«
»

Universal Androot 1.6.2 beta

Update: Apparently not working on Desire 2.2 (kernel: 2.6.32.15-gf9c0527)

警告 ! 這是 Beta 版本, 已經成功 root 可以不下載更新, 因為也沒什麼好更新. 如果你心臟夠大想要幫忙測試, 可以抓來玩玩..

Warning: This is beta version, for those already root / unroot you can skip this update. If you’re willing to help and afraid of nothing, grab and play !

修改記錄

  • 根據網友的建議加入所謂的 Soft root, 請勾選 Root temporary 這個選項, *也許* 能讓 Desire / Legend / Wildfire *暫時* 取得 root, 重開機後會回復原狀 (沒 root) 因為沒法寫入 /system, 所以可以拿來幹嘛.. 我也不清楚 :P
  • 加入 Generate log in /sdcard, 勾選後會在 SD 卡根目錄中產生 UniversalAndroot.log, 如果你的手機使用上有問題, 可以寄給我這個檔案讓我分析 ;-)

Change log

  • Add Soft root. To use it please check “Root temporary” option. This *may* *temporary* get root on Desire / Legend / Wildfire, you have to root again after reboot. I don’t know what else can do in this situation since /system is still read-only.. maybe flash custom recovery ?
  • Add “Generate log in /sdcard” option, log file named “UniversalAndroot.log” will be generated in your SD card root directory. If you have problem root / unroot, please send me this log file. ;-)

APK 下載: http://bit.ly/dbsWmj

Mirror: http://bit.ly/9W7mAr

This content is published under the Attribution-Noncommercial-Share Alike 3.0 Unported license.

Tags: , ,

This entry was posted on Tuesday, August 17th, 2010 at 5:40 pm and is filed under android, project. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

98 Responses to “Universal Androot 1.6.2 beta”

« Older Comments
  1. Rob R says:
    August 21, 2010 at 4:46 am

    Does Not work on Droid X with OS 2.2

  2. ykm83 says:
    August 21, 2010 at 11:15 am

    does not work on SE X10i R2BA020 version.

  3. matthew says:
    August 21, 2010 at 12:43 pm

    droid 2 anytime soon? i am dieing for it!

  4. daxx says:
    August 21, 2010 at 8:10 pm

    Hi guys, no version working on my gsm hero 2.1. It says that the phone is rooted but it is not. Tried almost everything i’ve found over the internet (root twice, root and reboot, do not install superuser, etc. starting with version 1.5.3 up to latest beta).

    when i try “su” on console it says [1] segmentation fault su

    plz help!!

  5. steven says:
    August 21, 2010 at 9:37 pm

    Tried this on my hero G2 with firmware version 2.1-update1 and it said woot your rooted but when i hold the power and home buttons on bootup i got nothing. Am i missing somthing

  6. minux says:
    August 22, 2010 at 12:28 am

    为啥在DESRIE 2.2没法工作呢？期待下一个版本可以搞定～～

  7. archos5 it says:
    August 22, 2010 at 5:06 am

    Version: Universal Androot – v1.6.2 beta
    Detected OS version:4
    Go for root !
    User selected: Cupcake
    Trying to get mount point:/system/bin
    Preparing Exploit … :1
    Preparing busybox binary … :1
    Preparing Su binary … :1
    Preparing Superuser apk … :1, resid:2130968581
    Preparing root toolkit script … :1
    Trying to get mount point:/data
    ubi1:data /data ubifs rw,noatime 0 0
    Trying to get mount point:/system
    /dev/block/sda2 /mnt/system ext3 rw,nosuid,nodev,noexec,noatime,errors=continue,data=ordered 0 0
    insmod ./tattoo_hack_gf922713.ko
    insmod ./tattoo_hack_g6561203.ko
    mount -o remount,rw /dev/block/sda2 /system
    cat su > /system/bin/su
    chmod 04755 /system/bin/su

    mount -o remount,ro /dev/block/sda2 /system

    insmod ./tattoo_hack_gf922713.ko
    insmod ./tattoo_hack_g6561203.ko
    mount -o remount,rw /dev/block/sda2 /system
    rm /system/bin/su
    mount -o remount,rw,noatime -t ubifs ubi1:data /data
    mount -o remount,ro /dev/block/sda2 /system

    Preparing to execute exploit, do chmod
    Executing exploit..
    cmd: /data/data/com.corner23.android.universalandroot/files/getroot ubi1:data ubifs
    [*] Android local root exploid (C) The Android Exploid Crew
    [*] Modified by shakalaca for various devices
    [+] Using basedir=/sqlite_stmt_journals, path=/data/data/com.corner23.android.universalandroot/files/getroot
    [+] opening NETLINK_KOBJECT_UEVENT socket
    [-] creat: Read-only file system
    Wifi in unknown state …
    After wifi, do copy files
    Root shell is missing ..
    ls -l /system/etc
    -rw-r–r– 1 root root 12190 Jan 1 1970 GPL_LGPL.html.gz
    -rw-r–r– 1 root root 53998 Jan 1 1970 NOTICE.html.gz
    lrwxrwxrwx 1 root root 21 Jan 1 1970 TZ -> /mnt/system/localtime
    -rw-r–r– 1 root root 1713 Jan 1 1970 apns-conf.xml
    drwxr-xr-x 1 root root 96 Jan 1 1970 bluez
    -rw-r–r– 1 root root 2037 Jan 1 1970 bookmarks.xml
    drwxr-xr-x 1 root root 24 Jan 1 1970 chatscripts
    -rw-r–r– 1 root root 935 Jan 1 1970 dbus.conf
    drwxr-xr-x 1 root root 76 Jan 1 1970 dhcpcd
    -rw-r–r– 1 root root 7301 Jan 1 1970 event-log-tags
    lrwxrwxrwx 1 root root 15 Jan 1 1970 fstab -> /etc/fstab_nand
    -rw-r–r– 1 root root 659 Jan 1 1970 fstab_nand
    -rw-r–r– 1 root root 670 Jan 1 1970 fstab_nor
    -rw-r–r– 1 root root 171 Jan 1 1970 group
    -rw-r–r– 1 root root 7 Jan 1 1970 hostname
    -rw-r–r– 1 root root 20 Jan 1 1970 hosts
    drwxr-xr-x 1 root root 40 Jan 1 1970 init.d
    -rwxr-xr-x 1 root root 1176 Jan 1 1970 init.goldfish.sh
    -rwxr-xr-x 1 root root 621 Jan 1 1970 init.gprs-pppd
    -rw-r–r– 1 root root 1488 Jan 1 1970 inittab
    -rw-r–r– 1 root root 1180 Jan 1 1970 inputrc
    -rw-r–r– 1 root root 57 Jan 1 1970 issue
    -rw-r–r– 1 root root 3340 Jan 1 1970 ld.so.cache
    drwxr-xr-x 1 root root 0 Jan 1 1970 ld.so.conf.d
    -rw-r–r– 1 root root 417 Jan 1 1970 mke2fs.conf
    lrwxrwxrwx 1 root root 14 Jan 1 1970 mtab -> ../proc/mounts
    drwxr-xr-x 1 root root 120 Jan 1 1970 network
    -rw-r–r– 1 root root 525 Jan 1 1970 passwd
    drwxr-xr-x 1 root root 112 Jan 1 1970 permissions
    drwxr-xr-x 1 root root 128 Jan 1 1970 ppp
    -rw-r–r– 1 root root 135 Jan 1 1970 profile
    -rw-r–r– 1 root root 444 Jan 1 1970 proftpd.conf
    -rw-r–r– 1 root root 1186 Jan 1 1970 protocols
    -rwxr-xr-x 1 root root 458 Jan 1 1970 pvplayer.cfg
    -rw-r–r– 1 root root 512 Jan 1 1970 random-seed
    lrwxrwxrwx 1 root root 16 Jan 1 1970 resolv.conf -> /tmp/resolv.conf
    -rw-r–r– 1 root root 64 Jan 1 1970 securetty
    drwxr-xr-x 1 root root 48 Jan 1 1970 security
    -rw-r–r– 1 root root 10868 Jan 1 1970 services
    -rw——- 1 root root 321 Jan 1 1970 shadow
    -rw-r–r– 1 root root 356 Jan 1 1970 smb.conf
    -r–r–r– 1 root root 12015 Jan 1 1970 tiwlan.ini
    -rwxr-xr-x 1 root root 1025 Jan 1 1970 udhcpc.script
    -rwxr-xr-x 1 root root 53 Jan 1 1970 udhcpd.conf
    -rw-r–r– 1 root root 389 Jan 1 1970 vold.conf
    drwxr-xr-x 1 root root 32 Jan 1 1970 wifi
    -rw-r–r– 1 root root 332 Jan 1 1970 wlanconf.nvs
    drwxr-xr-x 1 root root 608 Jan 1 1970 zoneinfo
    ls -l /sqlite_stmt_journals
    ls -l /data/local/tmp
    ls: can’t open ‘/data/local/tmp’: Permission denied
    ls -l /system/bin/reboot
    lrwxrwxrwx 1 root root 7 Jan 1 1970 /system/bin/reboot -> toolbox
    cat /proc/sys/kernel/osrelease
    2.6.27.10-omap1
    getprop ro.product.model
    Archos5
    getprop ro.product.brand
    archos
    getprop ro.product.name
    Archos5
    getprop ro.product.manufacturer
    archos
    getprop ro.build.product
    g7a
    Install rootkit: false
    Exploit delete success

