Mod Edit: Unstickied, placed link in wiki:http://forum.xda-developers.com/wiki/index.php?title=Nexus_One Thanks
This is an alternative approach of rooting the Nexus without touching the bootloader.
-no downgrade neccessary
-no battery modification neccessary
-no messing around with SD card slot
-you don't even have to open your phone...
Working and confirmed for ALL ROMs, including European Vodafone EPF30/FRF91, Korean FRF91, AT&T/T-Mo Stock including FRF91
-------
Credits:
-------
- The Android Exploid Crew:
http://c-skills.blogspot.com/2010/07/android-trickery.html
- Amon_RA
- cyanogen
-------
Notes:
-------
- The exploit wasn't found by me (see credits), I just implemented it as a proof of concept for the Nexus One
- Basically this method should work on all currently known ROM versions.
- I tested it on EPF30, Korean FRF91, Vodafone FRF91, US Stock FRF91.
- As usual when doing this kind of stuff: DO THIS AT YOUR OWN RISK.
- It could even work on other Android devices as long as their system partition is at
/dev/block/mtdblock3/ with yaffs2 file system and there is still some space left on the system partition (without any changes).
-------
Prerequisites:
-------
- Locked Nexus One
- Latest Android SDK incl. USB drivers
- Working ADB
- The file "freenexus.zip"
edit:
get it here:
http://multiupload.com/MVT98F5HBY
or
http://dl.dropbox.com/u/1327667/freenexus.zip
MD5: 947C20222056D7C070733E7FCF85CF15
-------
Step-by-step guide:
-------
1. install android sdk & USB drivers
2. extract the content of the zip file into the tools directory of SDK (i.e. \android-sdk-windows\tools)
-> For all Newbies: Take care that you extract the files directly to the tools folder and don't create a new subdirectory freenexus within tools!!! If you did, delete the folder and extract again!!! Check twice that there is no FOLDER freenexus in your tools directory before you continue!!!
3. open a command prompt (Windows: Start, Run, "cmd", OK; Linux: Terminal)
4. change to SDK tools directory (i.e. cd \android-sdk-windows\tools)
5. connect Nexus to USB and check if debugging mode is activated
(Settings/Application/Development/USB Debugging)
6. run "adb devices" in shell and see if there is a device listed. if not back to step 5 or reinstall USB-drivers
7a. for Windows: run "freenexus.bat" in command shell (this copies the neccessary files to /data/local/tmp)
7b. for Linux or manual installation: run the following commands
Code:
adb push freenexus /data/local/tmp/freenexus
adb push Superuser.apk /data/local/tmp/Superuser.apk
adb push su /data/local/tmp/su
adb push busybox /data/local/tmp/busybox
adb shell chmod 755 /data/local/tmp/freenexus
adb shell chmod 755 /data/local/tmp/busybox
8. run the following commands:
Code:
adb shell
(you should see a "$" prompt now)
cd /data/local/tmp
9. on your phone go to a screen where you can easily toggle wifi (widget or settings/wireless)
10. be prepared to toggle wifi immediately after you execute the next step
11. run
Code:
./freenexus
12. toggle wifi on
13. you should see something like that:
[*] Android local root exploid (C) The Android Exploid Crew
[*] Modified by ak for HTC Nexus One
[+] Using basedir=/sqlite_stmt_journals, path=/data/local/tmp/freenexus
[+] opening NETLINK_KOBJECT_UEVENT socket
[+] sending add message ...
[*] Try to invoke hotplug now, clicking at the wireless
[*] settings, plugin USB key etc.
[*] You succeeded if you find /system/bin/rootshell.
[*] GUI might hang/restart meanwhile so be patient.
13b) if you get "permission denied" error, you have most likely not followed the big red newbie hint after point 2. check this by entering "ls -l", if you see a "drwxr-xr-x" and not "-rwxr-xr-x" in front of the line where freenexus is listed you did not follow properly. Search the posts in the thread on how to correct this.
14. run
Code:
rootshell
15. if you succeeded you will be asked for a password, if not try again from step 10
16. enter the password "freenexus"
17. now you should see a "#" as a prompt -> you are root now
18. run the following commands:
Code:
./busybox cp busybox /system/bin
chmod 4755 /system/bin/busybox
busybox cp Superuser.apk /system/app
busybox cp su /system/bin
chmod 4755 /system/bin/su
rm /system/bin/rootshell
exit
exit
19. Check if you keep root rights:
Code:
adb shell
su
20. after you executed the su command the Superuser app on your device should ask you for allowance
21. you should see the "#" prompt again, if you didn't get that try su again
22. done
-------
Comments:
-------
- General
If you are not planning to wipe your data partition (what you probably will do when installing CM6 first time) you should think about deleting all the temp files still lying in /data/local/tmp (for safety reasons and to have more space on /data):
Code:
adb shell
cd /data/local/tmp
rm busybox
rm su
rm Superuser.apk
rm freenexus
rm flash_image (will only exist if you executed the steps below in recovery section)
- Installation of Custom Recovery
If you only want root rights you are done here. If you want to install custom ROMs you have to install
a custom recovery first. Easiest way would be to download "ROM Manager" from the market. There are plenty of tutorials on how to install custom recovery/ROM at xda.
Edit: It is safer to install the recovery manually. In this case or for those of you running into problems with installing custom recovery with ROM Manager (doesn't stick) you can continue with
these steps (without remount of system partition, now tested successfully):
1) Download recovery-RA-nexus-v1.7.0.1.img to the root directory of your SD-Card
- Note: UnMount your SD-Card after copying these files, but keep your phone plugged in
- or don't mount SD-Card at all and push the file via adb to /sdcard
2) Save file "flash_image" to sdk tools directory:
3) In your terminal run
Code:
adb push flash_image /data/local/tmp/flash_image
adb shell
su
- At this point, it will hang until you choose "Allow" on your phone with the SuperUser app pop-up
- $ should now be replaced with #
5) run the following commands:
Code:
[COLOR="Red"]mount -o rw,remount /dev/block/mtdblock3 /system[/COLOR]
cd /data/local/tmp
chmod 755 flash_image
[COLOR="Red"]./flash_image recovery /sdcard/recovery-RA-nexus-v1.7.0.1.img[/COLOR]
rm /system/etc/install-recovery.sh
rm /system/recovery-from-boot.p
(and if everything worked fine:)
rm flash_image
Alternatively you can continue with step 9 and then steps 16-24 from the old rooting method tutorial
to manually install Amon_RA's recovery. You will also need the file flash_image for that (link taken from HBOOT thread).
