• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Root Experimentation (learning)

DsyMnapTic

DsyMnapTic

Android Expert
So here it is.... Couldn't this script theoretically be altered to one that Android understands. Say, like take out all the adb stuff and then execute the script in an app called Script manager, to push files where they need to go? Couldn't you just throw everything into a directory together on the phone like you would on the computer and minus the adb crap and run the script and push the files to their respective directories to gain root?



ECHO OFF

CLS

ECHO . LG Motion Root and Recovery

ECHO .

ECHO . Credits to qaz753 for the IS11LG_SystemBackupTest.signed.apk root exploit

ECHO . Credits to alexp999 for Root your LG Optimus 4X GUIDE on XDA

ECHO . Credits to aaronmy for I found a root guys!!!! GUIDE on AF LGM Forum

ECHO . Credits to 985hPaKicK for LTE2 2nd-init Recovery

ECHO . Credits to hroark13 for mods in this script

ECHO .

ECHO .

ECHO . BE SURE YOU HAVE INSTALLED THE USB DRIVER

ECHO . LGUnitedMobileDriver_S4981MAN37AP22_ML_WHQL_Ver_3.7.2.exe

ECHO .

ECHO .

ECHO . THAT YOU HAVE TURNED USB DEBUGGING ON IN SYSTEM SETTINGS / DEVELOPER OPTIONS

ECHO .

ECHO . THAT USB IS CONNECTED AS CHARGE ONLY

ECHO .

ECHO .

PAUSE

CLS

ECHO DON'T UNPLUG WHILE ROOTING!

@adb kill-server

@adb wait-for-device

@adb install IS11LG_SystemBackupTest.signed.apk

@adb shell am start -a android.intent.action.MAIN -n com.example.systembackuptest/.MainActivity

CLS

ECHO . REBOOTING

@adb reboot

ECHO .

ECHO .

ECHO .

ECHO .ONCE AT LOCK SCREEN PRESS ANY KEY

ECHO .

ECHO .

ECHO .

ECHO .

PAUSE

@adb shell am start -a android.intent.action.MAIN -n com.example.systembackuptest/.MainActivity

ECHO PUSH FILES

@adb shell rm /data/local/installbusybox > nul

@adb shell rm /data/local/installbusybox2 > nul

@adb shell rm /data/local/root > nul

@adb shell rm /data/local/root2 > nul

@adb shell rm /data/local/sysro > nul

@adb shell rm /data/local/sysro2 > nul

@adb shell rm /data/local/sysrw > nul

@adb shell rm /data/local/sysrw2 > nul

@adb shell rm /data/local/unroot > nul

@adb shell rm /data/local/unroot2 > nul

@adb shell rm /data/local/busybox > nul

@adb shell rm /data/local/su > nul

@adb shell rm /data/local/Superuser.apk > nul

@adb push busybox /data/local/busybox

@adb push su /data/local/su

@adb push Superuser.apk /data/local/Superuser.apk

@adb push lte2recovery.apk /data/local/lte2recovery.apk

@adb shell chmod 777 /data/local/busybox

@adb shell chmod 755 /data/local/su

@adb shell chmod 755 /data/local/Superuser.apk

@adb shell chmod 755 /data/local/lte2recovery.apk

@adb shell mv /data/local/tmp /data/local/tmp.bak

@adb shell ln -s /data /data/local/tmp

@adb shell rm /data/local.prop > nul

@adb shell "mount -wo remount rootfs /"

@adb shell "mount -o remount,rw -t ext4 /dev/block/mmcblk0p14 /system"

@adb shell "cat /data/local/busybox > /system/xbin/busybox"

@adb shell "chmod 777 /system/xbin/busybox"

@adb shell "/system/xbin/busybox --install -s /system/xbin"

@adb shell "busybox cp /data/local/Superuser.apk /system/app/Superuser.apk"

@adb shell "busybox cp /data/local/lte2recovery.apk /system/app/lte2recovery.apk"

@adb shell "busybox cp /data/local/su /system/xbin/su"

@adb shell "chown 0.0 /system/xbin/su"

@adb shell "chmod 06755 /system/xbin/su"

@adb shell "chmod 644 /system/app/Superuser.apk"

@adb shell "chmod 644 /system/app/lte2recovery.apk"

@adb shell "rm /data/local.prop"

@adb shell "rm /data/local/tmp"

@adb shell "mv /data/local/tmp.bak /data/local/tmp"

ECHO.

ECHO REBOOT

adb uninstall com.example.systembackuptest

@adb reboot
 
The APK is what gives adb root access. Without the APK, you would get a ton of errors, like in the attached picture. That is why sometimes you have to do it twice, because the APK exploit doesn't take properly, and you end up seeing this.

neqatyse.jpg


Without root access, read/write capabilities to /system and /data are prohibited.
 
