GhettoRoot for the Samsung Galaxy Note 2 (I605) - 4.4.2 ND7 using Ubuntu 14.04LTS
May or may not work on other Linux distributions.
May or may not work for you:
NO GUARANTEES. USE AT YOUR OWN RISK.
I copied the following from the 'ghettoroot.bat' file in the GhettoRoot directory.
Credit goes to whoever is responsible for GhettoRoot.
NO GUARANTEES. USE AT YOUR OWN RISK.
Phone must be in 'Developer Mode'.
Connected to PC via a USB cable.
Adb must be installed on PC
Download 'ghettoroot.zip' from here:
http://forum.xda-developers.com/not...lroot-port-t2864125/post55210343#post55210343
Make sure no Ghettoroot or parts of GhettoRoot are already on your Note 2 by removing old root files.
adb shell "rm -f /data/local/tmp/cube-towel; rm -rf /data/local/tmp/META-INF; rm -rf /data/local/tmp/SuperSU; rm -f /data/local/tmp/*SuperSU*.zip; rm -f /data/local/tmp/busybox; rm -f /data/local/tmp/foo"
Check to see if successful:
adb shell ls -l /data/local/tmp
Pushing necessary files to your phone.:
adb push /(Path to GhettoRoot Directory)/libs/armeabi/ghettoroot /data/local/tmp/ghettoroot
adb push /(Path to GhettoRoot Directory)/data/local/tmp /data/local/tmp
Starting root exploit:
[email protected]:~$ adb push /(Path to GhettoRoot Directory)/GhettoRoot/libs/armeabi/ghettoroot /data/local/tmp/ghettoroot & adb shell "cd data/local/tmp; chmod 0755 ghettoroot; ./ghettoroot %*"
The following happened:
[2] 6579
************************************************
native ghettoroot, aka cube-towel, aka towelroot
running with pid 15545
kernel version: Linux version 3.0.31-1496113 ([email protected]) (gcc version 4.4.3 (GCC) ) #1 SMP PREEMPT Thu May 8 01:19:38 KST 2014
found matching phone: Linux version 3.0.31-
modstring: 1337 0 1 0 4 0
************************************************
Enter send_magicmsg (722)
Enter make_socket (681)
Enter search_goodnum (842)
Enter accept_socket (1072)
Socket tastefully accepted.
Exit make_socket (709)
Enter wake_actionthread (622)
Enter make_sigaction (579)
Exit wake_actionthread (675)
Enter wake_actionthread (622)
Enter make_sigaction (579)
Exit wake_actionthread (675)
starting the dangerous things
Enter setup_exploit (817)
Exit setup_exploit (824)
Enter setup_exploit (817)
Exit setup_exploit (824)
search_goodnum 908
MAGIC: a0000800
MAGIC_ALT: 00100800
magicval: a0000820
Enter wake_actionthread (622)
Enter make_sigaction (579)
Exit wake_actionthread (675)
MAGIC = MAGIC_ALT;
search_goodnum 920
Enter setup_exploit (817)
Exit setup_exploit (824)
Enter wake_actionthread (622)
Enter make_sigaction (579)
Exit wake_actionthread (675)
0xd527a000 is a good number
Enter get_root (310; tid: 3cc0)
get_root 315
cpid1 resumed
In get_root(329): HACKS_fdm = 7 [/dev/pts/1]
In get_root(349): ph->limit_offset == 0
Enter setup_exploit (817)
Exit setup_exploit (824)
Enter wake_actionthread (622)
Enter make_sigaction (579)
Exit wake_actionthread (675)
0xd2695d5c is also a good number
Enter setup_exploit (817)
Exit setup_exploit (824)
Enter wake_actionthread (622)
Enter make_sigaction (579)
Exit wake_actionthread (675)
Enter get_root (310; tid: 3cc2)
GOING
get_root 315
cpid3 resumed
In get_root(358): read(HACKS_fdm, readbuf, sizeof readbuf);
get_root 361
In write_pipe(258) dest:d2684008 src:00011000 count:4
get_root 364
get_root 367
WOOT
Enter read_pipe (233)
read_pipe(236) src:d2684000 dest:40b99a4c count:16
Exit read_pipe(248): len:16
