[Android Software/Hacking General [Developers Only]] Edge-Case:
using the busybox commands helps... ie

"busybox mount [and whatever your options and dirs are]"

for me right now I am working backwords, but this helped me...

"busybox mount --rbind $subset/etc /etc" where without the 'busybox' at the front I get errors but with it it works like it should.

I had it working the other day where I booted up msfconsole Without! a chroot.

I mounted the image and instead of changing my root to the root of the image, I moved all the dirs in the root of the image to the root ("/") directory of my phone (samsung gs III, sprint) and added the normal PATHs to my environ with an export. It has a few kinks due to a small amount of filesystem clashing at the /etc filesystem, stuff like bluetooth config files an rc files.

I'm excited about it, if anyone is interested in working on getting Backtrack and Kali working on phones Without! a chroot, I have been working on it, maybe a colaboration or dedicated thread somewhere.

I got it up and running again without a chroot, heres a looksee:

localhost / # set
ANDROID_ASSETS=/system/app
ANDROID_BOOTLOGO=1
ANDROID_CACHE=/cache
ANDROID_DATA=/data
ANDROID_PROPERTY_WORKSPACE=8,49152
ANDROID_ROOT=/system
ANDROID_SOCKET_adbd=9
ANDROID_STORAGE=/storage
ASEC_MOUNTPOINT=/mnt/asec
BASH=/system/xbin/bash
BASHOPTS=checkwinsize:cmdhist:expand_aliases:extquote:force_fignore:histappend:hostcomplete:interactive_comments:progcomp:promptvars:sourcepath
BASH_ALIASES=()
BASH_CMDS=()
BASH_LINENO=()
BASH_SOURCE=()
BASH_VERSINFO=([0]="4" [1]="1" [2]="0" [3]="1" [4]="release" [5]="arm-android-eabi")
BASH_VERSION='4.1.0(1)-release'
BOOTCLASSPATH=/system/framework/core.jar:/system/framework/core-junit.jar:/system/framework/bouncycastle.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/telephony-common.jar:/system/framework/mms-common.jar:/system/framework/android.policy.jar:/system/framework/services.jar:/system/framework/apache-xml.jar
COLUMNS=80
DIRSTACK=()
EMULATED_STORAGE_SOURCE=/mnt/shell/emulated
EMULATED_STORAGE_TARGET=/storage/emulated
EUID=0
EXTERNAL_STORAGE=/storage/emulated/legacy
GROUPS=()
HISTFILE=//.bash_history
HISTFILESIZE=500
HISTSIZE=500
HOME=/sdcard
HOSTNAME=android
HOSTTYPE=arm
IFS=$' \t\n'
LD_LIBRARY_PATH=/vendor/lib:/system/lib
LINES=24
LOOP_MOUNTPOINT=/mnt/obb
MACHTYPE=arm-android-eabi
MAILCHECK=60
MKSH=/system/bin/sh
OPTERR=1
OPTIND=1
OSTYPE=android-eabi
PATH=/sbin:/usr/bin:/usr/local/bin:/usr/sbin:/bin:/usr/local/sbin:/usr/games:/sbin:/vendor/bin:/system/sbin:/system/bin:/system/xbin:/bin:/sbin:/usr/bin:/usr/sbin
PIPESTATUS=([0]="0")
PPID=4242
PS1='\[\033[01;31m\]\h\[\033[01;34m\] \W \$\[\033[00m\] '
PS2='> '
PS4='+ '
PWD=/
SECONDARY_STORAGE=/storage/sdcard1
SHELL=/system/bin/sh
SHELLOPTS=braceexpand:emacs:hashall:histexpand:history:interactive-comments:monitor
SHLVL=1
TERM=linux
TERMINFO=/system/etc/terminfo
UID=0
USER=shell
_=PATH
localhost / # ls
acct init.target.rc
bin init.trace.rc
cache init.usb.rc
charger initlogo.rle
config lib
d lpm.rc
data media
default.prop mnt
dev opt
efs persist
etc proc
extSdCard res
firmware root
fstab.qcom run
home sbin
init sdcard
init.cm.rc srv
init.goldfish.rc storage
init.qcom.class_core.sh sys
init.qcom.class_main.sh system
init.qcom.early_boot.sh tmp
init.qcom.lpm_boot.sh tombstones
init.qcom.rc ueventd.goldfish.rc
init.qcom.sh ueventd.qcom.rc
init.qcom.syspart_fixup.sh ueventd.rc
init.qcom.usb.rc usbdisk0
init.qcom.usb.sh usr
init.rc var
init.recovery.qcom.rc vendor
localhost / # which apt-get
/usr/bin/apt-get
localhost / # which python
/usr/bin/python
localhost / # python
Python 2.7.3 (default, Jan 4 2013, 13:44:41)
[GCC 4.6.3] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> exit()
localhost / # which msfconsole
/usr/bin/msfconsole
localhost / # apt-get install reaver
Reading package lists... Done
Building dependency tree
Reading state information... Done
reaver is already the newest version.
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
localhost / #