Database Users

Step by Step for Rooting Rogers Captivate (I896)

Hey Guys
So one of the biggest questions I have seen in the last couple weeks since the Rogers captivate was released is how to root. I figured I would write a nice tutorial for everyone to make it easier!
Method 1: SuperOneClick
This is the easiest way, however most people have not been able to achieve root using this. Try this first if no luck move to method 2. Instructions on how to root using SuperOneClick can be found here
Method 2: Manual Root using ADB and Terminal
This one takes more time and not as easy to do as you have to do everything manually. But haven't heard of any problems with it yet
Step 1: Install <PDANet> Drivers. Just download the file and install. Select Samsung drivers. No need to actually install PDAnet on the Captivate you just need the drivers from the install. Follow the instructions with the installer to properly install the drivers.
Step 2: Download <Andriod SDK>.
- Extract the Android SDK .Zip file to C:\AndroidSDK (this should name the new folder created AndroidSDK in the C directory.
- Go to your start menu and search cmd or click run and type in cmd to open command prompt
- Type the following into command prompt, hitting enter at the end of each line
cd C:\AndroidSKD\Tools
adb devices
- You should see a serial number pop up. This is the serial number of your phone. This means ADB is set up
Step 3: Download <RageagainsttheCage Rooting Files>
- Extract them to the c:\AndroidSDK\tools\ folder. HAS TO BE IN THIS FOLDER FOR THE FOLLOWING COMMANDS TO WORK
Step 4: Unplug phone if it is plugged in. Then, on the phone, go to Settings > Applications > Development and make sure USB Debugging is Checked ON.
Step 5: Plug phone back in to computer. Make sure SD are not mounted
Step 6: Reopen Command prompt if not open. In the command prompt enter the following, pressing enter at the end of each line
cd c:\androidsdk\tools\
adb devices
adb push Superuser.apk /sdcard/
adb push su /sdcard/
adb push rageagainstthecage-arm5.bin /data/local/tmp/
adb shell chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
Step 7: On the phone, go to Marketplace and download Terminal Emulator
Step 8: Leaving the phone plugged in, open the Terminal Emulator on the phone. Type the following, pressing enter at the end of each line
cd /data/local/tmp
./rageagainstthecage-arm5.bin
Step 9: WAIT. It will take a full minutes for the rage root to install. When finished you will see "Forked Childs". DO NOT DO ANYTHING TILL YOU SEE THIS. Terminal will allow you to type as it goes back to $ while it is installing BUUT DO NOT DO ANYTHING JUST WAIT(Cannot stress this enough)
Step 10: once "Forked Childs" appears, exit the Terminal App, and then reopen it. Instead of $ you should now see #. If not redo Step 7. Otherwise continue.
Step 11: Type the following hitting enter at the end
cat /proc/mounts
This should bring up a list (Easiest to view in landscape mode. Look for the following
/dev/block/XXXXXXXXXX /system YYYY ro 0 0 (the XXXXXXXXX part should be different depending on which device you have. The YYYY part will either be; ext2, ext3 or yaffs2 or something similar. )
My YYYY was rtf , not sure if it will be the same for everyone (though i assume it is)
Step 12: Now in the terminal window, using the info from above, enter the following, hitting enter at the end of each line (Be sure to enter spaces where needed as below)
mount -o rw,remount -t YYYY /dev/block/XXXXXXXXXX /system
cat /sdcard/Superuser.apk > /system/app/Superuser.apk
cat /sdcard/su > /system/bin/su
chmod 4755 /system/bin/su
mount -o ro,remount -t YYYY /dev/block/XXXXXXXXXX /system
exit
Step 13: Close terminal window if still open. Check your app drawer and, assuming everything was completed properly, you should see Superuser. If not redo Step 12, again watching for spaces and using the correct info from Step 11.
ACKNOWLEDGEMENTS
I, in no way shape or form, came up with the above method or tools. This method was modified from and composed from the method decribed over at Theunlockr.com for ease of use and to root the Captivate specifically. I big thanks go out to those guys!
ORINGAL LINK CAN BE FOUND HERE
WARNING
I am not responsible for any damage doone to the phone or its file system as a result of this tutorial. It is for educational purposes only. You have been warned!

THANK YOU!
No other method was working for me (not SuperOneClick, not these ADB instructions). Sure enough, using Terminal Emulator, I was able to get #. I wasn't able get this through adb, nor was I through SuperOneClick (infinite loop @ "mount" command).
I noticed a few things:
-When I compared filesizes from your provided Rage Root files, to the ones that were included in this thread (which also come with SuperOneClick—and which I was unable to get working), I noticed major differences. This gave me hope!, as I'd tried everything else that I knew how to prior to this point.
-My "XXXXXXXXXX" was actually only 4 characters: "stl6".
-My "YYYY" was only 3 characters ("rfs").
-SuperUser showed up on my applist without even requiring a reboot.
THANKS AGAIN
I shall now attempt to apply a lagfix; I will report back with results.
--Bah: no luck. RyanZA's OCLF V2.2+ returns error:
Could not mount /dev/block/mmcblk0p2 onto /dbdata/rfsdata: mount: No such file or directory
--OCLF V1+ returns error:
Could not create /data/linux.ex2 - dd: can't open '/data/linux.ex2': Permission denied
Uh-oh.