  8. Itaru says:
    August 22, 2010 at 10:27 pm

    Version: Universal Androot – v1.6.2 beta
    Detected OS version:3
    Go for root !
    User selected: Cupcake
    Trying to get mount point:/system/bin
    Preparing Exploit … :1
    Preparing busybox binary … :1
    Preparing Su binary … :1
    Preparing Superuser apk … :1, resid:2130968581
    Preparing root toolkit script … :1
    Trying to get mount point:/data
    /dev/block/mtdblock2 /data yaffs2 rw,nosuid,nodev 0 0
    Trying to get mount point:/system
    /dev/block/mtdblock1 /system yaffs2 ro 0 0
    mkdir /sqlite_stmt_journals/sys_bin_orig
    mkdir /sqlite_stmt_journals/sys_bin_overlay
    ./busybox mount -r /dev/block/mtdblock1 /sqlite_stmt_journals/sys_bin_orig
    ./busybox ln -s /sqlite_stmt_journals/sys_bin_orig/bin/* /sqlite_stmt_journals/sys_bin_overlay/
    cat su > /sqlite_stmt_journals/sys_bin_overlay/su
    chmod 04755 /sqlite_stmt_journals/sys_bin_overlay/su
    ./busybox mount –bind /sqlite_stmt_journals/sys_bin_overlay /system/bin

    ./busybox umount /system/bin
    rm /sqlite_stmt_journals/sys_bin_overlay/*
    rmdir /sqlite_stmt_journals/sys_bin_overlay

    Preparing to execute exploit, do chmod
    Executing exploit..
    cmd: /data/data/com.corner23.android.universalandroot/files/getroot /dev/block/mtdblock2 yaffs2
    [*] Android local root exploid (C) The Android Exploid Crew
    [*] Modified by shakalaca for various devices
    [+] Using basedir=/sqlite_stmt_journals, path=/data/data/com.corner23.android.universalandroot/files/getroot
    [+] opening NETLINK_KOBJECT_UEVENT socket
    [+] sending add message …
    [*] Try to invoke hotplug now, clicking at the wireless
    [*] settings, plugin USB key etc.
    [*] You succeeded if you find /system/bin/rootshell.
    [*] GUI might hang/restart meanwhile so be patient.
    Wifi enabled …
    After wifi, do copy files
    Root shell is missing ..
    ls -l /system/etc
    drwxr-xr-x root root 2008-08-01 20:00 mgdata
    -rw-r–r– root root 3207 2008-08-01 20:00 init.qcom.bt.sh
    -r-xr-x— root shell 1086 2008-08-01 20:00 init.goldfish.sh
    -rw-r–r– root root 25 2008-08-01 20:00 hosts
    -rw-r–r– root root 185 2008-08-01 20:00 gps.conf
    drwxr-xr-x root root 2008-08-01 20:00 fuel_gauge
    -rw-r–r– root root 16305 2008-08-01 20:00 event-log-tags
    drwxr-xr-x root root 2008-08-01 20:00 minipad
    drwxr-xr-x root root 2008-08-01 20:00 security
    drwxr-xr-x root root 2008-08-01 20:00 dhcpcd
    -r–r—– bluetooth bluetooth 935 2008-08-01 20:00 dbus.conf
    -rw-r–r– root root 673 2008-08-01 20:00 bt_init.config
    -rw-r–r– root root 2325 2008-08-01 20:00 bookmarks.xml
    drwxr-xr-x root root 2008-08-01 20:00 bluez
    -rw-r–r– root root 366 2008-08-01 20:00 pvplayer.conf
    -rw-r–r– root root 19943 2008-08-01 20:00 apns-conf.xml
    drwxr-xr-x root root 2008-08-01 20:00 akm
    -rw-r–r– root root 137820 2008-08-01 20:00 NOTICE.html.gz
    -rw-r–r– root root 11476 2008-08-01 20:00 BCM4325D1_004.002.004.0218.0225f.hcd
    -rw-r–r– root root 44167 2008-08-01 20:00 AudioPara4.csv
    -rw-r–r– root root 4216 2008-08-01 20:00 AudioFilter.csv
    drwxr-xr-x root root 2008-08-01 20:00 permissions
    -rw-r–r– root root 1679 2008-08-01 20:00 ons-conf.xml
    drwxr-xr-x root root 2008-08-01 20:00 wifi
    -rw-r–r– root root 290 2008-08-01 20:00 vold.conf
    drwxr-xr-x root root 2008-08-01 20:00 motorola
    -rw-r–r– root root 15042 2008-08-01 20:00 mot_ise_imager_cfg.bin
    drwxr-xr-x root root 2008-08-01 20:00 touchpad
    -rw-r–r– root root 388 2008-08-01 20:00 supportedlocales.conf
    ls -l /sqlite_stmt_journals
    lrwxrwxrwx app_88 app_88 2010-08-22 22:18 data -> /proc/sys/kernel/hotplug
    -rw-r–r– app_88 app_88 6 2010-08-22 22:18 fs_type
    -rw-r–r– app_88 app_88 20 2010-08-22 22:18 mount
    -rw-r–r– app_88 app_88 62 2010-08-22 22:18 hotplug
    -rw-rw-rw- app_88 app_88 0 2010-08-22 22:18 loading
    ls -l /data/local/tmp
    opendir failed, Permission denied
    ls -l /system/bin/reboot
    lrwxrwxrwx root root 2010-08-09 22:07 reboot -> toolbox
    cat /proc/sys/kernel/osrelease
    2.6.27
    getprop ro.product.model
    ME600
    getprop ro.product.brand
    blur
    getprop ro.product.name
    motus
    getprop ro.product.manufacturer
    motorola
    getprop ro.build.product
    motus
    Install rootkit: false
    Exploit delete success

  9. M. Verro says:
    August 23, 2010 at 5:56 am

    Still no word on mytouch slide?

  10. frao29 says:
    August 23, 2010 at 11:22 am

    only temporary root on slide, i try many root apps and work great

  11. Patrick Poon says:
    August 23, 2010 at 12:06 pm

    Not working on my Aria 2.1……but I want to know if it can really delete all the trace of rooted when I press unroot. I’m afraid that the warrenty will be void.

    I tried other root method, but the unroot action for them is flashing another ROM. I don’t want to do such thing, so I hope Universal Androot can be successful on my Aria.

  12. M. Verro says:
    August 23, 2010 at 11:38 pm

    Just bought the Samsung Vibrant will this work to root?

  13. hongkongtom says:
    August 24, 2010 at 4:07 pm

    有人成功root Desire 2.1嗎?

