Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

According to the Wikipedia page for Andorid rooting,

The process of rooting varies widely by device, but usually includes exploiting a security weakness in the firmware of the device [emphasis added], and then copying the su binary to a location in the current process's PATH (e.g. /system/xbin/su) and granting it executable permissions with the chmod command. A supervisor application like SuperUser or SuperSU can regulate and log elevated permission requests from other applications. Many guides, tutorials, and automatic processes exist for popular Android devices facilitating a fast and easy rooting process.

Now, I wanted to know what exploits are being used in this process so I started looking around. I did find a couple references to Android exploits (notably RageAgainstTheCode), but a couple questions on here (this one and How does su regulate app permissions?) give me the impression that no actual exploit is being performed.

From what I have gathered the process works like such:

  1. Unlock bootloader (wipes device for security concerns)
  2. Install custom recovery (will allow flashing arbitrary ZIP files)
  3. Flash SuperUser.apk app

As I understand it, the custom recovery is able to flash the ZIP file because it exists at a lower level (so to speak) than the ROM, and as such, can modify the ROM to install the su binary and SuperUser app. That is, no real exploit is being used to attain root.

Am I grossly missing something here? Is some exploit being performed implicitly during one of these steps?

As a note, I'm talking about a user rooting a phone, not about a malicious piece of code getting root access.

share|improve this question
add comment

1 Answer 1

up vote 5 down vote accepted

First, there's nothing like THE rooting process. You partly answered your question yourself: rooting a device can be done in different ways. The two best known methods include:

  • using an exploit (SuperOneClick & Co do this: You install an app, klick it, and get rooted)
  • via a custom recovery (which is directly bootable and thus can access the device directly, so you can install any ROM -- which in turn may already be rooted)

So answering your question: Yes and no -- it all depends on how you root your device. Listing up all possible exploits might get a bit lengthy, so better let's skip that part. You might also check the questions in the "related" section of this page for more details (especially What are the steps for rooting an Android device, in general?).

share|improve this answer
    
Thank you for the descriptive answer. –  CatShoes Nov 20 '12 at 12:50
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.