Database Users

[How To] Rooting any HD2 android build.

Hi.
I was wondering how to do that and what's required for this - turned out that it's dead simple.
Requirements:
Linux machine
Root on the above Linux machine
Already working android on HD2
HD2 booted into Windows Mobile or the SD card taken out of it and mounted to your Linux machine
So...
There are some rootfs.img available to download from: http://ip208-100-42-21.static.xda-developers.com/showthread.php?t=719646 but they may not be working with your build or there's a newer build. The instructions I provide are universal and should work for all builds.
Since we have access to all partition images we can modify anything we like on them so getting root on your android will be easy.
From what I discovered - which maybe is obvious to some but was not to me, was that su binary is located in 2 places (two partitions):
/bin
/system/xbin
and the one in /system/xbin is overmounted by by the one from /bin - probably because the one in /bin is hacked (the standard one may not allow granting root to any application and only allow it to ADB shell).
If you do the following using any terminal emulator from Android:
ls -all /system/xbin/su
you'll see that it's permissions are set to: -rwxrwxrwx or -rwxr-xr-x depending on what build u have (the first one is not really a good permission set since it allows anybody to write to the file - BAD but irrelevant here). What's missing here is the SUID bit. Without SUID permission this binary won't be able to grant root. So what u need to do here is set su as SUID.
I saw on some hacked/rooted rootfs.img that this has been done by adding a chmod 04755 /bin/su and /system/xbin/su lines to startup scripts somewhere near the end of the booting process but my way of doing it is to set SUID on the binary itself.
So...
Assuming that you have your HD2 connected to your Linux machine via USB and it's set to STORAGE mode or you have your SD card inserted to the Linux machine and mounted as /media/disk (the path may be different in your case) you need:
On your Linux machine - Become root (su -) or (sudo bash) or login simply login as root
create yourself a directory (eg rootfs): mkdir rootfs
mount the root partition image to rootfs: mount -o loop /media/disk/rootfs.img rootfs
grant SUID to /bin/su: chmod +s rootfs/bin/su
unmount the image: umount rootfs
safely remove the card/disconnect HD2 (by using your distro ways - eg in KDE4 use "device notifier widget"
insert your SD card to HD2/disconnect HD2 from Linux box's USB port
Fire up haret and boot your Android distro
Enjoy rooted Android

a.key said:
Hi.
I was wondering how to do that and what's required for this - turned out that it's dead simple.
Requirements:
Linux machine
Root on the above Linux machine
Already working android on HD2
HD2 booted into Windows Mobile or the SD card taken out of it and mounted to your Linux machine
So...
There are some rootfs.img available to download from: http://ip208-100-42-21.static.xda-developers.com/showthread.php?t=719646 but they may not be working with your build or there's a newer build. The instructions I provide are universal and should work for all builds.
Since we have access to all partition images we can modify anything we like on them so getting root on your android will be easy.
From what I discovered - which maybe is obvious to some but was not to me, was that su binary is located in 2 places (two partitions):
/bin
/system/xbin
and the one in /system/xbin is overmounted by by the one from /bin - probably because the one in /bin is hacked (the standard one may not allow granting root to any application and only allow it to ADB shell).
If you do the following using any terminal emulator from Android:
ls -all /system/xbin/su
you'll see that it's permissions are set to: -rwxrwxrwx or -rwxr-xr-x depending on what build u have (the first one is not really a good permission set since it allows anybody to write to the file - BAD but irrelevant here). What's missing here is the SUID bit. Without SUID permission this binary won't be able to grant root. So what u need to do here is set su as SUID.
I saw on some hacked/rooted rootfs.img that this has been done by adding a chmod 04755 /bin/su and /system/xbin/su lines to startup scripts somewhere near the end of the booting process but my way of doing it is to set SUID on the binary itself.
So...
Assuming that you have your HD2 connected to your Linux machine via USB and it's set to STORAGE mode or you have your SD card inserted to the Linux machine and mounted as /media/disk (the path may be different in your case) you need:
On your Linux machine - Become root (su -) or (sudo bash) or login simply login as root
create yourself a directory (eg rootfs): mkdir rootfs
mount the root partition image to rootfs: mount -o loop /media/disk/rootfs.img rootfs
grant SUID to /bin/su: chmod +s rootfs/bin/su
unmount the image: umount rootfs
safely remove the card/disconnect HD2 (by using your distro ways - eg in KDE4 use "device notifier widget"
insert your SD card to HD2/disconnect HD2 from Linux box's USB port
Fire up haret and boot your Android distro
Enjoy rooted Android
Click to expand...
Click to collapse
Excellent post mate! Been wondering how to do this myself... I only got as far as mounting and chmod'ng the wrong files
What build did you root, btw?
Will test this in a bit

pongster said:
Excellent post mate! Been wondering how to do this myself... I only got as far as mounting and chmod'ng the wrong files
What build did you root, btw?
Will test this in a bit
Click to expand...
Click to collapse
pongster, long no heared of any new cleanex thinking of making any android builds?

