[GUIDE] Modfying CF-AutoRoot kit to enable ADB debugging on phone with broken screen - Android Q&A, Help & Troubleshooting

After breaking the screen on my phone I spent the following months reading about how to extract data. It all comes down to enabling ADB debugging and having your computer authorised. Usually this can be done from recovery and you're good to go. However, if you have a broken phone that is fully stock, with ADB disabled and with no custom recovery support then your data is as good as bricked. Such was the case with me when I broke my rare Samsung G360G. However, my phone was supported by CF-AutoRoot by Chainfire, and this gave just the opening I needed to go full wide.
Prerequisites:
Your phone needs to be supported by CF-AutoRoot. Check on there and the new site linked for support of your phone. If it's not there then you will need to download a stock ROM and use the CF-AutoRoot site tool to generate a root package for you. But that is outside the scope of this tutorial. This procedure has only been tested on Samsung. Your phone should have a minimal working charge.
https://autoroot.chainfire.eu/
This tutorial is also based on Linux. It should be translatable to Windows and Cygwin. But for simplicity I'll just use the method I used on Linux. However, if using Odin like I do, you'll need Windows to finish it off.
Aside from this it assumes files in are named in a particular format with a certain file format.
Tutorial:
1. First you need to download a CF-AutoRoot package for your phone. Won't get far without it.
2. Open up a terminal in Linux. We need to download some depends so enter this command:
Code:
sudo apt-get install android-tools-adb android-tools-fsutils
3. We need to extract the archive contents out. Create a suitable folder inside your home folder to build the patch in and cd to it. This uses an example file named CF-AutoRoot-example.tar.md5. Substitute with your actual archive name. Like so.
Code:
mkdir cfar-adb
cd cfar-adb
tar -xf CF-AutoRoot-example.tar.md5
4. There should be a recovery.img and a cache.img.ext4 extracted out. We just need to modify the cache.img.ext4. But first we need to convert it to a workable format. From a sparse to a raw image.
Code:
simg2img cache.img.ext4 cache.raw.ext4
5. We need to mount the cache image
Code:
mkdir cache
sudo mount -t ext4 -o loop cache.raw.ext4 cache
6. The big one. Doing the mod. So now we need to modify the cfar cleanup script. We need to insert commands on the end to enable ADB and add the key to authorise the computer. The following will do just that in this fashion.
a)
You will need to load in the cfar-cleanup.sh file inside the cfroot folder from the cache point mounted. Locate the end and paste the following lines before the reboot and exit commands on the end. Don't save yet.
Code:
echo -n 'mtp,adb' > /data/property/persist.sys.usb.config
mount -o remount,rw /system
echo '' >> /system/build.prop
echo 'persist.service.adb.enable=1' >> /system/build.prop
echo 'persist.service.debuggable=1' >> /system/build.prop
echo 'persist.sys.usb.config=mtp,adb' >> /system/build.prop
chmod 644 /system/build.prop
mount -o remount,ro /system
mkdir -p /data/misc/adb/
echo '' >/data/misc/adb/adb_keys
chmod 640 /data/misc/adb/adb_keys
b)
Load up the ~/.android/adbkey.pub file in a text editor and copy the entire contents in the clipboard. Now back at the script locate that last echo command you pasted into it and set the cursor just after the first single quotation mark. Now paste the clipboard in! This will add your key in. Make sure it's only between the single quotes with no extra characters or line feeds. The lines will naturally split if they don't fit on screen. Otherwise it should be good to go.
c)
Okay now save the file. The above will enable ADB and authorise your computer on the main Android system after the rooting script has done it's work. Before it reboots normally.
7. We need to unmount the cache so it's ready for use.
Code:
sudo umount cache
8. We need to convert the raw image back into a sparse image.
Code:
img2simg cache.raw.ext4 cache.img.ext4
9. Okay were almost done. Now we repack the files into a new Odin archive. Choose a suitable new filename. Like I have done here with my example file.
Code:
tar -H ustar -c recovery.img cache.img.ext4 > cfar-adb.tar
md5sum -t cfar-adb.tar >> cfar-adb.tar
mv cfar-adb.tar cfar-adb.tar.md5
10. The final step! So now the new package is ready for use. We just to use Odin and flash it to the phone. Save the package to a USB stick if needed.
a)
Reboot into Windows. Or you can run it virtualised from Linux. But I prefer to use the real things when dealing with things of a delicate manner and working blindly. Unplug your phone from the computer if connected. Now load up Odin in admin mode.
b)
Just to make sure pull the battery from your phone. Give it a few seconds then put the battery back in and click the back cover on. Now hold down volume down, then home key, and finally hold down power. Wait for the vibration. Then release power after a few moments. Finally release the other keys. At this point press volume up briefly. You should have just put your phone blindly into download mode. I've done this numerous times.
c)
Plug your phone into your computer. After a moment you should see Odin respond with a device added. Usually the phone can vibrate also when it connects giving more positive signs. If nothing happens disconnect the phone from the computer and retry the last step again to put it into download mode. Took me a few tries before I could do it blindly. It helps if you have a working Samsung to test it out on so you can see what happens before you can only feel it.
d)
Now in Odin press the PDA (or AP) button. Select the cfar-adb.tar.md5 package you made up. If the package is fine it will pass the md5 test. Now press the Start button and watch it go! If all goes well it will upload recovery, cache, give you a pass and then the phone will reset. At this point it will be in the process of being rooted, enable ADB, then reboot. If something goes wrong then you may need to go back and check all the patched files. Then rebuild the package again. But be careful, if the ADB has been enabled in the build.prop file one time, you don't want to add it in again and create duplicates, no matter how keen. Once I had it added the only other major problem I encountered was using the correct adb key.
e)
Hopefully now your phone is rooted, has ADB enabled and is booting up normally. Give it a few minutes. You can even see signs of life in Odin with adds and removes on USB activity. Your phone should also vibrate at times. And making noises is also a good sign.
1.1. So I just cranked it up to eleven. Open a Linux terminal again and give it a test. With your phone plugged in.
Code:
adb devices
If all goes well then adb will find your phone as well as list your device as authorised. You can now open shell to the inside. USB debugging is now enabled.
Conclusion:
Well I hope this helps those who have their app data stuck under a broken screen. As long as it was to type in this tutorial It still took me less time to write this tutorial than to learn all that was needed and apply it to my phone. This ends here but for you it may be only the beginning. A next step would be a screen mirroring app which I think is a must have for visual feedback. And USB debugging opens up these possibilities. One thing to be careful of, in a related issue, is that just because you can use adb and the phone is also rooted doesn't mean it will all work at once. If you are tempted to "su" it in an adb shell and get right in there then SuperSU will ask for permission on a blank screen. As will also happen if you try to do an adb backup, it will ask for confirmation on screen. So just expect to work with USB debugging blindly unless you already have a screen mirroring app installed. If you don't have one installed that is your next step.
And on that note. Good luck!

