As promised, I've published my root exploit. It's possible that this exploit will wipe your /data partition. This did not happen on the two devices that have been successfully rooted, but I don't want any nasty surprises. Please back up your applications and data if you're worried about this. There is no risk of permanent damage to the device, but by running this exploit, you assume all responsibilty.
You can root your device with the following steps:
1. Ensure your device is in USB debugging mode, is connected to your PC, and that ADB works. Instructions on this are available in this thread:
http://forum.xda-developers.com/showthread.php?t=1327139
2. Download the exploit here:
http://vulnfactory.org/public/Sony_Tablet_S_Root_Windows.zip
3. Unzip the full contents of the zip.
4. Run "run.bat"
---
Full details on how the exploit works are posted here:
http://vulnfactory.org/blog/2012/02/08/rooting-the-sony-tablet-s/
I can't guarantee that this exploit will work after receiving an OTA update, including ICS. As always, when rooted, be cautious of accepting OTA updates unless you have received confirmation that the root exploit has not been patched.
If you pledged towards the bounty, details on how to donate are at the bottom of the above blog post.
Enjoy,
Dan Rosenberg (@djrbliss)
P.S. For those interested in reposting this, I have no affiliation with any forum (including XDA).
nice work!
What is the indicator of success?
I get to * daemon started successfully *, but nothing more.
@ejchis: Superuser.apk should be installed on your device and apps that needs root rights should work now (Titanium backup, AdwareBlock ect)
obicom said:
@ejchis: Superuser.apk should be installed on your device and apps that needs root rights should work now (Titanium backup, AdwareBlock ect)
Click to expand...
Click to collapse
Thanks. I'm not getting to that point for some reason. I think my adb is not functioning properly. I need to play with this some more. I've always been a terminal emulator guy, so I'm not particularly confident with my adb skills.
I can confirm that this works perfectly. Let's hope this is but the first step in making this an awesome device. Many thanks!!!
use the command "adb devices" you should see what looks like a serial number show up. If nothing shows up then you have a problem with your ADB drivers. You may just need to restart the computer.
Thank !!!
Rooted
.............
Awesome! Works great! THX!!
Works great ... full respect from my side .... well done ... !!
YOU ARE MY HERO !!!!
My adb was being funky. I found a post somewhere else through Google where someone had to rename their adb.exe file to adb.exe.exe, reboot their computer, and rename the file back to adb.exe. I did this as a stab in the dark, and my command prompt suddenly began working for me. Tablet is currently rebooting for a third time. I'm keeping my fingers crossed.
EDIT: SUCCESS! Thank you, djrbliss.
Great, thank you for this !
I tried to use the exploit after a factory reset, and I can't get it to work.
Code:
F:\Desktop\Sony_Tablet_S_Root_Windows>run.bat
[*]
[*] Sony Tablet S root script (Windows version)
[*] by Dan Rosenberg (@djrbliss)
[*]
[*] Before continuing, ensure USB debugging is enabled, that ADB
[*] is working properly, and that your tablet is connected via USB.
[*]
[*] WARNING: This exploit may result in wiping your /data partition,
[*] causing you to lose any applications and data on your tablet.
[*] There should be no risk of permanent damage to your device, but
[*] by running this script you accept all responsibility.
[*]
[*] Press enter to root your tablet...
Press any key to continue . . .
[*]
[*] Waiting for device...
* daemon not running. starting it now *
* daemon started successfully *
[*] Device found.
[*] Pushing log flooder to device...
583 KB/s (5382 bytes in 0.009s)
[*] Preparing to append to packages.list...
[*] Rebooting device...
[*] Waiting for tablet to reboot.
[*] Attempting to move system package library directory...
[+] System package com.google.android.location has uid 10029
[+] Flooding log...
[*] If you received any errors in the previous step, abort the exploit
[*] and try again. Otherwise, press any key to continue.
Press any key to continue . . .
