[ROOT] TPSparkyRoot - ICS

Search This thread

sparkym3

Senior Member
Dec 31, 2011
433
805
I have your ICS root ready, how about we call it TPSparkyRoot. I based my research on code written by Dan Rosenberg (similar to what jchase did with NachoRoot in the fact that chown/chmod follows symlinks even when set during startup), here is a link to that research http://vulnfactory.org/blog/2011/08/25/rooting-the-droid-3/

**UPDATE**
Android's source has been patched so that future OEMs can not leave this hole open by accident.
https://android-review.googlesource.com/#/c/36035/

**UPDATE**
This method has been shown to work on the HTC One X see forum
http://forum.xda-developers.com/showthread.php?t=1644167

Theoretically this should work on Honeycomb versions of the Prime as well, since the Honeycomb update is where I found the flaw that is being exploited. I have confirmed this works on my Prime.

**UPDATE**
This exploit does not currently work for the latest ICS update released (v9.4.2.11 on 1/18/2012). You can use OTA Rootkeeper to backup your root prior to updating using OTA, which I have confirmed to work on my device, (this may not work if you push the update manually).
https://market.android.com/details?id=org.projectvoodoo.otarootkeeper
For the devs out there, it does not to honor the ro.kernel.qemu=1 setting within the local.prop because it is already set to blank by that point by the build.prop


You must have your Prime set up to use adb and your adb location contained in your path variable (windows) or unzip the files from my zip into that directory before running.
**UPDATED**
If you are have issues getting adb working, make sure asus sync is not running, if it is then kill it.


adb shell mv /data/local/tmp /data/local/tmp.bak
adb shell ln -s /data /data/local/tmp
adb reboot
adb shell rm /data/local.prop > nul
adb shell "echo \"ro.kernel.qemu=1\" > /data/local.prop"
adb reboot
adb shell id
//IF ID IS 0/root THEN CONTINUE, ELSE START OVER>
adb remount
adb push su /system/xbin/su
adb shell chown 0.0 /system/xbin/su
adb shell chmod 06755 /system/xbin/su
//UNDO EVERYTHING EXCEPT su
adb shell rm /data/local.prop
adb shell rm /data/local/tmp
adb shell mv /data/local/tmp.bak /data/local/tmp
adb reboot

**UPDATE** As jchase stated "If your device "bootloops" don't stress, just follow through with the commands as it "loops" ro.kernel.qemu can do funky stuff." I did notice this in my rooting but just assumed it was normal as this is my first use of adb.

**UPDATE2**
If you get a permissions error on the call
adb shell "echo \"ro.kernel.qemu=1\" > /data/local.prop"
then you may try
adb shell rm /data/local.prop
And then try the echo command again. This may be due to having rooted prior without cleaning up properly. Thanks to Franky_402 for this piece of info.
I have updated the batch file to include this step, it should still be fine for those who are not having the issue as well.

I have attached a zip file containing the su and a bat file for a more automated process (just pauses when during reboots, don’t hit go until it’s done rebooting). Or, you can run the commands manually and get the su file from the origin http://downloads.androidsu.com/superuser/su-bin-3.0.3.2-efghi-signed.zip

Finally, install Superuser to make it all work https://market.android.com/details?id=com.noshufou.android.su

**UPDATE** UNROOT
There are multiple was to unroot now that you have root access already (all you need to do is remove the su file; so you could potential skip all the steps before the remount and just add the local.prop manually using a file manager and then reboot).

The one most similar way to how you rooted would be to follow all of the steps above, but replace these 3 lines
adb push su /system/xbin/su
adb shell chown 0.0 /system/xbin/su
adb shell chmod 06755 /system/xbin/su

with this line
adb shell rm /system/xbin/su

This will remove the actual root, but it would leave behind any apps that you have given root access to or any files that those apps changed themselves (i.e. RootKeeper backs up the su file and the backup would need to be removed). If you had anything like this you would need to clean up that first before unrooting because it is a dead giveaway that it was rooted.

Viperboy should be releasing his tool shortly that utilizes this method, if you would like a one click process that installs apps along with it (superuser, busybox). I’m guessing it installed them to the root apps directory so these also would need to be removed when unrooting as well (i.e. if you root using his new tool you should unroot using it as well).

**UPDATED** Remove PayPal link in favor of link over there <-
 

Attachments

  • TPSparkyRoot.zip
    6.8 KB · Views: 20,168
Last edited:

Haro912

Senior Member
Jul 27, 2011
1,643
156
29
Pittsburgh
The commands more than likely are but the exploit must be different or Jcases rot would still be working... Thanks OP!!!

EDIT: He didn't "ask" for donations just gave a link since he doesn't have the donate button <<over there
 
Last edited by a moderator:

rhcp0112345

Senior Member
Jun 17, 2010
1,595
128
39
North Carolina
Not mine at all, props to this guy! Send him some bones.

As the main man says. Give credit when due. It's not his. and give the guy props and if you wish to donate donate.

This is why this android community is crap. because everyone trolls. If it was jcases he'd release it. not someone else. and im sure as hell he wouldnt be saying these things 'like give the guy some bones'
 

Danny-B-

Senior Member
May 6, 2005
684
129
Scotland
As the main man says. Give credit when due. It's not his. and give the guy props and if you wish to donate donate.