  14. shakalaca says:
    August 24, 2010 at 7:46 pm

    @steven: What do you mean “got nothing” ? :)

  15. shakalaca says:
    August 24, 2010 at 7:46 pm

    @daxx: Please send the log to me, thanks :)

  16. shakalaca says:
    August 24, 2010 at 7:49 pm

    @ykm83: Can you send me the log ? thanks!

  17. Ivanchuk says:
    August 25, 2010 at 3:16 am

    I’ve got “Failed! No ~~~ fu goo ~~~” trying to install it on chinese Gphone G2 with Android 1.5. Can my log be useful? If yes, where can I send it?

  18. sup says:
    August 25, 2010 at 6:03 pm

    works on moto droid 2.2 frg01b

  19. Johanove says:
    August 25, 2010 at 7:48 pm

    Thanks for a brilliant apk!! Worked like a sharm on my N1.. not that its hard on N1 but anyway :) I have a lot of friends waiting for a good Desire solution, hope you find a way! Cheers //johanove

  20. tracy says:
    August 25, 2010 at 9:49 pm

    回报，i5700的目录里确实没有firmware目录，这样是不是没办法了，有没有其他路径可以可做到呢

  21. colchiro says:
    August 26, 2010 at 7:59 am

    Can we get the option to use xbin instead of bin (for Droid X users)?

    I’m told installing su to xbin folder means we’d still have root after upgrade to 2.2.

    Thanks. (Great app!)

  22. Violet says:
    August 26, 2010 at 4:41 pm

    失败了……Desire 2.2……
    稍后给你发LOG

  23. Violet says:
    August 26, 2010 at 4:42 pm

    Version: Universal Androot – v1.6.2 beta
    Detected OS version:8
    Go for root !
    User selected: Eclair
    Trying to get mount point:/system/bin
    Preparing Exploit … :1
    Preparing busybox binary … :1
    Preparing Su binary … :1
    Preparing Superuser apk … :1, resid:2130968582
    Preparing root toolkit script … :1
    Trying to get mount point:/data
    /dev/block/mtdblock5 /data yaffs2 rw,nosuid,nodev,relatime 0 0
    Trying to get mount point:/system
    /dev/block/mtdblock3 /system yaffs2 ro,relatime 0 0
    insmod ./tattoo_hack_gf922713.ko
    insmod ./tattoo_hack_g6561203.ko
    mount -o remount,rw /dev/block/mtdblock3 /system
    cat su > /system/bin/su
    chmod 04755 /system/bin/su

    mount -o remount,ro /dev/block/mtdblock3 /system

    insmod ./tattoo_hack_gf922713.ko
    insmod ./tattoo_hack_g6561203.ko
    mount -o remount,rw /dev/block/mtdblock3 /system
    rm /system/bin/su
    mount -o remount,rw,nosuid,nodev,relatime -t yaffs2 /dev/block/mtdblock5 /data
    mount -o remount,ro /dev/block/mtdblock3 /system

    Preparing to execute exploit, do chmod
    Executing exploit..
    cmd: /data/data/com.corner23.android.universalandroot/files/getroot /dev/block/mtdblock5 yaffs2
    [*] Android local root exploid (C) The Android Exploid Crew
    [*] Modified by shakalaca for various devices
    [+] Using basedir=/data/data/com.corner23.android.universalandroot/files, path=/data/data/com.corner23.android.universalandroot/files/getroot
    [+] opening NETLINK_KOBJECT_UEVENT socket
    [+] sending add message …
    [*] Try to invoke hotplug now, clicking at the wireless
    [*] settings, plugin USB key etc.
    [*] You succeeded if you find /system/bin/rootshell.
    [*] GUI might hang/restart meanwhile so be patient.
    Wifi disabled …
    After wifi, do copy files
    Root shell is missing ..
    ls -l /system/etc
    drwxr-xr-x root root 2010-07-29 01:27 clockwidget
    -rw-r–r– root root 232 2010-07-29 01:27 gps.conf
    -rw-r–r– root root 63488 2010-07-29 01:27 timezones.db
    drwxr-xr-x root root 2010-07-29 01:27 wimax
    drwxr-xr-x root root 2010-07-29 01:27 security
    -rw-r–r– root root 6114 2010-07-29 01:27 voicemail-conf.xml
    -rw-r–r– root root 3008536 2010-07-29 01:27 WPDB.zip
    -rw-r–r– root root 186 2010-07-29 01:27 pvasflocal.cfg
    -rw-r–r– root root 459 2010-07-29 01:27 vomeplay.cfg
    -rw-r–r– root root 387 2010-07-29 01:27 spn-conf.xml
    -r–r—– bluetooth bluetooth 935 2010-07-29 01:27 dbus.conf
    drwxr-xr-x root root 2010-07-29 01:27 dhcpcd
    -rw-r–r– root root 10448 2010-07-29 01:27 event-log-tags
    drwxr-xr-x root root 2010-07-29 01:27 wifi
    -r-xr-x— root shell 1200 2010-07-29 01:27 init.goldfish.sh
    drwxr-xr-x root root 2010-07-29 01:27 iproute2
    drwxr-xr-x root root 2010-07-29 01:27 bluetooth
    -rw-r–r– root root 57323 2010-07-29 01:27 NOTICE.html.gz
    -rw-r–r– root root 499 2010-07-29 01:27 vomeComp.cfg
    -rw-r–r– root root 613 2010-07-29 01:27 vold.fstab
    -rw-r–r– root root 591 2010-07-29 01:27 AudioBTID.csv
    drwxr-xr-x root root 2010-07-29 01:27 permissions
    -rw-r–r– root root 473 2010-07-29 01:27 pvplayer.cfg
    -rw-r–r– root root 32768 2010-07-29 01:27 voVidDec.dat
    -rw-r–r– root root 285 2010-07-29 01:27 mm_property.conf
    drwxr-xr-x root root 2010-07-29 01:27 firmware
    -rw-r–r– root root 474 2010-07-29 01:27 vomeCore.cfg
    -rw-r–r– root root 1471 2010-07-29 01:27 apns-conf.xml
    -rw-r–r– root root 3329 2010-07-29 01:27 ser2net.conf
    -rw-r–r– root root 0 2010-07-29 01:27 agps_rm
    drwxr-xr-x root root 2010-07-29 01:27 ppp
    -rw-r–r– root root 6306 2010-07-29 01:27 media_profiles.xml
    -rw-r–r– root root 85 2010-07-29 01:27 01_qcomm_omx.cfg
    -rw-r–r– root root 25 2010-07-29 01:27 hosts
    ls -l /sqlite_stmt_journals
    /sqlite_stmt_journals: No such file or directory
    ls -l /data/local/tmp
    opendir failed, Permission denied
    ls -l /system/bin/reboot
    -rwsr-sr-x root shell 5632 2010-07-29 01:27 reboot
    cat /proc/sys/kernel/osrelease
    2.6.32.15-gf9c0527
    getprop ro.product.model
    HTC Desire
    getprop ro.product.brand
    htc_wwe
    getprop ro.product.name
    htc_bravo
    getprop ro.product.manufacturer
    HTC
    getprop ro.build.product
    bravo
    Install rootkit: false
    Exploit delete success
    Version: Universal Androot – v1.6.2 beta
    Detected OS version:8
    Go for root !
    User selected: Eclair
    Trying to get mount point:/system/bin
    Preparing Exploit … :1
    Preparing busybox binary … :1
    Preparing Su binary … :1
    Preparing Superuser apk … :1, resid:2130968582
    Preparing root toolkit script … :1
    Trying to get mount point:/data
    /dev/block/mtdblock5 /data yaffs2 rw,nosuid,nodev,relatime 0 0
    Trying to get mount point:/system
    /dev/block/mtdblock3 /system yaffs2 ro,relatime 0 0
    insmod ./tattoo_hack_gf922713.ko
    insmod ./tattoo_hack_g6561203.ko
    mount -o remount,rw /dev/block/mtdblock3 /system
    cat su > /system/bin/su
    chmod 04755 /system/bin/su

    mount -o remount,ro /dev/block/mtdblock3 /system

    insmod ./tattoo_hack_gf922713.ko
    insmod ./tattoo_hack_g6561203.ko
    mount -o remount,rw /dev/block/mtdblock3 /system
    rm /system/bin/su
    mount -o remount,rw,nosuid,nodev,relatime -t yaffs2 /dev/block/mtdblock5 /data
    mount -o remount,ro /dev/block/mtdblock3 /system