[*] Rebooting device...
[*] Waiting for tablet to reboot.
[*] Attempting to insert fake local.prop entry...
[+] Flooding log...
[*] Rebooting device...
[*] Waiting for tablet to reboot.
[*] Attemping persistence...
remount failed: Operation not permitted
failed to copy 'su' to '/system/bin/su': Read-only file system
Unable to chmod /system/bin/su: No such file or directory
failed to copy 'busybox' to '/system/xbin/busybox': Read-only file system
Unable to chmod /system/xbin/busybox: No such file or directory
/system/xbin/busybox: not found
failed to copy 'Superuser.apk' to '/system/app/Superuser.apk': Read-only file sy
stem
[*] Cleaning up...
failed on '/data/data/com.google.android.location/lib.bak' - Permission denied
[*] Rebooting...
[*] Exploit complete!
[*] Press any key to exit.
Press any key to continue . . .
ADB works and debugging is enabled.
Got it working. Next step is CWM and then a nice fresh cup of awesomeness. Thanks Dan. Expect a donation your way.
Judah001 said:
Is anyone able to make a YouTube video for people like me who can’t seem to figure it out? That would be totally appreciated not only by me but I’m sure the rest of our tablet S community. Thanks for root!
Click to expand...
Click to collapse
OKay
rjsmith2007 said:
I tried to use the exploit after a factory reset, and I can't get it to work.
Code:
F:\Desktop\Sony_Tablet_S_Root_Windows>run.bat
[*]
[*] Sony Tablet S root script (Windows version)
[*] by Dan Rosenberg (@djrbliss)
[*]
[*] Before continuing, ensure USB debugging is enabled, that ADB
[*] is working properly, and that your tablet is connected via USB.
[*]
[*] WARNING: This exploit may result in wiping your /data partition,
[*] causing you to lose any applications and data on your tablet.
[*] There should be no risk of permanent damage to your device, but
[*] by running this script you accept all responsibility.
[*]
[*] Press enter to root your tablet...
Press any key to continue . . .
[*]
[*] Waiting for device...
* daemon not running. starting it now *
* daemon started successfully *
[*] Device found.
[*] Pushing log flooder to device...
583 KB/s (5382 bytes in 0.009s)
[*] Preparing to append to packages.list...
[*] Rebooting device...
[*] Waiting for tablet to reboot.
[*] Attempting to move system package library directory...
[+] System package com.google.android.location has uid 10029
[+] Flooding log...
[*] If you received any errors in the previous step, abort the exploit
[*] and try again. Otherwise, press any key to continue.
Press any key to continue . . .
[*] Rebooting device...
[*] Waiting for tablet to reboot.
[*] Attempting to insert fake local.prop entry...
[+] Flooding log...
[*] Rebooting device...
[*] Waiting for tablet to reboot.
[*] Attemping persistence...
remount failed: Operation not permitted
failed to copy 'su' to '/system/bin/su': Read-only file system
Unable to chmod /system/bin/su: No such file or directory
failed to copy 'busybox' to '/system/xbin/busybox': Read-only file system
Unable to chmod /system/xbin/busybox: No such file or directory
/system/xbin/busybox: not found
failed to copy 'Superuser.apk' to '/system/app/Superuser.apk': Read-only file sy
stem
[*] Cleaning up...
failed on '/data/data/com.google.android.location/lib.bak' - Permission denied
[*] Rebooting...
[*] Exploit complete!
[*] Press any key to exit.
Press any key to continue . . .
ADB works and debugging is enabled.
Click to expand...
Click to collapse
Try running the .bat file again, it happened to me first time, but when I tried it second time it worked.
05081983 said:
Try running the .bat file again, it happened to me first time, but when I tried it second time it worked.
Click to expand...
