16

To get a privileged shell you need to modify the following lines to the given values in the default.prop file ro.secure=0

ro.debuggable=1

persist.service.adb.enable=1

I have the extracted the recovery image of my phone model : So is it possible to modify the following values in the default.prop file, repack the image and flash it using fastboot(bootloader is unlocked) to get a privileged shell, and then copy the su binary after remounting system as read/write?

Do I need to change any other values in any of the files? And will it work, theoretically at least?

Kedar
  • 293
  • 1
  • 2
  • 6
  • Before you reinvent the wheel, did you check xda-developers for an official root method for your device? – Mihic Sep 02 '12 at 15:05
  • 2
    Yes I have, there are no "official" methods and I wanted to do it by myself for once, its a re-branded Chinese device, so not much support there, – Kedar Sep 02 '12 at 15:11
  • Which device do you want to root? – Flow Sep 14 '12 at 10:54
  • @Flow Karbonn A9/K-Touch W680. Update: The above approach did not work, either because the image wasn't stock recovery in the first place or it isn't that easy. Phone is rooted now. – Kedar Sep 14 '12 at 14:08
  • default.prop is located in ramdisk, which is "reset" every boot – trogper Sep 21 '13 at 19:12
  • Can you link to or explain how to extract the recovery.img or boot.img from the phone (without already having root)? Thanks! – user29020 Jan 23 '15 at 02:20
  • @user29020 This was quite some time ago, I can't remember. – Kedar Jan 23 '15 at 11:01

2 Answers2

14

This approach will work (provided there are no proprietary funny locks in place anywhere), but the recovery partition is no party to it from the very beginning. The default.prop is overwritten on bootup, copied from the boot partition, which is not a directly accessible file system. You need an image of the boot partition, which you will then unpack, make the change, and repack.

Assuming you know how to go about doing all that (since you say you tried it with the recovery), I must warn ahead that often times it is necessary to include the base address when making the image with mkbootimg. There is no way to know when it is required, so it is safe to always include a base address. You can follow a tutorial here:

www.freeyourandroid.com/guide/extract-edit-repack-boot-img-windows

The script includes the od command with which you can get the base address, in case you want to make your own script. For more on the manual steps (for reproducing on GNU/Linux):

android-dls.com/wiki/index.php?title=HOWTO:_Unpack%2C_Edit%2C_and_Re-Pack_Boot_Images

I do not recommend use of the unpack/repack scripts, as they have hardcoded lines not portable across cases. Use split_bootimg.pl, then gunzip and cpio extract it, after which you will again use cpio and gzip it, followed by the mkbootimg command. The only exception is for MTK65xx devices, where you will need the relevant unpack/repack tools (because they have very different offsets; you will also skip the mkbootimg as the repack script does it for you):

github.com/bgcngm/mtk-tools

And here is an on-going example of a Chinese rebranded phone going through the same thing to finally get root:

forum.xda-developers.com/showthread.php?t=1818146&page=5

I'm sorry I have to strip off proper links, but I am apparently considered potential spam. Also, I've not been rather thorough because I'm not really sure you'd want more verbosity.

Flow
  • 18,464
  • 16
  • 79
  • 138
hattorihanzo
  • 156
  • 2
  • Can you link to or explain how to extract the recovery.img or boot.img from the phone (without already having root)? Thanks! – user29020 Jan 23 '15 at 02:19
3

The above approach did not seem to work.

Either because the stock recovery put up wasn't meant for the device or the method isn't this easy and may involve making other changes. The phone wouldn't go into recovery mode, which is the only mode in which you would get a privileged shell to perform the necessary operations to obtain permanent root.

Another method would be to modify the build.prop in the boot image itself, repack and then flash it and adb to get a privileged shell in normal operating mode.

Better to follow someone else's procedure when you're not too sure about your own.

Kedar
  • 293
  • 1
  • 2
  • 6
  • 1
    This is not working because the shipped ADB version is not supporting root. (I looked up the make file and the ADB source, I know what I am talking about) – Orri Nov 06 '15 at 08:23
  • 1
    @Orri Though this may be years later, I'm pretty sure Chainfire's insecure ADBD app was around when the answer was posted. – Math1000 May 25 '20 at 15:31