- HBOOT
If you rooted from a Korean Rom or have installed the latest Vodafone Rom via PASSIMG you probably have
HBOOT 0.35 which makes it currently difficult to install Cyanogenmod (there is an assertion failure in the install script, at least with CM6 RC1/2. Maybe future versions of CM6 will include HBOOT 0.35 in the script) or other custom ROMs. (You are still on 0.33 if you just installed the Vodafone OTA Update)
There is a tutorial to revert HBOOT here:
http://forum.xda-developers.com/showthread.php?t=726258
Instead of using the EPF30 image you can also use any other PASSIMG file (at least if it has HBOOT 0.33,
otherwise this step wouldn't make sense...)
Note that when flashing a PASSIMG with a different HBOOT version there is a reboot after the HBOOT has been flashed, then after reboot the PASSIMG will be loaded again and the rest of the image will be flashed.
To check HBOOT and Radio version: press and hold trackball while turning on the phone. To exit select Reboot with Vol+/- and press Power button.
Caution:
After you have reverted your HBOOT, you have lost your root rights and you are back on stock recovery.
But you can (or have to) repeat the above procedure to get root rights back.
Edit:
The downgrading also downgrades your radio!!! Before installing CM6 you have to flash a Froyo Radio!
Latest one can be found here:
http://forum.xda-developers.com/showthread.php?t=723839
-------
Troubleshooting:
-------
After trying to flash a custom ROM with ROM Manager one user wasn't able to boot the phone normally and also no longer able to boot to recovery. In this rare case try to download a compatible PASSIMG file:
For example EPF30 (Europe Vodafone 2.1)
http://shipped-roms.com/shipped/Pas...ogle_WWE_1.14.1700.1_EPF30_release_signed.zip
or FRF91 (Europe Vodafone 2.2):
http://shipped-roms.com/shipped/Pas...on_VF_2.15.151.5_R_FRF91_MFG_Shipment_ROM.zip (<-this one is currently a zip in zip. You have to extract it once to get the working PASSIMG.zip)
(Appropriate US-PASSIMGs can also be found on shipped-roms.com, most likely EPE76)
Rename the file to PASSIMG.zip (case sensitive, Windows users take care that the file isn't called PASSIMG.zip.zip hidden extension)
Copy it to main folder of SD card.
Boot phone into Bootloader mode (press and hold trackball when turning on the phone, until fastboot mode starts)
Select Bootloader mode by pressing power button.
The bootloader should then start to analyse the PASSIMG.zip and ask you afterwards to install it.
You're phone (not your SD) will be completely wiped after the procedure but should work again (and can be rooted again...)
sweet!! been waiting for this! will try it tomorrow as soon as i wake up! will report back then!
edit: i cant download freenexus.zip maybe use another hoster?
file section edited.
Great tutorial ! Waiting for some feedbacks
(file link doesn't work)
dolomiti7 said:
file section edited.
Click to expand...
Click to collapse
On the left I can see just an empty folder named "SmartDrive"
link doesn't work
dolomiti7 said:
-> after clicking on "Smartdrive Gastzugang starten" you might get an error message, but after klicking ok on the error message
you should be able to access the folder "nexus" on the left side of the window anyway
Click to expand...
Click to collapse
No way! Can't do anything even after i press ok on the error message
if you click on that there should be a subfolder "nexus" that should be clickable too. at least it works here... anyway. someone wants to upload the file to a hoster? rapidshare... contact me
for the early adaptors (will only work 10 times):
rapidshare.com/files/409266634/freenexus.zip
MD5: 947C20222056D7C070733E7FCF85CF15
multiple download sites!:
http://www.multiupload.com/MVT98F5HBY
or here:
http://dl.dropbox.com/u/1327667/freenexus.zip
thank you. added the link.
This worked flawlessly.
Massive thanks.
Hi, I have a Italian Vodafone Nexus One with FRF91, i have followed all the steps and now in my apps there is Superuser Permission with green light. It means that i have root rights? Can I install Cyanogen Mod now? Thanks, excuse my English.
Worked perfectly on a stock AT&T N1 with FRF91. Thanks!
Excellent tutorial step by step...great work!
Can i change the password at the end?
So once gaining root, I can flash a custom recovery with rom manager without braking/unlocking the boot loader?
@fc_themaster:
if the superuser app popped up at step 19/20 then you have root rights. you can try to install ROM Manager from the market and install a custom recovery with that porgram. it also needs root rights so superuser should pop up again at that point.
@PSeeCO: you don't need to change a password. the password was only used for the temporary rootshell which you (hopefully) deletetd with the command "rm /system/bin/rootshell" in step 18. From that point on root rights are controlled via the Superuser app. If you install an already rooted custom ROM it is obsolete anyway.
@jivemaster: yes, we can! just use ROM Manager from the market to install custom recovery.
dolomiti7 said:
@PSeeCO: you don't need to change a password. the password was only used for the temporary rootshell which you (hopefully) deletetd with the command "rm /system/bin/rootshell" in step 18. From that point on root rights are controlled via the Superuser app. If you install an already rooted custom ROM it is obsolete anyway.
Click to expand...
Click to collapse
Perfect, thank you so much!
Just in case someone is
This page details how to root the Fujitsu Arrows TAB F-01D.
http://arrowstab-f01d.blogspot.com/2012/03/easy-rooting-toolkit-for-arrows-tab-f.html
it works.
Now if only somebody can post the firmware updates..