PhrProfess said:
THANK YOU!
No other method was working for me (not SuperOneClick, not ). Sure enough, using Terminal Emulator, I was able to get #. I wasn't able get this through adb, nor was I through SuperOneClick (infinite loop @ "mount" command).
I noticed a few things:
-When I compared filesizes from your provided Rage Root files, to the ones that were included in this thread[/url] (which also come with SuperOneClick—and which I was unable to get working), I noticed major differences. This gave me hope!, as I'd tried everything else that I knew how to prior to this point.
-My "XXXXXXXXXX" was actually only 4 characters: "stl6".
-My "YYYY" was only 3 characters ("rfs").
-SuperUser showed up on my applist without even requiring a reboot.
THANKS AGAIN
I shall now attempt to apply a lagfix; I will report back with results.
--Bah: no luck. RyanZA's OCLF V2.2+ returns error:
Could not mount /dev/block/mmcblk0p2 onto /dbdata/rfsdata: mount: No such file or directory
--OCLF V1+ returns error:
Could not create /data/linux.ex2 - dd: can't open '/data/linux.ex2': Permission denied
Uh-oh.
Click to expand...
Click to collapse
Yup same problem here. I was able to root it manually a few days ago, but have as of yet been unable to lag fix it.

Strange. After I rooted I had no problem using RyanZa's Lagfix. Your still using the stock rom after rooted correct?

deacfire said:
Strange. After I rooted I had no problem using RyanZa's Lagfix. Your still using the stock rom after rooted correct?
Click to expand...
Click to collapse
Correct. I've tested out quite a few apps from the market, though.
When I mount my device, I notice that there are some files on my internal SDCard:
-su
-Superuser.apk
-nv_data.bin
-busybox (why is this there, I uninstalled that)
-update.zip
...and some folders:
-layar
-twc-cache
-Android -» data -» com.cooliris.media
-Android -» data -» com.google.android.apps.maps
-svox
...These all have subdirectories.
Not knowing what a default internal SD directory ought to look like, I wonder: Could any of these be causing a conflict? I read that some said not to have any apps installed on the SDCard while trying to mess around (with ROMs, I think), so I tried removing what I could, and then rebooting (and some folders respawned), and reapplying the fix—no dice. I've since replaced all of the folders and the files.

Stock rom here as well.

Hrmm not quite sure why lag fix isn't working for you guys. Just a quick question, in RyanZa One Click, is "Un-Root Device" green?
I still have no problems applying RyanZa Lag Fix to my Captivate as I had to redo it last night after i switched back to the Rogers stock rom after testing Cog 2.2. My guess, and it is just a guess, is that the root never applied properly. Have you tried rerooting the device?

deacfire said:
Hrmm not quite sure why lag fix isn't working for you guys. Just a quick question, in RyanZa One Click, is "Un-Root Device" green?
I still have no problems applying RyanZa Lag Fix to my Captivate as I had to redo it last night after i switched back to the Rogers stock rom after testing Cog 2.2. My guess, and it is just a guess, is that the root never applied properly. Have you tried rerooting the device?
Click to expand...
Click to collapse
Thought I might give you some info as well since i've been messing with mine for about a week now. I was able to root the device, oneclick did not work originally for this and I used ADB method similar to what you had here. After this I went for the lag fix, everything was green like it was supposed to be, installed the ext2 tools no problem and then get the same error about unable to mount when applying lag fix.
At this point I used OCLF to unroot the device and it did, I then used the oneclick to re-root which it did this time, in terminal I can su properly and again all the tools are green in OCLF. Tried to lagfix and failed again so I started making some changes manually based on the error messages that were out put. Created the folder it was trying to mount to for instance and then set the permission to this to 777 that would allow world write access, this allowed it to create the new partition in ext2 but when mounting the loopback device it fails saying it doesn't exist (which it doesn't I looked) so while I did get a bit further the lag fix still fails. I would gladly apply the lag fix manually through the terminal if I knew everything that was being done to re-format the partitions for ext3 but I can't seem to find that info anywhere.
Next best thing I would guess is to install a stock rom from rogers from someone else and see if there are any differences, I'm guessing based on the devices in the /dev folder that there are more then one image on the devices some set up more similar to AT&T that the lag fix will work on.

mrprefect said:
Thought I might give you some info as well since i've been messing with mine for about a week now. I was able to root the device, oneclick did not work originally for this and I used ADB method similar to what you had here. After this I went for the lag fix, everything was green like it was supposed to be, installed the ext2 tools no problem and then get the same error about unable to mount when applying lag fix.
At this point I used OCLF to unroot the device and it did, I then used the oneclick to re-root which it did this time, in terminal I can su properly and again all the tools are green in OCLF. Tried to lagfix and failed again so I started making some changes manually based on the error messages that were out put. Created the folder it was trying to mount to for instance and then set the permission to this to 777 that would allow world write access, this allowed it to create the new partition in ext2 but when mounting the loopback device it fails saying it doesn't exist (which it doesn't I looked) so while I did get a bit further the lag fix still fails. I would gladly apply the lag fix manually through the terminal if I knew everything that was being done to re-format the partitions for ext3 but I can't seem to find that info anywhere.
Next best thing I would guess is to install a stock rom from rogers from someone else and see if there are any differences, I'm guessing based on the devices in the /dev folder that there are more then one image on the devices some set up more similar to AT&T that the lag fix will work on.
Click to expand...
Click to collapse
Try the stock rom in the main Rogers Captivate forum. It is one i used to go from Cog 2.2 back to stock and it applied the root and lag fix without a hitch. Give it a try and let us know!

deacfire said:
Try the stock rom in the main Rogers Captivate forum. It is one i used to go from Cog 2.2 back to stock and it applied the root and lag fix without a hitch. Give it a try and let us know!
Click to expand...
Click to collapse
Happen to have a link right to the forum? so many threads to search through...
I'm new to the whole android thing though I've been working with linux for years but its a bit of a learning curve coming from a blackberry.
also what are you using to flash your device?

