2

I have an Android 6.0 phone that has not received updates in a year. It has likely dozens of security holes that allow one to gain root access. I wish to do this in order to remove pre-installed bloatware system apps and change system config files. However, all methods known to me involve running some closed source rooting tool that may very well contain a trojan or other malware.

What open-source (or ideally, type-in adb shell command list) method is there to root an Android phone not patched in the last year?

Of course, if a rooting tool is open source I would need to build it myself to be sure - so that would involve much more work than executing a script or entering shell commands

  • 1
    As matter of fact, you cannot alter the /system partition via adb, and hence cannot root. – Death Mask Salesman Sep 15 '17 at 18:51
  • Every Android device has different methods to root it, in some cases a security vulnerability is used, but this is becoming less and less common as it is only a device by device case. There is no generic vulnerability to exploit to gain root. The best way to root is to unlock the bootloader via official methods, install a custom recovery like TWRP, and flash a root method like Magisk or SuperSU. – acejavelin Sep 15 '17 at 19:17
  • 1
    There are a couple of implementations of the futex exploit (e.g. Towelroot) floating around that you could try to compile and run on your device, assuming it's vulnerable. I haven't tried them, but this repository has a project made to be built with the Android NDK. You'd probably want to use the privilege escalation to then help you install something permanent, though. – eldarerathis Sep 15 '17 at 21:42
  • Very legit concern, but at the same time if a way is easy enough and open-sourced then patching against it is all too easy as well. We've pretty much run out of such exploits since Android 4.x. – Andy Yan Sep 16 '17 at 0:55
  • @DeathMaskSalesman Why can't I remount -o rw /system via adb shell if I achieve root in this shell (by the exploit I am looking for)? Is there some extra protection by container (cgroups/namespaces) and/or chroot? – Ned64 Sep 18 '17 at 5:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.