Rooted through ARHD and attempting to go S-Off using Firewater
Heres my code in adb
C:\Users\Drew\Desktop\adb fastboot>adb reboot
C:\Users\Drew\Desktop\adb fastboot>adb wait-for-device push firewater /data/loca
l/tmp
2612 KB/s (4432776 bytes in 1.657s)
C:\Users\Drew\Desktop\adb fastboot>adb shell
[email protected]_m8:/ # chmod 755 /data/local/tmp/firewater
chmod 755 /data/local/tmp/firewater
[email protected]_m8:/ # su
su
[email protected]_m8:/ # /data/local/tmp/firewater
/data/local/tmp/firewater
[email protected]_m8:/ #
And then it stops there, where it should go on to the warning. Can anyone help?
Maybe if you post in the m8 forum you might get better help?
Sent from my HTC One using XDA Premium 4 mobile app
aviatordrew said:
Rooted through ARHD and attempting to go S-Off using Firewater
Heres my code in adb
C:\Users\Drew\Desktop\adb fastboot>adb reboot
C:\Users\Drew\Desktop\adb fastboot>adb wait-for-device push firewater /data/loca
l/tmp
2612 KB/s (4432776 bytes in 1.657s)
C:\Users\Drew\Desktop\adb fastboot>adb shell
[email protected]_m8:/ # chmod 755 /data/local/tmp/firewater
chmod 755 /data/local/tmp/firewater
[email protected]_m8:/ # su
su
[email protected]_m8:/ # /data/local/tmp/firewater
/data/local/tmp/firewater
[email protected]_m8:/ #
And then it stops there, where it should go on to the warning. Can anyone help?
Click to expand...
Click to collapse
I could be wrong but are you not supposed to do the 'su' command before the 'chmod' command?
Related
Hi guys......
I have Butterfly s 901e with HBOOT 1.57, when I tried to s-off with firewater, I didn't get anything while in the process..... when I made the last step ([email protected]:/ # chmod 755 /data/local/tmp/firewater then [email protected]:/ # /data/local/tmp/firewater), I got nothing.... I tried to check data/local/tmp manually in ES File Explorer to see what is going on, I noticed that after pushing firewater through adb it will appear in the TMP folder and after executing [email protected]:/ # chmod 755 /data/local/tmp/firewater then [email protected]:/ # /data/local/tmp/firewater the firewater file just disappear from TMP folder, and nothing is starting....
please help.
I am despeartely in need of your help here guys, I got this brand new HTC one m8 from sprint and am stuck during the process of getting the s-off while following this guide thread to sim unlock the device. I kept getting this same output after following all the steps for rooted m8
Code:
C:\HTC\adt-bundle-windows-x86-20130522\sdk\platform-tools>adb shell
[email protected]_m8whl:/ $ su
su
[email protected]_m8whl:/ # chmod 755 /data/local/tmp/firewater
chmod 755 /data/local/tmp/firewater
chmod 755 /data/local/tmp/firewater
[email protected]_m8whl:/ # /data/local/tmp/firewater
/data/local/tmp/firewater
/data/local/tmp/firewater
[email protected]_m8whl:/ #
thats all I get after following all the steps.
am so confused and stuck cause am sure without s-off I cant get it to work. and I kept getting this handsfree activation whenever I boot the phone. Please help
cuteomar said:
I am despeartely in need of your help here guys, I got this brand new HTC one m8 from sprint and am stuck during the process of getting the s-off while following this guide thread to sim unlock the device. I kept getting this same output after following all the steps for rooted m8
Code:
C:\HTC\adt-bundle-windows-x86-20130522\sdk\platform-tools>adb shell
[email protected]_m8whl:/ $ su
su
[email protected]_m8whl:/ # chmod 755 /data/local/tmp/firewater
chmod 755 /data/local/tmp/firewater
chmod 755 /data/local/tmp/firewater
[email protected]_m8whl:/ # /data/local/tmp/firewater
/data/local/tmp/firewater
/data/local/tmp/firewater
[email protected]_m8whl:/ #
thats all I get after following all the steps.
am so confused and stuck cause am sure without s-off I cant get it to work. and I kept getting this handsfree activation whenever I boot the phone. Please help
Click to expand...