This is why this android community is crap. because everyone trolls. If it was jcases he'd release it. not someone else. and im sure as hell he wouldnt be saying these things 'like give the guy some bones'

Biggem isnt really a troll, he's obv just got out of the wrong side of the bed ... i'm sure he'll take that back.
 

mattraab

Senior Member
Jan 30, 2011
102
17
Wait a minute, chainfire is paying attention to the thread, that only means good things. Please tell me your gonna dev some for this device

Sent from my SGH-T959 using XDA App
 

newellj79

Senior Member
Jan 2, 2011
2,370
296
not going good for me :( I'm on ubuntu with working adb. copied su to home directory and running all commands from there. when i get to, adb shell "echo \"ro.kernel.qemu=1\" > /data/local.prop", i get, /system/bin/sh: cannot create /data/local.prop: Permission denied. So i never get the right id to continue. Anyways please help. thankx
 

Top Liked Posts

  • There are no posts matching your filters.
  • 91
    I have your ICS root ready, how about we call it TPSparkyRoot. I based my research on code written by Dan Rosenberg (similar to what jchase did with NachoRoot in the fact that chown/chmod follows symlinks even when set during startup), here is a link to that research http://vulnfactory.org/blog/2011/08/25/rooting-the-droid-3/

    **UPDATE**
    Android's source has been patched so that future OEMs can not leave this hole open by accident.
    https://android-review.googlesource.com/#/c/36035/

    **UPDATE**
    This method has been shown to work on the HTC One X see forum
    http://forum.xda-developers.com/showthread.php?t=1644167

    Theoretically this should work on Honeycomb versions of the Prime as well, since the Honeycomb update is where I found the flaw that is being exploited. I have confirmed this works on my Prime.

    **UPDATE**
    This exploit does not currently work for the latest ICS update released (v9.4.2.11 on 1/18/2012). You can use OTA Rootkeeper to backup your root prior to updating using OTA, which I have confirmed to work on my device, (this may not work if you push the update manually).
    https://market.android.com/details?id=org.projectvoodoo.otarootkeeper
    For the devs out there, it does not to honor the ro.kernel.qemu=1 setting within the local.prop because it is already set to blank by that point by the build.prop


    You must have your Prime set up to use adb and your adb location contained in your path variable (windows) or unzip the files from my zip into that directory before running.
    **UPDATED**
    If you are have issues getting adb working, make sure asus sync is not running, if it is then kill it.


    adb shell mv /data/local/tmp /data/local/tmp.bak
    adb shell ln -s /data /data/local/tmp
    adb reboot
    adb shell rm /data/local.prop > nul
    adb shell "echo \"ro.kernel.qemu=1\" > /data/local.prop"
    adb reboot
    adb shell id
    //IF ID IS 0/root THEN CONTINUE, ELSE START OVER>
    adb remount
    adb push su /system/xbin/su
    adb shell chown 0.0 /system/xbin/su
    adb shell chmod 06755 /system/xbin/su
    //UNDO EVERYTHING EXCEPT su
    adb shell rm /data/local.prop
    adb shell rm /data/local/tmp
    adb shell mv /data/local/tmp.bak /data/local/tmp
    adb reboot

    **UPDATE** As jchase stated "If your device "bootloops" don't stress, just follow through with the commands as it "loops" ro.kernel.qemu can do funky stuff." I did notice this in my rooting but just assumed it was normal as this is my first use of adb.

    **UPDATE2**
    If you get a permissions error on the call
    adb shell "echo \"ro.kernel.qemu=1\" > /data/local.prop"
    then you may try
    adb shell rm /data/local.prop
    And then try the echo command again. This may be due to having rooted prior without cleaning up properly. Thanks to Franky_402 for this piece of info.
    I have updated the batch file to include this step, it should still be fine for those who are not having the issue as well.

    I have attached a zip file containing the su and a bat file for a more automated process (just pauses when during reboots, don’t hit go until it’s done rebooting). Or, you can run the commands manually and get the su file from the origin http://downloads.androidsu.com/superuser/su-bin-3.0.3.2-efghi-signed.zip

    Finally, install Superuser to make it all work https://market.android.com/details?id=com.noshufou.android.su

    **UPDATE** UNROOT
    There are multiple was to unroot now that you have root access already (all you need to do is remove the su file; so you could potential skip all the steps before the remount and just add the local.prop manually using a file manager and then reboot).

    The one most similar way to how you rooted would be to follow all of the steps above, but replace these 3 lines
    adb push su /system/xbin/su
    adb shell chown 0.0 /system/xbin/su
    adb shell chmod 06755 /system/xbin/su

    with this line
    adb shell rm /system/xbin/su

    This will remove the actual root, but it would leave behind any apps that you have given root access to or any files that those apps changed themselves (i.e. RootKeeper backs up the su file and the backup would need to be removed). If you had anything like this you would need to clean up that first before unrooting because it is a dead giveaway that it was rooted.

    Viperboy should be releasing his tool shortly that utilizes this method, if you would like a one click process that installs apps along with it (superuser, busybox). I’m guessing it installed them to the root apps directory so these also would need to be removed when unrooting as well (i.e. if you root using his new tool you should unroot using it as well).

    **UPDATED** Remove PayPal link in favor of link over there <-
    9
    Not mine at all, props to this guy! Send him some bones.
    5
    This root is confirmed!

    If your device "bootloops" don't stress, just follow through with the commands as it "loops" ro.kernel.qemu can do funky stuff.

    Good ****.
    5
    I believe I should be able to undo their jerry rigging of the system to block the honoring of the ro.kernal.qemu setting. I won't post it until I confirm it on my device though. Watch for an update this evening.

    Just as an update, the couple leads that I was looking into haven't worked out yet so I will try some different things tomorrow.
    3
    Any chance in the future this can be converted to an apk to install on Prime or a One-click method, per se?




    I'm sure Viperboy will make it a VERY simple process. He seems to be really good at "one click" methods!

    I will be updating viperMOD PrimeTime shortly, I just want to have OP's permission to do so. May I? I will also be sending you a PM, great work!!

    Sent from my SPH-D710 using Tapatalk