Tablet S 4.0.3 r1a rooted

WonderEkin · Sep 19, 2012

Thanks Yupandra2012, my Tablet S 4.0.3 r1a finally rooted.
Ref: http://forum.xda-developers.com/showpost.php?p=31408901&postcount=12

The original steps(this link) was written in Japanese, I've just translate it into Eng. But sorry for my bad English.

UPDATE:
A semi automatic script can be found at here.

Files you need:
adb tools
SonyTabletICS-2.zip
Superuser-3.1.3-arm-signed.zip
VpnFaker.apk (Attachment)
For those who are no using the US firmware, the attached VpnFaker.apk may not suitable for your tablet.
Please follow this steps(click me) to resign the VpnFaker.apk. Thanks.

***Pls Execute the command line by line***

Unzip those files into a dir, Open cmd console, cd to that dir
Run the following command and press Restore on your tablet

Code:

adb restore settings.ab

Check the result

Code:

adb shell ls -ld /data/data/com.android.settings/a
	[I][COLOR="DarkGreen"]drwxrwxrwx system system    a[/COLOR][/I]

And continue, ignore the "rm -r a" permission denied error

Code:

adb shell
	cd /data/data/com.android.settings
	rm -r a
	while : ; do ln -s /data a/file99; done

While the loop is running, open another cmd console and run

Code:

adb restore settings.ab

Once the restore process is completed, you can press CTRL+C on the 1st cmd console to break the loop

Check the /data permission

Code:

adb shell ls -ld /data
	[I][COLOR="DarkGreen"]drwxrwxrwx system system    data[/COLOR][/I]

Then continue

Code:

adb push busybox /data/local/tmp
adb push rootkit.tar.gz /data/local/tmp
adb push Superuser.apk /data/local/tmp
adb push su /data/local/tmp
adb shell
	cd /data/local/tmp
	chmod 755 busybox
	./busybox tar zxf rootkit.tar.gz
	exit

Push the resigned VpnFaker.apk(resign by ZipSigner 2) and update the timestamp

Code:

adb push VpnFaker.apk /data/local/tmp
adb shell
	touch -t 1346025600 /data/local/tmp/VpnFaker.apk
	exit

Now, replace the VpnDialogs, ignore "cp: can't open 'system/xxxxxxx': Permission denied" while you execute "/data/local/tmp/busybox cp -r system system2"

Code:

adb shell
	cd /data
	/data/local/tmp/busybox cp -r system system2
	[COLOR="DarkGreen"]#Pls ignore "cp: can't open 'system/xxxxxxx': Permission denied"[/COLOR]
	/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
	/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
	mv system system-
	mv system2 system

	mv app app-
	mkdir app
	mv /data/local/tmp/VpnFaker.apk /data/app

Make sure the datatime is 2012/08/27 00:00

Code:

	TZ=0 ls -l /data/app
		[I][COLOR="DarkGreen"]-rw-r--r-- shell shell 198580 2012-08-27 00:00 VpnFaker.apk[/COLOR][/I]

Generate the packages.xml

Code:

	/data/local/tmp/busybox sed -f /data/local/tmp/packages.xml.sed system-/packages.xml > system/packages.xml

And double check the result

Code:

	/data/local/tmp/busybox grep vpndialogs system/packages.xml
		[I][COLOR="DarkGreen"]<updated-package name="com.android.vpndialogs" codepath="/system/app/VpnDialogs.apk" nativelibrarypath="/data/data/com.android.vpndialogs/lib" flags="1" ft="136f14be668" it="136f14be668" ut="136f14be668" version="15" shareduserid="1000">
		<package name="com.android.vpndialogs" codepath="/data/app/VpnFaker.apk" nativelibrarypath="/data/data/com.android.vpndialogs/lib" flags="1" ft="1396560b400" it="1396560b400" ut="1396560b400" version="45" shareduserid="1000">[/COLOR][/I]

Exit adb shell and reboot, you should see something like "Android is updating" during startup.

Code:

	exit
	adb reboot

Start the injected Terminal Emulator

Code:

adb shell am start -n com.android.vpndialogs/.Term

Unlock your tabet, The Terminal Emulator should appeared. If not, post your "adb logcat".
Now, in the Terminal Emulator

Code:

id

You should see the uid is 1000(system)

Still in the Terminal Emulator, ignore the script error

Code:

/data/local/tmp/onload.sh
/data/local/tmp/onload2.sh

Now back to the cmd console

Code:

adb shell
	/dev/sh
	id

Check the uid is 2000(shell)

And

Code:

	chown 0.0 /data/local/tmp/_su
	chmod 6755 /data/local/tmp/_su
	/data/local/tmp/_su
	id

