Database Develop

[ROOTING] The M7 Exploit + Newbie Guide

To be honest, I'm a nice guy, but when threads get filled with utter "OMG, How do I root?" posts, I get pissed off. I don't mean to backseat moderate or anything, I just really get fed up sometimes. Hence, I've broken out the hardcore side of myself, and I present:
Coburn's (mostly) failproof rootmeplz kthxbai tutorial, featuring the awesome m7 exploit.
YOU CANNOT USE THIS ROOT GUIDE TO INSTALL ANDROID 2.0.x/2.1/2.x AT THIS MOMENT IN TIME. PLEASE DO NOT ASK IF YOU CAN INSTALL ANDROID 2.x USING ROOT, AT THIS STAGE IT'S A BIG FAT NO! THANK YOU FOR YOUR ATTENTION!!
Alright.
Easy to understand, plain english guide
Download the ZIP file attached to this post. Extract the files to a safe location - perhaps C:\Tattoo ?
Now, you'll need adb for windows. You can get it from my website's server here: ADB for windows.
Make sure your device is in USB Debug Mode (Settings > Applications > Development). This is ESSENTIAL!
Extract all the files in the adb4win zip file to your C:\Tattoo folder.
Now, go to Command Prompt. In XP, it's under System Tools in Accessories. In Vista/7, it'll be under accessories.
Do the following at the command line:
C:\Users\Coburn> cd C:\Tattoo
This will change your working directory from C:\Users\Coburn (or silimar) to C:\Tattoo .
Now, at the command line, do this:
C:\Tattoo> adb-windows shell "mkdir /data/local/bin" (with the quotes!).
This makes a directory on the Tattoo under /data/local, called bin. If you get a error (like mkdir failed, file/folder exists), this is fine! Don't sweat it.
Now, run this command:
C:\Tattoo> adb-windows push m7 /data/local/bin/m7
...and wait until finish.
Run this:
C:\Tattoo> adb-windows shell "cd /data/local/bin && chmod 755 ./m7" (with the quotes!)
This allows you to run the sucker.
Now, the fun part. Run this:
C:\Tattoo> adb-windows shell
This will dump you at a "$" shell. do the following:
C:\Tattoo> adb-windows shell
$ cd /data/local/bin
$ while ./m7 ; do : ; done
...lotsa text will flow down your screen. This is normal. Sometimes the exploit causes adb to freeze up, I don't know. I think it may be due to the exploit. It worked on my mac fine though...
Soon, you'll be greeted with this:
#
This is the root prompt! If you get stuff like this:
# usage: reboot ...
usage: reboot ....
usage: reboot ...
Just keep your cool, press enter and the # will say "Boo" again. This is due the exploit spawning reboots to gain the shell.
Then, do these commands from this thread's first post:
-bm- and the hax0rs crew said:
You did it, you should be root now!
Let's set some variables:
Code:
export LD_LIBRARY_PATH=/system/lib
export PATH=/system/bin
[...] check if ur root:
Code:
id
You should get something like this:
Code:
# id
uid=0(root) gid=1000(shell) groups=1003(graphics),1004(input),1007(log),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet)
uid=0(root) is important.
Click to expand...
Click to collapse
When you get this:
C:\Tattoo> adb-windows shell
$ cd /data/local/bin
$ while ./m7 ; do : ; done
[... lotsa pasta ...]
#
You can do anything then! Look at /system, /data, etc etc. You're broken free, my friend, and you'll forever be free. Until you press that exit button. you didn't. You didn't press that exit button? lolwut u did? Grrrrrrr!!!
EDIT: Added Guide to remount partitions. It's below.
Now you need to install su. Exit your root shell (via CTRL+C) (NO, Coburn, are you serious? ME LOSE ROOT SHELL?! ) and download this su.zip and extract it to C:\Tattoo. DO NOT EXIT THE COMMAND PROMPT WINDOW.
Meanwhile, back at the ranch, in your command prompt window, do this:
C:\Tattoo> adb-windows push su /data/local/bin/su
Then break out a shell...
C:\Tattoo> adb-windows shell
at the $ prompt, enter:
$ chmod 755 /data/local/bin/su
$ cd /data/local/bin/
..run the exploit again via "while 'true' ; do ./m7 ; done" to get root again then enter ...
# chown root.root /data/local/bin/su
# chmod 4755 /data/local/bin/su
# mount -o rw,remount /dev/block/mtdblock5 /data
# mount -o rw,remount /dev/block/mtdblock3 /system (This line allows you to play around with files on the system partition!)
After that, you can exit out of the root shell, and try a normal shell and this:
$ /data/local/bin/su
...which should make you get a nice # prompt. (Sometimes it doesn't, for me it got su: permission denied, wtf?)
(End SU Part of guide)
Tested on Windows 7. Also works on a phone terminal emulator too!
Keep your cool peeps - I do this for fun, I'm not a fulltime android dev. I am an addict though.
Happy rootin my friends.
Cheers,
Tattoo Hacker Coburn.
Greets fly out to the geeks that hacked it originally - without you, I'd have got a nexus one.
Thanks for marsdroid for correcting an error. Kudos to you, bro!
"ANDROID - It's a virus. In a Good Way. Once it's in your system, you can't get rid of it."