ti.task=e85ce600 .flags=00000200 .preempt_count=1 .addr_limit=ffffffff
Enter read_pipe (233)
read_pipe(236) src:e85ce600 dest:40b9964c count:1024
Exit read_pipe(248): len:1024
00000000 d2684000 00000002 00400040 00000000 00000000 00000001 00000001 00000082 00000082 00000082 00000000 c065fae0 00000000 0000006e 0253c825 00000001 db605dc0 00000000 db605dcc c316b5a0 00000001 d109a1e4 000005fb 000363ff 00000000 fcfee913 000046f7 000363ff 00000000 00000000 00000000 00000000 00000000 005e33e2 00000000 0000000e 00000000 006d0313 00000000 00000000 00000000 00000000 00000000 00000000 00000000 000d42db 00000000 000f9377 00000000 00000000 00000000 00000000 00000000 00008ca0 00000000 00007ab9 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 0000000d 00000000 00000000 00000000 00000000 00000000 0000000d 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 c316b570 00000000 00000000 e85ce768 e85ce768 00000000 000000c8 00000001 00000000 00000000 c316b610 00000000 00000000 00000000 00000000 00000001 00000000 00000000 e85ce7a4 e85ce7a4 00000000 0000000d 00000000 006cd897 00000000 d109a1e4 000005fb 00000000 00000000 c0acfb40 db604e50 0000008c e85ce7dc e85ce7dc e85ce7e4 e85ce7e4 e8229d40 e8229d40 00000001 00000001 00000000 00000001 00000000 00000000 00000000 ffffffff 00000000 00000000 00800000 00000000 00003cc2 00003cb9 db604c80 db604c80 e85ce834 e85ce834 e85ce83c e85ce83c db600cc0 e85ce848 e85ce848 e85ce850 e85ce850 00000000 dbd11148 dbd11140 db604ee4 e4873fcc e4873fc0 db604ef0 e4873fd0 e4873fc0 db600f3c e85cecbc 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000002 0000000a 000019b3 05429f05 000059f2 078c169f 00000001 00000000 00000000 00000000 00000000 00000000 00000000 e85ce8e0
Supposedly found credential at taskbuf[184]: c73dd400
Enter read_pipe (233)
read_pipe(236) src:c73dd400 dest:40b995f0 count:92
Exit read_pipe(248): len:92
Enter read_pipe (233)
read_pipe(236) src:cd1c3f80 dest:40b995d8 count:24
Exit read_pipe(248): len:24
YOU ARE A SCARY PHONE
In write_pipe(258) dest:cd1c3f80 src:40b995d8 count:24
In write_pipe(258) dest:c73dd400 src:40b995f0 count:92
In write_pipe(258) dest:e85ce824 src:00011004 count:4
-rw-rw-rw- root root 0 2014-10-06 13:28 rooted
856 KB/s (34208 bytes in 0.039s)
Package com.sec.knox.seandroid new state: disabled
Disabling Knox: Success
Disabling SEAndroid: Success
Package com.sec.knox.seandroid new state: disabled
Disabling Knox (again): Success
Package com.policydm new state: disabled
Disabling Policy Updater: Success
Disabling Local OTA Updates: Success
Package com.sec.android.fwupgrade new state: disabled
Disabling FWUpgrade: Success
Disabling Samsung Data Migration tool: Success
Remounting /system: Success
Remounting /: Success
Archive: /data/local/tmp/UPDATE-SuperSU.zip
inflating: META-INF/com/google/android/update-binary
inflating: META-INF/com/google/android/updater-script
/system/bin/cp: /system/app/Maps.apk: No such file or directory
ui_print *********************
ui_print
ui_print SuperSU installer ZIP
ui_print
ui_print *********************
ui_print
ui_print - Mounting /system, /data and rootfs
ui_print
Usage: mount [-r] [-w] [-o options] [-t type] device directory
Usage: mount [-r] [-w] [-o options] [-t type] device directory
skip reached end of input
skip reached end of input
2+0 records in
2+0 records out
2 bytes transferred in 0.001 secs (2000 bytes/sec)
ui_print - Extracting files
ui_print
Archive: /data/local/tmp/UPDATE-SuperSU.zip
