I'm using a Nexus 5X with release 6.0.0 (MDB08M). I unlocked the bootloader with fastboot oem unlock
, then created a boot image with a /default.prop
file containing ro.secure=0
. This appears to work, in that when I boot my device, I get:
shell@bullhead:/ $ getprop ro.secure
0
Unfortunately, though adb root
seems to succeed and reports:
restarting adbd as root
It does not get me a root shell. ps
confirms adbd
is still running as the shell user. My question is how to make adbd
obey ro.secure
, or whether there is some other easy way to get root by modifying /default.prop
or changing the kernel command-line arguments. I know there are third-party tools such as SuperSU, but I'm hoping to get a root shell without loading any third-party software on my phone.
To reproduce what I did, you can grab boot.img
out of the Nexus factory image (unzipping image-bullhead-mdb08m.zip
). Unpack the boot image using split_bootimg_pl
. Unpack and repack boot.img-ramdisk.gz
(I packed it using find . | bsdcpio -R 0:0 -H newc -o |gzip -9 > ../newramfs.gz
). Create a new-boot.img
using mkbootimg as follows:
mkbootimg -o new-boot.img --pagesize 4096 --base 0 --kernel_offset 0x8000 --ramdisk_offset 0x2000000 --tags_offset 0x1e00000 --kernel boot.img-kernel --ramdisk boot.img-ramdisk.gz --cmdline "console=ttyHSL0,115200,n8 androidboot.hardware=bullhead boot_cpus=0-5 lpm_levels.sleep_disabled=1 msm_poweroff.download_mode=0"
And finally of course flash new-boot.img
with fastboot flash boot new-boot.img
.