    Preparing to execute exploit, do chmod
    Executing exploit..
    cmd: /data/data/com.corner23.android.universalandroot/files/getroot /dev/block/mtdblock5 yaffs2
    [*] Android local root exploid (C) The Android Exploid Crew
    [*] Modified by shakalaca for various devices
    [+] Using basedir=/data/data/com.corner23.android.universalandroot/files, path=/data/data/com.corner23.android.universalandroot/files/getroot
    [+] opening NETLINK_KOBJECT_UEVENT socket
    [+] sending add message …
    [*] Try to invoke hotplug now, clicking at the wireless
    [*] settings, plugin USB key etc.
    [*] You succeeded if you find /system/bin/rootshell.
    [*] GUI might hang/restart meanwhile so be patient.
    Wifi disabled …
    After wifi, do copy files
    Root shell is missing ..
    ls -l /system/etc
    drwxr-xr-x root root 2010-07-29 01:27 clockwidget
    -rw-r–r– root root 232 2010-07-29 01:27 gps.conf
    -rw-r–r– root root 63488 2010-07-29 01:27 timezones.db
    drwxr-xr-x root root 2010-07-29 01:27 wimax
    drwxr-xr-x root root 2010-07-29 01:27 security
    -rw-r–r– root root 6114 2010-07-29 01:27 voicemail-conf.xml
    -rw-r–r– root root 3008536 2010-07-29 01:27 WPDB.zip
    -rw-r–r– root root 186 2010-07-29 01:27 pvasflocal.cfg
    -rw-r–r– root root 459 2010-07-29 01:27 vomeplay.cfg
    -rw-r–r– root root 387 2010-07-29 01:27 spn-conf.xml
    -r–r—– bluetooth bluetooth 935 2010-07-29 01:27 dbus.conf
    drwxr-xr-x root root 2010-07-29 01:27 dhcpcd
    -rw-r–r– root root 10448 2010-07-29 01:27 event-log-tags
    drwxr-xr-x root root 2010-07-29 01:27 wifi
    -r-xr-x— root shell 1200 2010-07-29 01:27 init.goldfish.sh
    drwxr-xr-x root root 2010-07-29 01:27 iproute2
    drwxr-xr-x root root 2010-07-29 01:27 bluetooth
    -rw-r–r– root root 57323 2010-07-29 01:27 NOTICE.html.gz
    -rw-r–r– root root 499 2010-07-29 01:27 vomeComp.cfg
    -rw-r–r– root root 613 2010-07-29 01:27 vold.fstab
    -rw-r–r– root root 591 2010-07-29 01:27 AudioBTID.csv
    drwxr-xr-x root root 2010-07-29 01:27 permissions
    -rw-r–r– root root 473 2010-07-29 01:27 pvplayer.cfg
    -rw-r–r– root root 32768 2010-07-29 01:27 voVidDec.dat
    -rw-r–r– root root 285 2010-07-29 01:27 mm_property.conf
    drwxr-xr-x root root 2010-07-29 01:27 firmware
    -rw-r–r– root root 474 2010-07-29 01:27 vomeCore.cfg
    -rw-r–r– root root 1471 2010-07-29 01:27 apns-conf.xml
    -rw-r–r– root root 3329 2010-07-29 01:27 ser2net.conf
    -rw-r–r– root root 0 2010-07-29 01:27 agps_rm
    drwxr-xr-x root root 2010-07-29 01:27 ppp
    -rw-r–r– root root 6306 2010-07-29 01:27 media_profiles.xml
    -rw-r–r– root root 85 2010-07-29 01:27 01_qcomm_omx.cfg
    -rw-r–r– root root 25 2010-07-29 01:27 hosts
    ls -l /sqlite_stmt_journals
    /sqlite_stmt_journals: No such file or directory
    ls -l /data/local/tmp
    opendir failed, Permission denied
    ls -l /system/bin/reboot
    -rwsr-sr-x root shell 5632 2010-07-29 01:27 reboot
    cat /proc/sys/kernel/osrelease
    2.6.32.15-gf9c0527
    getprop ro.product.model
    HTC Desire
    getprop ro.product.brand
    htc_wwe
    getprop ro.product.name
    htc_bravo
    getprop ro.product.manufacturer
    HTC
    getprop ro.build.product
    bravo
    Install rootkit: false
    Exploit delete success

  24. KEN says:
    August 27, 2010 at 12:17 am

    Aria不能用喔.

  25. ken says:
    August 27, 2010 at 12:03 pm

    在Legend Andorid 2.1 update1，無法Root成功耶~
    Log如下:

    Version: Universal Androot – v1.6.2 beta
    Detected OS version:7
    Go for root !
    User selected: Eclair
    Trying to get mount point:/system/bin
    Preparing Exploit … :1
    Preparing busybox binary … :1
    Preparing Su binary … :1
    Preparing Superuser apk … :1, resid:2130968582
    Preparing root toolkit script … :1
    Trying to get mount point:/data
    /dev/block/mtdblock5 /data yaffs2 rw,nosuid,nodev 0 0
    Trying to get mount point:/system
    /dev/block/mtdblock3 /system yaffs2 ro 0 0
    insmod ./tattoo_hack_gf922713.ko
    insmod ./tattoo_hack_g6561203.ko
    mount -o remount,rw /dev/block/mtdblock3 /system
    cat su > /system/bin/su
    chmod 04755 /system/bin/su

    mount -o remount,ro /dev/block/mtdblock3 /system

    insmod ./tattoo_hack_gf922713.ko
    insmod ./tattoo_hack_g6561203.ko
    mount -o remount,rw /dev/block/mtdblock3 /system
    rm /system/bin/su
    mount -o remount,rw,nosuid,nodev -t yaffs2 /dev/block/mtdblock5 /data
    mount -o remount,ro /dev/block/mtdblock3 /system

    Preparing to execute exploit, do chmod
    Executing exploit..
    cmd: /data/data/com.corner23.android.universalandroot/files/getroot /dev/block/mtdblock5 yaffs2
    [*] Android local root exploid (C) The Android Exploid Crew
    [*] Modified by shakalaca for various devices
    [+] Using basedir=/sqlite_stmt_journals, path=/data/data/com.corner23.android.universalandroot/files/getroot
    [+] opening NETLINK_KOBJECT_UEVENT socket
    [+] sending add message …
    [*] Try to invoke hotplug now, clicking at the wireless
    [*] settings, plugin USB key etc.
    [*] You succeeded if you find /system/bin/rootshell.
    [*] GUI might hang/restart meanwhile so be patient.
    Wifi disabled …
    After wifi, do copy files
    Version: Universal Androot – v1.6.2 beta
    Detected OS version:7
    Go for root !
    User selected: Eclair
    Trying to get mount point:/system/bin
    Preparing Exploit … :1
    Preparing busybox binary … :1
    Preparing Su binary … :1
    Preparing Superuser apk … :1, resid:2130968582
    Preparing root toolkit script … :1
    Trying to get mount point:/data
    /dev/block/mtdblock5 /data yaffs2 rw,nosuid,nodev 0 0
    Trying to get mount point:/system
    /dev/block/mtdblock3 /system yaffs2 ro 0 0
    insmod ./tattoo_hack_gf922713.ko
    insmod ./tattoo_hack_g6561203.ko
    mount -o remount,rw /dev/block/mtdblock3 /system
    cat su > /system/bin/su
    chmod 04755 /system/bin/su

    mount -o remount,ro /dev/block/mtdblock3 /system

    insmod ./tattoo_hack_gf922713.ko
    insmod ./tattoo_hack_g6561203.ko
    mount -o remount,rw /dev/block/mtdblock3 /system
    rm /system/bin/su
    mount -o remount,rw,nosuid,nodev -t yaffs2 /dev/block/mtdblock5 /data
    mount -o remount,ro /dev/block/mtdblock3 /system