Check the root access uid 0(root)

Backup /system (you may just skip it)

Code:

	dd if=/dev/block/mmcblk0p3 of=/mnt/sdcard/system.ext4 bs=128K

Copy su & Superuser.apk to /system

Code:

	/data/local/tmp/busybox mount -o rw,remount /system
	/data/local/tmp/busybox cp /data/local/tmp/_su /system/xbin
	chown 0.0 /system/xbin/_su
	chmod 6755 /system/xbin/_su
	/data/local/tmp/busybox cp /data/local/tmp/su /system/xbin
	chown 0.0 /system/xbin/su
	chmod 6755 /system/xbin/su
	/data/local/tmp/busybox cp /data/local/tmp/Superuser.apk /system/app
	/data/local/tmp/busybox mount -o ro,remount /system
	sync
	exit

Check the /system _su is working or not

Code:

	_su
	id

Should be uid 0(root)

And move the original /data/app & /data/system back (the original steps will keep the VpnFaker.apk, but i skip it)

Code:

	cd /data
	mv app app2
	mv app- app
	mv system system2
	mv system- system
	exit
	exit

Now, you Tablet S should be rooted.

SWFlyerUK · Sep 14, 2012 at 12:21 PM

I'm getting permission denied rm -r a... hopefully someone can make a batch file for this.

WonderEkin · Jul 7, 2007 162 306 0

SWFlyerUK said:
I'm getting permission denied rm -r a... hopefully someone can make a batch file for this.

You may just skip that error.
You can't delete that folder actually, just fake the system.

Cat McGowan · Sep 14, 2012 at 12:59 PM

WonderEkin said:
Thanks Yupandra2012, my Tablet S 4.0.3 r1a finally rooted.
Ref: http://forum.xda-developers.com/showpost.php?p=31408901&postcount=12

The original steps(this link) was written in Japanese, I've just translate it into Eng. But sorry for my bad English.

Good job and thank you. You beat me to the finish line, I was also translating (slowly) the original Japanese post into English by tediously using [B]http://www.bing.com/translator/[/B] and [B]http://translate.google.com/[/B] as my translators.

For convenience, those who do this rooting method may also want to copy the ADB files adb.exe, AdbWinApi.dll, and AdbWinUsbApi.dll (or download and extract ADB_v1.0.29.zip) into the same directory where they put the rooting files SonyTabletICS-2.zip, Superuser-3.1.3-arm-signed.zip, and VpnFaker.apk.

Now I just need to get an unrooted Sony Tablet S to test this method on. Perhaps I will unrooted my granddaughter's tablet.

SWFlyerUK · Sep 14, 2012 at 1:22 PM

This stopped working for me when I had to launch VpnDialogs, activity not found - also had permission denied which meant I couldn't go further, mkdir app said mkrdir not found:

Code:

/data/local/tmp/busybox cp -r system system2

= Permission Denied.

daniel910821 · Sep 14, 2012 at 2:10 PM

A couple questions,

Couldthis method brick my tablet, or is safe try it?
Would this work doing it on Ubuntu Linux?

Thanks in advance!

TomaHawk93 · Feb 22, 2011 66 7 0

SWFlyerUK said:
This stopped working for me when I had to launch VpnDialogs, activity not found - also had permission denied which meant I couldn't go further, mkdir app said mkrdir not found:

Code:

/data/local/tmp/busybox cp -r system system2

= Permission Denied.

Same Problem here, what to do now?

rrlu21 · Sep 14, 2012

WonderEkin said:
Thanks Yupandra2012, my Tablet S 4.0.3 r1a finally rooted.
Ref: http://forum.xda-developers.com/showpost.php?p=31408901&postcount=12

Now, you Tablet S should be rooted.

Thanks a lot for your hard work.
Before I start this root, I want to confirm with you whether this root will wipe out my installed app data?

WonderEkin · Sep 14, 2012 at 3:13 PM

SWFlyerUK said:
This stopped working for me when I had to launch VpnDialogs, activity not found - also had permission denied which meant I couldn't go further, mkdir app said mkrdir not found:

Code:

/data/local/tmp/busybox cp -r system system2

= Permission Denied.

Can you post the full command log?

TomaHawk93 · Sep 14, 2012

WonderEkin said:
Can you post the full command log?

