[ROOT][HOW-TO]Working Root Method for ICS 4.0.4

Rick#2

Senior Member
Mar 15, 2009
186
133
0
St. Albert
** Update ****************
************************
Posted a .zip with scripts for both Windows and *nix users to automate the process.

Linux:
-----
Unzip the contents of the attached ICS404root.zip anywhere on your computer and run the script aptly named "runme_root_script.sh". It should take care of the rest. Make sure you have USB Debugging enabled and you put the phone in Camera mode, not mass storage device.

Windows:
---------
Unzip ICS404root.zip wherever you want and then run "rootscript.bat". Make sure you have USB Debugging enabled and you put the phone in Camera mode, not mass storage device.
*************************
*************************

Credit to miloj for finding this technique on the Transformer. (See the thread noted below and be sure to thank him!) I modified it to work on our devices.

http://forum.xda-developers.com/showthread.php?t=1704209

I'll put together a script to automate this process shortly, but if you're antsy like me, here's the lowdown:

1. Download the following files:

su: http://db.tt/ShPzea6I
debugfs: http://db.tt/bGFh43LZ

2. Save the two files downloaded above on /sdcard. (ie: mount your sdcard in windows and copy them over, or "adb push" them to /sdcard).

**Make sure you have your phone on Mount Camera mode, not as a mass storage device; otherwise, you won't be able to access your /sdcard directory via adb. **

3. In a linux terminal/Windows command prompt:

Code:
adb shell

[email protected]_maserati:/ $ cd /sdcard
[email protected]_maserati:/ $ cp su /data/local/12m/
[email protected]_maserati:/ $ cp debugfs /data/local/12m/
[email protected]_maserati:/ $ cd /data/local/12m
[email protected]_maserati:/ $ chmod 755 debugfs
[email protected]_maserati:/ $ chmod 755 su
[email protected]_maserati:/ $ mv batch batch.bak
[email protected]_maserati:/ $ ln -s /dev/block/mmcblk1p20 batch
[email protected]_maserati:/ $ exit

adb reboot
4. While you are waiting for the phone to reboot, type the following into your terminal/command window:

Code:
adb wait-for-device shell
5. Once you're back into the android shell:

Code:
[email protected]_maserati:/ $ cd /data/local/12m
[email protected]_maserati:/ $ rm batch
[email protected]_maserati:/ $ mv batch.bak batch
[email protected]_maserati:/ $ /data/local/12m/debugfs -w /dev/block/mmcblk1p20

(The following is entered at the "debugfs:" prompt)

debugfs: # cd xbin
debugfs: # write /data/local/12m/su su
debugfs: # set_inode_field su mode 0104755
debugfs: # set_inode_field su uid 0
debugfs: # set_inode_field su gid 0
debugfs: # quit

[email protected]_maserati:/ $ cd /data/local/12m
[email protected]_maserati:/ $ rm su
[email protected]_maserati:/ $ rm debugfs
[email protected]_maserati:/ $ exit

adb reboot
Done deal. Now you've got the "su" binary pushed to your /system partition and set with the proper permissions for execution. Download the Superuser app from the market and you're good to go. Make sure you update the su binary within the Superuser app as well to make sure you're up to date.
 

Attachments

Last edited:

danifunker

Senior Member
Sep 12, 2011
892
242
63
38
Toronto
www.funkervogt.com
Awesome! Were you able to upgrade to the latest leak and not lose root? Btw, what carrier are you on? I figured out how to get tethering fully functional on rogers but the process requires root...

Sent from my XT894 running ICS
 

Rick#2

Senior Member
Mar 15, 2009
186
133
0
St. Albert
You bet. I had to fastboot the leaked .208 update over top of the .206 update yesterday because I messed up my /system partition; I had used the OTA Rootkeeper to keep root permissions when upgrading from .219 but had foolishly disabled it right before I bungled everything up.

So to sum it up, this method didn't require anything to be done before updating to the .208 leak; since it has nothing to do with the technical details of the kernel itself, I'm fairly certain it should work for the .200 or .206 leaks as well. Root permissions were obtained from a completely stock system.

I'm in Canada with Bell but it doesn't matter because I imported the phone from the US; Verizon is the only carrier that has this phone. At any rate, this method is pretty universal, it is preying on a vulnerability present in the stock init.rc file and I bet it would work on other phones such as the RAZR as well.
 
Last edited:

gdeeble

Senior Member
Oct 8, 2011
95
7
0
So we can confirm this is 100% working with Fastbooting back and moving to 208? If so I will probably jump on this immediately.
 

Die Bruine

Senior Member
Jan 2, 2008
569
34
58
Not able to reboot, trying manually...

Code:
debugfs:  /data/local/12m/su: Permission denied
debugfs:  su: File not found by ext2_lookup
debugfs:  su: File not found by ext2_lookup
debugfs:  su: File not found by ext2_lookup
Had to reboot manually twice. This is the only error message I received. Tried Superuser, but it stops.