English instructions
Well, with some help from Google Translate and some creative interpretations, I managed to do this and thought I'd provide some English instructions for others (with some added comments)
DISCLAIMER: AS USUAL, YOU SHOULD KNOW THAT FOLLOWING THESE ACTIONS (AND ESPECIALLY FOLLOWING THEM INCORRECTLY) CAN BRICK YOUR DEVICE (I.E. YOUR DEVICE WILL STOP WORKING, POSSIBLY PERMANENTLY). I AM NOT RESPONSIBLE FOR ANY DAMAGES THAT MAY ARISE FROM YOU FOLLOWING THESE INSTRUCTIONS, YOU DO SO AT YOUR OWN RISK.
Downloads
1. Windows -- the Arrows TAB USB driver Download.
2. Easy rooting toolkit (ERT) for Arrows Tab F-01D (ver 1.0) Download
3. goroh_kun's lsm_disabler.ko Download
Info
4. A su binary, such as the one found in DooMLoRD_v3_ROOT-zergRush-busybox-su.zip
5. Android SDK platform tools. adb(.exe) (and in Windows, specifically: AdbWinApi.dll, AdbWinUsbApi.dll)
Preparation
1. Unzip ert4F01D.zip, and in the subdirectory 'files' place:
* adb.exe (Windows only, from step 4 above)
* AdbWinApi.dll (Windows only, from step 4 above)
* AdbWinUsbApi.dll (Windows only, from step 4 above)
* lsm_disabler.ko (from step 3 above)
* su (from step 5 above)
2. Before connecting the USB, in Settings -> Applications -> Development:
* Check (tick) USB debugging ("Debug mode when USB is connected")
* Check (tick) Stay awake ("Screen will never sleep while charging")
3. Set up the USB drivers and Android Development stuff if you haven't already. I don't use Windows so can't help with this.
The Dirty Work
At this stage, you can run the batch file. Since I don't use Windows, I did the steps by hand, so you'll have to correlate your actions appropriately (I can't read Japanese either, so your guess is as good as mine ).
1. On your PC:
adb shell "mv /data/local/calib.dat /data/local/calib.dat_"
adb shell "ln -s /data/local.prop /data/local/calib.dat"
2. On the tablet, go into Google Maps, touch the GPS icon ("locate me" icon) on the top right hand corner, and then touch the BACK key to exit.
3. On your PC:
adb shell "echo ro.kernel.qemu=1 > /data/local.prop"
adb shell "rm /data/local/calib.dat"
adb shell "mv /data/local/calib.dat_ /data/local/calib.dat"
adb reboot
5. Once the device has fully rebooted, on your PC:
adb shell "mkdir /data/local/lib"
adb push files\lsm_disabler.ko /data/local/lib/
adb shell "insmod /data/local/lib/lsm_disabler.ko"
adb shell "mkdir /data/local/bin"
adb shell "echo '#!/system/bin/sh' > /data/local/bin/autoexec.sh"
adb shell "echo '/system/xbin/soff' >> /data/local/bin/autoexec.sh"
adb shell "chmod 755 /data/local/bin/autoexec.sh"
adb shell "mount -o rw,remount /system /system"
adb shell "ln -s /data/local/bin/autoexec.sh /system/etc/install-recovery.sh"
adb push files\su /system/xbin/
adb shell "chown root.root /system/xbin/su"
adb shell "chmod 06755 /system/xbin/su"
adb shell "echo insmod /data/local/lib/lsm_disabler.ko > /system/xbin/soff"
adb shell "chmod 755 /system/xbin/soff"
adb shell "mount -o ro,remount /system /system"
adb shell "echo > /data/local.prop"
6. I think at this point I was just meant to exit the lock screen.
7. adb reboot
8. Congratulations. You're now rooted. Go to the Play Store and download "Superuser" (by ChainsDD) and "BusyBox" (by Stericson). If you decide to buy BusyBox Pro, do not check the "symlinks" option in version 8.0, otherwise it's game over (no wifi, no adb shell, no root, no remount). It's a pain, but not impossible to repair this situation, see http://forum.xda-developers.com/showthread.php?p=26964465. I've emailed the author and I hope future versions won't trash the system so easily.
After all this, I'd suggest download Titanium Backup for Root users, backing everything up, and uninstall the all the bloatware that came with the device. Read up elsewhere about Titanium Backup.
Let me know if this helped you! Not sure how many other English speakers are using this device
Thank you for this wonderful post! A few questions:
1.) I use the F-01D but I don't live in Japan. One of the gripes I've been having about this tablet is that there doesn't seem to be anyway for me to get firmware updates unless I go there. Once rooted am I able to use Market Enabler to fake a carrier and update my tablet?
2.) This is slightly off on a tangent but since I can't find much English material about this tablet anway I might as well ask here. Another one of my gripes about the tablet is it doesn't seem to handle video very well. even 720p video doesn't play smoothly on it. On most of the software I download, it seems hardware acceleration is not enabled? Is this a hardware issue, or is it blocked by the software. And if the latter would rooting the tablet help resolve this issue; or is there any other solution? From what I've read the OMAP processor in this thing should easily be able to handle 1080p video right?
Many thanks! :good:
Kinslayer81 said:
Well, with some help from Google Translate and some creative interpretations, I managed to do this and thought I'd provide some English instructions for others (with some added comments)
DISCLAIMER: AS USUAL, YOU SHOULD KNOW THAT FOLLOWING THESE ACTIONS (AND ESPECIALLY FOLLOWING THEM INCORRECTLY) CAN BRICK YOUR DEVICE (I.E. YOUR DEVICE WILL STOP WORKING, POSSIBLY PERMANENTLY). I AM NOT RESPONSIBLE FOR ANY DAMAGES THAT MAY ARISE FROM YOU FOLLOWING THESE INSTRUCTIONS, YOU DO SO AT YOUR OWN RISK.
Downloads
1. Windows -- the Arrows TAB USB driver Download.
2. Easy rooting toolkit (ERT) for Arrows Tab F-01D (ver 1.0) Download
3. goroh_kun's lsm_disabler.ko Download
Info
4. A su binary, such as the one found in DooMLoRD_v3_ROOT-zergRush-busybox-su.zip
5. Android SDK platform tools. adb(.exe) (and in Windows, specifically: AdbWinApi.dll, AdbWinUsbApi.dll)
Preparation
1. Unzip ert4F01D.zip, and in the subdirectory 'files' place:
* adb.exe (Windows only, from step 4 above)
* AdbWinApi.dll (Windows only, from step 4 above)
* AdbWinUsbApi.dll (Windows only, from step 4 above)
* lsm_disabler.ko (from step 3 above)
* su (from step 5 above)
2. Before connecting the USB, in Settings -> Applications -> Development:
* Check (tick) USB debugging ("Debug mode when USB is connected")
* Check (tick) Stay awake ("Screen will never sleep while charging")
3. Set up the USB drivers and Android Development stuff if you haven't already. I don't use Windows so can't help with this.