Click to collapse
When I run the bat file the second time, I get an error related to the files that the exploit handles:
Code:
[+] System package com.google.android.location has uid 10029
[+] Flooding log...
failed on '/data/data/com.google.android.location/lib' - Permission denied
link failed File exists[*]
Code:
F:\Desktop\Sony_Tablet_S_Root_Windows>run.bat
[*]
[*] Sony Tablet S root script (Windows version)
[*] by Dan Rosenberg (@djrbliss)
[*]
[*] Before continuing, ensure USB debugging is enabled, that ADB
[*] is working properly, and that your tablet is connected via USB.
[*]
[*] WARNING: This exploit may result in wiping your /data partition,
[*] causing you to lose any applications and data on your tablet.
[*] There should be no risk of permanent damage to your device, but
[*] by running this script you accept all responsibility.
[*]
[*] Press enter to root your tablet...
Press any key to continue . . .
[*]
[*] Waiting for device...
* daemon not running. starting it now *
* daemon started successfully *
[*] Device found.
[*] Pushing log flooder to device...
656 KB/s (5382 bytes in 0.008s)
[*] Preparing to append to packages.list...
[*] Rebooting device...
[*] Waiting for tablet to reboot.
[*] Attempting to move system package library directory...
[+] System package com.google.android.location has uid 10029
[+] Flooding log...
failed on '/data/data/com.google.android.location/lib' - Permission denied
link failed File exists
[*] If you received any errors in the previous step, abort the exploit
[*] and try again. Otherwise, press any key to continue.
Press any key to continue . . .
[*] Rebooting device...
[*] Waiting for tablet to reboot.
[*] Attempting to insert fake local.prop entry...
[+] Flooding log...
[*] Rebooting device...
[*] Waiting for tablet to reboot.
[*] Attemping persistence...
remount failed: Operation not permitted
failed to copy 'su' to '/system/bin/su': Read-only file system
Unable to chmod /system/bin/su: No such file or directory
failed to copy 'busybox' to '/system/xbin/busybox': Read-only file system
Unable to chmod /system/xbin/busybox: No such file or directory
/system/xbin/busybox: not found
failed to copy 'Superuser.apk' to '/system/app/Superuser.apk': Read-only file sy
stem
[*] Cleaning up...
failed on '/data/data/com.google.android.location/lib.bak' - Permission denied
[*] Rebooting...
[*] Exploit complete!
[*] Press any key to exit.
Press any key to continue . . .
F:\Desktop\Sony_Tablet_S_Root_Windows>
I guess it is not so "easy" to get CWM on the tablet. As I know, CWM is part of kernel and this is signed on the Sony Tablet S ....
@Dan:
Is it right and do you see a opportunity to get CWM on Tablet S?
rjsmith2007 said:
When I run the bat file the second time, I get an error related to the files that the exploit handles:
Code:
[+] System package com.google.android.location has uid 10029
[+] Flooding log...
failed on '/data/data/com.google.android.location/lib' - Permission denied
link failed File exists[*]
Click to expand...
Click to collapse
I just uploaded a new version of the exploit that should fix this problem. Just unzip it, execute "run.bat", and let me know how it goes.
If anyone has been having any problems with the exploit, please try the new version here:
http://vulnfactory.org/public/Sony_Tablet_S_Root_Windows.zip
djrbliss said:
I just uploaded a new version of the exploit that should fix this problem. Just unzip it, execute "run.bat", and let me know how it goes.
If anyone has been having any problems with the exploit, please try the new version here:
http://vulnfactory.org/public/Sony_Tablet_S_Root_Windows.zip
Click to expand...
Click to collapse
Thanks. I'll try it out now!
Edit: I'm still getting the same end result. Should I wait for the device to boot fully to the launcher, when it asks me to press a button before it continues?
I am attempting to root using condis all in one. When I run the root option I get the following errors.
[*] Sony Tablet S root script v1.1 (Windows version)
[*] by Dan Rosenberg (@djrbliss).