I'm using Desire V5 and it's the one I rooted.

shu8i said:
pongster, long no heared of any new cleanex thinking of making any android builds?
Click to expand...
Click to collapse
Might give it a whirl once I find the time...

pongster said:
Might give it a whirl once I find the time...
Click to expand...
Click to collapse
what happened to ubunto

Rubanzip said:
what happened to ubunto
Click to expand...
Click to collapse
Why are you bumping old threads from 3 months ago?

one question fellos .... this post means booting android directly with out help of windows mobile ....

sathara said:
one question fellos .... this post means booting android directly with out help of windows mobile ....
Click to expand...
Click to collapse
nope. that's called NAND

Optware for Android

I was looking for a command line ssh program for Android, and was surprised that I couldn't find anything. I didn't want to install a chroot environment, but then I found Optware for Android. I've used it before on other devices and it's VERY useful for getting a more complete unix environment on otherwise stripped down linux devices.
The version on that page was built for a rooted Nook Color, but I only had to make minor changes to get it to run on an Epic running SRF:
1. Extract miniunz from Barnes and Noble's Nook Color 1.2 update zip and put it somewhere in the path - I put mine at /system/bin. You can get it from the first link here http://www.google.com/search?q=nook+color+1.2+update.
2. Make sure /system has at least 2MB or so free. Mine was full... I deleted a few ringtones from /system/media/audio/ringtones/
3. run this:
mount -o remount,rw /
ln -s /data/tmp /tmp
4. Follow the instructions from the Optware for Android page
Optware will now be installed, but pretty much nothing will run at the moment. I'm VERY new to Android, so I don't know that this is the right way to fix it, but here's what I did to get it working:
1. mount -o remount,rw /system
create /system/xbin/optlinks.sh with these contents:
#!/bin/sh
if [ ! -L /tmp ]; then
mount -o remount,rw /
ln -s /data/opt/lib/ld-linux.so.3 /lib/ld-linux.so.3
ln -s /data/opt /opt
ln -s /data/tmp /tmp
mount -o remount,ro /
fi
create /system/xbin/shell.sh with these contents:
#!/bin/sh
/system/bin/su -c /system/xbin/optlinks.sh
/system/bin/su -c "/opt/bin/bash --login"
2. chmod 755 shell.sh and optlinks.sh
3. Edit /etc/profile and add :/opt/sbin:/opt/bin to the PATH export and :/opt/lib to the LD_LIBRARY_PATH export.
4. Install Jack Palevich's Terminal Emulator from the Market
5. In Terminal Emulator's Prefs, set Initial Command to shell.sh.
I had to put the optlinks.sh part in because that's what optware expects - the Nook has those locations, SRF doesn't. Symlinks seem to work fine, but they disappear on reboot - no idea why - so that's why I run it every time.
Now, when I launch Terminal Emulator, I get a root shell, and can use ipkg install to get anything optware provides. It would be really cool if I the shell was run as a normal (non-root) user, and even better if the optware installer didn't need all the workarounds. Anybody have any ideas?

Tried this on CM 7
First off, thanks!
I tried this on CM 7 nightly (nexus one) and here is what I found:
- Most importantly, it broke root access to other apps on the phone. Not sure if this is due to not being able to update init.rc, may try to sort this out later.
- The goal of the install is to be able to run an SSH server and in addition to that you will have access to optware.
- The default busybox that is included with CM7 does not include adduser, addgroup or passwd applets which will cause things to fail once the install script tries to add a new user. Also, there is an app called "busybox installer" on the market that *will* update busybox, however it depends on libraries that CM7 does not include by default. The result is none of the busybox applets can reach the internet due to not being able to resolve domain names.
If you open the optware-bootstrap-0.0.1.shar file with 7zip, you will see there is a busybox executable included. It's an older version, however it includes what you need. I copied that version to /system/xbin and I was able to use the aforementioned applets
- At the end of my install I received an error that it was unable to edit the ram disk while trying to update init.rc. I think the solution is to add a script to /system/etc/init.d/ . Still working that out.
- I'm probably going to try combining this method with this one: http://android.modaco.com/topic/312...cripts-installing-bash-dropbear-mc-nano-opkg/ Since this is more of a manual method, however it's connecting to a custom optware feed that only has a few packages.

I dont suppose you got anywhere with this?
Looking to install optware on my desire hd running miui rom.