I'm having the same problem. Let me know if you somehow fix it.
Sent from my SAMSUNG-SGH-I896 using XDA App

I was finally able to get my last night.
Turns out my first root attempt was a failure. I had to unroot via an update.zip method as i did not have the permissions to remove the files from terminal.
Once unrooted i then did the update.zip method for the I897, and modified the script to look for I896 instead. It worked flawlessley. I am now getting the pop-up asking for root permissions. I had never seen it work previously.
I was then able to install OCLF without any problems. (and it popped up asking for root)
I am now rooted and lag fixed. Previous quadrant score was at 860's and i pulled a 2285 last night after the OCLF.

Can you please tell us how to modify script and how to flash back to stock..I need to return my phone and superuse app wont go away after unrooting and factory reset

inningsdefeat500 said:
Can you please tell us how to modify script and how to flash back to stock..I need to return my phone and superuser app wont go away after unrooting and factory reset
Click to expand...
Click to collapse
Well i cannot help you flash back to stock as i don't quite know how to do that yet myself. But i can help you unroot, re-root, and lag fix.
I have found the files again and uploaded them to rapid share with the necessary modifications.
Download THIS FILE and once downloaded, rename it to update.zip Be careful not to name it update.zip.zip by accident.
Place the file into the root of your sdcard.
Shutdown the phone with the power button, or pull the battery out and put it back in.
Enter recovery mode:
While holding the volume up and volume down buttons press and hold the power button until you see the white text that says SGH-I896, then release the power button only.
When in recovery mode use the volume down key to highlight reinstall packages, then press the power button. It should say completed and reboot the phone.
Once the phone has rebooted, do the exact same thing again, only use THIS FILE instead. Dont forget to rename the file again!
Then install the OCLF from market. Install the EXT2 tools first. Then run the lag fix installer.
I assume you already know how to enter recovery mode, but this way someone else searching for a fix will have all the info at their disposal here.
EDIT!!!
Some mirrors for the files
For the UN-Root files go HERE
For the ROOT files go HERE

Hi all i am very lost here....i have tried for hours the last few days on how to root this i896 with the super one click method with no luck....anyways i was speaking to my brother earlier and he has done it with his bell vibrant no problem....anyways what i want to know is what is the purpose of rootindg the phone? I thought it was for downloading 3rd party apps or whats the purpose for superuser? The reason why i am asking is that i can download 3rd party apps already...i allow them on my application settings and download a app downloader and works fine? Im lost someone please help.
Sent from my SAMSUNG-SGH-I896 using XDA App

dandroid123 said:
Hi all i am very lost here....i have tried for hours the last few days on how to root this i896 with the super one click method with no luck....anyways i was speaking to my brother earlier and he has done it with his bell vibrant no problem....anyways what i want to know is what is the purpose of rootindg the phone? I thought it was for downloading 3rd party apps or whats the purpose for superuser? The reason why i am asking is that i can download 3rd party apps already...i allow them on my application settings and download a app downloader and works fine? Im lost someone please help.
Sent from my SAMSUNG-SGH-I896 using XDA App
Click to expand...
Click to collapse
Take a look here. It answered alot of my questions.
http://www.androidcentral.com/rooting-it-me-some-qa
Also, if you only follow the second half of my post above you should be able to root it as well.

Thanks deacfire! The one click wouldn't work for me but the second method did.
I am having a really annoying problem though. The superuser.apk that you included just gave me a black screen. So I updated it to this one: http://forum.xda-developers.com/showthread.php?t=682828&highlight=no+apps+in+list
Which is newer. But now it just says "no apps in list". Tried installing it from the zip, tried from the market no different.
I do have apps that require superuser: ROM Manager, Root Explorer, Adfree. They all work, also have titanium backup but its is telling me it needs root access.
How can I fix this, it is a major issue.
EDIT:Thanks impulser91!! That work and was SUPER easy! Should probably get posted in the original post.

when i copy update.zip into the /sdcard and then try hitting reinstall packages, it results in an error and aborts. any suggestions?
Nevermind....it worked MUAHAHAHAHAHAH LET THE FUN BEGIN!

Sweet, 2 users. Not bad for under 10 posts
I'm glad its working for others. I had one heck of a time finding the right combination of files and process's for the I896. I am an IT professional and it took me a few days of fumbling around all the I896 and I897 posts.
Anyways, glad to hear it worked, and i hope other people find it useful as well. I will keep the originals, so if the links go down someone just PM me and i will load them somewhere else.

impulser91 said:
Well i cannot help you flash back to stock as i don't quite know how to do that yet myself. But i can help you unroot, re-root, and lag fix.
I have found the files again and uploaded them to rapid share with the necessary modifications.
Download and once downloaded, rename it to update.zip Be careful not to name it update.zip.zip by accident.
Place the file into the root of your sdcard.
Shutdown the phone with the power button, or pull the battery out and put it back in.
Enter recovery mode:
While holding the volume up and volume down buttons press and hold the power button until you see the white text that says SGH-I896, then release the power button only.
When in recovery mode use the volume down key to highlight reinstall packages, then press the power button. It should say completed and reboot the phone.
Once the phone has rebooted, do the exact same thing again, only use THIS FILE instead. Dont forget to rename the file again!
Then install the OCLF from market. Install the EXT2 tools first. Then run the lag fix installer.
I assume you already know how to enter recovery mode, but this way someone else searching for a fix will have all the info at their disposal here.
Click to expand...
Click to collapse
I could just about kiss you.... but I won't
Thanks for the update files they worked like a charm. I had a similar issue where the device didn't seem to be properly rooted, though it didn't give me any issues with most things when applying the lagfix it would die.
applied both your unroot and then root and it worked flawlessly the first time, lagfix then ran with no issues and my quadrant scores are 2250 now.
Not sure what you did exactly, I've tried rooting from update.zip from oneclick and neither worked I ended up rooting with the ADB and though it seemed to work it apparently did not.
Thanks again

VERY very long shot...