The Dirty Work
At this stage, you can run the batch file. Since I don't use Windows, I did the steps by hand, so you'll have to correlate your actions appropriately (I can't read Japanese either, so your guess is as good as mine ).
1. On your PC:
adb shell "mv /data/local/calib.dat /data/local/calib.dat_"
adb shell "ln -s /data/local.prop /data/local/calib.dat"
2. On the tablet, go into Google Maps, touch the GPS icon ("locate me" icon) on the top right hand corner, and then touch the BACK key to exit.
3. On your PC:
adb shell "echo ro.kernel.qemu=1 > /data/local.prop"
adb shell "rm /data/local/calib.dat"
adb shell "mv /data/local/calib.dat_ /data/local/calib.dat"
adb reboot
5. Once the device has fully rebooted, on your PC:
adb shell "mkdir /data/local/lib"
adb push files\lsm_disabler.ko /data/local/lib/
adb shell "insmod /data/local/lib/lsm_disabler.ko"
adb shell "mkdir /data/local/bin"
adb shell "echo '#!/system/bin/sh' > /data/local/bin/autoexec.sh"
adb shell "echo '/system/xbin/soff' >> /data/local/bin/autoexec.sh"
adb shell "chmod 755 /data/local/bin/autoexec.sh"
adb shell "mount -o rw,remount /system /system"
adb shell "ln -s /data/local/bin/autoexec.sh /system/etc/install-recovery.sh"
adb push files\su /system/xbin/
adb shell "chown root.root /system/xbin/su"
adb shell "chmod 06755 /system/xbin/su"
adb shell "echo insmod /data/local/lib/lsm_disabler.ko > /system/xbin/soff"
adb shell "chmod 755 /system/xbin/soff"
adb shell "mount -o ro,remount /system /system"
adb shell "echo > /data/local.prop"
6. I think at this point I was just meant to exit the lock screen.
7. adb reboot
8. Congratulations. You're now rooted. Go to the Play Store and download "Superuser" (by ChainsDD) and "BusyBox" (by Stericson). If you decide to buy BusyBox Pro, do not check the "symlinks" option in version 8.0, otherwise it's game over (no wifi, no adb shell, no root, no remount). It's a pain, but not impossible to repair this situation, see http://forum.xda-developers.com/showthread.php?p=26964465. I've emailed the author and I hope future versions won't trash the system so easily.
After all this, I'd suggest download Titanium Backup for Root users, backing everything up, and uninstall the all the bloatware that came with the device. Read up elsewhere about Titanium Backup.
Let me know if this helped you! Not sure how many other English speakers are using this device
Click to expand...
Click to collapse
Just wanted to say thank you again. The rooting worked perfectly, though it took me a while to manually type in all the commands. For people who want to try this, you do need to install busybox before any other programs such as rootchecker will properly verify that your device is actually rooted.
And just for anyone wondering - rooting and using MarketEnabler has NOT been able to resolve the issue of not being able to update the software overseas...
Hey, sorry for the late reply, busy times :>
Glad the post helped you! I know I was super amped to finally get rood and get rid of all the bloatware I couldn't even understand. Things have definitely been a lot smoother since then (but far from perfect, also dying for an ICS upgrade). As for your questions:
simzhewei said:
1.) I use the F-01D but I don't live in Japan. One of the gripes I've been having about this tablet is that there doesn't seem to be anyway for me to get firmware updates unless I go there. Once rooted am I able to use Market Enabler to fake a carrier and update my tablet?
Click to expand...
Click to collapse
From playing around, the requirements seem to imply that you *have to* upgrade via cellular data from a Docomo SIM card, and it can't be done via roaming, so yeah, it seems like you have to physically go to Japan to upgrade Your market enabler idea was a good one, but since you tried that (I'm assuming using the Docomo info), I guess the upgrade app is using a different source to check where you're at. Ultimately we need to somehow get hold of an update.zip (or other file) that can be run through the Recovery system (which does exist!).
2.) This is slightly off on a tangent but since I can't find much English material about this tablet anway I might as well ask here. Another one of my gripes about the tablet is it doesn't seem to handle video very well. even 720p video doesn't play smoothly on it. On most of the software I download, it seems hardware acceleration is not enabled? Is this a hardware issue, or is it blocked by the software. And if the latter would rooting the tablet help resolve this issue; or is there any other solution? From what I've read the OMAP processor in this thing should easily be able to handle 1080p video right?
Click to expand...
Click to collapse
Haven't tried 1080p, but after some tinkering I did get 720p playing. I use MX Player, and although they said it would download needed hardware decoders automatically, it didn't, and things improved a lot after I downloaded the MX Player ARMv7 codec. Video plays great, but to get sound, I had to run the sound through the software decoder (just tap the music note icon, and choose "Track #1 (S/W decoder)".
On the other hand, I found the hardware decoding often gets stuck (relaunching MX player just gives you a waiting indicator forever)... and the only way to fix it is a reboot. Since this happens quite often, it's incredibly annoying, and I'm hoping an upgrade will fix it. Let me know if this doesn't happen to you. Also have some very intermittent wifi issues, some things work fine (speedtest, etc) but apps like streaming radio, some work fine (spotify) and others don't work at all (di radio). Some things work fine for a while after a reboot.
---------- Post added at 10:02 AM ---------- Previous post was at 10:00 AM ----------
Incidentally, here's what happens if I try update via recovery (with no update files). Maybe it will help someone. Googling most of the stuff came up with nothing. The ** in the middle somewhere is stuff I couldn't read, guess I should go back and do it again but this is from quite a while ago.