You should also add the "su" part in order to get root easier after the first time. Otherwise you have to do the exploit every time you want #

You could also add an explanation on how to remount the partitions without nosuid, so that a suid su can work.

mainfram3 said:
You could also add an explanation on how to remount the partitions without nosuid, so that a suid su can work.
Click to expand...
Click to collapse
Noted. Will do.
LordGiotto said:
You should also add the "su" part in order to get root easier after the first time. Otherwise you have to do the exploit every time you want #
Click to expand...
Click to collapse
Heh, yeah. Might add that up too.

Coburn64.
Thanks Man.
Nice Thread.

Thank you Coburn

svprm said:
Coburn64.
Thanks Man.
Nice Thread.
Click to expand...
Click to collapse
Thanks bro for your thanks.

I'm very glad you did that work, I'm kind of busy but I will update my statusposting and link to your HowTo!
Thats great community work.
[ROOTING] The M7 Exploit + Newbie Guide
Easy to understand, plain english guide
Click to expand...
Click to collapse
I apologize for my english, it's not my native language and I tried my best. ;-)
Keep up your work!
-bm-

-bm- said:
I'm very glad you did that work, I'm kind of busy but I will update my statusposting and link to your HowTo!
Thats great community work.
I apologize for my english, it's not my native language and I tried my best. ;-)
Keep up your work!
-bm-
Click to expand...
Click to collapse
You're welcome. I actually wanted this thread to help your thread, I wanted to spawn a m7 exploit thread to keep the original thread (which is based on the classic m6 exploit) clean of "How do I root with m7" and such.
Keep up the good work too, bm!

Thanks Coburn, so m6 is useless..
adb shell rm /data/local/bin/m6?

thx for the work , and corrections ! deleted the ealyer post

?
When i get # , and type:
# chown root.root /data/local/bin/su
i get :
chown root.root /data/local/bin/su
chown: not found
#
What i'm doing wrong /??

liderzre said:
When i get # , and type:
# chown root.root /data/local/bin/su
i get :
chown root.root /data/local/bin/su
chown: not found
#
What i'm doing wrong /??
Click to expand...
Click to collapse
type
export LD_LIBRARY_PATH=/system/lib
export PATH=/system/bin

rooted
Ty. Guide is not 100% for noobs. (ME).

Problem copying files to system partition after successfull rooting
Hi
The device was rooted successfully (from the first time using m7)
But I have very strange problem.
I try to update some files in the /system (updating fonts in /system/fonts).
I successfully run following command to remount system with rw permissions
/system/bin/mount -o rw,remount /dev/block/mtdblock3 /system
But when I try to copy files to /system/fonts I get "not enough memory" error.
If I run "df" command it shows that /system has 14% free before write attempt
But if I run "df" command after the write attempt I see that there is no free space.
It looks like there is some protection mechanism that prevents copying files to /system partition.
Does any one has an idea how to solve it?
Thanks

ronyrad said:
Hi
The device was rooted successfully (from the first time using m7)
But I have very strange problem.
I try to update some files in the /system (updating fonts in /system/fonts).
I successfully run following command to remount system with rw permissions
/system/bin/mount -o rw,remount /dev/block/mtdblock3 /system
But when I try to copy files to /system/fonts I get "not enough memory" error.
If I run "df" command it shows that /system has 14% free before write attempt
But if I run "df" command after the write attempt I see that there is no free space.
It looks like there is some protection mechanism that prevents copying files to /system partition.
Does any one has an idea how to solve it?
Thanks
Click to expand...
Click to collapse
The problem is well known an jet we have got no explanation. It looks like an additional security system build in by HTC. That is what also prevents us from flashing Custom ROMS at the moment. Development goes on here: http://forum.xda-developers.com/showthread.php?t=631540&page=18 but there is no solution or explanation until now.
-bm-

Could it be that it seems to be that the driver (yaffs) is possibly trying to copy /system into memory, and then reflash the partition all at once (to prevent NAND/NOR tear and wear)?

this guide is in error and will for sure not work ...
you should post probberly ...specially now when things is working....
there is no reason do do a NONSENCE guide .....
thx for the work thoe
Click to expand...
Click to collapse
Excuse me, but it was tested working. I do not post false or misleading information, so please don't accuse me of posting something that won't work. It does work. If you have troubles, you're not following it correctly. Start again and work one step at a time.