inflating: META-INF/MANIFEST.MF
inflating: META-INF/CERT.SF
inflating: META-INF/CERT.RSA
inflating: META-INF/com/google/android/update-binary
inflating: META-INF/com/google/android/updater-script
inflating: arm/chattr
inflating: arm/chattr.pie
inflating: arm/su
inflating: common/99SuperSUDaemon
inflating: common/Superuser.apk
inflating: common/install-recovery.sh
inflating: x86/chattr
inflating: x86/chattr.pie
inflating: x86/su
ui_print - Disabling OTA survival
ui_print
/tmp/supersu/arm/chattr: No such file or directory while trying to stat /system/xbin/su
/tmp/supersu/arm/chattr.pie: No such file or directory while trying to stat /system/xbin/su
/tmp/supersu/arm/chattr: No such file or directory while trying to stat /system/bin/.ext/.su
/tmp/supersu/arm/chattr.pie: No such file or directory while trying to stat /system/bin/.ext/.su
/tmp/supersu/arm/chattr: No such file or directory while trying to stat /system/xbin/daemonsu
/tmp/supersu/arm/chattr.pie: No such file or directory while trying to stat /system/xbin/daemonsu
/tmp/supersu/arm/chattr: No such file or directory while trying to stat /system/etc/install-recovery.sh
/tmp/supersu/arm/chattr.pie: No such file or directory while trying to stat /system/etc/install-recovery.sh
ui_print - Removing old files
ui_print
ui_print - Creating space
ui_print
cp: /system/app/Maps.apk: No such file or directory
rm failed for /system/app/Maps.apk, No such file or directory
ui_print - Placing files
ui_print
mkdir failed for /system/bin/.ext, File exists
cp: /system/etc/init.d/99SuperSUDaemon: No such file or directory
ui_print - Restoring files
ui_print
cp: /Maps.apk: No such file or directory
rm failed for /Maps.apk, No such file or directory
ui_print - Setting permissions
ui_print
Unable to chown /system/etc/init.d/99SuperSUDaemon: No such file or directory
Unable to chown /system/etc/init.d/99SuperSUDaemon: No such file or directory
Unable to chmod /system/etc/init.d/99SuperSUDaemon: No such file or directory
Unable to chown /system/app/Maps.apk: No such file or directory
Unable to chown /system/app/Maps.apk: No such file or directory
Unable to chmod /system/app/Maps.apk: No such file or directory
chcon: Could not label /system/etc/init.d/99SuperSUDaemon with u
bject_r:system_file:s0: No such file or directory
chcon: Could not label /system/etc/init.d/99SuperSUDaemon with ubject_r:system_file:s0: No such file or directory
chcon: Could not label /system/app/Maps.apk with ubject_r:system_file:s0: No such file or directory
chcon: Could not label /system/app/Maps.apk with ubject_r:system_file:s0: No such file or directory
ui_print - Post-installation script
ui_print
ui_print - Unmounting /system and /data
ui_print
failed: Device or resource busy
failed: Device or resource busy
ui_print - Done !
ui_print
failed on '/system/app/Maps.apk.prespaz' - No such file or directory
get_root 550
: No such file or directory
User command failed (-1)Error running user command: 65280Thank you for choosing ghettoroot. Please enjoy your stay.
Your device will reboot in 10 seconds.
This is normal. Thanks for waiting.
10 seconds...
5 seconds...
Rebooting...
[1] Done adb push ~/Down*/Ghetto/GhettoRoot/libs/armeabi/ghettoroot /data/local/tmp/ghettoroot
[2]+ Done adb push ~/Down*/Ghetto/GhettoRoot/libs/armeabi/ghettoroot /data/local/tmp/ghettoroot
[email protected]:~$
IT WORKED FOR ME. MAY OR MAY NOT WORK FOR YOU.
