I own a relatively unknown Chinaphone, the CUBOT GT72+ (MTK6572 SoC) - on which I was attempting to gain root access. No known exploit-based root methods exist for this device (which runs on Android 4.4.2), so I found myself having to dissect boot.img using the MTK-Tools Perl-scripts.

After unpacking the boot image, I made some modifications in the initramfs, they are as follows:

  • Modify default.prop, setting ro.secure to 0, ro.debuggable to 1, and ro.adb.secure to 0.

  • Add the rootsh binary to /sbin.

  • Modify init.rc to mount /system as a rw filesystem, since (re)mounting /system is somehow not allowed by the kernel, even when root.

  • Replace adbd in /sbin with a version provided by a package called adbd insecure, which was supposed to automatically grant root access to adb-connections.

(Please note: Before replacing adbd I had also installed the su binary in /system/bin and the Superuser.apk package)

Now this is where the problem comes in: the hacked adbd no longer allows me to connect using adb. It shows the device - with an id of 0123456789ABCDEF as offline in the devices listing of adb.

Now, using an adb shell, I could simply get root by typing 'adb shell' followed by a simple 'su', and ta dah: root shell! Yet, somehow, the permissions on the su binary are all messed up - since when I use a terminal emulator on the device itself: I get presented with a 'Permission denied' error. Applications are not getting root, either. (I suppose the permissions are messed up somewhere, chmodding went fine, but chowning did not. Also, busybox is still missing.)

And here's the final problem: the phone does not have a way to get into fastboot mode using hardware buttons, so I found myself having to type 'adb reboot bootloader' to get it into fastboot mode... which, well, obviously doesn't work anymore. And to reflash boot.img I need to get into fastboot mode.

My device does work just fine when turned on (although not rooted), but I really want to reflash boot.img to get the proper adbd back. There is a button combination to get into recovery mode, but that doesn't provide me with a connection in adb. Sideload mode does seem to come up in adb, yet flashing any Update.zip has so far not been succesful (maybe due to a crippled adbd?), even though I have tried various methods of crafting (signed) Update.zip files with the only purpose to reboot the device into fastboot mode.

The device does come with a proprietary flashing tool, but that only works under Windows XP. I do not own any computers running Windows. And especially not XP. (The adb version I run on my computer is the latest provided by Debian (sid), so it should be quite recent.)

Now the question remains: How do I get my device into fastboot mode?

  • AFAIK, most of the reboot-to-fastboot-mode methods involve rooting or using ADB. So, your situation is pretty complicated. I'll research about this and get back to you. – rjt.rockx Apr 25 '15 at 12:48
  • I don't know whether all versions of it but TWRP recovery allows you to use adb during recovery mode. Did you try it or did it not work for you? What about packing boot.img into a zip file and flashing it via Recovery using Install Zip option. You don't need to do sideloading for that. – Firelord Apr 25 '15 at 13:00
  • Sadly, it runs the stock recovery menu. No adb available, no Install Zip option. Only sideloading. (Menu looks something like this @Firelord. – SqBlob Apr 25 '15 at 13:04
  • One more thing, though you must have tried it already. Have you considered all possible hardware button combinations? And about this : 0123456789ABCDEF as offline -- I too have this ID and I came to have it when I re-flashed my phone but didn't add its serial no. manually. May I know how did you get this ID? My device seems to be offline only when I do not authorize in the device the ADB connection initiated by PC. As soon as I authorize it (Kitkat), it gets online. Did you see the authorization box on the device when you tried ADB? – Firelord Apr 25 '15 at 13:05
  • I have. I can get in the stock recovery menu using VolUp+Pwr, VolDwn+Pwr gets me in a Chinese menu that seems to be used internally for quality control (it runs a couple of tests on the components, and turns them on/off in the process). No other button-combinations are available (VolUp+VolDwn+Pwr still brings me to the QC menu.) -- The device id changed when replacing adbd; because ro.adb.secure is set to 0, no authorization is needed/possible. @Firelord – SqBlob Apr 25 '15 at 13:09

If you've had problems flashing your phone through adb, you should really consider the Windows XP installation route. I've had to look around for some compatible drivers,as I've been experimenting using Windows XP and even Windows 8.1 with success using SP Flash tool. As one of the the answer given before in this thread, you don't need ADB to flash files to your phone SP Flash tools; just the required drivers and connect the phone to the computer with the battery removed.

You could try VMWARElinux to install Windows XP on with with required drivers/ files, etc. I can confirm VMWARE windows allows USB devices to connect to it, including this phone. I've flashed through it with success. Don't know if the Linux version does, though.

After lots of research and headaches I've finally managed to fully root my phone. I've posted my files so you can try it out here:

http://www.needrom.com/download/cubot-gt72-rooted-rom-twrp-recivery/

Best and luck and regards.

Did you properly change adbd permissions?

Look for other files in the same directory with adbd for permissions value. Most probably it will be 644 but be sure.

Note: adb is a service and need to be properly run at start so reboot after changing permissions

  • Irrelevant: adbd (the deamon, not the util) is broken - it has nothing to do with permissions. – SqBlob Apr 25 '15 at 21:55
  • chmodding went fine, but chowning did not. -- OP already mentioned that. What's your point then? – Firelord Apr 25 '15 at 21:56
  • chmodding went fine on su binary not adbd, whats wrong with all these people read the f*cking question first – Abbas Elmas Apr 26 '15 at 9:31

protected by Community Jan 21 '17 at 0:06

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.