Coburn64 said:
Excuse me, but it was tested working. I do not post false or misleading information, so please don't accuse me of posting something that won't work. It does work. If you have troubles, you're not following it correctly. Start again and work one step at a time.
Click to expand...
Click to collapse
don't worry for such baseless allegations coburn.... u r doing a great job. keep up this good work bro.... thanks a lot for this wonderful presentation...
waiting for ur custom ROM.....

Coburn64 u are missing a ; in the 2. while
and i dont expect the newbies to sit back and wait for the "BUUH"..
but im sure someone will....
thx again
EDIT Coburn64 fixed it

busybox error "FIX ME! getmntent()"

Hi
Here is what I tried:
Code:
$ adb shell busybox df -h
Filesystem Size Used Available Use% Mounted on
FIX ME! implement getmntent() bionic/libc/bionic/stubs.c:354
I have to say it is a custom ROM.
Can it be moved from a ROM to another?
I'm cooking one with root acces (xbin/su) and Superuser.apk.
All this is under Froyo.
What did I do wrong?
Thx

Solved
Pushed busybox-armv6l and no problem since
http://busybox.net/downloads/binaries/1.16.1/

yup, it works fine. Thanks.
Code:
adb push busybox-armv6l /system/bin/busybox
adb shell chmod 755 /system/bin/busybox

[guide]rooting lg leon!

** DISCLAIMER: I AM NOT A DEVELOPER. I DO THIS AS A HOBBY AND SHARE MY FINDINGS IN CASE SOMEONE ELSE FINDS THEM USEFUL. **
** THIS WORKED ON MY DEVICE BUT IT MAY NOT WORK ON YOURS. APPLY AT YOUR OWN RISK **
This has been tested with the LG LEON V10c-EUR-XX
This procedure removes Kingroot , installs superSU ,root binaries and busybox on your system.
Rootable Versions: V10a , V10b , V10c , V10g
Non-root Versions: , V10e
I'm not sure yet about V10d , in some people is working and some not. I think if you use latest kingroot version will work.
Non tested: V10f
If you want to downgrade follow this GUIDE!
Requirements
Make sure your PC can communicate with our LG Leon via adb.
Driver Pack for LG Leon ( Link can be found on #2 Post!)
The success of this method depends on following the procedure very carefully. So read the instructions and make sure you understand every step before you try it.
Procedure
1- Install and run Kingroot 4.0. You can google and download it or you can use the one in the attached zip file. When Kingroot runs it is all in Chinese, but basically you need to be connected to the internet for it to work. It will do its thing and show progress up to 100% after which you can exit the program. Now your phone is rooted. The following steps replaces the Kinguser with SuperSU.
2- Unzip the attached file in your adb directory and then open an adb terminal and make sure the PC can see your phone (you can check that by typing adb devices). Then type the following:
Code:
adb push su /data/local/tmp
adb push busybox /data/local/tmp
adb shell
3- In the shell that you get type the following and make sure you give the permission when the phone prompts you:
Code:
su
4- Continue by typing the following commands:
Code:
mount -o remount,rw /system
cat /data/local/tmp/su >/system/xbin/daemonsu && chmod 0755 /system/xbin/daemonsu
cat /data/local/tmp/busybox >/system/xbin/busybox && chmod 0755 /system/xbin/busybox
daemonsu -d &
The key is to keep this session running while you continue with the rest, so be careful with typos and monitor this window for any errors.
5- At this point, leave the adb terminal window running and go to your phone, open the Kinguser app, open settings (the wheel at the top right corner of the screen), Root authorization setting, and Remove Root permission. The app will self-uninstall.
6- Uninstall the other two Kingroot programs that are still on your phone (KingRoot and the other one with the blue icon and Chinese text under it).
7- Back to the adb terminal, and type the following:
Code:
cat /data/local/tmp/su >/system/xbin/su && chmod 0755 /system/xbin/su
busybox chattr -ia /system/xbin/ku.sud
busybox chattr -ia /system/xbin/supolicy
rm /system/xbin/ku.sud
rm /system/xbin/supolicy
rm /system/bin/rt.sh
rm /system/bin/install-recovery.sh
rm /system/bin/shipclean
rm /system/bin/start-ssh
busybox chattr -ia /system/etc/install-recovery.sh
busybox chattr -ia /system/etc/install-recovery.sh-ku.bak
rm /system/etc/install-recovery.sh
rm /system/etc/install-recovery.sh-ku.bak
rm /system/etc/install_recovery.sh
rm /system/usr/icu/icusuflag.conf
busybox chattr -ia /system/usr/iku/isu
rm -rf /system/usr/iku
rm /system/kroot_*
rm /sdcard/kr-stock-conf
rm -rf /sdcard/Kingroot
rm -rf /data/data-lib/com.kingroot.RushRoot
rm -rf /data/data-lib/com.kingroot.kinguser
rm -rf /data/data-lib/king
Again, leave the adb terminal window running and go to your phone.
8- Install superSU (from the attached file) on your phone, run it, and let it update the SU binary.
9- Reboot the phone. After about 5 minutes your root is ready.
Downloads + Troubleshooting stuff will be in the 2nd post!