[*]
[*] Before continuing, ensure USB debugging is enabled, that ADB
[*] is working properly, and that your tablet is connected via USB.
[*] You've got to have proper MPT driver to root your tab!
[*] (MPT driver - wpdmtp.inf included).
[*]
[*] WARNING: This exploit may result in wiping your /data partition,
[*] causing you to lose any applications and data on your tablet.
[*] There should be no risk of permanent damage to your device, but
[*] by running this script you accept all responsibility.
[*]
[*] +small mods/optimizations by Konrad Plaszczykowski (@condi)+
[*]
[*] FULLY AUTOMATIC - ROOT SHOULD TAKE ABOUT ~ 3min 10s.
[*] Press enter to root your tablet...
[*]
[*] Waiting for device...
* daemon not running. starting it now *
* daemon started successfully *
[*] MTP driver has been disabled.
[*] Device found.
[*] Pushing log flooder to device...
failed to copy 'files\flood' to '/log/flood': Permission denied
Unable to chmod /log/flood: No such file or directory
[*] Preparing to append to packages.list...
link failed File exists
[*] Rebooting device...
[*] Waiting for tablet to reboot...... (~20s)
[*] Attempting to move system package library directory...
/log/flood: not found
run-as: Package 'com.pwn.me' is unknown
rm failed for /log/AndroidRadio.txt, Permission denied
[*] Rebooting device...
[*] Waiting for tablet to reboot...... (~40s)
[*] Attempting to insert fake local.prop entry...
link failed File exists
/log/flood: not found
[*] Rebooting device...
[*] Waiting for tablet to reboot...... (~40s)
[*] Attemping persistence...
remount failed: Operation not permitted
failed to copy 'files\su' to '/system/bin/su': Read-only file system
Unable to chmod /system/bin/su: No such file or directory
failed to copy 'files\busybox' to '/system/xbin/busybox': Read-only file system
Unable to chmod /system/xbin/busybox: No such file or directory
/system/xbin/busybox: not found
failed to copy 'files\Superuser.apk' to '/system/app/Superuser.apk': Read-only f
ile system
[*] Cleaning up...
failed on '/data/data/com.google.android.location/lib.bak' - No such file or dir
ectory
[*] Rebooting...... (~35s)
[*] MTP driver has been enabled back.
[*] Exploit complete!
[*] Press any key to continue.
The only weird thing I can find is I can see the serial from from the adb installer but I do not see it from the adb option in the all in one. Hoping one of the experts here has an idea.
Marc
problem rooting
I am also getting this error and can only connect via static ip since attempting root
mprozyn said:
failed to copy 'files\flood' to '/log/flood': Permission denied
Click to expand...
Click to collapse
hmm... that looks like your firmware is locked down for exploit used to get root.
take a look at here:
http://forum.xda-developers.com/showpost.php?p=22396523&postcount=109
http://forum.xda-developers.com/showpost.php?p=22402606&postcount=113
Check if there is maybe an ota for you - settings/about/system update check
> http://forum.xda-developers.com/showpost.php?p=22460205&postcount=127
br
condi
THANK you for the reply. I can't get an ota says its got the current one, so I think its wait for the next one and cross my fingers it gets rooted.
Marc
Successfully rooted with:
3.2.1
2.6.36.3
[email protected]#1
THMAS0012400
I'm attempting to root my Rogers Razr XT190 running GB 2.3.6 so that I can install the ICS leak. I've tried two different root processes. I first tried the one that is recommended to root the phone to install ICS - DroidRazrRoot404. I have also tried the root process from DooMLoRD. Neither root process works. Both essentially indicate that the filesystem is read only. I've searched the forum but can't find anything specific about this issue.
I have installed the recommended drivers, enabled USB debugging and tried both charge only and "Windows" USB modes. No luck no matter what I do.
A transcript of the 404 root process is shown below.
Any assistance or pointers to a helpful thread would be greatly appreciated.