Code:
C_L1_043
2.6.35.7
V19R36D
=======================
SD Downloader
=======================
Device SW Downloading...
Don't remove
the SD Card & the Battery.
checking battery
eMMC SD mount complete.
microSD mount complete.
Firm name :
Firm name :
Target:
Check eMMC(SD).
Firm name :
Update GANG file not found
File open error!
**ddl Touch Firm Write start
Firm name :
/external_sd/I2C_HSSP_Bridge_Parallel.cyacd file not found
firm name :
/sdcard/I2C_HSSP_Bridge_Parallel.cyacd file not found
#sddl touch firm not found ret: 1
SKIP sddl launch firm write end ret: 1
SD : SdFgldfirmwrite -------
firm name :
BAC_H_19.enc =
firm name :
BAC_H_1.9.enc =
error
SKIP sddl fgic firm write end ret: 1
end
****************************
****************************
****
All firmware not found!
****
Interesting situation...
First off...Kinslayer81, thanks for posting this. I found the original in Japanese, and was not eager to try to translate it. Thanks for putting in the work.
For everyone (especially if you got this to work) - when I went through the step, I keep getting a "permissions denied" message. Whether it's the ERT4F01D batch file, or typing the commands in... I get "permissions denied".
Did you guys encounter this?
Glad it helped you On which step are you getting the error? Any strange output on any of the preceding steps?
Every step is important, to be done in the exact same order, e.g. loading google maps and pressing the 'my location' icon, etc.
Dakedo_Baby said:
First off...Kinslayer81, thanks for posting this. I found the original in Japanese, and was not eager to try to translate it. Thanks for putting in the work.
For everyone (especially if you got this to work) - when I went through the step, I keep getting a "permissions denied" message. Whether it's the ERT4F01D batch file, or typing the commands in... I get "permissions denied".
Did you guys encounter this?
Click to expand...
Click to collapse
Permission denied
Oh I know... I'm not new to the game. I've stalked these boards for a while now... This is my first tablet though.
I've tried running both the ERT4F01D batch... and the manual input.
I get it from the batch file, as soon as I tell it to "RUN"... "Permissions Denied"
From manual input - LINE 2: adb shell "ln -s /data/local.prop /data/local/calib.dat" = "Permissions Denied"
Like there's some additional admin privilege I don't have. Hmmmmm....
And here's an additional kicker... the tablet auto-reboots each and every time. I've tried it a number of times (started over from the top), same result each time.
Kinslayer81 said:
Glad it helped you On which step are you getting the error? Any strange output on any of the preceding steps?
Every step is important, to be done in the exact same order, e.g. loading google maps and pressing the 'my location' icon, etc.
Click to expand...
Click to collapse
I must admit, I don't have any great ideas.
So you can move the file in the first step no problem, and just the attempt to symlink gives you the error?
What is the output of "adb shell ls -la /data/local/".
When does the auto reboot occur?
Dakedo_Baby said:
Oh I know... I'm not new to the game. I've stalked these boards for a while now... This is my first tablet though.
I've tried running both the ERT4F01D batch... and the manual input.
I get it from the batch file, as soon as I tell it to "RUN"... "Permissions Denied"
From manual input - LINE 2: adb shell "ln -s /data/local.prop /data/local/calib.dat" = "Permissions Denied"
Like there's some additional admin privilege I don't have. Hmmmmm....
And here's an additional kicker... the tablet auto-reboots each and every time. I've tried it a number of times (started over from the top), same result each time.
Click to expand...
Click to collapse
I'm stumped too...
Well... this is getting a little interesting...
LS command - no problem (included image)
Decided to have another shot at it... and I was able to get a little further. Still encountered a problem
Now, the INSMOD command failed... "Operation not permitted"
Kinslayer81 said:
I must admit, I don't have any great ideas.
So you can move the file in the first step no problem, and just the attempt to symlink gives you the error?
What is the output of "adb shell ls -la /data/local/".
When does the auto reboot occur?
Click to expand...
Click to collapse
file system set to READ-only...
My file systems are set to Read-only... that explains quite a bit....
Dakedo_Baby said:
Well... this is getting a little interesting...
LS command - no problem (included image)
Decided to have another shot at it... and I was able to get a little further. Still encountered a problem
Now, the INSMOD command failed... "Operation not permitted"
Click to expand...
Click to collapse
Dakedo_Baby said:
My file systems are set to Read-only... that explains quite a bit....
Click to expand...
Click to collapse
Do you mind me asking, how did you set your file system to read-write? I have the same error as you were seeing but it's not allowing me to remount as read-write...
Can you confirm what command you used please?
thanks
Sorry again for late reply
Dakedo_Baby, I've looked at your stuff a few times and it's not obvious to me where things are going wrong. I again need some more info to try get a better idea of what's going on:
1) Before the first reboot, let me know the output of: adb shell "cat /data/local.prop"
2) After the reboot, let me know the output of: adb shell id
As for the file systems, well, /data should be already mounted rw, and /system should be mounted ro until you remount it. You can see how each is mounted with just "adb mount".
histrix said:
Do you mind me asking, how did you set your file system to read-write? I have the same error as you were seeing but it's not allowing me to remount as read-write...
Can you confirm what command you used please?
thanks
Click to expand...
Click to collapse
The command to remount the /system partition as read-write is: adb shell "mount -o rw,remount /system /system"
Of course, you should only be executing that step as part of the given sequence and in the correct order. You won't be able to execute the command until after your first reboot in the instructions, after which adb should still be running as root.
Any good Custom ICS roms you guys recommend after rooting the Arrows Tab?
ICS..Hurray!!!
Just found this out in Fujitsu site:
http://spf.fmworld.net/fujitsu/c/update/nttdocomo/f-01d/update1/top/index.html
There is a 4.0.3 download available. Click the 3rd Button (Green) downloads the zip package.
The 2nd link has howto from PC.
Still not sure if this will work, but trying out.
Also may lose root..and whatever else..So keeping my fingers crossed.
Google translation link
http://translate.google.com/transla...update/nttdocomo/f-01d/update1/top/index.html
Will post how it goes.