Chroot can't find /system/bin/sh

I copied over the debian image i made for my sgs i9000 to try and run on my galaxy tab since i think the much larger screen, double RAM and faster cpu would make the image run smoother. I hoped the p7510 might be able to replace my laptop for word processing by running openoffice in chroot. I remembed to set the path, user and home variables. After mounting the image i go to chroot but i get the error
"chroot: can't execute /system/bin/sh"
I tried installing 10 other versions of busybox from the market. I am currently using the latest bindroid rom and pershoot kernel. The image worked on my sgs when it ran stock roms and now cm7.1. Is it the bindroid rom? I also tried to use apk manage 4.9 to decompile the rom's framework-res to enable crt off but it always errors out recompiling.
I realize that /system/bin/sh is where android has sh but i thought busybox would be smart enough to know that normal linux like my laptop has it in /bin/sh. My sgs seemed to know its directory of sh was not normal.

i'm having the same problem as well setting up debian to my galaxy tab, same model as you. when i mounted debian, it doesn't have /system/bin/sh, it's just /bin/sh. maybe you should try to specify /bin/sh at the end of the command, if you don't, it will default to /system/bin/sh. maybe you'll have more luck than me. i mounted debian in /data/local/debian and typed chroot /data/local/debian /bin/sh but it says "/bin/sh: precmd: not found". if you or anybody else figures out how to get past that, that would be awesome! thanks!
EDIT: look at the directory structure and see if it's /bin/sh instead of /system/bin/sh and if it is, specify /bin/sh at the end of the chroot command then hit enter and you might get an error, if you do, type: unset PS1 PROMPT_COMMAND .. that worked for me and then you'll get a command prompt and you'll be in linux now and not android. i hope i helped

Linux chroot mount scripts

The actual creation of an arm linux chroot image is probably out here on teh internetz somewhere, but I can assist with my mounting shell script (which works).
My image is of a debian arm chroot, and the image filesystem is ext2 (a good idea for fewer writes. ie innately non-journaling), has been used extensively on fw DE .17 and I'm currently trying it out on WW .29 (thank you, miloj).
I would upload my debian img somewhere, but I've actually broken it somewhat (it works for my needs, but it's nonetheless a bit too hacked up to be reliable).
I've modified it somewhat for generalization, some of it is probably wrong and/or redundant, and it IS hackish and ugly, but it works for me (tm).
* the chroot image only need a root account (and probably bash installed, but it usually is)
* You need busybox installed.
* You need to upload your chroot image named linux.img to the internal sdcard in a folder named linux
A shell script to set things up is attached.
What you need to do:
push the install script and run it:
Code:
adb push installlinuxstuff.sh /data/local/
adb shell sh /data/local/installlinuxstuff.sh
Now you can (from adb shell or terminal emulator on device):
Code:
su -
/data/local/mnt/linux.sh
/data/local/mnt/notlinux.sh
Feel free to remove the install script at
/data/local/installlinuxstuff.sh
when you've got it up and running.
Alternative way to run the scripts from adb shell:
Code:
adb shell su -c /data/local/mnt/linux.sh
adb shell su -c /data/local/mnt/notlinux.sh
I usually symlink start and stop (in my case deb and undeb) shell scripts placed in /data/local/mnt in /system/bin (ie shell scripts with 'su -c /data/local/mnt/whatever.sh' in them) for easy start an stop from terminal emulator, and if you've gotten this far you may welcome the small advice. (in other words - don't do this unless you _really_ know what you're doing)

Debian ARMHF or ARMEL?
If you would uploaded it (good place is google drive , sharing as public, as there are no ads or bull**** and the download is extremely fast) I would love to try your image - after modifying your script so it can work on a UHS-1 class MicroSD I want to try running this off of (should give it a little more speed).

zamaditix said:
Debian ARMHF or ARMEL?
If you would uploaded it (good place is google drive , sharing as public, as there are no ads or bull**** and the download is extremely fast) I would love to try your image - after modifying your script so it can work on a UHS-1 class MicroSD I want to try running this off of (should give it a little more speed).
Click to expand...
Click to collapse
Armel (I use the same chroot installation on my phone in a smaller image file (with less stuff installed)). I've got loads of personal stuff all over it and besides - it's somewhat broken. I really don't want to try to fix it.
So I'm working on retracing my steps, creating a clean armhf ext2 image (debian wheezy base installation for now) and redo the mount script, but I can't make any promises on a release date.
Anyhu - there are loads of images (armel, at least) on teh internetz (BT5 and too many ubuntu, for instance).
Just check so our kernel can mount the filesystem.
Edit: if not you can just create a new image file with a filsystem that's mountable and copy the chroot files to it.

