Or, how do I root my device without a rooter?

Rooting instructions for Android devices that I have seen are typically of the following form:

  1. Download Gingerbreak.apk
  2. Run Gingerbreak, click “root device”
  3. Observe that Superuser.apk has been magically installed, possibly along with busybox and other things, and enjoy your rooty goodness.

What I am wanting to know is this: how does the rooting actually happen? What does Gingerbreak do?

I understand the end result of rooting:

  • su is present and working
  • Superuser.apk is installed and controls access to su
  • Various utilities are present, provided by BusyBox (optional?)

I also think I understand the basic idea of how Gingerbreak gets started — it exploits some local privilege escalation vulnerability and uses its new-found powers to deploy Superuser and whatever else is necessary.

So, unless I am wrong in some of the understanding I laid out above, the core of thing I want to know is what the root installer does to deploy and activate Superuser. It seems that just putting Superuser.apk in the right place wouldn't be enough — how does it get allowed root access? How does it get hooked up to moderate that access for other applications?

What does Gingerbreak do post-exploit to enable and secure root access?


What the APK and exploit do (usually) is as follows:

  • The APK puts the right files in the right place to run the exploit
  • The APK runs the exploit
  • The exploit attempts to attain root access
  • If it succeeds, the exploit remounts /system as read-write and runs the installer script
  • The installer script attempts to install the su binary and superuser APK, and reboots

As an example, this page details how the rageagainstthecage exploit attempts to gain elevated privileges.

  • 1
    Thanks. I think this narrows my real question further - what exactly does the installer script do? Or where can I find a copy of one to read? Most of the docs I see are very opaque — “download this APK, it works” with a link to some random file sharing site. – Michael Ekstrand May 10 '12 at 15:09
  • su allows elevation of privileges in Unix-like environments (what Android is based on). When the su binary is installed, apps/scripts can then use the su and sudo commands to run and access parts of the file system that are normally restricted for ordinary users. In essence, that is why one roots a phone - to be able to gain access to "restricted" parts of the system and to be able to carry out commands that an ordinary user is disallowed to perform. – Sparx May 11 '12 at 7:51

After much digging, I finally figured it out. I was wrong about where the magic is - it is not in the installer script; all that has to do is put the su and Superuser.apk binaries in the right place and set their permissions. So it really is as simple as dropping files in place and setting permissions. No magic wiring.

The magic happens in the su binary (see the source and also this question). I was (incorrectly) thinking that su was a standard su, and that things were somehow wired up to moderate access to that binary through Superuser.apk.

Wrong. What actually happens is far simpler: Superuser provides a custom implementation of su that authenticates access through Superuser and its authorized application database.

So the process of rooting is as simple as @Sparx said. The deployed software contains the magic.

  • I think this misses one important thing: the su is itself not magic at all, the only magic about it is that the OS treats it specially. All it has to do is return "OK" or "Not OK" when asked by the OS whether to allow a particular application to elevate permissions. If it's missing, or always returns "Not OK" then normal apps can never get root. So rooting is basically the process of placing an su binary that can sometimes return "OK", into the protected location on a system which isn't supposed to allow this to be done. – RomanSt Oct 13 '13 at 15:28
  • 3
    all that has to do is put the su and Superuser.apk binaries in the right place and set their permissions as if this would be easy without an exploit, the exploit is the magic. – Alex Oct 12 '14 at 13:44
  • 1
    @Alex Not quite. I was specifically trying to figure out what a rooter does post-exploit. In this case, because I had root access via ADB, so I didn't want to needlessly run an exploit. – Michael Ekstrand Oct 17 '14 at 14:19

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.