Hi all,
Love my HTC Desire so much i bought a Witstech A81E Android 2.2 Tablet. Which is pretty buggy to say the least though on the whole works well.
The one thing that is driving me crazy is a number of apps dont install with the logcat error:
"packagename.apk requires unavailable shared library com.google.android.maps"
Now from what i have read apparently this device does not come with Google Maps API so my question is how do i add it?
Can it be done? Do i need to modify a ROM to do it? can i push it via adb or apk?
A little help would be greatly appreciated.

It would need to have google apps installed to be able to access the libraries. Best bet is to find out if it has been rooted yet and try to install the proprietary applications they can't ship the device with.

appreciate the help mate. i've rooted the device though where can i find google maps api?
the unit already has google maps 5.0 installed but apparently doesnt have the API's.
Any idea what im looking for? will it be an APK or just some files i need to put in a system folder?
i think im over my head

additionally i have searched for any com.google.android.maps related data on my desire and have found the following:
/system/framework/com.google.android.maps.jar
/system/etc/permissions/com.google.android.maps.xml
/etc/permissions/com.google.android.maps.xml
/data/dalvik-cache/[email protected]@[email protected]
could it be as easy as copying this over to my tablet?
Ill try it out tonight.

If the application is installed correctly it should work because the api is stored in the data. Is the application on the tablet installed to the /system/ or /data/ partition. It might be looking for the data in /system/

not sure what you mean about where the application resides? you mean the app i am trying to install? The app i am trying to install is Tasker.
i have been doing some googling and saw someone else have the same problem and he managed to fix it:
When trying to install some apps, I would see this error message in logcat:
requires unavailable shared library com.google.android.maps
I had the Google Maps app installed and working, but that didn’t fix the issue. It turns out, I had to add two other files and restart the phone. I found those files in the google zip from Cyanogenmod. It took a little fiddling, but I was able to use these instructions to remount /system in write mode. First step was to take the following two files from the google apps zip (gapps-hdpi-20101114-signed.zip) and put them onto my sd card.
/system/etc/permissions/com.google.android.maps.xml
/system/framework/com.google.android.maps.jar
Then to load them onto the phone, I opened the terminal emulator and ran:
su
mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system
cp /mnt/sdcard/com.google.android.maps.xml /system/etc/permissions/
cp /mnt/sdcard/com.google.android.maps.jar /system/framework/
Then after I rebooted the phone, I was able to install apps that depend on Google Maps. I can now check bus and train times, and do all kinds of other cool stuff with maps!
Click to expand...
Click to collapse
i simply used root explorer to copy it across though still not working. surely someone smarter than me can tell me what i am doing wrong.
is copying with root explorer essentially the same as above?

damn i could have sworn someone here would have been switched on enough to help me on this
oh well back to random googling for me.

Well did you try using terminal emulator? And do what he did? B/c that looks like a remount to system to me easy as pie just do what he did you can find the files with root explorer or do it on your pc doesnt really matter. You can Not achieve what he did just using root explorer you need terminal emulator!

Sage said:
damn i could have sworn someone here would have been switched on enough to help me on this
oh well back to random googling for me.
Click to expand...
Click to collapse
I don't know how much it will help (or if its 100 percent true) but I was just told recently that moving a file via root explorer is the same as pushing it via adb.
sent from gv1.5 on g2

^correct
Sent from Enrique Iglesias.

now i am confused. can i use root explorer or not? i used root explorer and then reset the correct permissions on the files though its still not working.
I take it i can get a terminal emulator that runs on the device itself yeah?
Ill try that next.
If that fails i am going to try my first attempt at cooking a ROM
Appreciate all the help!

no more love for Sage?
i dont know why its so hard..
I did try to cook the original ROM though unyaffs couldnt extract the img.
looks like i might have to boot up a Virtual nix box.. damn this is so much harder than it should be.