[*] Motorola Razr ICS Root Exploit (Windows version)
[*] by Dan Rosenberg (@djrbliss)
[*]
[*] Before continuing, ensure USB debugging is enabled, that you
[*] have the latest Motorola drivers installed, and that your phone
[*] is connected via USB.
[*]
[*] Press enter to root your phone...
Press any key to continue . . .
[*]
[*] Waiting for device...
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
[*] Device found.
[*] Rebooting device...
[*] Waiting for device to reboot...
rm failed for /data/local.prop, Permission denied
cannot create /data/local.prop: permission denied
[*] Rebooting device again...
[*] Waiting for device to reboot...
[*] Attemping persistence...
remount failed: Operation not permitted
failed to copy 'su' to '/system/bin/su': Read-only file system
Unable to chmod /system/bin/su: No such file or directory
failed to copy 'busybox' to '/system/xbin/busybox': Read-only file system
Unable to chmod /system/xbin/busybox: No such file or directory
/system/xbin/busybox: not found
failed to copy 'Superuser.apk' to '/system/app/Superuser.apk': Read-only file sy
stem
[*] Cleaning up...
rm failed for /data/local.prop, Permission denied
Unable to chmod /data: Operation not permitted
Unable to chmod /data: Operation not permitted
[*] Rebooting...
[*] Exploit complete!
[*] Press any key to exit.
Press any key to continue . . .
Use the tool on my thread
http://forum.xda-developers.com/showthread.php?t=1710871
It seems you've a messed system. If don't get root try flashing ics again after a factory reset from system.
Cheers
Sent from my XT910 using xda premium
i'm using a sony tablet P (China version), with ICS and kernel 26.39.4 [email protected] #1
when I try to root using ALLinONE v4.1, I get
[*] Waiting for device...
* daemon not running. starting it now *
* daemon started successfully *
[*] It looks that your device is [for now] not rootable...
[*] In your kernel version exploit vulnerability has been locked down...
[*] You need to wait for DEVs to find another way...
[*] Press any key to exit.
Click to expand...
Click to collapse
well, then I searched many but everyone says kernel builds5 is rootable, builds > 8 are not rootable....
I tried old Sony Tablet S root script v1.1, also failed.
[*] Waiting for device...
* daemon not running. starting it now *
* daemon started successfully *
[*] MTP driver has been disabled.
[*] Device found.
[*] Pushing log flooder to device...
failed to copy 'flood' to '/log/flood': Permission denied
Unable to chmod /log/flood: No such file or directory
[*] Preparing to append to packages.list...
link failed File exists
[*] Rebooting device...
[*] Waiting for tablet to reboot...... (~20s)
[*] Attempting to move system package library directory...
/system/bin/sh: /log/flood: not found
run-as: Package 'com.pwn.me' is unknown
rm failed for /log/AndroidRadio.txt, Permission denied
[*] Rebooting device...
[*] Waiting for tablet to reboot...... (~40s)
[*] Attempting to insert fake local.prop entry...
link failed File exists
/system/bin/sh: /log/flood: not found
[*] Rebooting device...
[*] Waiting for tablet to reboot...... (~40s)
[*] Attemping persistence...
remount failed: Operation not permitted
failed to copy 'su' to '/system/bin/su': Read-only file system
Unable to chmod /system/bin/su: No such file or directory
failed to copy 'busybox' to '/system/xbin/busybox': Read-only file system
Unable to chmod /system/xbin/busybox: No such file or directory
/system/bin/sh: /system/xbin/busybox: not found
failed to copy 'Superuser.apk' to '/system/app/Superuser.apk': Read-only file sy
stem
[*] Cleaning up...
failed on '/data/data/com.google.android.location/lib.bak' - No such file or dir
ectory
[*] Rebooting...... (~35s)
[*] MTP driver has been enabled back.
[*] Exploit complete!
[*] Press any key to exit.
Click to expand...