So the ideal image for this tablet is armhf? If I wanted to create a Gentoo image, I would go with armv7? I'm just not sure exactly which ARM architecture this tablet is.

EndlessDissent said:
So the ideal image for this tablet is armhf? If I wanted to create a Gentoo image, I would go with armv7? I'm just not sure exactly which ARM architecture this tablet is.
Click to expand...
Click to collapse
The CPU is the Tegra 3 if you want to google it and it is an ARMv7 w/ NEON extensions chip. ARMv7 specification requires hardware fp so naturally it is ARMhf.
Nice to hear, keep us updated on your progress. I'm currently running an armel copy of Ubuntu 12.04 but it has problems with some packages and others are armhf only.

When I run linux.sh, I get an error that /sdcard can't be mounted because it doesn't exist.
Code:
mount: mounting /sdcard on /data/local/mnt/linux/sdcard failed: No such file or directory
I also tried changing the script to mount /mnt/sdcard, but that didn't work either.

EndlessDissent said:
When I run linux.sh, I get an error that /sdcard can't be mounted because it doesn't exist.
Code:
mount: mounting /sdcard on /data/local/mnt/linux/sdcard failed: No such file or directory
I also tried changing the script to mount /mnt/sdcard, but that didn't work either.
Click to expand...
Click to collapse
Yes, it is somewhat hackish, like I wrote. My image has got an sdcard folder (/sdcard) inside of it where I mount /sdcard from android. (Ie chroot and mkdir /sdcard)

followed this:
http://androlinux.com/android-ubuntu-development/how-to-install-ubuntu-on-rooted-transformer-prime/
make sure you have busybox installed der. Or at least the cp command in /system/bin
works well on my TF300T, Yea its not native but im currently configuring it for kernel building ;-D

FlyingPoo said:
followed this:
http://androlinux.com/android-ubuntu-development/how-to-install-ubuntu-on-rooted-transformer-prime/
make sure you have busybox installed der. Or at least the cp command in /system/bin
works well on my TF300T, Yea its not native but im currently configuring it for kernel building ;-D
Click to expand...
Click to collapse
Why does the mount script remount a non-existing block device with an ancient (according to android) filesystem?
Code:
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
Edit: I read all the scripts, and they all mount that crap. It's not made for transformers, and on the android device it's made for it leaves /system mounted rw after you've run it, and WHEN run (installed) it modifies too much in /system/bin
Code:
# At first it copies loads of crap to /system/bin, and then:
cd /system/bin/
chmod 4777 *
It's not even "hackish" - it's just... wrong...
Will loop1 work every mount?
Code:
mknod /dev/loop1 b 7 0
losetup /dev/block/loop1
I'm almost only asking, since this thread was supposed to be about scripts?

gasingvar said:
Yes, it is somewhat hackish, like I wrote. My image has got an sdcard folder (/sdcard) inside of it where I mount /sdcard from android. (Ie chroot and mkdir /sdcard)
Click to expand...
Click to collapse
Thanks. I created /sdcard, and it works almost perfectly now. However, mounting devpts at /dev/pts doesn't seem to work. I replaced that line with
Code:
mount --bind /dev $mnt/dev
and it seems to work fine. Is there anything wrong with my method?
/dev/void said:
Why does the mount script remount a non-existing block device with an ancient (according to android) filesystem?
Code:
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
Edit: I read all the scripts, and they all mount that crap. It's not made for transformers, and on the android device it's made for it leaves /system mounted rw after you've run it, and WHEN run (installed) it modifies too much in /system/bin
Code:
# At first it copies loads of crap to /system/bin, and then:
cd /system/bin/
chmod 4777 *
It's not even "hackish" - it's just... wrong...
Will loop1 work every mount?
Code:
mknod /dev/loop1 b 7 0
losetup /dev/block/loop1
I'm almost only asking, since this thread was supposed to be about scripts?
Click to expand...
Click to collapse
I'm assuming you're talking about the link in the post you quoted, even though you seem to be referencing the OP's use of the word "hackish". The script in the OP doesn't do any of that stuff. It just creates a few directories in /data/local/mnt/ and writes the mount/unmount scripts, which themselves only un/mount appropriate directories for the tablet. As for your question, I'm not nearly experienced enough to answer it. Sorry.