I made a new thread for this, since it's a different topic and you'll lose root too
http://forum.xda-developers.com/showthread.php?p=32200671
insmod lsm-disabler.so to remount /system rw
Back to the original topic... what I maybe didn't notice before is that the stock kernel blocks even root users from remounting /system as rw. So in case you ever need rw access to /system again, obviously you'll first have to be root, and afterwards you'll need to "insmod lsm-disabler.so" (as per the original instructions) before you can "busybox mount -o remount,rw /system" (or run any root app that remounts the system partition).
locked F-01d
Kinslayer81 said:
Well, with some help from Google Translate and some creative interpretations, I managed to do this and thought I'd provide some English instructions for others (with some added comments)
DISCLAIMER: AS USUAL, YOU SHOULD KNOW THAT FOLLOWING THESE ACTIONS (AND ESPECIALLY FOLLOWING THEM INCORRECTLY) CAN BRICK YOUR DEVICE (I.E. YOUR DEVICE WILL STOP WORKING, POSSIBLY PERMANENTLY). I AM NOT RESPONSIBLE FOR ANY DAMAGES THAT MAY ARISE FROM YOU FOLLOWING THESE INSTRUCTIONS, YOU DO SO AT YOUR OWN RISK.
Downloads
1. Windows -- the Arrows TAB USB driver Download.
2. Easy rooting toolkit (ERT) for Arrows Tab F-01D (ver 1.0) Download
3. goroh_kun's lsm_disabler.ko Download
Info
4. A su binary, such as the one found in DooMLoRD_v3_ROOT-zergRush-busybox-su.zip
5. Android SDK platform tools. adb(.exe) (and in Windows, specifically: AdbWinApi.dll, AdbWinUsbApi.dll)
Preparation
1. Unzip ert4F01D.zip, and in the subdirectory 'files' place:
* adb.exe (Windows only, from step 4 above)
* AdbWinApi.dll (Windows only, from step 4 above)
* AdbWinUsbApi.dll (Windows only, from step 4 above)
* lsm_disabler.ko (from step 3 above)
* su (from step 5 above)
2. Before connecting the USB, in Settings -> Applications -> Development:
* Check (tick) USB debugging ("Debug mode when USB is connected")
* Check (tick) Stay awake ("Screen will never sleep while charging")
3. Set up the USB drivers and Android Development stuff if you haven't already. I don't use Windows so can't help with this.
The Dirty Work
At this stage, you can run the batch file. Since I don't use Windows, I did the steps by hand, so you'll have to correlate your actions appropriately (I can't read Japanese either, so your guess is as good as mine ).
1. On your PC:
adb shell "mv /data/local/calib.dat /data/local/calib.dat_"
adb shell "ln -s /data/local.prop /data/local/calib.dat"
2. On the tablet, go into Google Maps, touch the GPS icon ("locate me" icon) on the top right hand corner, and then touch the BACK key to exit.
3. On your PC:
adb shell "echo ro.kernel.qemu=1 > /data/local.prop"
adb shell "rm /data/local/calib.dat"
adb shell "mv /data/local/calib.dat_ /data/local/calib.dat"
adb reboot
5. Once the device has fully rebooted, on your PC:
adb shell "mkdir /data/local/lib"
adb push files\lsm_disabler.ko /data/local/lib/
adb shell "insmod /data/local/lib/lsm_disabler.ko"
adb shell "mkdir /data/local/bin"
adb shell "echo '#!/system/bin/sh' > /data/local/bin/autoexec.sh"
adb shell "echo '/system/xbin/soff' >> /data/local/bin/autoexec.sh"
adb shell "chmod 755 /data/local/bin/autoexec.sh"
adb shell "mount -o rw,remount /system /system"
adb shell "ln -s /data/local/bin/autoexec.sh /system/etc/install-recovery.sh"
adb push files\su /system/xbin/
adb shell "chown root.root /system/xbin/su"
adb shell "chmod 06755 /system/xbin/su"
adb shell "echo insmod /data/local/lib/lsm_disabler.ko > /system/xbin/soff"
adb shell "chmod 755 /system/xbin/soff"
adb shell "mount -o ro,remount /system /system"
adb shell "echo > /data/local.prop"
6. I think at this point I was just meant to exit the lock screen.
7. adb reboot
8. Congratulations. You're now rooted. Go to the Play Store and download "Superuser" (by ChainsDD) and "BusyBox" (by Stericson). If you decide to buy BusyBox Pro, do not check the "symlinks" option in version 8.0, otherwise it's game over (no wifi, no adb shell, no root, no remount). It's a pain, but not impossible to repair this situation, see http://forum.xda-developers.com/showthread.php?p=26964465. I've emailed the author and I hope future versions won't trash the system so easily.
After all this, I'd suggest download Titanium Backup for Root users, backing everything up, and uninstall the all the bloatware that came with the device. Read up elsewhere about Titanium Backup.
Let me know if this helped you! Not sure how many other English speakers are using this device
Click to expand...
Click to collapse
thanks for the rooting tutorial but mine is also locked to ntt DOCOMO,,,ANY WAY TO UNLOCK IT
how to unlock the network
please help me how to unlock this tablet i got this tablet from my japan friend but it is network locked please help me to unlock this
I just got a cute chinese phone, called Bluebo B3000.
(The manufacturer is www bluebo net)
the device has MTK6575
Android 4.0.4, Kernel 3.0.13
no GPS,
RAM: 256MB
ROM: 512MB
Resolution: 320 x 480 Pixels
SIM slots: 2
SD card
quadband GSM 850/900/1800/1900MHz
I only need root.
Which flash tool is good for this device?
There are russian forums discussing this device, e.g..forum china-iphone ru , viewtopic.php?f=46&t=22437
but I dont understand what they say.
Thanks!
yay
I posted how to root this phone in the Russian Forum, (in Russian and English), here are the steps to follow:
I have the same phone (BlueBo B3000 -MTK6575)
English:
We have to have our mobile perfectly recognized by the computer as "ADB Device", with the controller properly installed, and Debug Mode Enable (connected to the PC with the USB cable).
Download (htt p://ww w.4shar ed.com/zip/fyH9xy DF/Roo tTianji.ht m l) (remove spaces), you need to work in command mode with ADB.