Try this?

Code: 
ECHO OFF

CLS
ECHO . LG Motion Root and Recovery
ECHO .
ECHO . Credits to qaz753 for the IS11LG_SystemBackupTest.signed.apk root exploit
ECHO . Credits to alexp999 for Root your LG Optimus 4X GUIDE on XDA
ECHO . Credits to aaronmy for I found a root guys!!!! GUIDE on AF LGM Forum
ECHO . Credits to 985hPaKicK for LTE2 2nd-init Recovery
ECHO . Credits to hroark13 for mods in this script
ECHO .
ECHO .
ECHO . BE SURE YOU HAVE INSTALLED THE USB DRIVER
ECHO . LGUnitedMobileDriver_S4981MAN37AP22_ML_WHQL_Ver_3. 7.2.exe
ECHO .
ECHO .
ECHO . THAT YOU HAVE TURNED USB DEBUGGING ON IN SYSTEM SETTINGS / DEVELOPER OPTIONS
ECHO .
ECHO . THAT USB IS CONNECTED AS CHARGE ONLY
ECHO .
ECHO .
PAUSE

CLS
ECHO DON'T UNPLUG WHILE ROOTING!
@adb kill-server
@adb wait-for-device
@adb install "IS11LG_SystemBackupTest.signed.apk"
@adb wait-for-device
@adb shell am start -a android.intent.action.MAIN -n com.example.systembackuptest/.MainActivity
PAUSE
CLS

ECHO . REBOOTING
@adb reboot
ECHO .
ECHO .
ECHO .
ECHO .ONCE AT LOCK SCREEN PRESS ANY KEY
ECHO .THERE WILL BE A MOMENTARY LAPS
ECHO .IN TIME FOR YOU TO PRESS BUTTON
ECHO .
ECHO .
PAUSE
@adb wait-for-device

@adb reboot
@adb wait-for-device

ECHO PUSH FILES

@adb shell rm /data/local/installbusybox > nul
@adb shell rm /data/local/installbusybox2 > nul
@adb shell rm /data/local/root > nul
@adb shell rm /data/local/root2 > nul
@adb shell rm /data/local/sysro > nul
@adb shell rm /data/local/sysro2 > nul
@adb shell rm /data/local/sysrw > nul
@adb shell rm /data/local/sysrw2 > nul
@adb shell rm /data/local/unroot > nul
@adb shell rm /data/local/unroot2 > nul
@adb shell rm /data/local/busybox > nul
@adb shell rm /data/local/su > nul
@adb shell rm /data/local/Superuser.apk > nul

@adb push busybox /data/local/busybox
@adb push su /data/local/su
@adb push Superuser.apk /data/local/Superuser.apk
@adb push lte2recovery.apk /data/local/lte2recovery.apk

@adb shell chmod 777 /data/local/busybox
@adb shell chmod 755 /data/local/su
@adb shell chmod 755 /data/local/Superuser.apk
@adb shell chmod 755 /data/local/lte2recovery.apk

@adb shell mv /data/local/tmp /data/local/tmp.bak
@adb shell ln -s /data /data/local/tmp
@adb shell rm /data/local.prop > nul

@adb shell "mount -wo remount rootfs /"
@adb shell "mount -o remount,rw -t ext4 /dev/block/mmcblk0p14 /system"

@adb shell "cat /data/local/busybox > /system/xbin/busybox"
@adb shell "chmod 777 /system/xbin/busybox"
@adb shell "/system/xbin/busybox --install -s /system/xbin"

@adb shell "busybox cp /data/local/Superuser.apk /system/app/Superuser.apk"
@adb shell "busybox cp /data/local/lte2recovery.apk /system/app/lte2recovery.apk"
@adb shell "busybox cp /data/local/su /system/xbin/su"

@adb shell "chown 0.0 /system/xbin/su"
@adb shell "chmod 06755 /system/xbin/su"
@adb shell "chmod 644 /system/app/Superuser.apk"
@adb shell "chmod 644 /system/app/lte2recovery.apk"

@adb shell "rm /data/local.prop"
@adb shell "rm /data/local/tmp"
@adb shell "mv /data/local/tmp.bak /data/local/tmp"
ECHO.
ECHO REBOOT

adb uninstall com.example.systembackuptest
@adb reboot 
@adb wait-for-device
PAUSE
 
amos420en said:
You want to make a app that installs root with out a computer. Is that what you mean?
Click to expand...