Alternative thoughts on preventing OTA update

I don't think I have seen any mention of this idea yet. Sorry if I missed it...
In a recent thread about the 6.2.2 update and people wanting to prevent it, I thought I read that someone saw the file show up in the update directory. I'm assuming this means the same 'kindleupdates' directory you could manually drop the update into -- but if not, the idea is the same. Why not just take some step to prevent access to this directory?
The exact step to take would depend on how smart the developers were about dealing with problems in the update process
The easiest step would be to chmod 555 it. But of course if the update process is running as root it is under no requirement to honor those permissions! (My experience in the unix world tells me that about half the time, programs running as root do honor the permissions even though technically root overrides them).
Another easy step would be to delete it altogether. But they probably thought of that (if it's /mnt/sdcard/kindleupdates where someone could easily accidentally delete it) and recreate it if it's missing.
One trick that is often done is to replace the directory with a file. Some programmers do not think to check this kind of condition - they see there is something there, but they get an error opening it as a directory, and they just declare it's an error.
A more subtle trick would be to replace the directory with a symlink that points to a read-only directory (such as /system). In this case, they could open it as a directory, and just fail to write there. The programmer probably would not have thought to check whether it's a link vs. a real directory. One possible gotcha is if you point to /system, and /system is r/w, then the update could screw something up under /system. So maybe mount /system r/w, mkdir /system/kindleupdates, remount /system r/o, then link the update dir to /system/kindleupdates.
And finally, I don't know if Android has any kind of loopback filesystem capability, but loopback-mounting something read/only on that directory would certainly fake the OS into thinking there was a directory there; it would definitely be read/only, and I don't think they would ever think to check whether there is actually some filesystem mounted there! (and if there was, all you need is an app that constantly accesses some file you put there, which would make it busy so that it couldn't be unmounted).

The first method won't work because the sdcard partition is fat32 and doesn't accept unix permissions.

it downloads to the /cache folder - this folder is also used for other things like market downloads, logs from twrp and i don't know what else
btw. there are a lot of threads about this from the 6.2.1 update
make a short search for "prevent ota update" - you'll have a lot to read ...

well, i just deregistered my kindle acount and i'm still in 6.2.1...

b63 said:
it downloads to the /cache folder - this folder is also used for other things like market downloads, logs from twrp and i don't know what else
Click to expand...
Click to collapse
Ah, that makes this less practical. Still, perhaps when the next update comes out I can try a variation on this but it requires the filename to be known.
If the update is downloaded as a single file to /cache, which is named the same as the file you can manually grab, then someone who hasn't gotten 6.2.2 (and is not averse to this failing) can try this in a root shell:
mkdir /cache/update-kindle-6.2.2_D01E_3205220.bin
mkdir /cache/update-kindle-6.2.2_D01E_3205220.bin/blah
The purpose here is to put something unremovable in the way of the file it wants to download. Most likely if the update sees something with the existing name there it would probably want to blow it away (after determining it's incomplete) - and since any update there would normally be a regular file, they probably would do nothing more complicated than a simple unlink syscall to delete it before re-downloading. However, since it's a directory with something in it, that unlink will fail. In actuality, making the subdirectory (second command above) should be unnecessary because the unlink should not work for directories; there's a special rmdir syscall for them.
btw. there are a lot of threads about this from the 6.2.1 update
make a short search for "prevent ota update" - you'll have a lot to read ...
Click to expand...
Click to collapse
I did read a lot of that last time and I don't think I actually saw a definitively successful method. If there is one it should be stickied
My interest in this is a little different from most of you guys - I have very limited satellite internet and I don't like these unscheduled 185-meg downloads so I want to be able to update only when I want mostly to control that. This kind of means looking for the least-intrusive way to accomplish this.

/cache/update-kindle-6.2.2_D01E_3205220.bin is exactly where it downloads
if you find a way to even prevent the download, that would be greatly appreciated

Unfortunately I already got the update so I can't try it this time.

at least you could try your method with a dummy file of an other name and try to overwrite it with adb - if you can't overwrite it there's a good chance

I think I'm about the only one who prevented 6.2.1. I did it by constantly checking the cache folder. Found the update by chance and deleted it before it updated. Waited over a week for it to come back. Never did. An app that watched the cache folder for the updates and then moved/deleted them would work fine
Sent from my SGH-I897 using xda premium

jcase already work a way around this automatic OTA update, so when FIREMOD is ready to replace burrito I think we will have no more problem with this OTA issue. (you can find jcase announcement in the kindle developer section)

Heres what I have done to prevent this.
1) Droidwall (white list only the apps you want to allow internet access)
2) Removed "otacerts.zip" from /system/etc/security/otacerts.zip.
3) I removed "OTASilentInstall.apk" /system/app
4) Installed this 6.2.2 based Rom http://forum.xda-developers.com/showthread.php?t=1439916
Hopefully this eliminates the OTA. I had my Fire rooted on 6.2.1 with twrp and it OTA'd on its own, broke root and twrp. So I rerooted with burritoroot2 and installed CWM based recovery.