Unzip in "C :/" folder, it will be now "C :/ RootTianji /".
Open a command window (cmd.exe). Then we put (without the quotes) cd.. "until we get "C:>" then put "cd RootTianji" and then just put "adb".
Best explained
1 -. cmd.exe
2 -. cd ..
3 -. cd .. (again)
4 -. Stop when you get "C:>" prompt
5 -. RootTianji cd
6 -. adb
Now we have to follow these steps to the letter.
Type and hit enter: adb push su /data/local/tmp/su
Type and hit enter: adb push Superuser.apk /data/local/tmp/Superuser.apk
Type and hit enter: adb restore fakebackup.ab (Do not do anything on the phone yet)
Type and hit enter: adb shell "while ! ln -s /data/local.prop /data/data/com.android.settings/a/file99; do :; done" (Now in the command window appear few rows error and that means the exploit is working and now is when you press on the phone and within seconds Restore on mobile as a message that the restoration is completed. If a password is asked do not to write anything, just continue)
Type and hit enter: adb reboot (The phone now reboots itself. Do not do anything until it completely reboot. Might take a little and flashes).
Type and hit enter: adb shell
Now the phone is in root mode and the # prompt appears.
Type and hit enter: mount -o remount,rw -t ext4 /dev/block/mmcblk0p1 /system
Type and hit enter: cat /data/local/tmp/su > /system/bin/su
Type and hit enter: chmod 06755 /system/bin/su
Type and hit enter: ln -s /system/bin/su /system/xbin/su
Type and hit enter: cat /data/local/tmp/Superuser.apk > /system/app/Superuser.apk
Type and hit enter: chmod 0644 /system/app/Superuser.apk
Type and hit enter: rm /data/local.prop
Type and hit enter: exit
Type and hit enter: adb shell "sync; sync; sync;"
Type and hit enter: adb reboot
Your mobile is now root.
If you could try to do all steps from the beginning and from step 9 and 10 run these commands: chown 0.0 / system / bin / su
If the process gets "stuck" in the row of errors (never ends), close and disconnect everything and connect the phone again seeing that everything necessary is in good condition (drivers, cables, files), then proceed to retry processes from the beginnin. (cmd.exe).
If you dont understand something just ask.
This guide was originally made for Tinji Mobile N9000 i9220, but when I realized it was the same processor as mine (B3000 - MT6575), I decided to try it, and for my surprise, it worked!
Please be careful and use this information at your own risk
Sorry if I wrote something bad or strange. Bye
Thanks!! I will try.
Hooray! I've got root!
thanks!
unlucky for me I have messed some things around and mis-spelled the "ln -s" command,
but eventually I managed to install all the drivers required, and to load a ROM with root.
Thanks a lot!
BlueBo unlock
gonzalox said:
I posted how to root this phone in the Russian Forum, (in Russian and English), here are the steps to follow:
I have the same phone (BlueBo B3000 -MTK6575)
English:
We have to have our mobile perfectly recognized by the computer as "ADB Device", with the controller properly installed, and Debug Mode Enable (connected to the PC with the USB cable).
Download (htt p://ww w.4shar ed.com/zip/fyH9xy DF/Roo tTianji.ht m l) (remove spaces), you need to work in command mode with ADB.
Unzip in "C :/" folder, it will be now "C :/ RootTianji /".
Open a command window (cmd.exe). Then we put (without the quotes) cd.. "until we get "C:>" then put "cd RootTianji" and then just put "adb".
Best explained
1 -. cmd.exe
2 -. cd ..
3 -. cd .. (again)
4 -. Stop when you get "C:>" prompt
5 -. RootTianji cd
6 -. adb
Now we have to follow these steps to the letter.
Type and hit enter: adb push his / data / local / tmp / su
Type and hit enter: adb push Superuser.apk / data / local / tmp / Superuser.apk
Type and hit enter: adb restore fakebackup.ab (Do not do anything on the phone yet)
Type and hit enter: adb shell "while! Ln-s / data / local.prop / data/data/com.android.settings/a/file99, do:; done" (Now in the command window appear few rows error and that means the exploit is working and now is when you press on the phone and within seconds Restore on mobile as a message that the restoration is completed. If a password is asked do not to write anything, just continue)
Type and hit enter: adb reboot (The phone now reboots itself. Do not do anything until it completely reboot. Might take a little and flashes).
Type and hit enter: adb shell
Now the phone is in root mode and the # prompt appears.
Type and hit enter: mount-o remount, rw-t ext4 / dev/block/mmcblk0p1 / system
Type and hit enter: cat / data / local / tmp / su> / system / bin / su
Type and hit enter: chmod 06755 / system / bin / su
Type and hit enter: ln-s / system / bin / su / system / xbin / su
Type and hit enter: cat / data / local / tmp / Superuser.apk> / system / app / Superuser.apk
Type and hit enter: chmod 0644 / system / app / Superuser.apk
Type and hit enter: rm / data / local.prop
Type and hit enter: exit
Type and hit enter: adb shell "sync, sync, sync;"
Type and hit enter: adb reboot
Your mobile is now root.
If you could try to do all steps from the beginning and from step 9 and 10 run these commands: chown 0.0 / system / bin / su
If the process gets "stuck" in the row of errors (never ends), close and disconnect everything and connect the phone again seeing that everything necessary is in good condition (drivers, cables, files), then proceed to retry processes from the beginnin. (cmd.exe).
If you dont understand something just ask.
This guide was originally made for Tinji Mobile N9000 i9220, but when I realized it was the same processor as mine (B3000 - MT6575), I decided to try it, and for my surprise, it worked!
Please be careful and use this information at your own risk
Sorry if I wrote something bad or strange. Bye
Click to expand...
Click to collapse
I have purchased a B3000 but it's not accepting my SIM for Tmobile and I need it unlocked....do anyone know how to unlock?
sugabear210 said:
I have purchased a B3000 but it's not accepting my SIM for Tmobile and I need it unlocked....do anyone know how to unlock?
Click to expand...
Click to collapse
i think the problem might be your SIM card, this mobile come as unlocked as default.