EndlessDissent said:
Thanks. I created /sdcard, and it works almost perfectly now. However, mounting devpts at /dev/pts doesn't seem to work. I replaced that line with
Code:
mount --bind /dev $mnt/dev
and it seems to work fine. Is there anything wrong with my method?
Click to expand...
Click to collapse
AFAIK your mount seems to be more complete, ie more android hardware goodies accessable from the chroot environment. However - that means more things possibly going wrong (like writing to a device who's critical to the android environment).
Personally I'd try to find what "hardware goodies" and whatnot I'd need to get the chroot environment working optimally, and not mount ALL of /dev.
EndlessDissent said:
I'm assuming you're talking about the link in the post you quoted, even though you seem to be referencing the OP's use of the word "hackish". The script in the OP doesn't do any of that stuff. It just creates a few directories in /data/local/mnt/ and writes the mount/unmount scripts, which themselves only un/mount appropriate directories for the tablet. As for your question, I'm not nearly experienced enough to answer it. Sorry.
Click to expand...
Click to collapse
Yes, and the OP is very honest about his script(s) being "hackish", which I interpret to mean 'not optimal, possibly redundant but working', all of which it is (and I applaud the early release, since for instance I could get things rolling), but the ubuntu image installation and mounting scripts from the other poster ( whom I was addressing ) are plain faulty.

I am looking for a armhf build of ubuntu or debian that I can chroot (newer the better), if anyone knows of such a build that would be fantastic but if not does anyone know of an easy to follow guide to compile such a thing?

I found two pretty good guides. I mostly followed THIS ONE, but I found that it doesn't mount enough before "first boot", so what I did was follow the guide until the point where you move the image to the tablet. Then I ran the OP's installlinux.sh script, and then the mount script. However, the mount/unmount scripts need to be edited before using them. Comment out the sdcard line and probably the devpts line (mounting devpts didn't work; Bash complained that devpts didn't exist; I had to replace it with the line I mentioned a few posts above, but as /dev/void says, it could be problematic, so be careful). Mount the image, make the /sdcard directory, exit, unmount, and edit the scripts again to mount/unmount /sdcard.
Next time you enter the chroot, feel free to run the
Code:
sh /debootstrap/debootstrap --second-stage
command to build the image, and follow the linked guide until the next time it tells you to exit the session (NOTE: The second echo "whatever" > sources.list command is wrong; it should be echo "whatever" >> sources.list; Also, remember to replace "squeeze" with the appropriate Debian version, in my case, "testing"). Instead of exiting right after the apt-get update, I'd recommend playing around with the chroot and configuring whatever apps you install. You can just use the OP's scripts now and ignore the script in the linked guide.
When the guide I linked above gets to this line:
Code:
sudo debootstrap --verbose --arch armel --foreign squeeze /mnt/squeeze/ http://ftp.debian.org/debian
just replace armel with armhf, and if you want a testing image, replace squeeze with testing.
Sorry I'm not attaching my image. I made it gigantic (5GB), so I don't really have anywhere to store it, and you probably wouldn't want to download a file that big. Plus, it already has Openbox and a bunch of other things you probably don't want installed. I'm assuming you'd want GNOME or KDE instead.

