -o remount,rw
/data/su/busybox cp /data/su/su /system/xbin/su
chown 0.0 /system/xbin/su
chmod 06755 /system/xbin/su
[B][email protected]:/data $ /data/boot_complete_hook.sh
/data/boot_complete_hook.sh
/system/bin/sh: /data/boot_complete_hook.sh: No such file or directory
1|[email protected]:/data $
[/B]
Yub it does
Code:
cat clrbootcount.sh
#!/system/bin/sh
################################################################################
##
#
# File          clrbootcount.sh
# Description   Clear the bootcount variable to 0 on successful boot
#
##
# Run potential hook first.
[B]/data/boot_complete_hook.sh[/B]
# Zero the boot count
cat /system/etc/zerobootcnt > /bootdata/BootCnt
 

Top Liked Posts

  • There are no posts matching your filters.
  • 16
    How to root Nook HD+ (and Nook HD too, I guess).
    (Thanks for some useful ideas to sparkym3: http://forum.xda-developers.com/member.php?u=4411543 )

    (tested only on 2.0.0 version (as comes out of the box), also works on 2.0.2

    Get one of the attached files: root_win.zip if you are on windows, or root_unix.tgz if you are on Linux or Mac.

    unpack the file to some dir and run "makeroot" on Windows or "sh makeroot.sh" on Mac/Linux

    After a couple of reboots you should be able to do
    adb shell and issue a "su" command in the shell and get the root prompt (#).

    Thanks to someone0 for his prior investigations here.

    Known bugs:
    Superuser.apk does not really install because package manager could not be contacted.

    Oh, and I think you'll find this interesting too:
    5
    CWM is now possible too.

    4
    I am back from the conference and can play this stuff again ;)

    So I think I figured out how the thing detects it has been tampered with.
    In the root of the ramdisk there is a /manifest file that contans a list of all files in /system and their checksums.
    init reads the file and then verifies every file in /system to match the recorded checksum. Missing file is ok too.
    Having any files not in the list or a file whose checksum does not match = reboot right away (unless ro.secure is set to 0).
    Good news is that it only cares about files, so you can create directories and symlinks freely.

    Since hacking bootloader to circumvent ramdisk security check just for rooting is overkill, I guess the best solution for now will be to use a method somewhat similar to method by someone0 and a symlink from /system/xbin/su to a real su somewhere (sadly there's nothing but /system mounted without nosuid option, so no easy way to place su on e.g. /data and symlink there).
    That's going to be a very fragile root, though.

    I have some thoughts on how to better defeat this, but we'll see what's B&N approach going to be wrt fixing the existing holes first before showing them other holes, I guess.
    2
    hey how do you get nooktools installed to the system/app? i have the .apk installed via adb but when i copy the apk to /system/app it just force closes.
    You should not have adb installed it first. You need to uninstall the app from your device using settings. Make sure you do not have it in /system/app, then reboot to clear things. Then put the app in /system/app and look for it in your launcher. Then do the unknown sources thing, then remove from /system/app and you should be good. I later reinstalled it to use the hidden settings part of the app. It only needs to be in /system for the unknown sources fix.

    And you should ask this question in only one thread.

    Sent from my Nook HD+ using Tapatalk
    2
    recovery is signed, so it's not super easy to replace it with anything that would run.
    The unsigned bootloader trick at the moment requires a boot from sdcard.