May or may not work on other Linux distributions.
May or may not work for you:
NO GUARANTEES. USE AT YOUR OWN RISK.
I copied the following from the 'ghettoroot.bat' file in the GhettoRoot directory.
Credit goes to whoever is responsible for GhettoRoot.
NO GUARANTEES. USE AT YOUR OWN RISK.
Phone must be in 'Developer Mode'.
Connected to PC via a USB cable.
Adb must be installed on PC
Download 'ghettoroot.zip' from here:
http://forum.xda-developers.com/not...lroot-port-t2864125/post55210343#post55210343
Make sure no Ghettoroot or parts of GhettoRoot are already on your Note 2 by removing old root files.
adb shell "rm -f /data/local/tmp/cube-towel; rm -rf /data/local/tmp/META-INF; rm -rf /data/local/tmp/SuperSU; rm -f /data/local/tmp/*SuperSU*.zip; rm -f /data/local/tmp/busybox; rm -f /data/local/tmp/foo"
Check to see if successful:
adb shell ls -l /data/local/tmp
Pushing necessary files to your phone.:
adb push /(Path to GhettoRoot Directory)/libs/armeabi/ghettoroot /data/local/tmp/ghettoroot
adb push /(Path to GhettoRoot Directory)/data/local/tmp /data/local/tmp
Starting root exploit:
[email protected]:~$ adb push /(Path to GhettoRoot Directory)/GhettoRoot/libs/armeabi/ghettoroot /data/local/tmp/ghettoroot & adb shell "cd data/local/tmp; chmod 0755 ghettoroot; ./ghettoroot %*"
The following happened:
[2] 6579
************************************************
native ghettoroot, aka cube-towel, aka towelroot
running with pid 15545
kernel version: Linux version 3.0.31-1496113 ([email protected]) (gcc version 4.4.3 (GCC) ) #1 SMP PREEMPT Thu May 8 01:19:38 KST 2014
found matching phone: Linux version 3.0.31-
modstring: 1337 0 1 0 4 0
************************************************
Enter send_magicmsg (722)
Enter make_socket (681)
Enter search_goodnum (842)
Enter accept_socket (1072)
Socket tastefully accepted.
Exit make_socket (709)
Enter wake_actionthread (622)
Enter make_sigaction (579)
Exit wake_actionthread (675)
Enter wake_actionthread (622)
Enter make_sigaction (579)
Exit wake_actionthread (675)
starting the dangerous things
Enter setup_exploit (817)
Exit setup_exploit (824)
Enter setup_exploit (817)
Exit setup_exploit (824)
search_goodnum 908
MAGIC: a0000800
MAGIC_ALT: 00100800
magicval: a0000820
Enter wake_actionthread (622)
Enter make_sigaction (579)
Exit wake_actionthread (675)
MAGIC = MAGIC_ALT;
search_goodnum 920
Enter setup_exploit (817)
Exit setup_exploit (824)
Enter wake_actionthread (622)
Enter make_sigaction (579)
Exit wake_actionthread (675)
0xd527a000 is a good number
Enter get_root (310; tid: 3cc0)
get_root 315
cpid1 resumed
In get_root(329): HACKS_fdm = 7 [/dev/pts/1]
In get_root(349): ph->limit_offset == 0
Enter setup_exploit (817)
Exit setup_exploit (824)
Enter wake_actionthread (622)
Enter make_sigaction (579)
Exit wake_actionthread (675)
0xd2695d5c is also a good number
Enter setup_exploit (817)
Exit setup_exploit (824)
Enter wake_actionthread (622)
Enter make_sigaction (579)
Exit wake_actionthread (675)
Enter get_root (310; tid: 3cc2)
GOING
get_root 315
cpid3 resumed
In get_root(358): read(HACKS_fdm, readbuf, sizeof readbuf);
get_root 361
In write_pipe(258) dest:d2684008 src:00011000 count:4
get_root 364
get_root 367
WOOT
Enter read_pipe (233)
read_pipe(236) src:d2684000 dest:40b99a4c count:16
Exit read_pipe(248): len:16
ti.task=e85ce600 .flags=00000200 .preempt_count=1 .addr_limit=ffffffff
