I own a relatively unknown Chinaphone, the CUBOT GT72+ (MTK6572 SoC) - on which I was attempting to gain root access. No known exploit-based root methods exist for this device (which runs on Android 4.4.2), so I found myself having to dissect boot.img using the MTK-Tools Perl-scripts.
After unpacking the boot image, I made some modifications in the initramfs, they are as follows:
Modify default.prop, setting ro.secure to 0, ro.debuggable to 1, and ro.adb.secure to 0.
Add the rootsh binary to /sbin.
Modify init.rc to mount /system as a rw filesystem, since (re)mounting /system is somehow not allowed by the kernel, even when root.
Replace adbd in /sbin with a version provided by a package called adbd insecure, which was supposed to automatically grant root access to adb-connections.
(Please note: Before replacing adbd I had also installed the su binary in /system/bin and the Superuser.apk package)
Now this is where the problem comes in: the hacked adbd no longer allows me to connect using adb. It shows the device - with an id of 0123456789ABCDEF as offline in the devices listing of adb.
Now, using an adb shell, I could simply get root by typing 'adb shell' followed by a simple 'su', and ta dah: root shell! Yet, somehow, the permissions on the su binary are all messed up - since when I use a terminal emulator on the device itself: I get presented with a 'Permission denied' error. Applications are not getting root, either. (I suppose the permissions are messed up somewhere, chmodding went fine, but chowning did not. Also, busybox is still missing.)
And here's the final problem: the phone does not have a way to get into fastboot mode using hardware buttons, so I found myself having to type 'adb reboot bootloader' to get it into fastboot mode... which, well, obviously doesn't work anymore. And to reflash boot.img I need to get into fastboot mode.
My device does work just fine when turned on (although not rooted), but I really want to reflash boot.img to get the proper adbd back. There is a button combination to get into recovery mode, but that doesn't provide me with a connection in adb. Sideload mode does seem to come up in adb, yet flashing any Update.zip has so far not been succesful (maybe due to a crippled adbd?), even though I have tried various methods of crafting (signed) Update.zip files with the only purpose to reboot the device into fastboot mode.
The device does come with a proprietary flashing tool, but that only works under Windows XP. I do not own any computers running Windows. And especially not XP. (The adb version I run on my computer is the latest provided by Debian (sid), so it should be quite recent.)
Now the question remains: How do I get my device into fastboot mode?