I've recently rooted my Android phone. I was surprised by how difficult they make it (and it seems that every new version of Android makes it harder). I have Lollipop 5.11, and I had to find and download a specially-hacked .img file of what I'm guessing is the system partition, and flash it to the device to get root.
What I'd like to know is, how is a rooted .img file made? Suppose I had a new phone and I had to figure out how to root it myself. What would I do? (I'm guessing: create a backup, figure out how to mount the partition, muck around in some low-level linux config somewhere..?)