[HOW-TO] Lenovo IdeaTab A1000 Rooting

HOW TO ROOT YOUR LENOVO IDEATAB A1000​
<DISCLAIMER>​
By attempting these steps, your warranty will be void. Even worse than that, it might cause crashes, freezes, random explosions, 2nd degree burns, or even turn your beloved tab into $100+ paperweight. What works on mine might not work on yours, so don't attempt if you don't know what you're doing. Do at your own risk. Corrections are welcome. I must admit that I'm not an expert, so any info I posted might be wrong, and I can't offer you much help. I'm not responsible for anything arising from the use of this how-to. I can only wish you good luck.
<WHY ROOT?>​
- Without root or OTA upgrades (at time of writing, Indonesian customers still can't get it), you'll be stuck with ~500MB internal memory. That's annoying.
- You're stuck with the default IO scheduler (cfq) and governor (hybrid, haven't heard that one..)
- You have an incredibly large amount of bloatware you can't get rid of, in that already cramped up internal storage
- Did I mention freedom?
<REQUIREMENTS>​
This method is originally used to root Acer Iconia B1-A71. Somehow I noticed that the two actually has the same chipset, MTK8317 (if it really was relevant ). So I tried the method, and through sheer n00b's luck, it worked like a charm!
Lenovo IdeaPad A1000-G --> 4GB storage, 2G/EDGE. This method haven't been tested on A1000-T/F, different storage cap (16GB, etc.) or other variants, but it should work with slight modification. Screenshots of my specs are attached below. Remember, proceed at your own risk!
A Linux System. Never tried on Windows or Mac. I personally used Linux Mint 15. The source post uses Ubuntu.
working ADB (android-tools-adb). You can get this from synaptics, apt-get, etc. If your system can detect adb devices, you should be fine.
Superuser Binary
Busybox Binary (You can get these two from the links on original post. XDA says noobs can't post links :'( )
ORIGINAL THREAD
<CREDITS>​
XDA Senior Member entonjackson, for writing such a noob-friendly how-to for rooting Acer Iconia B1-A71 and for allowing me to use it for this how-to.
XDA Member alba81, for discovering the method as acknowledged on the original post by entonjackson
All awesome gurus on XDA which I can't mention one by one.
<THE STEPS>​
1. Extract the android sdk to your home folder, e.g. a user named Bob will use like /home/bob
2. Open a terminal
3. Now plug your A1000 into your machine and turn on Debugging Mode (Go into Settings -> Developer Tools, turn on Developer tools, then turn on USB Debugging Mode)
4. Now back at the keyboard of your Linux machine in your terminal type:
Code:
sudo adb devices
The output should be something like:
Code:
123456789ABCDEF device
If it's not, google for it. Somehow your Linux hasn't detected the A1000, although the android sdk for Linux brings all needed drivers with it.
If your device was found, congratulations. The adb connection between your linux machine and your tablet is intact.
5. Now extract the downloaded busybox archive to your home folder, in it there should be a busybox binary. So Bob does:
Code:
sudo ./adb push /home/bob/busybox /data/local/tmp
Code:
sudo ./adb shell
Code:
chmod 755 /data/local/tmp/busybox
6. You should copy the busybox binary into a directory where you can access it as a plain non-root user on the tablet. We need this binary. so we can apply unix tools like telnet, dd, cat, etc. But for now we need it to establish a telnet session between our tablet and our linux machine.
(This point is written on original post. Seems important, but as soon as I finished step 5, I can use those tools)
7. Dial *#*#3646633#*#* to enter Engineer Mode
8. Go to Connectivity -> CDS Information -> Network Utility
9. type the following command:
Code:
/data/local/tmp/busybox telnetd -l /system/bin/sh -p 1234
Advice from original poster: copy and paste it from the browser on your tablet, because dependent on which keyboard app installed, this can be freakin tricky. In the next step you will learn, why it's so important why this command should be correct.
10. Tap on Run. You won't get any feedback, so you will never know if the entered command runs properly or not. That's why you should make sure the command is ok.
Now we have started our telnet server on the tablet.
11. Back in the terminal type:
Code:
/data/local/tmp/busybox telnet 127.0.0.1 1234
If you now get an error like couldn't find busybox or something, then either adb push failed or you forgot to chmod, in step 5
12. Now enter:
Code:
cat /proc/dumchar_info
You should get a bunch of lines, try to find a line containing the partition named android
{..... partition list .....}
android 0x0000000028A00000 0x00000000020E8000 2 /dev/block/mmcblk0p3
{..... partition list .....}
13. We will create a dump of our android system. This is the point where different variants *MIGHT* have different parameters. This step is important, as wrong parameter will result in unmountable image.
Stop. Take a deep breath. If you're not familiar with dd, find a good doc of it. There's a plethora of them.
Get yourself a programmer's calculator (Linux Mint 15 has one built in).
Here's what you'll do :
Convert the hex number on the 3rd column into decimal. In my case (0x20E8000) will yield 34504704. Divide by 4096. The result (8424) goes to the skip parameter.
Convert the hex number on the 2nd column. In my case (0x28A00000) will yield 681574400. Divide by 4096. The result (166400) goes to the count parameter.
So the full dd command will look like :
Code:
dd if=/dev/block/mmcblk0 bs=4096 skip=8424 count=166400 | gzip > /cache/system.img.gz
Do a full sanity check before hitting enter! It will take about 5 minutes.
14. After it's finished we must make the image readable for adb, so we do:
Code:
chmod 777 /cache
and
Code:
chmod 777 /cache/system.img.gz
15. Leave the telnet, and then adb shell session by:
Code:
exit
Code:
exit
16. Now we pull our image by
Code:
sudo adb pull /cache/system.img.gz
wait 1-2 minutes.
It should be then located inside /home/bob. It did for me. If not, do a search . It should be a .gz, extract it right there (or /home/bob if it isn't there)
17. Now we need to modify our system image by adding the tiny but helpful su binary. Extract the SU binary to /home/bob.
18. We create a folder where we will mount our system image to. To create it do:
Code:
sudo mkdir /media/a1000
19. Now we mount it:
Code:
sudo mount -o loop /home/bob/system.img /media/a1000
if it fails, then you entered wrong parameters on step 13
20. Now we copy our SU binary to our mounted system image:
Code:
sudo cp /home/bob/su /media/a1000/bin
21. the su binary needs to have the proper rights to make it usable, so we 'suid' it with:
Code:
sudo chmod 06755 /media/a1000/bin/su
22. Let's unmount our baby by:
Code:
sudo umount /media/a1000
and because bob doesn't like a messed up system, he does:
Code:
sudo rm -rf /media/a1000
because he hopefully won't need it anymore.
23. We have to gzip it again to bring it back to where it belongs to. this we do by:
Code:
cd /home/bob
Code:
gzip /home/bob/system.img
24. So here we are now, we made it to the final Boss fight! The next steps are dangerous and should be performed with caution. We copy back our modified system image, which can brick your device, if you do a mistake! Enter adb shell again :
Code:
sudo adb shell
25. Remove the old boring image:
Code:
rm /cache/system.img.gz
26. Leave adb shell
Code:
exit
27. copy our cool new system image containing the su binary:
Code:
sudo adb push /home/bob/system.img.gz /cache
28. Enter adb shell again
Code:
sudo adb shell
29. Usually the telnet server on the tablet is still running, at least in my case it's been like that. That's why we can directly connect to the telnet server with:
Code:
/data/local/tmp/busybox telnet 127.0.0.1 1234
If this doesn't work, then obviously your telnet server isn't running anymore. So on your tablet if the telnet command is still entered (see step 9), tap on Run again and repeat step 29.
30. Now this is the most dangerous step in this how to (no it wasn't the mkdir one). You can copy following command to make sure everything is fine and paste it into your telnet session on your linux terminal.
<WARNING! SANITY CHECK! MAKE SURE *ALL* THE DD PARAMETERS MATCH THE FIRST DD (STEP 13) OR YOUR A1000 WILL TURN INTO A VERY EXPENSIVE PAPERWEIGHT!>
Code:
[B]/data/local/tmp/busybox zcat /cache/system.img.gz | dd of=/dev/block/mmcblk0 bs=4096 seek=8424 count=166400[/B]
After 1-2 minutes you're done, if your tablet or pc or yourself didn't catch fire, everything's fine.
31. Leave telnet / adb shell by doing
Code:
exit
Code:
exit
32. Reboot your A1000 via ADB, then exit
Code:
sudo adb reboot
Code:
exit
33. Unplug your tablet from PC
34. Install Superuser (No, not SuperSU, cause it won't work!). I personally use Superuser by ChainsDD, from Play Store
35. Be lucky. Your tablet and thus you are now free!
Don't forget to hit thanks, if this helps ​