Click to collapse
Did you do "adb reboot, then adb wait-for-device push firewater /data/local/tmp" before the other commands?
gstanke said:
Did you do "adb reboot, then adb wait-for-device push firewater /data/local/tmp" before the other commands?
Click to expand...
Click to collapse
Also, if you did any updates with your OTA, this will not work!
I used Sunshine, and paid the $25 to have them help me, it was the best 5 mins of my life!
After you get frustrated and try Firewater a few dozen times... head over to theroot.ninja and pay the $25 dollars... TOTALLY WORTH IT!!
cuteomar said:
I am despeartely in need of your help here guys, I got this brand new HTC one m8 from sprint and am stuck during the process of getting the s-off while following this guide thread to sim unlock the device. I kept getting this same output after following all the steps for rooted m8
Code:
C:\HTC\adt-bundle-windows-x86-20130522\sdk\platform-tools>adb shell
[email protected]_m8whl:/ $ su
su
[email protected]_m8whl:/ # chmod 755 /data/local/tmp/firewater
chmod 755 /data/local/tmp/firewater
chmod 755 /data/local/tmp/firewater
[email protected]_m8whl:/ # /data/local/tmp/firewater
/data/local/tmp/firewater
/data/local/tmp/firewater
[email protected]_m8whl:/ #
thats all I get after following all the steps.
am so confused and stuck cause am sure without s-off I cant get it to work. and I kept getting this handsfree activation whenever I boot the phone. Please help
Click to expand...
Click to collapse
I fought and fought with adb, rooting, and s-off and Im well versed in adb etc. Just do yourself a favor, pay the $25 fee and go with sunshine. Its expensive but will save you so much headache
Success100 said:
I fought and fought with adb, rooting, and s-off and Im well versed in adb etc. Just do yourself a favor, pay the $25 fee and go with sunshine. Its expensive but will save you so much headache
Click to expand...
Click to collapse
I had no problem dropping the 25 bones for the S off. Those guys work hard and I was having a headache trying firewater which wouldn't work for me. It's easy and imo the $25 was worth it.
At&t user here saying "just do it"
You will sleep better after spending $25 and easily gain S-OFF
at the last line :
"adb reboot
adb wait-for-device push firewater /data/local/tmp
adb shell
su
chmod 755 /data/local/tmp/firewater
/data/local/tmp/firewater <.----
it says to me "firewater[2]: syntax error: '(' unexpected" after I press enter
edit : that says my cmd :
Code:
C:\android-sdk\platform-tools>adb reboot
C:\android-sdk\platform-tools>adb wait-for-device push firewater /data/local/tmp
218 KB/s (670 bytes in 0.003s)
C:\android-sdk\platform-tools>adb shell
[email protected]_m8:/ # su
su
[email protected]_m8:/ # chmod 755 /data/local/tmp/firewater
chmod 755 /data/local/tmp/firewater
[email protected]_m8:/ # /data/local/tmp/firewater
/data/local/tmp/firewater
/data/local/tmp/firewater[2]: syntax error: '(' unexpected
1|[email protected]_m8:/ #
Htconem8user said:
at the last line :
"adb reboot
adb wait-for-device push firewater /data/local/tmp
adb shell
su
chmod 755 /data/local/tmp/firewater
/data/local/tmp/firewater <.----
it says to me "firewater[2]: syntax error: '(' unexpected" after I press enter
edit : that says my cmd :
Code:
C:\android-sdk\platform-tools>adb reboot
C:\android-sdk\platform-tools>adb wait-for-device push firewater /data/local/tmp
218 KB/s (670 bytes in 0.003s)
C:\android-sdk\platform-tools>adb shell
[email protected]_m8:/ # su
su
[email protected]_m8:/ # chmod 755 /data/local/tmp/firewater
chmod 755 /data/local/tmp/firewater
[email protected]_m8:/ # /data/local/tmp/firewater
/data/local/tmp/firewater
/data/local/tmp/firewater[2]: syntax error: '(' unexpected
1|[email protected]_m8:/ #
Click to expand...
Click to collapse
Firewater is dead ... they abandoned it last week sometime
clsA said:
Firewater is dead ... they abandoned it last week sometime
Click to expand...
Click to collapse
oh :/
I've read that somewhere else too.
But I thought it should be still working.
is there any other method then sunshine ? Because currently I can't buy it now.