(OUTDATED) Nook HD+ root, modified 2/15/13 RIP

THIS METHOD IS NO LONGER WORKS as of update version 2.0.5 and higher.
Please visit this thread instead for the current rooting method.
Posting in this thread will get you nowhere, let it RIP.
ANNOUNCEMENT:
If you have a new Nook HD/HD+ and want to root and get the GAPPS running, you should follow the guide at the All-in-One thread instead. That said, I won't copy all the information here to there, so you should continue to read on.
Let me start by saying that I didn't come up with the working root method. The original root instruction came from verygreen in this thread. And I am not a developer, I merely have a few linux background and even less so in the Android. I worked on this on my spare time by myself.
I merely take what was working, but unusable to make it usable. I found something that he is missed. This may actually be working on Nook HD (non-plus) also, but since I don't own one I can't say that it will.
Disclaimer:
If something gone wrong, it's all your fault. I take ZERO responsibility for what happen to your device, your life, your wife/husband, your kids, your unborn child and etc. You get the idea.
Background:
When I found out the root doesn't actually work past a reboot, I start looking what actually cause the Nook to be pissed and factory reset itself. Well, it seem that the /system and anything in there is basically coming from a /dev/block/mmcblk0p8 And if something got change, Nook get pissed and do a FULL FACTORY RESET(I'll explain in a moment). Well, at least I start investigated under that idea.
What I found:
What I found, or at least what I think I found is that, probably just adding file, or increase in the size(maybe there is a threshold for this), will cause it to do a full factory reset. What I also found is that there is a $PATH for /system/sbin but not pointing to anywhere. So I come up with the idea of making another ext4 file system in a file and loop mount it to /system/sbin I guess that work(very well). What I also found is that, there are two kind of factory resets. The one that you perform yourself, which is actually not a full factory reset and the one that Nook get pissed and do the full one.
A factory reset that you perform yourself, whether from the GUI or button combination will basically clean the partition /data while a full blown one will basically restore other partition such as /system
What is included:
basically a zip file, inside that zip file are 6 files.
boot_complete_hook.sh.bak this is basically a modified version of verygreen's
busybox & su are basically from his thread
superuser.apk well I found this one floating around and seem like a good idea to stick it in there (not even sure if it gonna work w/ Nook)
makeroot.bat this is basically what do most of the work. It's base on verygreen original rooting instruction.
sbin_mount This is basically an ext4 file system which have su and another version of busybox all setup nice and tidy for you all. This version of busybox is 1.20.2r2 which I grabbed from here.
Prerequisite:
ADB, it's your responsibility to have adb up and running, meaning not just have it install, but it can see your nook also.
leapinlar wrote a post to help you getting ADB to work here.
Now to get root:
all you have to do is unzip it and run makeroot.bat (obviously you run this in windows command prompt). Yub that's all. The batch file will do the rest, including reboot the nook and wait for it to reboot and stuff. Won't make a coffee for you though.
The manual and hard way:
well, I will only explain this in a summarize way. Basically this start with verygreen rooting method. It basically take advantage of the exploit and run /data/boot_complete_hook.sh which you adb push yourself(with correct permission) with root privilege. What you can run in there is basically up to your creativity. So obviously in this case, you mount the sbin_mount as an ext4 filesystem in the /system/sbin You can make this file yourself if you want to, in linux using dd and mkfs command. Basically using dd to create a file volume to the size you want and mkfs to format it to ext4. Mount it and start uploading stuff you want in there. You will have to correct all the file permission as well. Since all of this will be mounted to /system/sbin you should be aware what you gonna put in there. I guess I could make this thing 100MB, but for this specific purpose 10MB is enough. I my case, just the su and busybox and the symbolic links for the busybox. I'm doing this for the long term. I'm too lazy to point to busybox everytime I wanna do something.
What to do afterward:
Now that you have root, you can Enable Unknown Source to allow you to install app from within the device and install GAPPS. Follow the two guides below if you interested.
Enable Unknown Source: Again, I make an easy little tool for you here.
GAPPS: here.
Did I missed something:
Well, as I said I'm no coder so if I didn't do a clean job, you can refine it. If I didn't document or give proper credit, then I guess I missed that. Sorry about that, again I'm no coder and never done this. And finally:
If this thing work for you, feel free to hit that "THANKS" button. I spent many hours trying to come up with this solution.
FAQ:
Q: My so and so application when attempting to have root access get freeze up, or superuser doesn't work?
A: Well, I'm not sure if this is dued to how the Nook side-loading work or not, but it seem for some reason superuser won't start by itself. So you have to start it manually the first time.
Q: I type in "adb root" and I can't get in as root, it doesn't work?
A: yes it does, it's just not working with adb root. You can get in via "adb shell" once you get in, type in "su" and you can see that you now should have root access.

Thank you so much! This works perfectly. Survives reboot.

here's the Linux version.
Thanks someone0 for getting this started.
Haven't fully tested the linux version, but it loads and starts up, so should work.
extract, and open up terminal and navigate to the dir you extracted to, and type
./makeroot.sh and then enter.

This sounds like a good idea initially.
It is true that the B&N does not just check for /system/xbin/su directly like they did in the past.
This time they check for something else and I just had no time to look into it more deeply to find out what is it they are actually checking for. I plan to figure this out on Friday when I am back home.
Also wanted to tell you that having Linux background is a great thing when tinkering with Android (at a low level, anyway). I don't have much Android background to speak of as well.

This works really well, and thanks to Someone (and mad props too) for getting persistent root working on this.
I may be being very naive, but my suspicion on the reboot is around the manifest file that's present at root.
It seems to be generated by the boot process and it might provide a quick and dirty list of what's permitted on the device to check. With persistent root, lots of investigation becomes a lot less painful. I expect that by end of day we'll have install unsigned running.
Early in my experimenting with the HD+, I noted:
- some versions of the Google Services Framework can be installed via adb
- when I launched the native calendar app after installing gsf, it wanted to sync to a google account, and was able to add the google account
- one version of the Play store installed and launched as far as throwing the 'you must accept the terms of service' before crashing

What BN most likely does is calculating the hash value (or digest, if you prefer) of certain system files that they think shouldn't be tampered with, then during reboot, the values of these files must match, or they will do a factory reset.
The key point is to find out where they do these checks and fool the check.
This sound simple but it depends on how they implement it. If they use binary decisions (like if the hash_value == calculated), then it is easy to get around. If not (e.g. using white box algorithm to hide keys), then it get more complicated.

excellent and very elegant solution. Kudos!