Yes, exactly that's what I'm getting at. However at this point I'm guessing that a new exploit would need to be discovered for that to work. Also Exploits are called Exploits for that exact reason, they are utilized as a "hole" to get into the system and allow root privileges. Now considering that there are plenty of phones that are rooted via apk or at even at all, means that obviously you don't need SU privileges to root a phone. You may however need superuser to run a script, i was just playing around and noticed that script manager allows you to run scripts without root. However then it comes down to the fact that, in order to be able to legitimately write anything to system (via a script) then you would in fact need root permission. So I think I've come to the conclusion that if any of us wish to root beyond our current method and without a computer, then we need to find a different exploit. The developer of a program known as Poot, has stated that this phone could potentially be vulnerable to a LG specific backlight bug that could be exploited to gain root. However certain aspects of the program would have to be revised to work on our ice cream sandwich OS. Technically I don't have the knowledge to know how to make those changes or what changes need to be made.
 
DsyMnapTic said:
Yes, exactly that's what I'm getting at. However at this point I'm guessing that a new exploit would need to be discovered for that to work. Also Exploits are called Exploits for that exact reason, they are utilized as a "hole" to get into the system and allow root privileges. Now considering that there are plenty of phones that are rooted via apk or at even at all, means that obviously you don't need SU privileges to root a phone. You may however need superuser to run a script, i was just playing around and noticed that script manager allows you to run scripts without root. However then it comes down to the fact that, in order to be able to legitimately write anything to system (via a script) then you would in fact need root permission. So I think I've come to the conclusion that if any of us wish to root beyond our current method and without a computer, then we need to find a different exploit. The developer of a program known as Poot, has stated that this phone could potentially be vulnerable to a LG specific backlight bug that could be exploited to gain root. However certain aspects of the program would have to be revised to work on our ice cream sandwich OS. Technically I don't have the knowledge to know how to make those changes or what changes need to be made.
Click to expand...

My two cents for what it's worth? We have a root method already, and this phone will only be viable for about twelve months, hell, metro doesn't even sell it anymore, so I don't really see the point. I applaud the diligence, and love to see people so amped up about learning and developing.

Here is an idea though: if you were to break this script in to a couple scripts, instead of one (to facilitate the reboots, obviously the the script won't pickup where it left off after a reboot) I think this method might be able to work. If you split it into 3 scripts, each ending with 'adb reboot' it might just work.
 
Okay well, while I still think its possible to utilize an alternate exploit to perform such a procedure,
I was actually able to finally use a friends computer and get the phone to root after many attempts of getting the drivers to install properly. It worked finally though.:)
 
DsyMnapTic said:
Okay well, while I still think its possible to utilize an alternate exploit to perform such a procedure,
I was actually able to finally use a friends computer and get the phone to root after many attempts of getting the drivers to install properly. It worked finally though.:)
Click to expand...

I'm going to try and create an experimental root through scripts tonight
 
If anyone makes/finds a root method that will root a motion without a computer, please let me know (need it to root a motion thats on ms77010b firmware at a metro store)...they won't let me buy it :o
Maybe i should offer $150 for it..
 
sammyz said:
If anyone makes/finds a root method that will root a motion without a computer, please let me know (need it to root a motion thats on ms77010b firmware at a metro store)...they won't let me buy it :o
Maybe i should offer $150 for it..
Click to expand...

Why won't they let you buy it?
 
for one, what you posted is a batch script aka .bat for windows. It would need to be converted to shell script (.sh) for linux to run on android, which I did for my self way back when. I can play a bit to see it the cmds will even run like that.

Personally tho, if I were any of yall, I wouldnt bother with finding another root method, one you have works perfectly. ;)

I will mess around with it tho,, as its what I do. ;)
 
Yup, I was aware of the whole batch script thing... I just am not sure how to make the whole thing into a shell script (Linux). Obviously the script I put up wouldn't be the one to use anyhow... It's not the original root.bat. It's one that someone put together (I think johnny) to do everything for you (install systembackuptest and do reboots and all) So clearly from the phone the multiple reboots wouldn't run through in one script.
 
DsyMnapTic said:
So clearly from the phone the multiple reboots wouldn't run through in one script.
Click to expand...
Could you create a recovery-install.sh that runs the script, overwrites the current script with the next set of commands, reboots, and continues to do what you want as many times as you need?
 
exile1975 said:
Could you create a recovery-install.sh that runs the script, overwrites the current script with the next set of commands, reboots, and continues to do what you want as many times as you need?
Click to expand...

Probably not. I still think that we would be able to split it into 3 different scripts and run it, when I have time I'll convert it to .sh and give it a shot. Will have to unroot my phone, but that's fine ;)
 
You must log in or register to reply here.
Back
Top Bottom