    Preparing to execute exploit, do chmod
    Executing exploit..
    cmd: /data/data/com.corner23.android.universalandroot/files/getroot /dev/block/mtdblock5 yaffs2
    [*] Android local root exploid (C) The Android Exploid Crew
    [*] Modified by shakalaca for various devices
    [+] Using basedir=/sqlite_stmt_journals, path=/data/data/com.corner23.android.universalandroot/files/getroot
    [+] opening NETLINK_KOBJECT_UEVENT socket
    [+] sending add message …
    [*] Try to invoke hotplug now, clicking at the wireless
    [*] settings, plugin USB key etc.
    [*] You succeeded if you find /system/bin/rootshell.
    [*] GUI might hang/restart meanwhile so be patient.
    Wifi enabled …
    After wifi, do copy files

  26. Bardelli says:
    August 27, 2010 at 7:43 pm

    Hi! Couldn’t make it work on my Motorola Quench (Cliq XT) with 1.5…

    How can I send you the log?

  27. Chris says:
    August 27, 2010 at 9:24 pm

    apparently upgrade frg22d breaks support for moto droid (original)
    http://www.droid-life.com/2010/08/26/manually-update-to-frg22d-froyo-for-droid-now/

    can you fix? I have been declining the update in order to continue to use your program

  28. M. Verro says:
    August 28, 2010 at 9:38 am

    anything on the Samsung Vibrant?

  29. tony says:
    August 28, 2010 at 1:50 pm

    Doesn’t work

    Motorola Droid (1), FRG22D

  30. oasiskim says:
    August 28, 2010 at 4:18 pm

    samsung～～～

  31. shakalaca says:
    August 28, 2010 at 6:45 pm

    @colchiro: It’s a good idea .. :)

  32. shakalaca says:
    August 28, 2010 at 6:46 pm

    @tracy: 看來需要另一種方式了..

  33. rodger says:
    August 28, 2010 at 11:26 pm

    hello,

    I have a htc desire a8181 with ota 2.2.
    Install worked fine! but root doesnt work.
    Other problem….i dont get any log file on my sd-card!!!……
    So i cannot send you the log…..
    How do i get the log? I checked my sd-card with my pc by cable, directly from my cardreader in the pc and looked with andexplorer on the phone itself. But didnt find any log on my card.

    i have
    smalband: 32.43.00.32U_5.0900.20
    kernel: 2.6.32.15-gf9c0527
    build: 2.09.405.8 CL218634
    software: 2.09.405.8
    webkit: 3.1

    Hope u can help me, because i like to have root on my phone, and i want to help you with more information for your project..

    cheers!

  34. rodger says:
    August 29, 2010 at 1:30 am

    dont know why…somehow there was my log on the root of my card…send u mail!

    cheers

  35. Szaby59 says:
    August 29, 2010 at 4:51 am

    Hi!
    I tried on my Samsung Galaxy i5801 (same as i5800 but this is with Orange firmware).
    But now working.
    Here is the log: http://www.mediafire.com/?b4py8qsw61mltzm

  36. Szaby59 says:
    August 29, 2010 at 4:51 am

    Sorry!
    But now working.*

    NOT WORKING

  37. proteus says:
    August 29, 2010 at 5:52 am

    does this work on nexus one 2.2 FRF 91 ?

  38. sev7en says:
    August 29, 2010 at 7:19 am

    Does not work with OTA Froyo FRG22D.

  39. Todd Brunhoff says:
    August 29, 2010 at 4:32 pm

    Did not work on G1 running standard T-mobile 1.6 following the downgrade guide here: http://wiki.cyanogenmod.com/index.php?title=Full_Downgrade_Guide_-_HTC_Dream

    The generated logfile suggests that /system has no space (it has 40KB). I guess I will use the traditional method. Here’s the log:

    Version: Universal Androot – v1.6.2 beta
    Detected OS version:4
    Go for root !
    User selected: Cupcake
    Trying to get mount point:/system/bin
    Preparing Exploit … :1
    Preparing busybox binary … :1
    Preparing Su binary … :1
    Preparing Superuser apk … :1, resid:2130968581
    Preparing root toolkit script … :1
    Trying to get mount point:/data
    /dev/block/mtdblock5 /data yaffs2 rw,nosuid,nodev 0 0
    Trying to get mount point:/system
    /dev/block/mtdblock3 /system yaffs2 ro 0 0
    insmod ./tattoo_hack_gf922713.ko
    insmod ./tattoo_hack_g6561203.ko
    mount -o remount,rw /dev/block/mtdblock3 /system
    cat su > /system/bin/su
    chmod 04755 /system/bin/su

    mount -o remount,ro /dev/block/mtdblock3 /system

    insmod ./tattoo_hack_gf922713.ko
    insmod ./tattoo_hack_g6561203.ko
    mount -o remount,rw /dev/block/mtdblock3 /system
    rm /system/bin/su
    mount -o remount,rw,nosuid,nodev -t yaffs2 /dev/block/mtdblock5 /data
    mount -o remount,ro /dev/block/mtdblock3 /system

    Preparing to execute exploit, do chmod
    Executing exploit..
    cmd: /data/data/com.corner23.android.universalandroot/files/getroot /dev/block/mtdblock5 yaffs2
    [*] Android local root exploid (C) The Android Exploid Crew
    [*] Modified by shakalaca for various devices
    [+] Using basedir=/sqlite_stmt_journals, path=/data/data/com.corner23.android.universalandroot/files/getroot
    [+] opening NETLINK_KOBJECT_UEVENT socket
    [+] sending add message …
    [*] Try to invoke hotplug now, clicking at the wireless
    [*] settings, plugin USB key etc.
    [*] You succeeded if you find /system/bin/rootshell.
    [*] GUI might hang/restart meanwhile so be patient.
    Wifi enabled …
    After wifi, do copy files
    insmod: init_module ‘./tattoo_hack_gf922713.ko’ failed (Exec format error)
    insmod: init_module ‘./tattoo_hack_g6561203.ko’ failed (Exec format error)
    write: No space left on device
    ls -l /system/etc
    -rw-r–r– root root 2037 2010-08-29 00:16 bookmarks.xml
    -r-xr–r– root root 415 2008-08-01 05:00 install-recovery.sh
    -rw-r–r– root root 6521 2010-08-29 00:16 apns-conf.xml
    -rw-r–r– root root 58366 2008-08-01 05:00 NOTICE.html.gz
    -rw-r–r– root root 85 2008-08-01 05:00 01_qcomm_omx.cfg
    drwxr-xr-x root root 2008-08-01 05:00 wifi
    -rw-r–r– root root 368 2008-08-01 05:00 vold.conf
    drwxr-xr-x root root 2008-08-01 05:00 security
    drwxr-xr-x root root 2008-08-01 05:00 permissions
    -rw-r–r– root root 25 2008-08-01 05:00 hosts
    -rw-r–r– root root 232 2008-08-01 05:00 gps.conf
    drwxr-xr-x root root 2008-08-01 05:00 firmware
    drwxr-xr-x root root 2008-08-01 05:00 dhcpcd
    -r–r—– bluetooth bluetooth 935 2008-08-01 05:00 dbus.conf
    -rw-r–r– root root 1321 2008-08-01 05:00 contributors.html
    -rw-r–r– root root 682 2008-08-01 05:00 contributors.css
    drwxr-xr-x root root 2008-08-01 05:00 bluez
    -rw-r–r– root root 5220 2008-08-01 05:00 AudioPreProcess.csv
    -r–r—– radio audio 44542 2008-08-01 05:00 AudioPara4.csv
    -rw-r–r– root root 1898 2008-08-01 05:00 AudioFilter.csv
    -rw-r–r– root root 473 2008-08-01 05:00 pvplayer.cfg
    -r-xr-x— root shell 1176 2010-08-29 00:16 init.goldfish.sh
    -rw-r–r– root root 183 2008-08-01 05:00 pvasflocal.cfg
    -rw-r–r– root root 7276 2010-08-29 00:16 event-log-tags
    drwxr-xr-x root root 2008-08-01 05:00 ppp
    ls -l /sqlite_stmt_journals
    ls -l /data/local/tmp
    opendir failed, Permission denied
    ls -l /system/bin/reboot
    lrwxrwxrwx root root 2010-08-28 23:57 reboot -> toolbox
    cat /proc/sys/kernel/osrelease
    2.6.29-00479-g3c7df37
    getprop ro.product.model
    T-Mobile G1
    getprop ro.product.brand
    tmobile
    getprop ro.product.name
    kila
    getprop ro.product.manufacturer
    HTC
    getprop ro.build.product
    dream
    Install rootkit: true
    Exploit delete success

  40. shakalaca says:
    August 29, 2010 at 11:28 pm

    @Todd Brunhoff: Androot will write su file in your /system.. you can use Soft root and clean up something.