I'm heading out to work, and if you think your theory is right, try poking around with it. Now that your have root, you can try to dd those bootloading partitions out to user area and upload them out to PC and inspect them.
looking at the vold.fstab
Code:
xloader -> /dev/block/mmcblk0p1
bootloader -> /dev/block/mmcblk0p2
recovery -> /dev/block/mmcblk0p3
boot -> /dev/block/mmcblk0p4
rom -> /dev/block/mmcblk0p5
bootdata -> /dev/block/mmcblk0p6
factory -> /dev/block/mmcblk0p7
system -> /dev/block/mmcblk0p8
cache -> /dev/block/mmcblk0p9
userdata -> /dev/block/mmcblk0p10
Be extra careful when touching those partition if you not sure, don't touch them. But making a block copy of them and taking them out should be relatively easy and safe. Obviously you gonna need a Linux box to do this. I setup a VM on one of my PC last night because I need to get a ext4 partition and put all the goodies in there.

krylon360 said:
here's the Linux version.
Thanks someone0 for getting this started.
Haven't fully tested the linux version, but it loads and starts up, so should work.
extract, and open up terminal and navigate to the dir you extracted to, and type
./makeroot.sh and then enter.
Click to expand...
Click to collapse
Just wonder why do use a zip file for the linux version? Wouldn't this kinda messup the permission when compress/uncompress? meaning, makeroot.sh may not have the proper permission when unzip. Please double check.

someone0 said:
Just wonder why do use a zip file for the linux version? Wouldn't this kinda messup the permission when compress/uncompress? meaning, makeroot.sh may not have the proper permission when unzip. Please double check.
Click to expand...
Click to collapse
works just fine.
I chmod a+x'd the script before putting it into the zip.
heh, yeah, it works. Forgot I had my touchpad pluged in and it rebooted it....
whoops.

thanks for posting the location of the /recovery partition. I want to put a copy of htat on ice to prevent BN from undoing any of my work in a future update - I may want some of the fixes they have, but I want to be able to roll them back if needed.

Someone0 are you around can you pm me, Your root works, I installed nook color tools ver .02 in system/app folder and was able to see it in my sideloaded launcher, was able to uncheck/check install non market apps which sets the setting for US to be able to install .apk files from the nook itself, ONLY ISSUE is since I put that file in the system/app folder and the nook didnt like it I got stuck in a bootloop and get to start this process all over again! (nook resetted to ground zero)
maybe we temporary can leave it there get us the permission to install non market apps then remove the file and we will be ok or maybe stuck in another bootloop.
---------- Post added at 09:20 PM ---------- Previous post was at 08:52 PM ----------
GOT IT WORKING NOW:
1. Once rooted, get a file manager with root support and enable read/write permission to /system
2. temporary copy nook tools ver .02 .apk to the system/app folder
3. have a sideloaded launcher and check the app drawer youll see nook tools, run it, first screen uncheck and check the install non market apps box couple of times make sure its checked afterwards
4. have a test .apk to run the BN installer on and see you can now install .apks from the NOOK HD and HD+
5. remove the nook tools.apk file from the system/app folder and quit your file explorer which should reset everything for the system folder back to the way it orginally is!
6. reboot, if you reboot successfully with no boot loop 8 times, your GOLDEN FOR NOW! once again load up a file manager go select an .apk file and see you can now install it! Next step is trying to get amazon market working! then google somehow, but for google you need files in system/app folder permanently!
7. YOU CAN NOW SUCCESSFULLY DOWNLOAD .APK FILES through web, email, any other app and install through the NOOK HD or HD+ BN installer for .apk files. Watch what you install, if it gets put into /system or /system/app folder DREADED BOOT LOOP which resets everything! AMAZON MARKET WORKS!!!! and apps from there install fine to the BUILT IN MEMORY.
** Hopefully amazon market dont install stuff to the system/app folder and if it does hopefully you do not get the dreaded boot loops where you got to start this whole process over again so be forwarned!!! you will loose all data on NOOK HD and HD+ if u get stuck in the bootloops! BACKUP STUFF before messing with root and this kind of thing! DEVELOPMENT!

Aside from moving the actual apk to /system/app/ temporary (since you only do it once), putting a symbolic link there may work also without creating a reset loop. But can't you just side load the apk and run it in other folder?

someone0 said:
Aside from moving the actual apk to /system/app/ temporary (since you only do it once), putting a symbolic link there may work also without creating a reset loop. But can't you just side load the apk and run it in other folder?
Click to expand...
Click to collapse
when you sidelaod it OR install or have it installed to another folder or ran from another folder it cant modify the setting to allow non market apps to install!!
has to be in the /system/app folder THEN RAN from app drawer then you can set the setting uncheck and check box quit program and for now YOU HAVE to remove the .apk from the system/app folder and then you can reboot and the setting sticks! I GOT AMAZON MARKET INSTALLED right now installing apps! NOW WE GOT A KINDLE ladys and gentleman!

Amazon apk installs in internal memory. Apps downloaded from Amazon get installed in internal memory. You can then move them to SD card or leave them in internal memory. System apps are provided in the ROMs by the developers or vendors. ALWAYS back up before making system changes.. Now rooted - use Titanium Backup. System/app should be static throughout ROM lifecycle unless modified by user.

skyhawk21 said:
7. YOU CAN NOW SUCCESSFULLY DOWNLOAD .APK FILES through web, email, any other app and install through the NOOK HD or HD+ BN installer for .apk files. Watch what you install, if it gets put into /system or /system/app folder DREADED BOOT LOOP which resets everything! AMAZON MARKET WORKS!!!! and apps from there install fine to the BUILT IN MEMORY.
** Hopefully amazon market dont install stuff to the system/app folder and if it does hopefully you do not get the dreaded boot loops where you got to start this whole process over again so be forwarned!!! you will loose all data on NOOK HD and HD+ if u get stuck in the bootloops! BACKUP STUFF before messing with root and this kind of thing! DEVELOPMENT!
Click to expand...
Click to collapse
This is why I put the /system back to ro, at least that is what I think I did.

