[ROOT][HOW-TO]Working Root Method for ICS 4.0.4

[Rick#2]

** Update ****************
************************
Posted a .zip with scripts for both Windows and *nix users to automate the process.

Linux:
-----
Unzip the contents of the attached ICS404root.zip anywhere on your computer and run the script aptly named "runme_root_script.sh". It should take care of the rest. Make sure you have USB Debugging enabled and you put the phone in Camera mode, not mass storage device.

Windows:
---------
Unzip ICS404root.zip wherever you want and then run "rootscript.bat". Make sure you have USB Debugging enabled and you put the phone in Camera mode, not mass storage device.
*************************
*************************

Credit to miloj for finding this technique on the Transformer. (See the thread noted below and be sure to thank him!) I modified it to work on our devices.

http://forum.xda-developers.com/showthread.php?t=1704209

I'll put together a script to automate this process shortly, but if you're antsy like me, here's the lowdown:

1. Download the following files:

su: http://db.tt/ShPzea6I
debugfs: http://db.tt/bGFh43LZ

2. Save the two files downloaded above on /sdcard. (ie: mount your sdcard in windows and copy them over, or "adb push" them to /sdcard).

**Make sure you have your phone on Mount Camera mode, not as a mass storage device; otherwise, you won't be able to access your /sdcard directory via adb. **

3. In a linux terminal/Windows command prompt:

adb shell

[email protected]_maserati:/ $ cd /sdcard
[email protected]_maserati:/ $ cp su /data/local/12m/
[email protected]_maserati:/ $ cp debugfs /data/local/12m/
[email protected]_maserati:/ $ cd /data/local/12m
[email protected]_maserati:/ $ chmod 755 debugfs
[email protected]_maserati:/ $ chmod 755 su
[email protected]_maserati:/ $ mv batch batch.bak
[email protected]_maserati:/ $ ln -s /dev/block/mmcblk1p20 batch
[email protected]_maserati:/ $ exit

adb reboot

4. While you are waiting for the phone to reboot, type the following into your terminal/command window:

adb wait-for-device shell

5. Once you're back into the android shell:

[email protected]_maserati:/ $ cd /data/local/12m
[email protected]_maserati:/ $ rm batch
[email protected]_maserati:/ $ mv batch.bak batch
[email protected]_maserati:/ $ /data/local/12m/debugfs -w /dev/block/mmcblk1p20

(The following is entered at the "debugfs:" prompt)

debugfs: # cd xbin
debugfs: # write /data/local/12m/su su
debugfs: # set_inode_field su mode 0104755
debugfs: # set_inode_field su uid 0
debugfs: # set_inode_field su gid 0
debugfs: # quit

[email protected]_maserati:/ $ cd /data/local/12m
[email protected]_maserati:/ $ rm su
[email protected]_maserati:/ $ rm debugfs
[email protected]_maserati:/ $ exit

adb reboot

Done deal. Now you've got the "su" binary pushed to your /system partition and set with the proper permissions for execution. Download the Superuser app from the market and you're good to go. Make sure you update the su binary within the Superuser app as well to make sure you're up to date.

 

[danifunker]

Awesome! Were you able to upgrade to the latest leak and not lose root? Btw, what carrier are you on? I figured out how to get tethering fully functional on rogers but the process requires root...

Sent from my XT894 running ICS

 

[Rick#2]

You bet. I had to fastboot the leaked .208 update over top of the .206 update yesterday because I messed up my /system partition; I had used the OTA Rootkeeper to keep root permissions when upgrading from .219 but had foolishly disabled it right before I bungled everything up.

So to sum it up, this method didn't require anything to be done before updating to the .208 leak; since it has nothing to do with the technical details of the kernel itself, I'm fairly certain it should work for the .200 or .206 leaks as well. Root permissions were obtained from a completely stock system.

I'm in Canada with Bell but it doesn't matter because I imported the phone from the US; Verizon is the only carrier that has this phone. At any rate, this method is pretty universal, it is preying on a vulnerability present in the stock init.rc file and I bet it would work on other phones such as the RAZR as well.

 

[gdeeble]

So we can confirm this is 100% working with Fastbooting back and moving to 208? If so I will probably jump on this immediately.

 

[droidian1441]

I am trying to do this method but I cant adb to detect my phone. Im on the .208 leak. Can anybody help?

 

[Rick#2]

Have you enabled USB Debugging in the Settings->Developer Options menu?

 

[droidian1441]

Have you enabled USB Debugging in the Settings->Developer Options menu?

Yep.

 

[Die Bruine]

Not able to reboot, trying manually...

debugfs:  /data/local/12m/su: Permission denied
debugfs:  su: File not found by ext2_lookup
debugfs:  su: File not found by ext2_lookup
debugfs:  su: File not found by ext2_lookup

Had to reboot manually twice. This is the only error message I received. Tried Superuser, but it stops.