  41. shakalaca says:
    August 29, 2010 at 11:29 pm

    @proteus: Yes, my phone is Nexus One with FRF91 :)

  42. shakalaca says:
    August 29, 2010 at 11:30 pm

    @Szaby59: This application can not root i5801 because there’s no /etc/firmware directory… sorry for that.

  43. shakalaca says:
    August 29, 2010 at 11:31 pm

    @rodger: Desire with 2.2 should fix the hole thus can’t be rooted by Androot :(

  44. Michael says:
    August 30, 2010 at 12:01 am

    1.6.2 beta seems to work on the Motorola Flipout!!! (Android 2.1)

  45. Szaby59 says:
    August 30, 2010 at 12:37 am

    @shakalaca: Thanks for the answer.

  46. Cord says:
    September 5, 2010 at 4:06 am

    Tried loading on my evo. Nogo. Said failed!!!! I tried v1.6.2 beta and beta 5. Tried all options under superuser. Tried solfroot.

    here is my log:

    Go for root !
    Version: Universal Androot – v1.6.2 beta 5
    Detected OS version:8
    ls -l /system/etc
    drwxr-xr-x root root 2010-04-29 01:47 clockwidget
    drwxr-xr-x root root 2010-04-29 01:47 wifi
    -rw-r–r– root root 199 2010-04-29 01:47 TPA2018.csv
    drwxr-xr-x root root 2010-08-02 22:43 firmware
    drwxr-xr-x root root 2010-08-02 22:39 bluez
    -rw-r–r– root root 25 2010-04-29 01:47 hosts
    -rw-r–r– root root 186 2010-04-29 01:47 pvasflocal.cfg
    -rw-r–r– root root 713 2010-04-29 01:47 AudioBTID.csv
    drwxr-xr-x root root 2010-04-29 01:47 wimax
    -rw-r–r– root root 91 2010-04-29 01:47 vo_omx_core.cfg
    -rw-r–r– root root 144 2010-04-29 01:47 bluetoothinfo.conf
    drwxr-xr-x root root 2010-08-02 22:41 dhcpcd
    drwxr-xr-x root root 2010-08-02 22:43 iproute2
    drwxr-xr-x root root 2010-04-29 01:47 ppp
    -rw-r–r– root root 151 2008-08-01 08:00 mm_property.conf
    -rw-r–r– root root 6306 2008-08-01 08:00 media_profiles.xml
    -rw-r–r– root root 6114 2010-08-02 22:41 voicemail-conf.xml
    -rw-r–r– root root 32768 2010-08-02 22:41 voVidDec.dat
    -rw-r–r– root root 459 2008-08-01 08:00 vomeplay.cfg
    -rw-r–r– root root 474 2008-08-01 08:00 vomeCore.cfg
    -r-xr-x— root shell 1200 2010-08-02 22:41 init.goldfish.sh
    -rw-r–r– root root 85 2010-04-29 01:47 01_qcomm_omx.cfg
    -rw-r–r– root root 279 2010-08-02 22:41 gps.conf
    drwxr-xr-x root root 2010-08-02 22:41 security
    -rw-r–r– root root 387 2010-04-29 01:47 spn-conf.xml
    -rw-r–r– root root 63488 2010-04-29 01:47 timezones.db
    -r–r—– bluetooth bluetooth 935 2010-04-29 01:47 dbus.conf
    -rw-r–r– root root 473 2010-04-29 01:47 pvplayer.cfg
    -rw-r–r– root root 3329 2010-04-29 01:47 ser2net.conf
    -rw-r–r– root root 10448 2010-08-02 22:41 event-log-tags
    -rw-r–r– root root 499 2008-08-01 08:00 vomeComp.cfg
    -rw-r–r– root root 613 2008-08-01 08:00 vold.fstab
    drwxr-xr-x root root 2010-08-02 22:43 permissions
    -rw-r–r– root root 0 2010-04-29 01:47 agps_rm
    -rw-r–r– root root 202 2010-04-29 01:47 TPA2018MFG.csv
    -rw-r–r– root root 717 2010-04-29 01:47 iqprofile.pro
    -rw-r–r– root root 1471 2010-08-02 22:41 apns-conf.xml
    -rw-r–r– root root 1050 2008-08-01 08:00 searchabledb.conf
    drwxr-xr-x root root 2010-08-02 22:43 bluetooth
    -rw-r–r– root root 3008536 2010-08-02 22:41 WPDB.zip
    -rw-r–r– root root 63822 2010-08-02 22:41 NOTICE.html.gz
    -rw-r–r– root root 3073 2008-08-01 08:00 AdieHWCodecSetting.csv
    ls -l /system/bin/reboot
    -rwsr-sr-x root shell 5632 2010-08-02 22:41 reboot
    cat /proc/sys/kernel/osrelease
    2.6.32.15-g746f4f0
    getprop ro.product.model
    PC36100
    getprop ro.product.brand
    sprint
    getprop ro.product.name
    htc_supersonic
    getprop ro.product.manufacturer
    HTC
    getprop ro.build.product
    supersonic
    ls -l /sqlite_stmt_journals
    /sqlite_stmt_journals: No such file or directory
    ls -l /data/local/tmp
    opendir failed, Permission denied
    ls -l /app-cache
    drwxr-xr-x app_70 app_70 2010-09-04 13:44 com.android.browser
    srwxrwxrwx root root 2010-09-04 13:44 iqserver
    run mount
    rootfs / rootfs ro,relatime 0 0
    tmpfs /dev tmpfs rw,relatime,mode=755 0 0
    devpts /dev/pts devpts rw,relatime,mode=600 0 0
    proc /proc proc rw,relatime 0 0
    sysfs /sys sysfs rw,relatime 0 0
    none /acct cgroup rw,relatime,cpuacct 0 0
    tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
    none /dev/cpuctl cgroup rw,relatime,cpu 0 0
    /dev/block/mtdblock4 /system yaffs2 ro,relatime 0 0
    /dev/block/mtdblock6 /data yaffs2 rw,nosuid,nodev,relatime 0 0
    /dev/block/mtdblock5 /cache yaffs2 rw,nosuid,nodev,relatime 0 0
    tmpfs /app-cache tmpfs rw,relatime,size=8192k 0 0
    /dev/block/vold/179:1 /mnt/sdcard vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
    /dev/block/vold/179:1 /mnt/secure/asec vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
    tmpfs /mnt/sdcard/.android_secure tmpfs ro,relatime,size=0k,mode=000 0 0
    /dev/block/dm-0 /mnt/asec/com.glu.android.wsop3-1 vfat ro,dirsync,nosuid,nodev,noexec,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
    run df
    /dev: 212448K total, 0K used, 212448K available (block size 4096)
    /mnt/asec: 212448K total, 0K used, 212448K available (block size 4096)
    /system: 358400K total, 264652K used, 93748K available (block size 4096)
    /data: 437888K total, 165376K used, 272512K available (block size 4096)
    /cache: 163840K total, 3320K used, 160520K available (block size 4096)
    /app-cache: 8192K total, 4K used, 8188K available (block size 4096)
    /mnt/sdcard: 7763968K total, 738752K used, 7025216K available (block size 32768)
    /mnt/asec/com.glu.android.wsop3-1: 20764K total, 19388K used, 1376K available (block size 4096)
    /mnt/secure/asec: Permission denied
    Preparing Exploit … :true
    Preparing busybox binary … :true
    User selected: Not install
    Preparing Su binary … :true
    Preparing root toolkit script … :true
    Trying to get mount point:/data
    /dev/block/mtdblock6 /data yaffs2 rw,nosuid,nodev,relatime 0 0
    Trying to get mount point:/system
    /dev/block/mtdblock4 /system yaffs2 ro,relatime 0 0
    Trying to get mount point:/system/bin
    mkdir /data/local/tmp/sys_bin_orig
    mkdir /data/local/tmp/sys_bin_overlay
    ./busybox mount -r /dev/block/mtdblock4 /data/local/tmp/sys_bin_orig
    ./busybox ln -s /data/local/tmp/sys_bin_orig/bin/* /data/local/tmp/sys_bin_overlay/
    cat su > /data/local/tmp/sys_bin_overlay/su
    chmod 04755 /data/local/tmp/sys_bin_overlay/su
    ./busybox mount –bind /data/local/tmp/sys_bin_overlay /system/bin