Amazon Store working on ROOTED Nook HD
Proof of Concept:
http://youtu.be/wCyd730L74Y

skyhawk21 said:
Proof of Concept:
http://youtu.be/wCyd730L74Y
Click to expand...
Click to collapse
LOL, your internet is slow. Could have cut the video time by 1/2 if not 2/3 if you switch to faster ISP.

skyhawk21 said:
Someone0 are you around can you pm me, Your root works, I installed nook color tools ver .02 in system/app folder
Click to expand...
Click to collapse
What exactly did you install? I cannot find "nook color tools" in Google Play or on APKTOP. Thanks for your hard work!
NEVERMIND! I found the thread that has the link for the app: http://forum.xda-developers.com/showthread.php?t=868366 Thanks again.

does this root method work on Nook HD+2.0.2?
if not how I can downgrade to 2.0.0?

[Q] Cifs/Mount Manager "Empty Folder"

Been trying to get this to work for hours, followed endless amounts of tutorials, I've hit a brick wall and am finally at the point I need to ask for more specific help.
I have 32gb Nexus 7 wifi only
Version: 4.2.1
Kernal: Motley's kernal 3.1.10-motley-v3+
Build Number:JOP40D
I started with CifsManager, couldn't get it to work because of no/wrong modules, tried many I found in tutorials around the net, eventually found I needed a new kernal, settled on Motley's, this finally allowed cifs to mount the folder, but the folder is always empty.
Came across Mount Manager, set it up, same problem.
Here's what my settings look like:
CifsManager:
Share Path: 192.168.1.18/y
Mount Point: /mnt/sdcard/cifs/pcY
Username: Comp1
Password: Password
Options: iocharset=utf8
I have tried it with options blank, same thing, yes my share is called y, Comp1 is the account I set up to access shares, no my password is not really password but you get the idea. I can access this share fine from other devices including my wii using the same settings.
Mount manager is basically the same except I made the mount point /compY because I didn't know if it would conflict, and it has file_mode and dir_mode = 0777.
Thank you for your time and any help is greatly appreciated.

Still searching for a solution, even a nudge in the right direction would help a lot right now.

I found out how chainfire solved this problem. (And did not said how ) I think my thread got lost ist the Android General section.... I should have posted it in the Nexus 7 General. (I tested it on my Nexus 7)
http://forum.xda-developers.com/showthread.php?t=2062768

vorcers said:
I found out how chainfire solved this problem. (And did not said how ) I think my thread got lost ist the Android General section.... I should have posted it in the Nexus 7 General. (I tested it on my Nexus 7)
http://forum.xda-developers.com/showthread.php?t=2062768
Click to expand...
Click to collapse
Thank you very much for your reply.
I am very new to this, I can't quite follow what I am supposed to do, I think start the file debuggerd as a system service? I can find the file, but I can't find out how to start it, I've done a few searches on this site and google but have come up empty, could you please explain exactly what I need to do to make this solution work?
Thanks again for your help

(For germans: "Bitte nagelt mich nicht darauf fest" (Auf die Informationen) Sorry, I don't know the english phrase for this...)
The "debuggerd" is an "debugger daemon". It can be started with "start debuggerd" and stopped with "stop debuggerd". I think errors at excecution are posted in dmesg or logcat.
The main thought behind this, that the debuggerd is started by "start" with higher privileges even then our normal su. (Or it does mount something, I don't know) So, if you backup the original /system/bin/debuggerd and write your own commands into that file and start it via "start debuggerd" these commands are executed with these "high privileges". For example, if you write these content in debuggerd and start it, the share should be available for all apps. (Well, only if "others" have r (? wx ?) permissions on server...)
/system/bin/debuggerd
Code:
#!/bin/sh
busybox mount -t cifs //server/share /mnt/sdcard/mnt -o username=max,password=mustermann)
You can also mount devices with this method...
Well, you can't use this with the manager, because the manager needs to be changed to support this.
I hope this helps you.

You can turn on your "ADB over network".Then you con connect from your device with
adb connect 127.0.0.1:5555
Click to expand...
Click to collapse
now youre ready to mount but the foders are visable only in the apps that are been started befour mount can see the folder.

Tornadough said:
Still searching for a solution, even a nudge in the right direction would help a lot right now.
Click to expand...
Click to collapse
Here's a solution that can be implemented by ROMs or kernels to fix app mount support in Android 4.2 without requiring modifications to CifsManager or other apps.
I'd recommend asking your favorite ROM to incorporate the dalvik/init.rc patches.

vorcers said:
The main thought behind this, that the debuggerd is started by "start" with higher privileges even then our normal su.
Click to expand...
Click to collapse
What's happening is that the debuggerd process is spawned directly by init, which uses the default mount namespace, so any mount operations are shared with/visible to all other processes.
The problem is that when an app calls "su" to mount a file system, it's already walled off in a separate mount namespace by virtue of the app itself having been spawned from zygote. Basically, any process whose ancestry can be traced back to zygote can't mount file systems visible to other apps. Those whose process ancestry don't include zygote can. Which is why manually mounting file systems from adb (with either "su" or "adb root") also works.

After all this time nobody has updated any app to fix this problem?