60 replies to this topic

[Namtaffy]

am I being dumb or is there code in init.rc that detects if adb is in root mode and resets the usb connection? it's about halfway down the file? or am I talking out of my butt (which is highly likely ) either that or it resetting to handle the new root instance of adb maybe?

# adbd on at boot in emulator
on property:ro.kernel.qemu=1
	start adbd
# This property trigger has added to imitiate the previous behavior of "adb root".
# The adb gadget driver used to reset the USB bus when the adbd daemon exited,
# and the host side adb relied on this behavior to force it to reconnect with the
# new adbd instance after init relaunches it. So now we force the USB bus to reset
# here when adbd sets the service.adb.root property to 1.  We also restart adbd here
# rather than waiting for init to notice its death and restarting it so the timing
# of USB resetting and adb restarting more closely matches the previous behavior.
on property:service.adb.root=1
	write /sys/class/android_usb/android0/enable 0
	restart adbd
	write /sys/class/android_usb/android0/enable 1

Edited by Namtaffy, 09 May 2012 - 07:12 PM.

[Fstluxe]

Dear Paul,

One x WWE @1.29



HTC One X Tegra 3 Root Script by Paul O'Brien- includes script from kennethpenn
Follow @paulobrien and @modaco on Twitter for more Android fun!
DON'T TOUCH THE DEVICE OR UNPLUG WHILE ROOTING!
PUSH FILES
909 KB/s (837916 bytes in 0.900s)
781 KB/s (91980 bytes in 0.115s)
705 KB/s (570342 bytes in 0.789s)

REBOOT
Reboot again... note that when device returns it may appear to be bootlooping, d
on't panic!
AGAIN!?

C:\Users\FPC\Downloads\r3-root-one-x-tegra\root-one-x-tegra>

Ass you can see it pushes the files, but after that nothing...


I thought you where using the exploit, So what is the exploit?

after its rebooted I dont get Superuser..

Edited by Fstluxe, 09 May 2012 - 07:15 PM.

[kruppin]

Too bad. But why is it working on the S4 variant and not the tegra one? Wierd. Either they don't have "real" s-on, or maybe they want people to root (since at&t wont allow unlocking) so they can charge money to fix faulty devices through warranty.

[Namtaffy]

Fstluxe, on 09 May 2012 - 07:12 PM, said:

Dear Paul,

One x WWE @1.29



HTC One X Tegra 3 Root Script by Paul O'Brien- includes script from kennethpenn
Follow @paulobrien and @modaco on Twitter for more Android fun!
DON'T TOUCH THE DEVICE OR UNPLUG WHILE ROOTING!
PUSH FILES
909 KB/s (837916 bytes in 0.900s)
781 KB/s (91980 bytes in 0.115s)
705 KB/s (570342 bytes in 0.789s)

REBOOT
Reboot again... note that when device returns it may appear to be bootlooping, d
on't panic!
AGAIN!?

C:\Users\FPC\Downloads\r3-root-one-x-tegra\root-one-x-tegra>

Ass you can see it pushes the files, but after that nothing...


I thought you where using the exploit, So what is the exploit?

after its rebooted I dont get Superuser..

I think the exploit is using a file with root permissions created in init.rc to push the property "ro.kernel.qemu=1" into local.prop so that adb has root access to run the rest of the script

[Fstluxe]

thats pretty gay..

[c4b4l3]

bat file manually execute command by command
after reboot
error at @adb shell "echo ro.kernel.qemu=1 > /data/local.prop" == Permissions denied

[kruppin]

Actually, I think it DOES work.. But after a real reboot it's gone again (s-on). I tried not removing the local.prop, and when I adb shell I get # and can mount system without problem. But with that local.prop there, the phone seems to restart as soon as it's booted. With S-ON I don't think this'll ever work. It's wierd it does on the AT&T variant.

[PaulOBrien]

Basically writing the local.prop gives you temproot, but makes the device think it's running in the emulator, which breaks all sort of stuff hence the reboots. The fipside is you have temproot, so hopefully you can remount /system rw and put permroot on.

S-ON, like we've seen in the past, seems to prevent writing to /system, so unfortunately that's a no-go. Very strange they didn't go that route on the AT&T One X but hey!