Getting stuck
If the process gets "stuck" in the row of errors (never ends), close and disconnect everything and connect the phone again seeing that everything necessary is in good condition (drivers, cables, files), then proceed to retry processes from the beginnin. (cmd.exe).
Click to expand...
Click to collapse
I always get stuck at this part, i own a Bluebo B3000 Android 4.0.4 ICS can you help me? thank you
EDIT: I've figured it out, you have to write the code and click the restore option as quick as possible
EDIT 03/01/2013: I've given up hope in trying to root this phone, when i tried two days ago i couldn't root it but now i've tried and it worked like WOAH! thank you for this wonderful tutorial!!!
gonzalox said:
I posted how to root this phone in the Russian Forum, (in Russian and English), here are the steps to follow:
I have the same phone (BlueBo B3000 -MTK6575)
English:
We have to have our mobile perfectly recognized by the computer as "ADB Device", with the controller properly installed, and Debug Mode Enable (connected to the PC with the USB cable).
Download (htt p://ww w.4shar ed.com/zip/fyH9xy DF/Roo tTianji.ht m l) (remove spaces), you need to work in command mode with ADB.
Unzip in "C :/" folder, it will be now "C :/ RootTianji /".
Open a command window (cmd.exe). Then we put (without the quotes) cd.. "until we get "C:>" then put "cd RootTianji" and then just put "adb".
Best explained
1 -. cmd.exe
2 -. cd ..
3 -. cd .. (again)
4 -. Stop when you get "C:>" prompt
5 -. RootTianji cd
6 -. adb
Now we have to follow these steps to the letter.
Type and hit enter: adb push su /data/local/tmp/su
Type and hit enter: adb push Superuser.apk /data/local/tmp/Superuser.apk
Type and hit enter: adb restore fakebackup.ab (Do not do anything on the phone yet)
Type and hit enter: adb shell "while ! ln -s /data/local.prop /data/data/com.android.settings/a/file99; do :; done" (Now in the command window appear few rows error and that means the exploit is working and now is when you press on the phone and within seconds Restore on mobile as a message that the restoration is completed. If a password is asked do not to write anything, just continue)
Type and hit enter: adb reboot (The phone now reboots itself. Do not do anything until it completely reboot. Might take a little and flashes).
Type and hit enter: adb shell
Now the phone is in root mode and the # prompt appears.
Type and hit enter: mount -o remount,rw -t ext4 /dev/block/mmcblk0p1 /system
Type and hit enter: cat /data/local/tmp/su > /system/bin/su
Type and hit enter: chmod 06755 /system/bin/su
Type and hit enter: ln -s /system/bin/su /system/xbin/su
Type and hit enter: cat /data/local/tmp/Superuser.apk > /system/app/Superuser.apk
Type and hit enter: chmod 0644 /system/app/Superuser.apk
Type and hit enter: rm /data/local.prop
Type and hit enter: exit
Type and hit enter: adb shell "sync; sync; sync;"
Type and hit enter: adb reboot
Your mobile is now root.
If you could try to do all steps from the beginning and from step 9 and 10 run these commands: chown 0.0 / system / bin / su
If the process gets "stuck" in the row of errors (never ends), close and disconnect everything and connect the phone again seeing that everything necessary is in good condition (drivers, cables, files), then proceed to retry processes from the beginnin. (cmd.exe).
If you dont understand something just ask.
This guide was originally made for Tinji Mobile N9000 i9220, but when I realized it was the same processor as mine (B3000 - MT6575), I decided to try it, and for my surprise, it worked!
Please be careful and use this information at your own risk
Sorry if I wrote something bad or strange. Bye
Click to expand...
Click to collapse
its not worked for me - b3000s
when get error with the msg for restor the error rows never be end
and when type this comand : mount -o remount,rw -t ext4 /dev/block/mmcblk0p1 /system
i see error please help me
Device Not Recognized
When I connect my Bluebo B3000 to the computer even with USB debugging on it doesn't recognize it. I have everything installed to root this phone, and I just need to figure out how to fix this. I'm using Windows 7 x64.
Is there any drivers for this phone? I can't find any. It might be in Chinese or Russian, I don't know. I also tried to find drivers for Tinji Mobile N9000 i9220 since gozalox says that it has the same processor as this one, but the search results yielded with roms; they don't look legitimate so I don't want to bother.
Thank you for reading.
EDIT:
After installing MTK6575 device I finally was able to get in my phone, but I still get stuck at the "while" part
I followed everything as instructed, and yes I checked if the spelling was correct by pasting the instructions in the notepad.
After entering the adb shell "while ! ln -s /data/local.prop /data/data/com.android.settings/a/file99; do :; done" I get link failed File exists. I did click restore my data quickly and kept waiting. I did see the com.android.settings under the page in the phone. I don't understand the password request part since the phone asks me for the encryption password on the page in which I'm sure I don't have. I was stuck on the data restore until the streams of "link failed File exists" disappeared so I proceeded to reboot, but when I type adb shell it was still $ I've kept trying to do this over and over again from step 1 (not closing the cmd prompt though, I wouldn't want to type them over and over) but it still doesn't work. My last resort would be typing everything from scratch and hope for the best.
Please help. Thank you!
EDIT 2:
I finally rooted my phone. For those people who need help, go here ht tp://fo rum. china-iphon e.ru/viewt opic.p hp?f=31&t =17863 (remove spaces) and click MTK Droid Root & Tools v2.3.7 The program is in English, so no worries about that. I did it twice for mine and it worked~ Install the Android Terminal app to check if you're rooted. Just type su in a window and if it has the hash sign "#" then you're rooted. Good luck!
Ignore, as I'm still looking for the delete button. Noob, noob, noob...
Messed it Up with mtkdroid Tools
I Have used the Mtk droid Tool, clicked on root button, and confirmed on the onscreen button.
after this the program continues to recognize my device but now the "ROOT" button disapears, and above was write "root shell quemu mode".
I think the phone was rooted, but I installed some root required apks and they said that i have not the root permisions, including the Terminal emulator, this said "permission denied" when prompt "su" command.
After I requested a normal reboot via the MtkdroidTools and the device dont boot, it stays freezed at Android logo.
I tried the Recovery mode, but dont worked too...