I'm on .200 btw.
 
Last edited:

gdeeble

Senior Member
Oct 8, 2011
95
7
0
Likewise, Reboot requires su access, manual only. When I go and run the write command in debugfs permission denied. Any ideas what would cause this? Based on the code shown in the first post, SU had been already acquired(# vs $), which makes me wonder here.
 
Last edited:

Rick#2

Senior Member
Mar 15, 2009
186
133
0
St. Albert
Not able to reboot, trying manually...

Code:
debugfs:  /data/local/12m/su: Permission denied
debugfs:  su: File not found by ext2_lookup
debugfs:  su: File not found by ext2_lookup
debugfs:  su: File not found by ext2_lookup
Had to reboot manually twice. This is the only error message I received. Tried Superuser, but it stops.

I'm on .200 btw.
Looks like you're doing something wrong with the debugfs command; you don't want to enter /data/local/12m/su at that prompt.

Running su from any partition other than /system will lead to a permissions error, so you don't want to bother trying to execute it from the /data/local/12m location.

(The following is entered at the "debugfs:" prompt, ie: after executing /data/local/12m/debugfs -w /dev/block/mmcblk1p20; see step 5.)

Code:
debugfs: # cd xbin
debugfs: # write /data/local/12m/su su
debugfs: # set_inode_field su mode 0104755
debugfs: # set_inode_field su uid 0
debugfs: # set_inode_field su gid 0
debugfs: # quit
 

droidian1441

Senior Member
Sep 17, 2011
503
130
0
Christiansburg
I'm having the same issue. I'm on the 208 leak. I start command prompt in windows then type "adb shell" and I get the "device not found" message. I enabled usb debugging and my phone is connected as mass storage.
Ive got the same situation over here. I can stick without root, just the fact that I would have it again would be just the single reason to do it. Lol.

Sent from my DROID4 using Tapatalk 2
 

gdeeble

Senior Member
Oct 8, 2011
95
7
0
Code:
debugfs 1.42 (29-Nov-2011)
debugfs:  cd xbin
cd xbin
debugfs:  write /data/local/12m/su su
write /data/local/12m/su su
/data/local/12m/su: Permission denied
Rick, that's what we're putting in. From the code you posted it shows that you had root access already. Do you have any other suggestions on this? Because that's the in and out I get.

---------- Post added at 04:57 AM ---------- Previous post was at 04:53 AM ----------

Problem resolved. Need to run the following code:

Code:
chmod 755 debugfs
chmod 755 su
Then continue with rooting.
 
Last edited:

Rick#2

Senior Member
Mar 15, 2009
186
133
0
St. Albert
From the code you posted it shows that you had root access already.
Not sure where you're making this assumption from. I just wrote the "#" symbol in there to signal where to start entering commands... though I suppose you're correct in pointing out that the "#" shows up on a root prompt. A smarter choice probably would have been "$".

Trust me, I'm not an idiot. I wouldn't have gone through the hassle of writing up the guide in the first post if it didn't work. :p
 

Die Bruine

Senior Member
Jan 2, 2008
569
34
58
Tried it again. This time no errors and the phone rebooted. But now Superuser keeps on FC :eek: .

Reinstalled superuser, updated and busybox. Now rooted! Thnx.

BTW, you might wanna update the OP. Do not batch the commands under windows. I tried several times. I think there is something wrong with the timing. Manually entering all the commands in a shell works. But putting them in a batch will enter them too fast for ADB to handle (under Windows shell) I guess.
 
Last edited:

Rick#2

Senior Member
Mar 15, 2009
186
133
0
St. Albert
BTW, you might wanna update the OP. Do not batch the commands under windows. I tried several times.
I don't know, it seemed to work fine for me with the script I made. Anyways, glad it worked out for you.

Now that we can re-root as well as (somewhat convolutedly) fastboot ourselves back on track, we're good to go.
 
  • Like
Reactions: mj084

rumgool

Senior Member
Feb 16, 2012
147
24
0
GAINESVILLE
I was trying to do it manually last night before the OP posted the batch file, and it was not working because I was in MTP instead of PTP. SO make sure you use PTP.

Put your phone in camera (PTP) mode for the USB connection and it should work fine. Also, after it completes, download Superuser from the market.

I ran Titanium Backup after everything and it told me it needed to fix my su binary permissions or something like that... I let it do its thing... Either way, IT WORKED!!!!!
 

Grizzy3

Senior Member
Jan 7, 2012
187
27
0
I put it in camera mode and made sure usb debugging is enabled. Then I ran the script for windows. Still getting the device not found error throughout. Really don't know what's going on.
 
Our Apps
Get our official app!
The best way to access XDA on your phone
Nav Gestures
Add swipe gestures to any Android
One Handed Mode
Eases uses one hand with your phone