P

[Fstluxe]

Don't worry guys, I got cotulla on this case to get the device S-off.

Within weeks we have a fully S-off device.

[kickasskev]

Paul, will there ever be a way to unlock the bootloader without going through htcdev or am I just wainting for false hopes?
Also is the root without unlocked bootloader  a total no go now in your opinion or do you think this also may be possible in future?

[Shuflie]

I'm S-ON on a Three branded One X that had previously been rooted but was reverted to stock although bootloader is still unlocked. Script worked on my mac and gave perm root again. This is the output from the script

(null):root-one-x-tegra shuflie$ ./root-mac.sh
HTC One X Tegra 3 Root Script by Paul O'Brien- includes script from kennethpenn
Follow @paulobrien and @modaco on Twitter for more Android fun!echo Don't touch the device or unplug while rooting!
Push files
* daemon not running. starting it now *
* daemon started successfully *
706 KB/s (837916 bytes in 1.158s)
706 KB/s (91980 bytes in 0.127s)
964 KB/s (570342 bytes in 0.577s)
rm failed for /data/local.prop, No such file or directory
Reboot
Reboot again... note that when device returns it may appear to be bootlooping, don't panic!
Reboot one last time...

I should probably have tried it after relocking the boot loader but I can confirm that it roots an unlocked device quite easily.

Edited by Shuflie, 11 May 2012 - 11:19 PM.

[r3x]

Fstluxe, on 09 May 2012 - 09:21 PM, said:

Don't worry guys, I got cotulla on this case to get the device S-off.

Within weeks we have a fully S-off device.

how close are u to cotulla..coz i know he wont do it !

[GuyAdams]

kickasskev, on 10 May 2012 - 07:05 PM, said:

Paul, will there ever be a way to unlock the bootloader without going through htcdev or am I just wainting for false hopes?
Also is the root without unlocked bootloader  a total no go now in your opinion or do you think this also may be possible in future?

Basically until the One X is S-OFF the only way to unlock is via HTCDEV. Once (or if) we have S-OFF then a Revolutionary style option will be available which means you won't have to HTCDEV unlock.

[Psychogenius2]

Linux Ubuntu 11.04 Script with no errors but still no root

[schnurzelat]

Why is noboby investigating here anymore? I tried different things but failed.

I am on 1.26 and got temporary root with this script. I modified the script and was able to put the files in its respective folders.

The problem was, that after umount, remount or trying to remove the ext4 Journal the device crashes. i used dd to dump the system image to the sd memory.

I didn't tried yet, to modify the system image and use dd to wirte it back.

It seems, that nobody is researching the possibilities.

Greetings schnurzelat

[ChronoWerX]

schnurzelat, on 28 June 2012 - 12:38 PM, said:

Why is noboby investigating here anymore? I tried different things but failed.

I am on 1.26 and got temporary root with this script. I modified the script and was able to put the files in its respective folders.

The problem was, that after umount, remount or trying to remove the ext4 Journal the device crashes. i used dd to dump the system image to the sd memory.

I didn't tried yet, to modify the system image and use dd to wirte it back.

It seems, that nobody is researching the possibilities.

Greetings schnurzelat

How you get temp root? Please share

[schnurzelat]

I am doing no magic. I just cut the script (from the first post) off at the line "ECHO AGAIN!?".

Then you can open a shell with "adb shell" with root rights. While you have the root shell the phone its constantly soft rebooting (the shell is working all the time). The script posted here is not working below the line "ECHO AGAIN!?". I was able to do the changes. I installed busybox, the su command and placed the superuser.apk in the app folder.

But if i try to umount /system, the phone reboots hard and all changes are gone.

I tried to:

-remove the ext4 journal, but the phone hangs.
-playing around with htcfs command
-playing around with mount option for removing or not using the ext4 journal

But i wasn't brave enough yet, to use dd to write /system back. My Idea was, to dump /system to sd, do the changes, while mounting the system.img in linux and write it back with the dd command.

[Xmoo]

Just tried it on the 2.05 test rom with s-off device... confirmed working!

[kickasskev]

Xmoo, on 12 July 2012 - 10:38 PM, said:

Just tried it on the 2.05 test rom with s-off device... confirmed working!

Its already mentiond that it only works with s-off

[Xmoo]

Does not work anymore on latest JB ROM