    mount -o remount,rw,nosuid,nodev,relatime -t yaffs2 /dev/block/mtdblock6 /data

    ./busybox umount /system/bin
    rm /data/local/tmp/sys_bin_overlay/*
    rmdir /data/local/tmp/sys_bin_overlay

    Preparing to execute exploit, do chmod
    Executing exploit..
    cmd: /data/data/com.corner23.android.universalandroot/files/getroot /dev/block/mtdblock6 yaffs2
    [*] Android local root exploid (C) The Android Exploid Crew
    [*] Modified by shakalaca for various devices
    [+] Using basedir=/data/data/com.corner23.android.universalandroot/files, path=/data/data/com.corner23.android.universalandroot/files/getroot
    [+] opening NETLINK_KOBJECT_UEVENT socket
    [+] sending add message …
    [*] Try to invoke hotplug now, clicking at the wireless
    [*] settings, plugin USB key etc.
    [*] You succeeded if you find /system/bin/rootshell.
    [*] GUI might hang/restart meanwhile so be patient.
    Wifi enabled …
    /sqlite_stmt_journals/rootshell missing ..
    /app-cache/rootshell missing ..
    /data/local/tmp/rootshell missing ..
    Install/Uninstall rootkit: false
    ls -l /sqlite_stmt_journals
    /sqlite_stmt_journals: No such file or directory
    ls -l /data/local/tmp
    opendir failed, Permission denied
    ls -l /app-cache
    drwxr-xr-x app_70 app_70 2010-09-04 13:44 com.android.browser
    srwxrwxrwx root root 2010-09-04 13:44 iqserver
    run mount
    rootfs / rootfs ro,relatime 0 0
    tmpfs /dev tmpfs rw,relatime,mode=755 0 0
    devpts /dev/pts devpts rw,relatime,mode=600 0 0
    proc /proc proc rw,relatime 0 0
    sysfs /sys sysfs rw,relatime 0 0
    none /acct cgroup rw,relatime,cpuacct 0 0
    tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
    none /dev/cpuctl cgroup rw,relatime,cpu 0 0
    /dev/block/mtdblock4 /system yaffs2 ro,relatime 0 0
    /dev/block/mtdblock6 /data yaffs2 rw,nosuid,nodev,relatime 0 0
    /dev/block/mtdblock5 /cache yaffs2 rw,nosuid,nodev,relatime 0 0
    tmpfs /app-cache tmpfs rw,relatime,size=8192k 0 0
    /dev/block/vold/179:1 /mnt/sdcard vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
    /dev/block/vold/179:1 /mnt/secure/asec vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
    tmpfs /mnt/sdcard/.android_secure tmpfs ro,relatime,size=0k,mode=000 0 0
    /dev/block/dm-0 /mnt/asec/com.glu.android.wsop3-1 vfat ro,dirsync,nosuid,nodev,noexec,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
    run df
    /dev: 212448K total, 0K used, 212448K available (block size 4096)
    /mnt/asec: 212448K total, 0K used, 212448K available (block size 4096)
    /system: 358400K total, 264652K used, 93748K available (block size 4096)
    /data: 437888K total, 165264K used, 272624K available (block size 4096)
    /cache: 163840K total, 3320K used, 160520K available (block size 4096)
    /app-cache: 8192K total, 4K used, 8188K available (block size 4096)
    /mnt/sdcard: 7763968K total, 738752K used, 7025216K available (block size 32768)
    /mnt/asec/com.glu.android.wsop3-1: 20764K total, 19388K used, 1376K available (block size 4096)
    /mnt/secure/asec: Permission denied
    Trying to get mount point:/system/bin
    Go for root !
    Version: Universal Androot – v1.6.2 beta 5
    Detected OS version:8
    ls -l /system/etc
    drwxr-xr-x root root 2010-04-29 01:47 clockwidget
    drwxr-xr-x root root 2010-04-29 01:47 wifi
    -rw-r–r– root root 199 2010-04-29 01:47 TPA2018.csv
    drwxr-xr-x root root 2010-08-02 22:43 firmware
    drwxr-xr-x root root 2010-08-02 22:39 bluez
    -rw-r–r– root root 25 2010-04-29 01:47 hosts
    -rw-r–r– root root 186 2010-04-29 01:47 pvasflocal.cfg
    -rw-r–r– root root 713 2010-04-29 01:47 AudioBTID.csv
    drwxr-xr-x root root 2010-04-29 01:47 wimax
    -rw-r–r– root root 91 2010-04-29 01:47 vo_omx_core.cfg
    -rw-r–r– root root 144 2010-04-29 01:47 bluetoothinfo.conf
    drwxr-xr-x root root 2010-08-02 22:41 dhcpcd
    drwxr-xr-x root root 2010-08-02 22:43 iproute2
    drwxr-xr-x root root 2010-04-29 01:47 ppp
    -rw-r–r– root root 151 2008-08-01 08:00 mm_property.conf
    -rw-r–r– root root 6306 2008-08-01 08:00 media_profiles.xml
    -rw-r–r– root root 6114 2010-08-02 22:41 voicemail-conf.xml
    -rw-r–r– root root 32768 2010-08-02 22:41 voVidDec.dat
    -rw-r–r– root root 459 2008-08-01 08:00 vomeplay.cfg
    -rw-r–r– root root 474 2008-08-01 08:00 vomeCore.cfg
    -r-xr-x— root shell 1200 2010-08-02 22:41 init.goldfish.sh
    -rw-r–r– root root 85 2010-04-29 01:47 01_qcomm_omx.cfg
    -rw-r–r– root root 279 2010-08-02 22:41 gps.conf
    drwxr-xr-x root root 2010-08-02 22:41 security
    -rw-r–r– root root 387 2010-04-29 01:47 spn-conf.xml
    -rw-r–r– root root 63488 2010-04-29 01:47 timezones.db
    -r–r—– bluetooth bluetooth 935 2010-04-29 01:47 dbus.conf
    -rw-r–r– root root 473 2010-04-29 01:47 pvplayer.cfg
    -rw-r–r– root root 3329 2010-04-29 01:47 ser2net.conf
    -rw-r–r– root root 10448 2010-08-02 22:41 event-log-tags
    -rw-r–r– root root 499 2008-08-01 08:00 vomeComp.cfg
    -rw-r–r– root root 613 2008-08-01 08:00 vold.fstab
    drwxr-xr-x root root 2010-08-02 22:43 permissions
    -rw-r–r– root root 0 2010-04-29 01:47 agps_rm
    -rw-r–r– root root 202 2010-04-29 01:47 TPA2018MFG.csv
    -rw-r–r– root root 717 2010-04-29 01:47 iqprofile.pro
    -rw-r–r– root root 1471 2010-08-02 22:41 apns-conf.xml
    -rw-r–r– root root 1050 2008-08-01 08:00 searchabledb.conf
    drwxr-xr-x root root 2010-08-02 22:43 bluetooth
    -rw-r–r– root root 3008536 2010-08-02 22:41 WPDB.zip
    -rw-r–r– root root 63822 2010-08-02 22:41 NOTICE.html.gz
    -rw-r–r– root root 3073 2008-08-01 08:00 AdieHWCodecSetting.csv
    ls -l /system/bin/reboot
    -rwsr-sr-x root shell 5632 2010-08-02 22:41 reboot
    cat /proc/sys/kernel/osrelease
    2.6.32.15-g746f4f0
    getprop ro.product.model
    PC36100
    getprop ro.product.brand
    sprint
    getprop ro.product.name
    htc_supersonic
    getprop ro.product.manufacturer
    HTC
    getprop ro.build.product
    supersonic
    ls -l /sqlite_stmt_journals
    /sqlite_stmt_journals: No such file or directory
    ls -l /data/local/tmp
    opendir failed, Permission denied
    ls -l /app-cache
    drwxr-xr-x app_70 app_70 2010-09-04 13:44 com.android.browser
    srwxrwxrwx root root 2010-09-04 13:44 iqserver
    run mount
    rootfs / rootfs ro,relatime 0 0
    tmpfs /dev tmpfs rw,relatime,mode=755 0 0
    devpts /dev/pts devpts rw,relatime,mode=600 0 0
    proc /proc proc rw,relatime 0 0
    sysfs /sys sysfs rw,relatime 0 0
    none /acct cgroup rw,relatime,cpuacct 0 0
    tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
    none /dev/cpuctl cgroup rw,relatime,cpu 0 0
    /dev/block/mtdblock4 /system yaffs2 ro,relatime 0 0
    /dev/block/mtdblock6 /data yaffs2 rw,nosuid,nodev,relatime 0 0
    /dev/block/mtdblock5 /cache yaffs2 rw,nosuid,nodev,relatime 0 0
    tmpfs /app-cache tmpfs rw,relatime,size=8192k 0 0
    /dev/block/vold/179:1 /mnt/sdcard vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
    /dev/block/vold/179:1 /mnt/secure/asec vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
    tmpfs /mnt/sdcard/.android_secure tmpfs ro,relatime,size=0k,mode=000 0 0
    /dev/block/dm-0 /mnt/asec/com.glu.android.wsop3-1 vfat ro,dirsync,nosuid,nodev,noexec,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
    run df
    /dev: 212448K total, 0K used, 212448K available (block size 4096)
    /mnt/asec: 212448K total, 0K used, 212448K available (block size 4096)
    /system: 358400K total, 264652K used, 93748K available (block size 4096)
    /data: 437888K total, 165264K used, 272624K available (block size 4096)
    /cache: 163840K total, 3320K used, 160520K available (block size 4096)
    /app-cache: 8192K total, 4K used, 8188K available (block size 4096)
    /mnt/sdcard: 7763968K total, 738752K used, 7025216K available (block size 32768)
    /mnt/asec/com.glu.android.wsop3-1: 20764K total, 19388K used, 1376K available (block size 4096)
    /mnt/secure/asec: Permission denied
    Preparing Exploit … :true
    Preparing busybox binary … :true
    User selected: Not install
    Preparing Su binary … :true
    Preparing root toolkit script … :true
    Trying to get mount point:/data
    /dev/block/mtdblock6 /data yaffs2 rw,nosuid,nodev,relatime 0 0
    Trying to get mount point:/system
    /dev/block/mtdblock4 /system yaffs2 ro,relatime 0 0
    mount -o remount,rw -t yaffs2 /dev/block/mtdblock4 /system
    mkdir /system/xbin
    cat su > /system/xbin/su
    chmod 04755 /system/xbin/su
    ln -s /system/xbin/su /system/bin/su