Troubleshooting & Downloading
Troubleshooting
1- Most of the problems that I noticed people have encountered is due to not reading the instructions fully. So make sure you read the OP word by word.
2- If you miss a step or mess up something go back to installing Kingroot and start over from the beginning.
3- Finally, I noticed that with an AT&T sim card in the phone Kingroot fails (why am I not surprised?) Either a reboot occurs in the middle of rooting or it completes the cycle without accomplishing root. If that occurs, my best advice is to change your phone company. If that fails, you may need to factory reset your phone or even install the firmware from scratch and try again without the sim card.
Downloading
MediaFire
Mega (Complete pack)
Drivers
Please do not mirror my links ,I'm counting em!
Hit the thanks button if i help you If you have a question feel free to post it. If you want to say "thank you" you can press the button , isn't worth to reply it
EDIT: If someone test it in another device or V10b etc.. , leave a feedback at comments so i could add it!

Two questions:
1: Are you terryg4 from androidforums? http://androidforums.com/threads/root-rooting-lg-leon-v10c-eur-xx-change-kingroot.946345/
2: Which kingroot 4.0 you talking about? Any minor version?

Plus, here is a fail from v10c..
Please don't copy-paste non-working solutions.

xfce4 said:
Two questions:
1: Are you terryg4 from androidforums? http://androidforums.com/threads/root-rooting-lg-leon-v10c-eur-xx-change-kingroot.946345/
2: Which kingroot 4.0 you talking about? Any minor version?
Click to expand...
Click to collapse
Two answers
1. Yes i'm that guy at androidforums
2. if link is broken i will replace it! I use this version of kingroot and it works for me! Read instructions again!

xfce4 said:
Plus, here is a fail from v10c..
Please don't copy-paste non-working solutions.
Click to expand...
Click to collapse
It's impossible! Send me pics of your android firmware! Maybe you have to downgrade

bkpaokfc said:
It's impossible! Send me pics of your android firmware! Maybe you have to downgrade
Click to expand...
Click to collapse
Here you go then..

Also using your exact version gave me the same response, only Chinese this time.

xfce4 said:
Also using your exact version gave me the same response, only Chinese this time.
Click to expand...
Click to collapse
I don't know nothing about your version. It should work but still don't know why. Anyway if your country have more Firmwares try downgrading.
If still doesn't work use this http://forum.xda-developers.com/lg-g3/general/guide-root-method-lg-devices-t3129197 maybe it will solve your problem.

Cannot delete(access old user files and folders after reflashing Vanilla-Android 4.2

Today I reflashed Stock Android 4.2 on a Xperia T.
Before there was Cyanogenmod (Android 5) installed.
I forgot to delete all user files/folder in internal memory.
Now, I cannot delete or access old user files and folders, even as root!?!
Its a problem of the permissions, I guess.
I can RENAME folders, but cant delete/open/chmod/change permissions recursiv, not with a file manager (as root), not with adb, not with "rm - rf", nothing.
So how I can get rid of those old folders?
E.g., for camera I had to rename DCIM to DCIMold, and create a new folder to get saving pictures to work.

Hi did you use neo's cm12.1. if you did use his, did you flash uninstaller,zip if didn't flash it here is a link https://www.androidfilehost.com/?fid=95916177934533137 and if you didn't use neos im sorry i dont know
If I helped please be kind and click like :good::good:

Yes, it was neo's cm12.1.
No,i didnt flash any uninstall.zip
Thank you for the info.
But I guess its to late now?

rrutk said:
Yes, it was neo's cm12.1.
No,i didnt flash any uninstall.zip
Thank you for the info.
But I guess its to late now?
Click to expand...
Click to collapse
nope dont think its to late just flash a custom kernel and then flash the uninstaller
If i helped please be kind and click like :good::good:

alial04 said:
nope dont think its to late just flash a custom kernel and then flash the uninstaller
If i helped please be kind and click like :good::good:
Click to expand...
Click to collapse
if I send the only command from the uninstall.zip
find /sdcard -user 1023 -exec chown 2800:2800 {} \;
in Terminal as SU, nothing changes....
Will it be a difference while flashing it?