---

Hi there,
Your tutorial on how to achieve this on Linux looks real neat and complete. Unfortunately, i'm on Windows and i would like to know if you would be able to rewrite this totorial for a Windows user?
I've been reading online for about a week and i've never saw such a complete guide to help newbies to ADB to be able to retrieve data on their locked broken devices.
Cheers!

---

Hi RaiM1986 and thanks for your kind words. Yes I wrote it so it would be useful to newbies and seasoned hackers alike. Plus I needed to write down some instructions in case I need to do it all again.
Looking at the tutorial it is a bit Linux-centric. I don't know how well it would translate to Windows. Though there would be Windows version of the tools used the main problem would be mounting the filesystem image and making modifications without corrupting it. Because of things like Linux file modes.
However the following tools may be of assistance.
ADB tools:
https://wiki.lineageos.org/adb_fastboot_guide.html
Cygwin provides Linux tools if needed:
http://www.cygwin.com
simg2img:
https://github.com/KinglyWayne/simg2img_win
For mounting the ext4 image:
https://www.osforensics.com/tools/mount-disk-images.html
img2simg and other tools:
https://forum.xda-developers.com/showpost.php?p=49235638&postcount=5
For the ADB key it should be in %USERPOFILE%\.android and other spots I've read of are C:\Windows\System32\config\systemprofile\.android
In case any of the above fails, since I haven't tested them, the easiest alternative might be to just download a Linux live CD, boot it and do the steps inside. Of course any work is lost when you shut it down. You could also boot it in VM program running on Windows.

---

Amazing guide, Hypexed! The amount of work you put in to figure this out is incredible.
However, I'm stuck on step 6c, where I'm supposed to save the cfar-cleanup.sh file. It's not letting me save it at all, either within the mount point or to another location, it says that I don't have permissions to save the file. I tried the 'sudo chown' to change ownership to try to edit the permissions, but that didn't work either with it still saying I can't have access to the file. Any ideas? There is probably a simple solution, but this is my first time really using Linux so I'm a noob. I'm using Ubuntu 18.04.1LTS installed, not live, dual-booted with Windows, if that's important to know

---

SpinningQyarks said:
Amazing guide, Hypexed! The amount of work you put in to figure this out is incredible.
Click to expand...
Click to collapse
Thank you for noticing. It really was the culmination of months of hacking and cracking. Not to mention research. I decided I had to write a guide so I could document what I did in case I needed to do it again. And of course if it helped anyone else.
However, I'm stuck on step 6c, where I'm supposed to save the cfar-cleanup.sh file. It's not letting me save it at all, either within the mount point or to another location, it says that I don't have permissions to save the file. I tried the 'sudo chown' to change ownership to try to edit the permissions, but that didn't work either with it still saying I can't have access to the file. Any ideas? There is probably a simple solution, but this is my first time really using Linux so I'm a noob. I'm using Ubuntu 18.04.1LTS installed, not live, dual-booted with Windows, if that's important to know
Click to expand...
Click to collapse
Sorry you got stuck. I can see some issues in my guide. Especially after trying to do 6c again. First I notice I didn't specify where to store all the folders. Somewhere in the home folder obviously but it looks like you sorted that out fine.
I have tested a working solution to the permissions problem. In fact two:
1. Locate cf folder in the cache mount point on the desktop and go into it. Now right click in the window to bring up the context menu and select "Open as Root". Open up the editor as before.
2.. In the terminal run the editor as root. For example:
sudo gedit cfar-cleanup.sh
I've tested this on Mint which is a "relation" of Ubuntu so should work the same.
Now the original permissions should be left intact. I checked and they didn't have the execute bit set which is unusual. It may help here to save your work on the file to a place you can save to in the meantime. So you don't get stuck again. And then unmount your cache mount point, extract the raw image again as per step 4 and remount as per step 5, if the permissions need restoring. They really should be as they are originally set in the image.
Then continue through to step 6 and beyond as you were.
Good luck!