Sure, i tried it two times: (for any reason i can't copy the full log, sry)

C:\STS>adb shell
[email protected]:/ $ cd /data
cd /data
[email protected]:/data $ /data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox cp -r system system2
cp: can't create directory 'system2': Permission denied
1|[email protected]:/data $ /data/local/tmp/busybox find system2 -type f -exec chmod
666 {} \
d system2 -type f -exec chmod 666 {} \ <
> /data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \
> mv system system-
mv system system-
find: -exec requires an argument
1|[email protected]:/data $ mv system2 system
mv system2 system
failed on 'system2' - No such file or directory
255|[email protected]:/data $ cd /data
/data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
mv system system-
mv system2 systemcd /data
/data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
mv system system-
[email protected]:/data $ /data/local/tmp/busybox cp -r system system2
cp: can't create directory 'system2': Permission denied

WonderEkin · Sep 14, 2012 at 3:36 PM

daniel910821 said:
A couple questions,

Couldthis method brick my tablet, or is safe try it?

Would this work doing it on Ubuntu Linux?

Thanks in advance!

Modify /data won't brick the device, you can wipe it if /data really corrupted.
For /system, those steps should be harmless

If you have and for Linux, then yes, should works on Linux

gordo79 · Sep 14, 2012 at 3:47 PM

I can't get the restore settings part to work. All the files are extracted to the same folder as adb any ideas

Sent from my Sony Tablet S using xda app-developers app

WonderEkin · Sep 14, 2012 at 4:22 PM

rrlu21 said:
Thanks a lot for your hard work.
Before I start this root, I want to confirm with you whether this root will wipe out my installed app data?

I'm not sure this root will keep the installed app or not, as i've wipe my tablet many times to test the VpnFaker.apk...
But the steps will rename the original app folder and rename it back in the final steps. Should be no data lost.

WonderEkin · Sep 14, 2012 at 4:41 PM

TomaHawk93 said:
Sure, i tried it two times: (for any reason i can't copy the full log, sry)

C:\STS>adb shell
[email protected]:/ $ cd /data
cd /data
[email protected]:/data $ /data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox cp -r system system2
cp: can't create directory 'system2': Permission denied
1|[email protected]:/data $ /data/local/tmp/busybox find system2 -type f -exec chmod
666 {} \
d system2 -type f -exec chmod 666 {} \ <
> /data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \
> mv system system-
mv system system-
find: -exec requires an argument
1|[email protected]:/data $ mv system2 system
mv system2 system
failed on 'system2' - No such file or directory
255|[email protected]:/data $ cd /data
/data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
mv system system-
mv system2 systemcd /data
/data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
mv system system-
[email protected]:/data $ /data/local/tmp/busybox cp -r system system2
cp: can't create directory 'system2': Permission denied

Seeme you paste multi lines of command at one time, am I correct?
Those command should execute one by one.

You can simple wipe the device and redo again
or
Can you execute the following code in adb shell so that I can give you the fallback command?

Code:

ls -la /data

TypoCorrecto · Sep 15, 2012

My brother has this tablet and I plan on attempting to root this evening...

excentra · Sep 14, 2012

[/COLOR]video tut maybe ?

ptexas · Sep 14, 2012 at 8:07 PM

Resign VpnFaker.apk

Hi

Do I have to resign the file VpnFaker.apk? If yes can someone explain hoe this is done.
I can do all commands until the replacement of the VpnDialogs. Then I get stuck with 'permission denied'.

Regards Paul

zorbakun · Sep 14, 2012 at 9:47 PM

Can we use this method to may root Xperia tablet s on 4.0.3?

excentra · Sep 15, 2012

im stuck @ replace the VpnDialogs

i get Permission denied for all

c:\sony>adb shell
[email protected]:/ $ cd /data
/data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
mv system system-
mv system2 system
c
d /data
mv app app-
mkdir app
mv /data/local/tmp/VpnFaker.apk /data/app /data/local/tmp/busybox
cp -r system system2
/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
mv system system-
mv system2 system

mv app app-
[email protected]:/data $ /data/local/tmp/busybox cp -r system system2
mkdir app
cp: can't create directory 'system2': Permission denied
d system2 -type f -exec chmod 666 {} \; <
find: system2: No such file or directory
d system2 -type d -exec chmod 777 {} \; <
find: system2: No such file or directory
1|[email protected]:/data $ mv system system-
failed on 'system' - Permission denied
255|[email protected]:/data $ mv system2 system
failed on 'system2' - No such file or directory
255|[email protected]:/data $
255|[email protected]:/data $ mv app app-
failed on 'app' - Permission denied
255|[email protected]:/data $ mkdir app
mkdir failed for app, File exists
255|[email protected]:

ptexas · Sep 14, 2012 at 11:41 PM

zorbakun said:
Can we use this method to may root Xperia tablet s on 4.0.3?

It says so in the first post and the thread title also referrs to 4.0.3 r1a

Tablet S 4.0.3 r1a rooted

Senior Member

Attachments

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Member

Member

Senior Member

Member

Member