Click to collapse
ALLinONE tool seems ICS-OK, China-devices-compatible, and works with builds5.....but....
why i can't
zh99998 said:
i'm using a sony tablet P (China version), with ICS and kernel 26.39.4 [email protected] #1
when I try to root using ALLinONE v4.1, I get
well, then I searched many but everyone says kernel builds5 is rootable, builds > 8 are not rootable....
I tried old Sony Tablet S root script v1.1, also failed.
ALLinONE tool seems ICS-OK, China-devices-compatible, and works with builds5.....but....
why i can't
Click to expand...
Click to collapse
ICS-OK means you can preroot ICS then install.
You need 3.2.1 with a kernel lower than 10.
3.2 is too old and 4.0.3 is too new. The exploit used to gain root access has been patched.
You will have to wait just like me and lots of others.
Chur
Stifilz
Edit: Thought I would add, I have searched far and wide for an answer, using multiple different keywords and come up empty each time...
Hello everyone,
A few days ago I got my hands on a second hand U8655-1 (Huawei Ascend Y200) and have been trying to root it to no avail.
This phone is running Android Gingerbread 2.3.6, and is completely stock, and reset to factory settings.
The symptoms I have been getting tells me that I am not able to write any data manually to the phone at all, unless it is copied from a PC the normal way by allowing the phone to pass the SD card over to the PC.
Root tools I have tried:
Y200Toolbox
GingerBreak 1.0, 1.1, 1.2.
rageagainstthecage (copying to the phone using adb push)
Motofail Exploit
SRSRoot One Click Root
SuperOneClick 1.5, 1.7, 2.3.3.0 (ZergRush) (psneuter isn't compatible)
Framaroot (about three different versions, can't remember which ones specifically, but I know one of them was the latest)
In each exploit attempt it is clear that nothing is able to get write ability to the phone.
All of these were done with the following:
Debugging Enabled
Fastboot unticked
In the case of GingerBreak/Framaroot having the USB cable both connected and disconnected
I also attempted to run the others with the phone booted normally and with it in recovery mode.
Here is the output from Motofail:
[*]
[*] Motofail: Universal Motorola Android Root Exploit (Windows version)
[*] by Dan Rosenberg (@djrbliss)
[*]
[*] Tested on Droid 3, Droid Bionic, Droid RAZR, and Droid 4
[*]
[*] Before continuing, ensure USB debugging is enabled, that you
[*] have the latest Motorola drivers installed, and that your phone
[*] is connected via USB.
[*]
[*] Press enter to root your phone...
Press any key to continue . . .
[*]
[*] Waiting for device...
[*] Device found.
[*] Deploying payload...
2610 KB/s (0 bytes in 501292.000s)
[*] Owning phone...
[*] Motofail: Universal Motorola Android Root Exploit
[*] Copyright (c) 2012 Dan Rosenberg (@djrbliss)
[*] Exploit complete.
[*] Rebooting device...
[*] Waiting for phone to reboot.
[*] Attemping persistence...
remount failed: Operation not permitted
failed to copy 'su' to '/system/bin/su': Read-only file system
Unable to chmod /system/bin/su: No such file or directory
link failed Read-only file system
failed to copy 'busybox' to '/system/xbin/busybox': Read-only file system
Unable to chmod /system/xbin/busybox: No such file or directory
/system/xbin/busybox: not found
failed to copy 'Superuser.apk' to '/system/app/Superuser.apk': Read-only file system
[*] Cleaning up...
[*] Motofail: Universal Motorola Android Root Exploit
[*] Copyright (c) 2012 Dan Rosenberg (@djrbliss)
[*] Exploit complete.
[*] Rebooting...
[*] Exploit complete!
[*] Press any key to exit.
Press any key to continue . . .
I have no idea what I am missing and I swear my hair is starting to fall out on its own now.
Sorry for the long read and hopefully there is enough info there to work with.
KapzyPanda