hi, after step 13 (i double checked the command), i get this error
Code:
/system/bin/sh: can't create /cache/system.img.gz: Permission denied
/dev/block/mmcblk0: cannot open for read: Permission denied
I have the WiFi 4G version

Im too stuck in step 13.....nothing wrong with the script, can u give me a solution?
Im using A1000G also

@ts
Your guide work perfectl, in windows enviroment but mount step still need linux,
I've question are you using DirectoryBinding? Mine always close when playing Real Racing, its very annoying
You have suggeztion or alternative for DirectoryBinding?

Root with Windows ?
Hi,
I am a new member because i bought this tblet but i can't root. I don't have a linux environment, so there is a solution with W8 Pro 64 ?
Thanks a lot for you help,

ulisez said:
hi, after step 13 (i double checked the command), i get this error
Code:
/system/bin/sh: can't create /cache/system.img.gz: Permission denied
/dev/block/mmcblk0: cannot open for read: Permission denied
I have the WiFi 4G version
Click to expand...
Click to collapse
have you chmod-ed the busybox (or is the chmod successful without error)? Try chmod-ing the /cache before attempting step 13. It seems that you still don't have access to the NAND device (mmcblk0). Have you updated firmware via OTA?
artonelico said:
Im too stuck in step 13.....nothing wrong with the script, can u give me a solution?
Im using A1000G also
Click to expand...
Click to collapse
Do you encounter the same error message like ulisez had? Could you post the screenshot of the partition list (the lines after you execute dumchar_info)?
rmage said:
@ts
Your guide work perfectl, in windows enviroment but mount step still need linux,
I've question are you using DirectoryBinding? Mine always close when playing Real Racing, its very annoying
You have suggeztion or alternative for DirectoryBinding?
Click to expand...
Click to collapse
I personally use Link2SD by Bulent Akpinar to link apps to 2nd partition on my SDcard.
Letsar said:
Hi,
I am a new member because i bought this tblet but i can't root. I don't have a linux environment, so there is a solution with W8 Pro 64 ?
Thanks a lot for you help,
Click to expand...
Click to collapse
The original developer who posted the method (entonjackson) plans to integrate the method in the next release his toolkit, the Acer Iconia Toolkit. I think you should check his thread : http://forum.xda-developers.com/showthread.php?t=2240029

sammymaddog said:
have you chmod-ed the busybox (or is the chmod successful without error)? Try chmod-ing the /cache before attempting step 13. It seems that you still don't have access to the NAND device (mmcblk0). Have you updated firmware via OTA?
Do you encounter the same error message like ulisez had? Could you post the screenshot of the partition list (the lines after you execute dumchar_info)?
I personally use Link2SD by Bulent Akpinar to link apps to 2nd partition on my SDcard.
The original developer who posted the method (entonjackson) plans to integrate the method in the next release his toolkit, the Acer Iconia Toolkit. I think you should check his thread : http://forum.xda-developers.com/showthread.php?t=2240029
Click to expand...
Click to collapse
Link2SD doesn't link app data, do you have any option?

