2

Disclaimer: The question is not meant like these:

  • How do I root my device? – Take tool X/Y/Z!
  • Where do I find tool X/Y/Z for rooting? – Link, Link, Link!
  • What is "root"? – Full permissions on Linux, UID 0!

The question I have is this: When a new device with a customized Android gets released, what exactly do the "root release crews" do? And why does it differ for each device? Aren't all "Androids" across the different devices with the same x.y version identical? Yeah, OK, most have custom brand programs (because everyone wants user data these days, or for device-specific sensors and so on), but all have the same kernel and core tools (which handle the permission system).

Let's say I buy a new device and want "to root" it fully myself (without ready-made tools/images from others), where would I start? Do a full dump of the flash memory and change some bits?

3

3 Answers 3

5

A rooted system is a system that has a working su binary, that is, one that allows the user and/or processes to attain full root rights. So, in order to root a device, you "just" need to get that binary in place, and you're done. (In practice, it's not as simple; most superuser applications ship with a daemon that is actually responsible for giving apps root privileges, and they might also apply patches to the SELinux policy so processes can get root rights).

How you root device depends on the model of the device. There are devices that can be "unlocked". That usually means that it will disable the checks the system has in place to ensure that the device only boots an operating system supplied by your manufacturer. So, with the checks disabled, the easiest option to root your device is flashing a custom recovery (which is basically a stripped down OS, used to update the actual Android OS and for other tasks like backups). This recovery will then run with root rights, so it can also place a su binary on the device.

If your device cannot be unlocked, the process is much more complicated. In this case, the developers try to find exploits in the software that can be used to attain (temporary) root privileges, which can then be used to install a su binary. Obviously, since this process involves finding flaws in the device's security, it may take a long time for it to happen, or it might not happen at all.

This process of finding exploits is different for different devices, but you may find that some root exploits work for similar devices. Not all devices run the same operating system, or the same hardware. Device X might ship with a modified version of software component Y, which is vulnerable, while device Z doesn't ship with it, so you'll have to find another exploit.

1
  • If you can root a locked phone, then IMO it wasn't properly locked at all. To me, a phone is locked iff the /system, /boot and /recovery partition can't be changed by any means.
    – jiggunjer
    Dec 2, 2015 at 4:57
1

Sorry to give you an un-understandable answer, my bad, and though I completely messed it and gave wrong guidelines. Sorry but it is as most of the users here How does rooting work? it is indeed installing su bianaries and then supersu.apk and giving them each certain privileges. Also that su binaries does all the work itself.

You would just need a windows and linux, most probably linux as you can use adb on linux too, as it's a part of it.

So here guys is the ultimate rooting guide, which will walk you through rooting your phone, and as the android kernel is made up of linux, you need a linux installation to root your phone, just one step for this linux command. Here's the link: http://forum.xda-developers.com/showthread.php?t=2684210

Also su binaries contain all the data and you don't need to know anything else as su is same for all devices. Please sorry for my previous utterly idiotic answer. It's just about su binaries and supersu.apk which is to root.

Yeah and su binaries do get updated, so don't forget to download the latest binaries.

1

You just have to add the su binary and superuser app to manage root so how to do this?

This can be achieved by exploiting some vulnerability in the system, so you can execute the script that adds su binary to /system and the superuser app to the desired place. That's how all the rooting tools and apps work

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .