Database Users

Android 1.x / 2.x HTC Wildfire Local Root Exploit

Hi, I just found this post on packetstormsecurity with the code of an ingenious local root exploit for HTC Wildfire, which uses a flaw in the hotplug subsystem...
packetstormsecurity.org/files/view/98106/androidwildfire-exec.txt
I'm wondering if this could be the first step for a new 1-click root app for Wildfire...
Bye

bruno820 said:
Hi, I just found this post on packetstormsecurity with the code of an ingenious local root exploit for HTC Wildfire, which uses a flaw in the hotplug subsystem...
packetstormsecurity.org/files/view/98106/androidwildfire-exec.txt
I'm wondering if this could be the first step for a new 1-click root app for Wildfire...
Bye
Click to expand...
Click to collapse
sounds promising
Martin Eve's official blog about the exploit:
martineve.com/2010/08/15/htc-wildfire-stage-1-soft-root/
Erwin

i dont have linux now, can someone compile it and put binary here as addon ?

yes, i have linux... is it just a normal gcc compile? shouldn't it have a flag for arm cpu?
tell me how to do it and i will post the binary

maybe take flags and settings from here:
http://forum.xda-developers.com/showpost.php?p=7611978&postcount=75

ErwinP said:
martineve.com/2010/08/15/htc-wildfire-stage-1-soft-root/
Erwin
Click to expand...
Click to collapse
..........

but look at this date:
http://www.exploit-db.com/author/?a=3158

I made it!
Here is the binary
PS: Ubuntu Maverick has everything needed to build for arm architecture, just apt-get it...
$ sudo apt-get install gcc-arm-linux-gnueabi g++-arm-linux-gnueabi

did you tried to run it ?

No, I didn't... I'm trying to understand what to do next
Edit: it seems that I need the USB cable to use adb tool... I will try later when I will be at home.

I tried with terminal:
cat /sdcard/exploid > /sqlite_stmt_journals/exploid
chmod 0755 /sqlite_stmt_journals/exploid
/sqlite_stmt_journals/exploid
BUT this directory does not exist,error.
there is no sqlite_stmt_journals directory in wf

Maybe you have to connect the device to adb to make that directory appear.

the same while adb

No way
I connected my Wildfire to adb...
$ ./adb push exploid /sqlite_stmt_journals/exploid
failed to copy 'exploid' to '/sqlite_stmt_journals/exploid': No such file or directory
I guess that HTC has fixed this bug... please, someone contradict me!

hmmm..
the blog is dated by: August 15, 2010 ...

Ok, I managed to run the executable (I recompiled it, it's attached)... this is the output from adb:
$ ./exploid
[*] Android local root exploid (C) The Android Exploid Crew
[*] Modified by Martin Paul Eve for Wildfire Stage 1 soft-root
[+] Using basedir=/data/local/tmp, path=/data/local/tmp/exploid
[+] opening NETLINK_KOBJECT_UEVENT socket
[+] sending add message ...
[*] Try to invoke hotplug now, clicking at the wireless
[*] settings, plugin USB key etc.
[*] You succeeded if you find /system/bin/rootshell.
[*] GUI might hang/restart meanwhile so be patient.
[1] + Stopped (signal) ./exploid
[1] Segmentation fault ./exploid
$
I copied the executable to /data/local/tmp/ because i can't find /sqlite_stmt_journals/ on my device...
And finally.... invoking hotplug (wifi on/off) does nothing!! But at least it runs...

Code:
cut
* Copy from sdcard to /sqlite_stmt_journals/exploid, chmod 0755 and run.
* Or use /data/local/tmp if available (thx to ioerror!) It is important to
* to use /sqlite_stmt_journals directory if available.
cut
find this in exploid file....give it a try
use /data/local/tmp if available....
i've tried with no success no root access, no superuser, no titanium backup...
saluti, mario

Yes, I did it indeed.
I'm starting to think that this hack is for the stock Eclair, not for Froyo...

Lol martin did this method for the soft root ages ago.
Sent from my HTC Wildfire using XDA App

Ok ok, I know... but the code has been modified and put online again on 2/2/2011 (you can read this too).
My hope was that it had been adapted to 2.2, but it seems I was wrong... we would have never know without trying

Root the kyocera echo!!!

WE ARE ROOTED!!!
Okay, we have successfully found root for the Kyocera Echo (We have reached our goal folks!!!) So here is the Root method!
DISCLAIMER: This has to be done correctly, or you will have to reset your phone in order to run the Exploit again! Follow all instructions below please.
Credits:
All credits go to zergRush of XDA, Saridnour for his dedicated work to H.T.E. (Which will soon be Hear OUR Echo), and all who tested this to confirm its functionality and show me the proper way to do it!
A little Information:
I will be using my directory to my SDK folder for this tutorial (C:\sdk\tools) but whatever your directory is to SDK is what you will use.
Things you will need:
Android SDK (already set up)
A Kyocera Echo (duh!)
zergRush (XDA root exploit)
Root method:
1. Download zergRush and put the file (not the zip) in your tools folder of sdk
Open your CMD promt, then redirect to SDK (just type exactly what I type after you're in SDK)
(cd c:\sdk\tools) <-- SDK redirect
adb shell rm -r /data/local/temp/*
adb push zergRush /data/local/temp/zergRush
adb shell
chmod 755 /data/local/temp/zergRush
/data/local/zergRush
then you should see this:
[**] Zerg rush - Android 2.2/2.3 local root [**] (C) 2011 Revolutionary. All rights reserved. [**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew. [+] Found a GingerBread ! 0x00017118[*] Sending 149 zerglings ...[*] Trying a new path ...[*] Sending 149 zerglings ...[*] Trying a new path ...[*] Sending 149 zerglings ...[*] Trying a new path ...[*] Sending 149 zerglings ... [+] Zerglings caused crash (good news): 0x401219c4 0x0054[*] Researching Metabolic Boost ... [+] Speedlings on the go ! 0xafd260a9 0xafd39f9f[*] Poping 24 more zerglings[*] Sending 173 zerglings ... [+] Rush did it ! It's a GG, man !
[+] Killing ADB and restarting as root..enjoy!
3. Afterwards, you will have to manually push SuperUser and Busybox (DO NOT UNPLUG THE PHONE)
find the SU and Busybox files here
Then, ADB push them with these commands:
Type: adb push GingerBreak /data/local/tmp/GingerBreak
Type: adb push Superuser.apk /data/local/tmp/Superuser.apk
Type: adb push su /data/local/tmp/su
Type: adb push busybox /data/local/tmp/busybox
AND THERE YOU HAVE IT, YOUR PHONE IS NOW ROOTED. HAVE FUN MODDING AND DOING WHATEVER ELSE. AS SOON AS SARIDNOUR AND H.T.E. COME OUT WITH THE RECOVERY, WE ARE ON TO CUSTOM ROMS!!!!
Thanks for supporting us this whole time,
BFG SgtRecon

First
. . . .

Amazing my girl wants to cook up her own rom ......well wants me to..
Good job all would worked on this
Sent from my PC36100 using xda premium

There is also a one-touch method that is easy to use and free. Just go to the forums at heartheecho.webs.com. Register for free, and the software and instructions are easy to find in the Tutorials section of the forums.
Sent from my M9300 using XDA App

I know, the guy named saridnour built it. (I own hear the echo, or am the creator of it rather, my name on there is BFG SgtRecon on the site though)
Sent from my PG86100 using XDA App

just use z4root

Z4root work only for froyo, but not for GB
Windows Must Die! Why??? http://www.youtube.com/watch?v=ET0UAdzQkpQ&feature=youtube_gdata_player

Look for my three step process on next gen xda or android central
Sent from my M9300 using Tapatalk 2

[Q] Should my zergRush rooting remain after reboot ?

Hi
I have rooted my Fire with zergRush and confirmed with adb shell
Code:
# id
uid=0 gid=0
but after rebooting the Fire it seems to have gone as the prompt returned to $
Is this usual?
I'm on a MAC and the Fire is 6.2. I can root again but obviously it would be good if it remained after a reboot.
Any help would be much appreciated
edit: but now I'm not so sure.. SU from adb shell returns 'not found' and when running a terminal app I have on the Fire the prompt is $ and SU returns 'permission denied'.

I'm not really one who should answer this as I'll not really up on the different exploits used for rooting but...
My understanding was that zergRush got you a temporary root which was enough to enable you to remount /system as RW which then let's you install su and busybox and the superuser.apk which then gives you permanent root.
Sent from my Kindle Fire using Tapatalk

Like bsoplinger said,
zergRush is the exploit most are using to gain root, and then while having root allow you to install tools which survive the reboot cycle to continue to provide root from that point on.
Busybox, su and superuser are those tools.

Thanks very much, certainly gives me more to go on although I'm a bit confused as to when I should be installing tools using adb and when I should be using a file manager. Probably neither and I have the wrong end of the stick no probs.. on on
edit: I think I've got it... can't thank you enough your advice has saved me hours I'm sure but I will wait till the morning. I'd rather brick it with a fresh head than the one on my shoulders now.

Android rooting - Linux port of DooMLoRD script - ICS as well as Gingerbread

Update: I have now also made a Linux port for DooMLoRD's rooting of ICS phones.(Sony Xperia only)
Please see attached file: Xperia-2011-ICS-ROOT-emu-Linux.zip
Note: You need flashtool for linux. Procedure remains the same as for windows.
Original script thread: http://forum.xda-developers.com/showthread.php?t=1601038
Rooting procedure: http://talk.sonymobile.com/thread/41119?start=0&tstart=0
Please update Superuser app as well as SU binary to the latest version after rooting is done successfully.
Update: Updated as per DooMLoRD's v4.0 script with zergRush binary of 21 Nov 2011 and with makespace which deletes Google Maps if there is not enough space.(< 6MB).
Hello
I am completely new to Android but not at all new to Linux.
I used paxchristos script (ran commands manually though) to root my Sony Ericsson Live with Walkman. (WT19i / Android 2.3.4 / Build 4.0.2.A.0.58)
Source threads used:
http://forum.xda-developers.com/showthread.php?t=1319653
http://forum.xda-developers.com/showthread.php?p=18615502
In an attached file, I fixed/modified/added few things in paxchristos script. Here is the detail:
1) Fixed error in symlinking su. (source/destination were same)
2) Don't delete (and recreate) /data/local/tmp/ directory unnecessarily, just delete its contents.
3) Create /data/local/tmp if it does not exist.
4) Uses dd instead of cp (because DooMLoRD's script does, dont know why!). Update: as per anantshri, dd is used because cp has been known to give errors.
5) If your system already has 'adb' then it uses system 'adb' instead of one in zip-archive.
6) Updated zip archive to contain the latest files from DooMLoRD's archive (paxchristos archive seemed old)
Please try/verify and let me know if I missed something.
Thanks.

Very nice to know that fellow *nixers are on xda.

Thanks, I am still getting used to this forum.
Have already found answers to many of my questions regarding Android.
One thing that shocked me is Android uses Java and not C. I would have preferred C anyday.

ohk so few things
1) yes java is used mainly in Android, However look at NDK if you are a C fan.
2) dd command is used in scripts to avoid cp related issues. coz last i remember we encountered multiple errors based on scenarios where cp used to fail but dd used to work. so dd is defacto there.
@doomLord, Correct me if i am wrong.

Ah that clears dd confusion. Till now I was wondering why he chose dd? I thought may be because dd was faster for internal memory to internal memory transfer.
Since DooMLoRD is good programmer I knew there has to be a reason. And that is why I changed paxchristos script to use dd.

Updated to match with DooMLoRD's v4 script. See update on first post for details.

Just used this script on my Galaxy S 2 Skyrocket. Worked great!

Have used the script with Sony Ericsson Xperia Mini E10a Latin America.
Script runned, ADB found the device, device has rebooted correctly but... no root after reboot. Checked with Root Checker from Market.
Anyway, great script! Should work for some models.

On my phone (Milestone 2 with Gingerbread 2.3.6) the root process worked, but part of the space check it returns 90% of free space, the software does not correctly identify and delete my google maps. The following screen to evaluate and correct the bug. And congratulations for the initiative, I'd have to do it by hand when I found your script ready.
---------------------------------------------------------------
Easy rooting toolkit (v4.0)
created by DooMLoRD
using exploit zergRush (Revolutionary Team)
This script has been ported by paxchristos and modified by amish
Credits go to all those involved in making this possible!
---------------------------------------------------------------
[*] This script will:
(1) root ur device using latest zergRush exploit (16 Nov)
(2) install Busybox (1.18.4)
(3) install SU files (binary: 3.0.3 and apk: 3.0.6)
(4) some checks for free space, tmp directory
(will remove Google Maps if required)
[*] Before u begin:
(1) make sure u have installed adb drivers for ur device
(2) enable 'USB DEBUGGING'
from (Menu\Settings\Applications\Development)
(3) enable 'UNKNOWN SOURCES'
from (Menu\Settings\Applications)
(4) [OPTIONAL] increase screen timeout to 10 minutes
(5) connect USB cable to PHONE and then connect to PC
(6) skip 'PC Companion Software' prompt on device
---------------------------------------------------------------
CONFIRM ALL THE ABOVE THEN
PRESS ENTER WITHIN 120 seconds TO CONTINUE OR ctrl-c to cancel
--Starting---
---Killing the adb server to make sure that there are no problems---
---Waiting for Device---
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
---Cleaning out any previous zergRush attempts---
mkdir failed for /data/local/tmp, File exists
rm failed for /data/local/tmp/*, No such file or directory
---Pushing zergRush---
531 KB/s (23060 bytes in 0.042s)
---Fixing permissions for zergRush---
---Running zergRush---
If it gets stuck here for a long time then try:
1)disconnect usb cable and reconnect it
2)toggle 'Usb Debugging' (first disable it then reenable it)
[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.
[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.
[+] Found a GingerBread ! 0x00000118
[*] Scooting ...
[*] Sending 149 zerglings ...
[*] Sending 189 zerglings ...
[+] Zerglings found a way to enter ! 0x18
[+] Overseer found a path ! 0x000151e0
[*] Sending 189 zerglings ...
[+] Zerglings caused crash (good news): 0x4011ccd4 0x0074
[*] Researching Metabolic Boost ...
[+] Speedlings on the go ! 0xafd19413 0xafd3925f
[*] Sending 181 zerglings ...
[+] Rush did it ! It's a GG, man !
[+] Killing ADB and restarting as root... enjoy!
---Waiting for Device---
---Pushing busybox---
2011 KB/s (1075144 bytes in 0.522s)
---Fixing busybox permissions---
---remounting system---
---checking free space on /system---
10 KB/s (439 bytes in 0.040s)
--- Free space on /system : 90% bytes
test: 90%: bad number
--- NOT enough free space on /system!!!
--- making free space by removing Google Maps
---copying busybox to /system/xbin---
2099+1 records in
2099+1 records out
1075144 bytes transferred in 0.084 secs (12799333 bytes/sec)
---fixing ownership and permissions---
---installing busybox---
---cleaning up---
---pushing SU binary---
546 KB/s (22228 bytes in 0.039s)
---correcting ownership and permissions for SU---
---correcting symlinks---
---Pushing Superuser app---
2160 KB/s (785801 bytes in 0.355s)
--cleaning---
---rebooting---
---All done, your Xperia has been rooted by DooMLoRD---
---This script has been ported by paxchristos and modified by amish!!---
---If have any questions, feel free to email me @ [email protected]---

Umm.... Freespace checking script was not developed by me. I have copied it directly from DooMLoRD script AS IS (had not tested it either). I think we dont need it anyway. It will be very rare that person rooting wud have run out of space. Person can re-install Google Maps (so no big harm done by bug)
But when I get the time I will check the DooMLoRD's script if there exist a bug.
Please click on THANKS if u liked my script

Your script has saved me a lot of work, because I'm tired of borrowing the notebook of my wife for flashing my phone and was looking for solutions for linux, missing root can do, I do not want to use SuperOneclick (did not want to install it just for Mono ) and go on to adapt the script DoomLord for Linux, which you did very well done. Now I can do everything on my computer with linux, what about the bug, I realized that the program was part of the original script, but I made a warning to those who wish, like me, deactivate the check room not to lose Google Maps (or have to reinstall the Market).

adb drivers in linux ?
Hy ! Can I use this script to root my Galaxy Note ? And can you say me how to install adb drivers in linux, plz ?

Just try it.
ADB is already there with script.
If you have fedora then u can install adb by running:
yum install android-tools

OK
Thank you, i will try. I didn't realize that "ADP" is the same as "ADP drivers".

well in linux there is nothing like drivers u can say
very few hardware require driver.
and when android itself is born from linux, linux shud already have support for it

Everything went well, thank you very much! We should just specify the need to execute the file "runme-linux" as root (with "sudo") ;-).
I would not to abuse, but would it be possible to have the same thing for unroot, please ?

Easy unroot for linux
Hy,
I used Amish translation to do the same for the DooMLoRD's Unrooting Script. I succesfully tried it with my phone, but REMEMBER YOU ARE DOING THIS AT YOUR OWN RISK (I suppose you know this song ;-))
DooMLoRD's instructions :
so here is the unrooting script to be USED ONLY AND ONLY IF U HAVE USED MY FILES (Easy Rooting Toolkit) FOR ROOTING
[ WARNING ]
if u have used any other way/solution for rooting then PLEASE DO NOT RUN THIS... you MIGHT END UP with damaged system...
(thats cause some ppl create symlinks for busybox in /system/bin/ which wipes out stock symlinks to /system/bin/toolbox and breaks/damages system)
More informations here http://forum.xda-developers.com/showthread.php?p=18615502 and here http://forum.xda-developers.com/showthread.php?t=1329360

I havent unrooted but I think unrooting wud be nothing but removing busybox symlinks (and busybox itself) and removing su binary and superuser.apk.

btw there is no need to run "runme-linux" as super user.
it works as normal user (recommended)

amishxda said:
btw there is no need to run "runme-linux" as super user.
it works as normal user (recommended)
Click to expand...
Click to collapse
If I run the script without sudo, the script block just after "* daemon started successfully *"
You can see below the console log :
Code:
---------------------------------------------------------------
Easy rooting toolkit (v4.0)
created by DooMLoRD
using exploit zergRush (Revolutionary Team)
This script has been ported by paxchristos and modified by amish
Credits go to all those involved in making this possible!
---------------------------------------------------------------
[*] This script will:
(1) root ur device using latest zergRush exploit (16 Nov)
(2) install Busybox (1.18.4)
(3) install SU files (binary: 3.0.3 and apk: 3.0.6)
(4) some checks for free space, tmp directory
(will remove Google Maps if required)
[*] Before u begin:
(1) make sure u have installed adb drivers for ur device
(2) enable 'USB DEBUGGING'
from (Menu\Settings\Applications\Development)
(3) enable 'UNKNOWN SOURCES'
from (Menu\Settings\Applications)
(4) [OPTIONAL] increase screen timeout to 10 minutes
(5) connect USB cable to PHONE and then connect to PC
(6) skip 'PC Companion Software' prompt on device
---------------------------------------------------------------
CONFIRM ALL THE ABOVE THEN
PRESS ENTER WITHIN 120 seconds TO CONTINUE OR ctrl-c to cancel
--Starting---
---Killing the adb server to make sure that there are no problems---
---Waiting for Device---
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
^C [COLOR="Red"](because no reaction after 5 minutes)[/COLOR]
error: protocol fault (no status)
---Cleaning out any previous zergRush attempts---
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
error: insufficient permissions for device
error: insufficient permissions for device
---Pushing zergRush---
error: insufficient permissions for device
---Fixing permissions for zergRush---
error: insufficient permissions for device
---Running zergRush---
If it gets stuck here for a long time then try:
1)disconnect usb cable and reconnect it
2)toggle 'Usb Debugging' (first disable it then reenable it)
error: insufficient permissions for device
---Waiting for Device---
^C
If I run the same script as root (with "sudo"), the script continues without problem.

[Q] Editing Build.prop results in failure to boot [bricked]

As you may know, some Android games especially most Gameloft games are not compatible with the Kindle Fire. So in efforts to find a way to make certain Gameloft games to work such as Modern Combat 2 and Shrek Kart and others, I resorted to editing my build.prop in the systems folder to make my device compatible with the apps. So I copied the original build.prop file, renamed it, and saved it to my SD Card folder. I took the copy I made and I then replaced it with the build.prop from HTC Glacier. (I never knew what could possibly happen) So then to apply those settings you have to reboot the device. I rebooted the Kindle and now it won't boot up. It get's to the Kindle Fire screen when booting up but after several seconds it just shows a black screen. No physical damage has been incurred to it but I feel like my stupid mistake of modding the build.prop resulted in the Kindle Fire unable to boot up correctly. It also isn't recognized by the PC when I hook it up to a USB cable. So far I've found nothing that could help to solve this. I've seen a Factory Default Settings Cable which is a special cable to reverts the device to its factory default settings but I'm not too sure if that would work. I'm in desperate need of help as in I use my Kindle Fire for everyday work and play. Thanks.
EDIT: I've tried adb push and renaming and moving the build.prop into the /system/ but returns that it is a Read-File System Only. Also adb shell and su doesn't work as in it ends up with segmentation fault. I've tried to zergRush root it and permanently root it using KFU but it ends up with 'Cannot Access Package Manager. Is System running?' Also the mount -o rw,remount.....command doesn't work either as it says Permission Denied. All of this would be easy to accomplish if only it ADB allowed me to write onto the /system file.
EDIT**: The biggest issue I'm faced with is the permission settings that prevent my from editing anything. You cannot simply change it from RO to RW because apparently the ADB is not rooted. And I also can't root it because problems exist when accessing either Package Manager or Activity Manager. What I need is a way to access the /system files without a root (non-rooted). Either that or enable fastboot because I cannot access that either. On a reply on the second page is the resulting lines when changing bootmodes on the KFU.

Don't know how to fix your problem, but just wondering, did you just completely replace the kindle fire build.prop with the HTC glacier? Because you can't do that, it will, as you have learned, mess up your device.. Your supposed to edit the build.prop and just change a few things. Next time read up on the subject before deciding to mod the device you use everyday...

the cable you'r talking about is a "factory cable" it forces the kf to fastboot mode - it don't restore any settings !
you need fastboot mode to install fff (firefirefire - custom bootloader) and twrp (recovery)
do you allready have installed fff & twrp (or cwm) ?
if you have twrp installed and booted into then you have adb command available and can copy back the original build.prop

Did you remember to restore the read/write permissions to build.prop? It should be set to 644.

As already stated, your not supposed to replace the whole file, build.prop tells android which device you have, so now Android thought and configured itself to different hardware config. which is not available to it. Adb seems like the only option.

I should have really looked more into it before modifying the build.prop. I replaced the ENTIRE build prop with the build.prop of HTC Glacer. (I know, i know I was stupid) And referring to the factory cable, I don't think I'll resort to that: too time consuming. In regards to the last person that posted before me who said that my only option was ADB could you elaborate? Thanks for all your feedback.

gococogo321 said:
I should have really looked more into it before modifying the build.prop. I replaced the ENTIRE build prop with the build.prop of HTC Glacer. (I know, i know I was stupid) And referring to the factory cable, I don't think I'll resort to that: too time consuming. In regards to the last person that posted before me who said that my only option was ADB could you elaborate? Thanks for all your feedback.
Click to expand...
Click to collapse
Your going to have to use adb to basically remove the HTC Glacier build.prop and replace it with the original build.prop.
For example:
Adb remount <- allows you to mount system as rw
Adb pull /path-to-original/build.prop
Adb push build.prop /system
Adb shell chmod 644 /system/build.prop <- sets permissions to rwrr
Adb reboot
Sent from my Kindle Fire using xda premium

You dont have access to recovery? Either TWRP or CWM?

daggy1985 said:
Your going to have to use adb to basically remove the HTC Glacier build.prop and replace it with the original build.prop.
For example:
Adb remount <- allows you to mount system as rw
Adb pull /path-to-original/build.prop
Adb push build.prop /system
Adb shell chmod 644 /system/build.prop <- sets permissions to rwrr
Adb reboot
Sent from my Kindle Fire using xda premium
Click to expand...
Click to collapse
I tried doing that but it says something like Access Denied or Read-Only File System when i try to push the build.prop into it.