yes i had same message with ulyses, by the way im from indonesia too can i contact you through chat client?
oh yeah im using windows 7 and using cmd as a terminal in linux
thx before bro

sammymaddog said:
The original developer who posted the method (entonjackson) plans to integrate the method in the next release his toolkit, the Acer Iconia Toolkit. I think you should check his thread : http://forum.xda-developers.com/showthread.php?t=2240029
Click to expand...
Click to collapse
Ok, i see his toolkit. It's very good. I'll wait

rmage said:
Link2SD doesn't link app data, do you have any option?
Click to expand...
Click to collapse
I'm not sure whether the stock kernel of our devices supports init.d, thus supports CronMod/Data2SD. Lenovo locked our bootloader, and currently there's no way around it. So I personally think, Link2SD method are the best option for now.
Let's give it several months until our dev gurus bring their miracles upon this device

The attached image shows mt6577 Hardware, can u provide the Soc details please

Hi, Can any one upload Lenovo ideatab A1000 system.img

in step 20, it appears you are writing to a /bin directory on the android system. However such a directory is not visible either through shell or the system telnet account.
Do I need to understand something else about android to make sense of this.
regards
vidya

one month gone past but the op seems to be in caves or has bricked the device

STOCK ROM
CAN ANY BODY PROVIDE ME A STOCK ROM OF THIS DEVISE
I HV ROOTED SUCCESSFULLY BY A VERY EASY METHOD
BUT SCREWED UP WHILE UPDATING IT SO PLZ PLZ HELP ME OUT
THE DEVICE BOOTS BUT ALL THE APP CRASHES :crying::crying:

VR.gtmini said:
The attached image shows mt6577 Hardware, can u provide the Soc details please
Click to expand...
Click to collapse
VR.gtmini said:
one month gone past but the op seems to be in caves or has bricked the device
Click to expand...
Click to collapse
sorry to make you wait. I'm a last grader university student, and final project stuffs have got me pinned down. Hope you understand
Actually the SoC is MT8317. For some god-knows reason Mediatek have made this SoC with signatures similar to MT6577. But somehow CPU tweaker correctly detects the SoC (MT8317). Maybe it's the CPU-Z bug?
unknown_world said:
Hi, Can any one upload Lenovo ideatab A1000 system.img
Click to expand...
Click to collapse
zod0070 said:
CAN ANY BODY PROVIDE ME A STOCK ROM OF THIS DEVISE
I HV ROOTED SUCCESSFULLY BY A VERY EASY METHOD
BUT SCREWED UP WHILE UPDATING IT SO PLZ PLZ HELP ME OUT
THE DEVICE BOOTS BUT ALL THE APP CRASHES :crying::crying:
Click to expand...
Click to collapse
I'm uploading the modified .img. Let's pray my old HSPA modem won't catch fire by the morning.
vidyadhara said:
in step 20, it appears you are writing to a /bin directory on the android system. However such a directory is not visible either through shell or the system telnet account.
Do I need to understand something else about android to make sense of this.
regards
vidya
Click to expand...
Click to collapse
I think you got it wrong. The write process does not take place on the device. It's on the loop-mounted .img in /mnt/a1000 on your computer (step 18-19). Cheers!

Here's the ALREADY BUSYBOX-ED .img for Ideapad A1000-G 4GB EDGE version. Hope it helps :
www dropbox com/s/rmpnz7c285t5sqz/system.7z

sammymaddog said:
Here's the ALREADY BUSYBOX-ED .img for Ideapad A1000-G 4GB EDGE version. Hope it helps :
www.dropbox.com/s/rmpnz7c285t5sqz/system.7z
Click to expand...
Click to collapse
Thanks for coming back, could u post the MD5 of the system.7z & system.zip.
Also could u provide simple way/steps to directly flash this .img without extracting existing stock system image
My tab A1000-G

do you have stockROM for lenovo A1000G
I need this :crying:

raffly said:
do you have stockROM for lenovo A1000G
I need this :crying:
Click to expand...
Click to collapse
Don't worry, the above link is a stock Lenovo A1000 G ROM, but with pre-root files having no superuser app. Just extract the .7z file
System.7z MD5: 658CA71AC8A230B244F267513857F9A5