And I don't want to wait...
Why should there be only one option ( sunshine) to take s off ?
Is it that hard to code a working programm ?
Htconem8user said:
is there any other method then sunshine ?
Click to expand...
Click to collapse
unfortunately,no (unless you have an old hboot version)
Why should there be only one option ( sunshine) to take s off ?
Is it that hard to code a working programm ?
Click to expand...
Click to collapse
No disrespect mate but it looks like you underestimate the amount of work, time and knowledge needed to:
find a security hole and how to exploit it so you can grant s-off
do it again everytime HTC updates their firmware to patch these security holes
code everything so the average user can achieve s-off using an automated program
maintain everything (program, servers, website)
This have nothing to do with C# programming you can learn at high school to make your own calculator
So to answer your question, Yes its probably hard to do
alray said:
find a security hole and how to exploit it so you can grant s-off
do it again everytime HTC updates their firmware to patch these security holes
code everything so the average user can achieve s-off using an automated program
maintain everything (program, servers, website)
Click to expand...
Click to collapse
okay I got it. thanks for the reply^^
My Hboot is 3.19.0.0000 <- is it old ?
Hi
I am trying to install root on Android 7.1.1 (from geektillithertz.com, rom: and7_1-tablet-23012017.img) on Raspberry Pi 3 B.
When I manually execute the following commands via ADB, the system does not start after reboot.
Code:
adb shell "mount -o rw,remount /system"
adb push common/Superuser.apk /system/app/SuperSU/SuperSU.apk
adb shell chmod 0644 /system/app/SuperSU/SuperSU.apk
adb shell chcon u:object_r:system_file:s0 /system/app/SuperSU/SuperSU.apk
adb push common/install-recovery.sh /system/etc/install-recovery.sh
adb shell chmod 0755 /system/etc/install-recovery.sh
adb shell chcon u:object_r:toolbox_exec:s0 /system/etc/install-recovery.sh
adb push armv7/su /system/xbin/daemonsu
adb shell chmod 0755 /system/xbin/daemonsu
adb shell chcon u:object_r:system_file:s0 /system/xbin/daemonsu
adb push armv7/su /system/xbin/sugote
adb shell chmod 0755 /system/xbin/sugote
adb shell chcon u:object_r:zygote_exec:s0 /system/xbin/sugote
adb push armv7/supolicy /system/xbin/supolicy
adb shell chmod 0755 /system/xbin/supolicy
adb shell chcon u:object_r:system_file:s0 /system/xbin/supolicy
adb push armv7/libsupol.so /system/lib/libsupol.so
adb shell chmod 0755 /system/lib/libsupol.so
adb shell chcon u:object_r:system_file:s0 /system/lib/libsupol.so
adb shell touch /system/etc/.installed_su_daemon
adb shell chmod 0644 /system/etc/.installed_su_daemon
adb shell chcon u:object_r:system_file:s0 /system/etc/.installed_su_daemon
adb shell cp /system/bin/sh /system/xbin/sugote-mksh
adb shell chmod 0755 /system/xbin/sugote-mksh
adb shell chcon u:object_r:system_file:s0 /system/xbin/sugote-mksh
adb shell cp /system/bin/app_process32 /system/bin/app_process32_original
adb shell chmod 0755 /system/bin/app_process32_original
adb shell chcon u:object_r:zygote_exec:s0 /system/bin/app_process32_original
adb shell mv /system/bin/app_process /system/bin/app_process_original
adb shell chmod 0755 /system/bin/app_process_original
adb shell chcon u:object_r:zygote_exec:s0 /system/bin/app_process_original
adb shell mv /system/bin/app_process32 /system/bin/app_process_init
adb shell chmod 0755 /system/bin/app_process_init
adb shell chcon u:object_r:system_file:s0 /system/bin/app_process_init
adb shell ln -s /system/xbin/daemonsu /system/bin/app_process
adb shell ln -s /system/xbin/daemonsu /system/bin/app_process32
adb shell ln -s /system/etc/install-recovery.sh /system/bin/install-recovery.sh
Stuck on the screen with animation "android."
When I restore the /system/app_process file to the original version, the system starts (but with no root).
I tried SuperSU 2.76, 2.78, 2.79 and 2.82.