gococogo321 said:
I tried doing that but it says something like Access Denied or Read-Only File System when i try to push the build.prop into it.
Click to expand...
Click to collapse
Did you use the 'adb remount' command? Sometimes, when attempting to push a file to the system, I get the 'read-only file system' and I have to issue adb reboot followed by adb remount and then push the file again. It seems after a time the mount system as read write automatically goes back to read-only.
Sent from my ADR6400L using xda premium

Have you got TWRP or ClockworkMod?
Because you could flash a new rom then.

abd - root mode
Perhaps, running adb in root mode will
allow you to push the original build.prop
back. Then execute "adb remount / rw" to mount the
root directory as read/write. Hopefully you will be able to push
it then follow daggy1985's instructions.
* In Win 7, type "cmd " at the 'SEARCH/RUN' and hold
shift + ctrl while hitting 'Enter' to put yourself
in Admin mode which apparently makes adb work in root mode when you launch it.
* Xda-dev is the coolest site for Android that I have seen. Kudo's to everyone participating.

sum1nil said:
Perhaps, running adb in root mode will
allow you to push the original build.prop
back. Then execute "adb remount / rw" to mount the
root directory as read/write. Hopefully you will be able to push
it then follow daggy1985's instructions.
* In Win 7, type "cmd " at the 'SEARCH/RUN' and hold
shift + ctrl while hitting 'Enter' to put yourself
in Admin mode which apparently makes adb work in root mode when you launch it.
* Xda-dev is the coolest site for Android that I have seen. Kudo's to everyone participating.
Click to expand...
Click to collapse
Thanks but I have actually been running it from Administrator from the very beginning. I've used Kindle Fire Utility KFU and it says that ADB Server is Online and my Bootmode is 4000 but it says ADB root: No. And whenever I choose any bootmode whether it be Normal, Fastboot, or Recovery, it always shows this:
***********************************************
* Activating Normal (4000) *
***********************************************
Installing BurritoRoot, Courtesy of Jcase of TeamAndIRC!
1393 KB/s (1164225 bytes in 0.816s)
Error: Could not access the Package Manager. Is the system running?
Activating BurritoRoot...
Error type 2
android.util.AndroidException: Can't connect to activity manager; is the system
running?
Elevating the Shell...
* daemon not running. starting it now *
* daemon started successfully *
/data/local/tmp/BurritoRoot3.bin: permission denied
mount: Operation not permitted
mount: Operation not permitted
failed to copy 'files\rbfb' to '/system//rbfb': Read-only file system
Unable to chmod /system/rbfb: No such file or directory
Unable to chmod /system/rbfb: No such file or directory
mount: Operation not permitted
mount: Operation not permitted
***********************************************
* Root Activated *
***********************************************
The kindle is successfully running in root mode.
<idme> Invalid permission
reboot: Operation not permitted
Same goes for the Temp Burrito Root and installing FFF and TWRP. It always shows something about cannot access Package manager. I have no clue what the Package Manager even does but apparently I cannot find a solution to that.

I think you need to get a factory programming cable like we talked about on gtalk. I'm confident that will fix this.
Sent from my DROIDX using Tapatalk

I used android commander for windows, mounted system in TWRP and used android commander to copy a new working build.prop to the right place.
With a cable from my htc desire.

would make a little test:
issue "adb shell"
if you get a error message your up to a factory cable because the system shell is messed up and you have no possibility to get to fastboot mode to install fff & twrp
if you get a $ or # prompt you can resume and try "mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system" to mount system in read/write mode

daggy1985 said:
Your going to have to use adb to basically remove the HTC Glacier build.prop and replace it with the original build.prop.
For example:
Adb remount <- allows you to mount system as rw
Adb pull /path-to-original/build.prop
Adb push build.prop /system
Adb shell chmod 644 /system/build.prop <- sets permissions to rwrr
Adb reboot
Sent from my Kindle Fire using xda premium
Click to expand...
Click to collapse
hey, I've tried to remount my rooted galaxy y, fall in for same problem.but there show this message; "remount failed: Operation not permitted"
my device's usb debugging mode was off in last entire.
what I have to do now?

how did u edit build.prop in the first place if u don't have root and this might help
http://yaseminavcular.blogspot.com/2012/01/how-to-get-bricked-kindle-fire-back-to.html?m=1
Sent from my R800i using Tapatalk