Enter read_pipe (233)
read_pipe(236) src:e85ce600 dest:40b9964c count:1024
Exit read_pipe(248): len:1024
00000000 d2684000 00000002 00400040 00000000 00000000 00000001 00000001 00000082 00000082 00000082 00000000 c065fae0 00000000 0000006e 0253c825 00000001 db605dc0 00000000 db605dcc c316b5a0 00000001 d109a1e4 000005fb 000363ff 00000000 fcfee913 000046f7 000363ff 00000000 00000000 00000000 00000000 00000000 005e33e2 00000000 0000000e 00000000 006d0313 00000000 00000000 00000000 00000000 00000000 00000000 00000000 000d42db 00000000 000f9377 00000000 00000000 00000000 00000000 00000000 00008ca0 00000000 00007ab9 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 0000000d 00000000 00000000 00000000 00000000 00000000 0000000d 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 c316b570 00000000 00000000 e85ce768 e85ce768 00000000 000000c8 00000001 00000000 00000000 c316b610 00000000 00000000 00000000 00000000 00000001 00000000 00000000 e85ce7a4 e85ce7a4 00000000 0000000d 00000000 006cd897 00000000 d109a1e4 000005fb 00000000 00000000 c0acfb40 db604e50 0000008c e85ce7dc e85ce7dc e85ce7e4 e85ce7e4 e8229d40 e8229d40 00000001 00000001 00000000 00000001 00000000 00000000 00000000 ffffffff 00000000 00000000 00800000 00000000 00003cc2 00003cb9 db604c80 db604c80 e85ce834 e85ce834 e85ce83c e85ce83c db600cc0 e85ce848 e85ce848 e85ce850 e85ce850 00000000 dbd11148 dbd11140 db604ee4 e4873fcc e4873fc0 db604ef0 e4873fd0 e4873fc0 db600f3c e85cecbc 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000002 0000000a 000019b3 05429f05 000059f2 078c169f 00000001 00000000 00000000 00000000 00000000 00000000 00000000 e85ce8e0
Supposedly found credential at taskbuf[184]: c73dd400
Enter read_pipe (233)
read_pipe(236) src:c73dd400 dest:40b995f0 count:92
Exit read_pipe(248): len:92
Enter read_pipe (233)
read_pipe(236) src:cd1c3f80 dest:40b995d8 count:24
Exit read_pipe(248): len:24
YOU ARE A SCARY PHONE
In write_pipe(258) dest:cd1c3f80 src:40b995d8 count:24
In write_pipe(258) dest:c73dd400 src:40b995f0 count:92
In write_pipe(258) dest:e85ce824 src:00011004 count:4
-rw-rw-rw- root root 0 2014-10-06 13:28 rooted
856 KB/s (34208 bytes in 0.039s)
Package com.sec.knox.seandroid new state: disabled
Disabling Knox: Success
Disabling SEAndroid: Success
Package com.sec.knox.seandroid new state: disabled
Disabling Knox (again): Success
Package com.policydm new state: disabled
Disabling Policy Updater: Success
Disabling Local OTA Updates: Success
Package com.sec.android.fwupgrade new state: disabled
Disabling FWUpgrade: Success
Disabling Samsung Data Migration tool: Success
Remounting /system: Success
Remounting /: Success
Archive: /data/local/tmp/UPDATE-SuperSU.zip
inflating: META-INF/com/google/android/update-binary
inflating: META-INF/com/google/android/updater-script
/system/bin/cp: /system/app/Maps.apk: No such file or directory
ui_print *********************
ui_print
ui_print SuperSU installer ZIP
ui_print
ui_print *********************
ui_print
ui_print - Mounting /system, /data and rootfs
ui_print
Usage: mount [-r] [-w] [-o options] [-t type] device directory
Usage: mount [-r] [-w] [-o options] [-t type] device directory
skip reached end of input
skip reached end of input
2+0 records in
2+0 records out
2 bytes transferred in 0.001 secs (2000 bytes/sec)
ui_print - Extracting files
ui_print
Archive: /data/local/tmp/UPDATE-SuperSU.zip