If you want to use stock rom write this in terminal:
Code:
su
chmod 777 /mnt/media_rw/sdcard0
chown 2800:2800 /mnt/media_rw/sdcard0
chown -R 2800:2800 /mnt/media_rw/sdcard0

krasimiretov said:
If you want to use stock rom write this in terminal:
Code:
su
chmod 777 /mnt/media_rw/sdcard0
chown 2800:2800 /mnt/media_rw/sdcard0
chown -R 2800:2800 /mnt/media_rw/sdcard0
Click to expand...
Click to collapse
I'm already on stock ROM now.
I did the above mentioned, but I have to use "/mnt/sdcard", because "mnt/media_rw/sdcard0" seems not exist.
chmod 777 /mnt/sdcard
chown 2800:2800 /mnt/sdcard
works.
su busybox chown -R 2800:2800 /mnt/sdcard
gives "read only filesystem".
if I do a "mount -o remount rw /sdcard" before the command it works, BUT NOTHING CHANGES.
cant delete the files.
crazy.
do I really need to flash another kernel before?
cant understand why root has no access to the files.

SOLVED.
Correct is (as SuperUser):
busybox chmod -R 777 /mnt/int_storage
busybox chown 2800:2800 /mnt/int_storage
busybox chown -R 2800:2800 /mnt/int_storage
rrutk said:
I'm already on stock ROM now.
I did the above mentioned, but I have to use "/mnt/sdcard", because "mnt/media_rw/sdcard0" seems not exist.
chmod 777 /mnt/sdcard
chown 2800:2800 /mnt/sdcard
works.
su busybox chown -R 2800:2800 /mnt/sdcard
gives "read only filesystem".
if I do a "mount -o remount rw /sdcard" before the command it works, BUT NOTHING CHANGES.
cant delete the files.
crazy.
do I really need to flash another kernel before?
cant understand why root has no access to the files.
Click to expand...
Click to collapse

Question Mounting system R/W

Hi,
did anybody successfully mount system R/W?
I tried https://forum.xda-developers.com/t/script-android-10-universal-mount-system-read-write-r-w.4247311/
but it did not work.
Regards,
Hyper

I used https://forum.xda-developers.com/t/...ake-partitions-rw-in-super-partition.4120963/
for stock rom.

NisseGurra said:
I used https://forum.xda-developers.com/t/...ake-partitions-rw-in-super-partition.4120963/
for stock rom.
Click to expand...
Click to collapse
Just forgot, I also tried this one. How did you do it?
I could not find super.sin.
Also when trying to unpack the super image, the Tools says, it would not be a proper super image :-/

You need root and usb debugging
Place the superrepack.arm64_pie in your adb folder and then open an cmd shell:
adb push superrepack.arm64_pie /data/local/tmp
adb shell
su
cd /data/local/tmp
mv superrepack.arm64_pie superrepack
chmod 755 superrepack
stop
Then i used for a-active:
./superrepack /dev/block/bootdevice/by-name/super system_a
./superrepack /dev/block/bootdevice/by-name/super system_ext_a
./superrepack /dev/block/bootdevice/by-name/super product_a
sync
reboot

Can i ask why you want to mount system as RW?

morpheus302 said:
Can i ask why you want to mount system as RW?
Click to expand...
Click to collapse
Without a proper debloating it is not possible to get MicroG running without issues :-/

NisseGurra said:
You need root and usb debugging
Place the superrepack.arm64_pie in your adb folder and then open an cmd shell:
adb push superrepack.arm64_pie /data/local/tmp
adb shell
su
cd /data/local/tmp
mv superrepack.arm64_pie superrepack
chmod 755 superrepack
stop
Then i used for a-active:
./superrepack /dev/block/bootdevice/by-name/super system_a
./superrepack /dev/block/bootdevice/by-name/super system_ext_a
./superrepack /dev/block/bootdevice/by-name/super product_a
sync
reboot
Click to expand...
Click to collapse
Thank you! Gonna try this again.
//EDIT
Unfortunately after reboot I have ramdump. This never happpend before
I exceuted the scripts until all errors were gone.