Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

Or, how do I root my device without a rooter?

Rooting instructions for Android devices that I have seen are typically of the following form:

  1. Download Gingerbreak.apk
  2. Run Gingerbreak, click “root device”
  3. Observe that Superuser.apk has been magically installed, possibly along with busybox and other things, and enjoy your rooty goodness.

What I am wanting to know is this: how does the rooting actually happen? What does Gingerbreak do?

I understand the end result of rooting:

  • su is present and working
  • Superuser.apk is installed and controls access to su
  • Various utilities are present, provided by BusyBox (optional?)

I also think I understand the basic idea of how Gingerbreak gets started — it exploits some local privilege escalation vulnerability and uses its new-found powers to deploy Superuser and whatever else is necessary.

So, unless I am wrong in some of the understanding I laid out above, the core of thing I want to know is what the root installer does to deploy and activate Superuser. It seems that just putting Superuser.apk in the right place wouldn't be enough — how does it get allowed root access? How does it get hooked up to moderate that access for other applications?

What does Gingerbreak do post-exploit to enable and secure root access?

share|improve this question
    
See also: android.stackexchange.com/questions/236/… –  Al E. May 10 '12 at 12:56
add comment

2 Answers

What the APK and exploit do (usually) is as follows:

  • The APK puts the right files in the right place to run the exploit
  • The APK runs the exploit
  • The exploit attempts to attain root access
  • If it succeeds, the exploit remounts /system as read-write and runs the installer script
  • The installer script attempts to install the su binary and superuser APK, and reboots

As an example, this page details how the rageagainstthecage exploit attempts to gain elevated privileges.

share|improve this answer
1  
Thanks. I think this narrows my real question further - what exactly does the installer script do? Or where can I find a copy of one to read? Most of the docs I see are very opaque — “download this APK, it works” with a link to some random file sharing site. –  Michael Ekstrand May 10 '12 at 15:09
    
su allows elevation of privileges in Unix-like environments (what Android is based on). When the su binary is installed, apps/scripts can then use the su and sudo commands to run and access parts of the file system that are normally restricted for ordinary users. In essence, that is why one roots a phone - to be able to gain access to "restricted" parts of the system and to be able to carry out commands that an ordinary user is disallowed to perform. –  Sparx May 11 '12 at 7:51
add comment
up vote 4 down vote accepted

After much digging, I finally figured it out. I was wrong about where the magic is - it is not in the installer script; all that has to do is put the su and Superuser.apk binaries in the right place and set their permissions. So it really is as simple as dropping files in place and setting permissions. No magic wiring.

The magic happens in the su binary (see the source and also this question). I was (incorrectly) thinking that su was a standard su, and that things were somehow wired up to moderate access to that binary through Superuser.apk.

Wrong. What actually happens is far simpler: Superuser provides a custom implementation of su that authenticates access through Superuser and its authorized application database.

So the process of rooting is as simple as @Sparx said. The deployed software contains the magic.

share|improve this answer
    
I think this misses one important thing: the su is itself not magic at all, the only magic about it is that the OS treats it specially. All it has to do is return "OK" or "Not OK" when asked by the OS whether to allow a particular application to elevate permissions. If it's missing, or always returns "Not OK" then normal apps can never get root. So rooting is basically the process of placing an su binary that can sometimes return "OK", into the protected location on a system which isn't supposed to allow this to be done. –  romkyns Oct 13 '13 at 15:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.