inflating: META-INF/MANIFEST.MF
inflating: META-INF/CERT.SF
inflating: META-INF/CERT.RSA
inflating: META-INF/com/google/android/update-binary
inflating: META-INF/com/google/android/updater-script
inflating: arm/chattr
inflating: arm/chattr.pie
inflating: arm/su
inflating: common/99SuperSUDaemon
inflating: common/Superuser.apk
inflating: common/install-recovery.sh
inflating: x86/chattr
inflating: x86/chattr.pie
inflating: x86/su
ui_print - Disabling OTA survival
ui_print
/tmp/supersu/arm/chattr: No such file or directory while trying to stat /system/xbin/su
/tmp/supersu/arm/chattr.pie: No such file or directory while trying to stat /system/xbin/su
/tmp/supersu/arm/chattr: No such file or directory while trying to stat /system/bin/.ext/.su
/tmp/supersu/arm/chattr.pie: No such file or directory while trying to stat /system/bin/.ext/.su
/tmp/supersu/arm/chattr: No such file or directory while trying to stat /system/xbin/daemonsu
/tmp/supersu/arm/chattr.pie: No such file or directory while trying to stat /system/xbin/daemonsu
/tmp/supersu/arm/chattr: No such file or directory while trying to stat /system/etc/install-recovery.sh
/tmp/supersu/arm/chattr.pie: No such file or directory while trying to stat /system/etc/install-recovery.sh
ui_print - Removing old files
ui_print
ui_print - Creating space
ui_print
cp: /system/app/Maps.apk: No such file or directory
rm failed for /system/app/Maps.apk, No such file or directory
ui_print - Placing files
ui_print
mkdir failed for /system/bin/.ext, File exists
cp: /system/etc/init.d/99SuperSUDaemon: No such file or directory
ui_print - Restoring files
ui_print
cp: /Maps.apk: No such file or directory
rm failed for /Maps.apk, No such file or directory
ui_print - Setting permissions
ui_print
Unable to chown /system/etc/init.d/99SuperSUDaemon: No such file or directory
Unable to chown /system/etc/init.d/99SuperSUDaemon: No such file or directory
Unable to chmod /system/etc/init.d/99SuperSUDaemon: No such file or directory
Unable to chown /system/app/Maps.apk: No such file or directory
Unable to chown /system/app/Maps.apk: No such file or directory
Unable to chmod /system/app/Maps.apk: No such file or directory
chcon: Could not label /system/etc/init.d/99SuperSUDaemon with u
bject_r:system_file:s0: No such file or directorychcon: Could not label /system/etc/init.d/99SuperSUDaemon with u
bject_r:system_file:s0: No such file or directorychcon: Could not label /system/app/Maps.apk with u
bject_r:system_file:s0: No such file or directorychcon: Could not label /system/app/Maps.apk with u
bject_r:system_file:s0: No such file or directoryui_print - Post-installation script
ui_print
ui_print - Unmounting /system and /data
ui_print
failed: Device or resource busy
failed: Device or resource busy
ui_print - Done !
ui_print
failed on '/system/app/Maps.apk.prespaz' - No such file or directory
get_root 550
: No such file or directory
User command failed (-1)Error running user command: 65280Thank you for choosing ghettoroot. Please enjoy your stay.
Your device will reboot in 10 seconds.
This is normal. Thanks for waiting.
10 seconds...
5 seconds...
Rebooting...
[1] Done adb push ~/Down*/Ghetto/GhettoRoot/libs/armeabi/ghettoroot /data/local/tmp/ghettoroot
[2]+ Done adb push ~/Down*/Ghetto/GhettoRoot/libs/armeabi/ghettoroot /data/local/tmp/ghettoroot
[email protected]:~$
IT WORKED FOR ME. MAY OR MAY NOT WORK FOR YOU.