    mount -o remount,ro -t yaffs2 /dev/block/mtdblock4 /system
    mount -o remount,rw,nosuid,nodev,relatime -t yaffs2 /dev/block/mtdblock6 /data

    mount -o remount,rw -t yaffs2 /dev/block/mtdblock4 /system
    rm /system/bin/su
    rm /system/xbin/su

    Preparing to execute exploit, do chmod
    Executing exploit..
    cmd: /data/data/com.corner23.android.universalandroot/files/getroot /dev/block/mtdblock6 yaffs2
    [*] Android local root exploid (C) The Android Exploid Crew
    [*] Modified by shakalaca for various devices
    [+] Using basedir=/data/data/com.corner23.android.universalandroot/files, path=/data/data/com.corner23.android.universalandroot/files/getroot
    [+] opening NETLINK_KOBJECT_UEVENT socket
    [+] sending add message …
    [*] Try to invoke hotplug now, clicking at the wireless
    [*] settings, plugin USB key etc.
    [*] You succeeded if you find /system/bin/rootshell.
    [*] GUI might hang/restart meanwhile so be patient.
    Wifi disabled …
    /sqlite_stmt_journals/rootshell missing ..
    /app-cache/rootshell missing ..
    /data/local/tmp/rootshell missing ..
    Install/Uninstall rootkit: false
    ls -l /sqlite_stmt_journals
    /sqlite_stmt_journals: No such file or directory
    ls -l /data/local/tmp
    opendir failed, Permission denied
    ls -l /app-cache
    drwxr-xr-x app_70 app_70 2010-09-04 13:44 com.android.browser
    srwxrwxrwx root root 2010-09-04 13:44 iqserver
    run mount
    rootfs / rootfs ro,relatime 0 0
    tmpfs /dev tmpfs rw,relatime,mode=755 0 0
    devpts /dev/pts devpts rw,relatime,mode=600 0 0
    proc /proc proc rw,relatime 0 0
    sysfs /sys sysfs rw,relatime 0 0
    none /acct cgroup rw,relatime,cpuacct 0 0
    tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
    none /dev/cpuctl cgroup rw,relatime,cpu 0 0
    /dev/block/mtdblock4 /system yaffs2 ro,relatime 0 0
    /dev/block/mtdblock6 /data yaffs2 rw,nosuid,nodev,relatime 0 0
    /dev/block/mtdblock5 /cache yaffs2 rw,nosuid,nodev,relatime 0 0
    tmpfs /app-cache tmpfs rw,relatime,size=8192k 0 0
    /dev/block/vold/179:1 /mnt/sdcard vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
    /dev/block/vold/179:1 /mnt/secure/asec vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
    tmpfs /mnt/sdcard/.android_secure tmpfs ro,relatime,size=0k,mode=000 0 0
    /dev/block/dm-0 /mnt/asec/com.glu.android.wsop3-1 vfat ro,dirsync,nosuid,nodev,noexec,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
    run df
    /dev: 212448K total, 0K used, 212448K available (block size 4096)
    /mnt/asec: 212448K total, 0K used, 212448K available (block size 4096)
    /system: 358400K total, 264652K used, 93748K available (block size 4096)
    /data: 437888K total, 165264K used, 272624K available (block size 4096)
    /cache: 163840K total, 3320K used, 160520K available (block size 4096)
    /app-cache: 8192K total, 4K used, 8188K available (block size 4096)
    /mnt/sdcard: 7763968K total, 738752K used, 7025216K available (block size 32768)
    /mnt/asec/com.glu.android.wsop3-1: 20764K total, 19388K used, 1376K available (block size 4096)
    /mnt/secure/asec: Permission denied

  47. M. Verro says:
    September 5, 2010 at 1:50 pm

    Does not support Moto droid 2.2 FRG22 had root but installed ota last night should’ve read up on it 1st

  48. ray says:
    November 17, 2011 at 5:51 pm

    It wont work for my captivate so tell me how

« Older Comments

Leave a Reply