Unfortunately, I have always had the same effect.
I also tried Android Marshmallow (andrpi3-20160626.img) but it also ended with a bootloop.
When I manually run su daemon through ADB, root is working fine, but it is not permanent (after reboot there is no root).
What to do to make the system start with root?
I tried to perform a manual installation of SuperSU (2.82 SR5) on my Raspberry Pi running the developer version of AndroidThings 1.0.4, which is based on Android 8.1.0 / API 27. Rather than flashing the zip in recovery, as I'm not sure where to start with that on the Things platform, I manually pushed files and set file permissions and contexts via adb shell. My guide for this was the summary at the top of the script at SuperSU/META-INF/com/google/android/update-binary.
The new su binary appears to work for the most part. I can execute su and read/write with the interactive shell. However, when I attempt to execute the same operations as a command through su (ie: su -c mkdir /system/testdirectory), it responds saying its a read-only filesystem. The filesystem has been remounted with adb remount. I'm unable to perform the remount with the mount command, as /system is not listed in /proc/filesystems. From my understanding, this is due to some recent security model changes in Android. That being said, after the adb remount, all other normal interactions with the filesystem seem to work without issue. I have verified that selinux is in permissive mode.
I don't have busybox installed. These efforts are to allow for installation of busybox for other projects.
Does anybody know whats causing the commands proxied through su to not work correctly?
Here are the commands I used to perform my manual installation.
Code:
cd ~/Downloads/SuperSU-2.82-SR5
adb connect [IP_ADDRESS]:5555
adb root
adb remount
adb push common/install-recovery.sh /system/etc/install-recovery.sh
adb shell chmod 0755 /system/etc/install-recovery.sh
adb shell chcon u:object_r:toolbox_exec:s0 /system/etc/install-recovery.sh
adb shell ln -s /system/etc/install-recovery.sh /system/bin/install-recovery.sh
adb shell chcon -h u:object_r:toolbox_exec:s0 /system/bin/install-recovery.sh
cd armv7
# adding as `su_next` to prevent any issues before dropping it in
adb push su /system/xbin/su_next
adb shell chmod 0755 /system/xbin/su_next
adb shell chcon u:object_r:system_file:s0 /system/xbin/su_next
adb push su /system/xbin/daemonsu
adb shell chmod 0755 /system/xbin/daemonsu
adb shell chcon u:object_r:system_file:s0 /system/xbin/daemonsu
adb push supolicy /system/xbin/supolicy
adb shell chmod 0755 /system/xbin/supolicy
adb shell chcon u:object_r:system_file:s0 /system/xbin/supolicy
adb push libsupol.so /system/lib/libsupol.so
adb shell chmod 0644 /system/lib/libsupol.so
adb shell chcon u:object_r:system_file:s0 /system/lib/libsupol.so
adb shell cp /system/bin/app_process32 /system/bin/app_process32_original
adb shell cp /system/bin/app_process32 /system/bin/app_process_init
adb shell rm /system/bin/app_process
adb shell ln -s /system/xbin/daemonsu /system/bin/app_process
adb shell rm /system/bin/app_process32
adb shell ln -s /system/xbin/daemonsu /system/bin/app_process32
adb shell chmod 0755 /system/bin/app_process
adb shell chmod 0755 /system/bin/app_process32
adb shell chcon u:object_r:system_file:s0 /system/bin/app_process
adb shell chcon u:object_r:zygote_exec:s0 /system/bin/app_process32
# Swapping new su binary in
adb shell cp /system/xbin/su /system/xbin/su_original
adb shell rm /system/xbin/su
adb shell mv /system/xbin/su_next /system/xbin/su
adb shell /system/xbin/su --install
adb reboot
I need to correct myself: the new su binary can only read with privileges. It cannot write at all. I am only able to write either as the adb root shell, or with the stock su binary. I noticed that the device's adbd process relaunches with its own privileged context passed to it when adb remount is run. (adbd --root_seclabel=u:r:su:s0)
If I've run adb root and adb remount, adb shell, and then enter the su binary, I lose the ability to write to the remounted filesystem. So it appears that there is something wrong with the new su binary and its related files.
Anyway, this isn't critical to my project, so I'm abandoning my efforts for now. If anyone has any ideas on what is wrong here, I'd love to hear them and give this another shot!