I'm on .200 btw.

 

[Grizzy3]

Yep.

I'm having the same issue. I'm on the 208 leak. I start command prompt in windows then type "adb shell" and I get the "device not found" message. I enabled usb debugging and my phone is connected as mass storage.

 

[gdeeble]

Likewise, Reboot requires su access, manual only. When I go and run the write command in debugfs permission denied. Any ideas what would cause this? Based on the code shown in the first post, SU had been already acquired(# vs $), which makes me wonder here.

 

[Rick#2]

Not able to reboot, trying manually...

debugfs:  /data/local/12m/su: Permission denied
debugfs:  su: File not found by ext2_lookup
debugfs:  su: File not found by ext2_lookup
debugfs:  su: File not found by ext2_lookup

Had to reboot manually twice. This is the only error message I received. Tried Superuser, but it stops.

I'm on .200 btw.

Looks like you're doing something wrong with the debugfs command; you don't want to enter /data/local/12m/su at that prompt.

Running su from any partition other than /system will lead to a permissions error, so you don't want to bother trying to execute it from the /data/local/12m location.

(The following is entered at the "debugfs:" prompt, ie: after executing /data/local/12m/debugfs -w /dev/block/mmcblk1p20; see step 5.)

debugfs: # cd xbin
debugfs: # write /data/local/12m/su su
debugfs: # set_inode_field su mode 0104755
debugfs: # set_inode_field su uid 0
debugfs: # set_inode_field su gid 0
debugfs: # quit

 

[droidian1441]

I'm having the same issue. I'm on the 208 leak. I start command prompt in windows then type "adb shell" and I get the "device not found" message. I enabled usb debugging and my phone is connected as mass storage.

Ive got the same situation over here. I can stick without root, just the fact that I would have it again would be just the single reason to do it. Lol.

Sent from my DROID4 using Tapatalk 2

 

[gdeeble]

debugfs 1.42 (29-Nov-2011)
debugfs:  cd xbin
cd xbin
debugfs:  write /data/local/12m/su su
write /data/local/12m/su su
/data/local/12m/su: Permission denied

Rick, that's what we're putting in. From the code you posted it shows that you had root access already. Do you have any other suggestions on this? Because that's the in and out I get.

---------- Post added at 04:57 AM ---------- Previous post was at 04:53 AM ----------

Problem resolved. Need to run the following code:

chmod 755 debugfs
chmod 755 su

Then continue with rooting.

 

[Rick#2]

From the code you posted it shows that you had root access already.

Not sure where you're making this assumption from. I just wrote the "#" symbol in there to signal where to start entering commands... though I suppose you're correct in pointing out that the "#" shows up on a root prompt. A smarter choice probably would have been "$".

Trust me, I'm not an idiot. I wouldn't have gone through the hassle of writing up the guide in the first post if it didn't work.

 

[gdeeble]

Didn't mean it that way, just looked like it already had root, which was what confused me. But thanks again for this. :-D

 

[Die Bruine]

Tried it again. This time no errors and the phone rebooted. But now Superuser keeps on FC .

Reinstalled superuser, updated and busybox. Now rooted! Thnx.

BTW, you might wanna update the OP. Do not batch the commands under windows. I tried several times. I think there is something wrong with the timing. Manually entering all the commands in a shell works. But putting them in a batch will enter them too fast for ADB to handle (under Windows shell) I guess.

 

[Rick#2]

BTW, you might wanna update the OP. Do not batch the commands under windows. I tried several times.

I don't know, it seemed to work fine for me with the script I made. Anyways, glad it worked out for you.

Now that we can re-root as well as (somewhat convolutedly) fastboot ourselves back on track, we're good to go.

 

[azrael293]

Ive got the same situation over here. I can stick without root, just the fact that I would have it again would be just the single reason to do it. Lol.

Sent from my DROID4 using Tapatalk 2

As stated in the guide, you need to be in camera mode not mass storage.

Sent from my DROID4 using XDA

 

[rumgool]

I was trying to do it manually last night before the OP posted the batch file, and it was not working because I was in MTP instead of PTP. SO make sure you use PTP.

Put your phone in camera (PTP) mode for the USB connection and it should work fine. Also, after it completes, download Superuser from the market.

I ran Titanium Backup after everything and it told me it needed to fix my su binary permissions or something like that... I let it do its thing... Either way, IT WORKED!!!!!

 

[Grizzy3]

I put it in camera mode and made sure usb debugging is enabled. Then I ran the script for windows. Still getting the device not found error throughout. Really don't know what's going on.