[Galaxy S II General] appagom:
root through "hidden" partition

For reference only really. Read next post for the easiest way to root a stock ROM.

So I found a new way to get root with a stock ROM. First, the usual ways are all pretty much some form of these:

1)Through a run-time exploit.

2)Through a kernel flash.

3)Through a ROM flash.

4)Through an un-finicky recovery mode if you have one (see next post)

Ideally 1 isn't possible because it REALLY IS a security threat to yourself in that a malicious app could do it too in most cases (and it's happened), but of course these do exist and are often easy to apply once worked out. The exploits come and go though. Some kernel flashes actually use modified stock kernels that required root access or a leak to obtain in the first place (mine did and I think tegrak's did and or still do) and method 3 requiers first having a ROM to modify which one could say is an exploit of sorts anyway. Of course someone with some dev skill can get in the door even with a leaked ROM.. move root to a kernel, then get an official ROM working.. Real custom kernels are just compiled from source. It's almost possible to just rip the ROM off the phone directly, but a few system files don't have read permissions without already having root access so only compiling the kernel, 4, and my new trick below doesn't require some kind of sneakery.

Method 4, which surely I'm not the first to notice, but I haven't checked, is to use the "hidden" partition, which we didn't have before, which is mounted by the Jelly Bean ROMS under /preload.

This partition contains nothing but apps (apks) which are all readable (I think they must be to work, but anyway they are). most are probably arguably bloatware anyway, but it looks like some might be desirable or even fairly fundamental, I'm not sure yet.

It also turns out that it is possible to execute files from this partition (that's not true on the internal storage for instance), but of course it's not writable without flashing it.

So it's easy to copy all the files off the so called "hidden" partition (it's not hidden) through adb without root access... add an su binary, repack with make_ext4fs and tar and reflash with odin.

Then you can adb in, run /preload/su to get root, and then copy su into the more normal place to make it more readily available to apps.

Again this isn't quite possible for the main partition because of the non-readable files.

I've tested all steps, although not all together since I already have root by hijacking KIES. Anyway, it will work.

If one can get heimdall in linux working reliably for large flashes, (and I'm sure it's possible) this can all be done in a one linux script (or windows too probably.. but click apps aren't my thing) without messing with KIES. Anyway, using odin for the flashing still works.

I will probably start using this method because it doesn't requiring waiting for 20 minutes with your finger over the button to freeze kies at just the right time. It's much faster and more scriptable and doesn't really exploit anything. The only thing you need to get root is a way to insert a readable executable setuid-root file somewhere without damaging the system. This partition provides that.

Next time, I'll write a shell script to automate it. I'll be glad to share. For those without linux.. android runs on linux and, while slightly more work, it should even be possible to do all the work off building the rooted hidden image on the phone itself. I might not have time to make it that tidy though.

I went ahead and made a dev post here:

http://xdaforums.com/showthread.php?t=2168007

No worries. I didn't want to a waste a post just to tell DVDeus he wasted post cause then he might have to waste another post to tell me I wasted a post... lol.