yashsingh1/xdaforums huggingface dataset:
[Android Software Development] thephunk:
Getting "[-] Cannot copy boomsh.: Permission denied" from the shell when attempting to run zergRush on HTC Amaze. This was the 2nd time running on this phone after a reboot. The 1st time was successful, however my wife pulled me away so I couldn't finish what I wanted to do with root. No, I'm not going to divorce her over this. :)

macpro:platform-tools $ /android/platform-tools/adb push /android/temp/zergRush /data/local/zergRush
2076 KB/s (21215 bytes in 0.009s)
macpro:platform-tools $ /android/platform-tools/adb shell
$ chmod 755 /data/local/zergRush
$ /data/local/zergRush

[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.

[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.

[-] Cannot copy boomsh.: Permission denied
$ macpro:platform-tools $
[Android Software Development] ieftm:
You may need to create /data/local/tmp first.

Also, if you've already ran this once, you might need to clean up this directory - remove boomsh/sh.
[Android Software Development] Nitemar3:
how do i clean up the directory
[Android Software Development] thephunk:
That was exactly it. It appears that I have to do that each time I run to get root. Thanks!
[Android Software Development] Nitemar3:
edit : i rooted :)
[Android Software Development] zaventh:
Same. Is there no hope for this on the SGS2? Interestingly, shortly after running this the app layer crashes and the android UI restarts. Could it just be a matter of finding the correct offsets for this device?
[Android Software Development] csoulr666:
Same here plzzz
[Android Software Development] ajeevlal:
how did u push the bin? mine is s-on and for me it says permission denied

---------- Post added at 09:16 PM ---------- Previous post was at 09:04 PM ----------

i found the problem, i am supposed to push outside the adb shell
[Android Software Development] ajeevlal:
in adb shell, change directory to /data/local/tmp

then use rm boomsh and rm sh
[Android Software Development] paxChristos:
Or you could just type in the following

goto /data/local/

$ rm -r tmp

$ mkdir tmp

and now you have a clean tmp folder!

Have tried it 3x so far with the Sony Xperia Play (R800x) to no avail, here's the code

I am running Ubuntu 11.10, adb is latest version, R800x is running gingerbread 2.3.3

[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.

[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.

[+] Found a GingerBread ! 0x00015118
[*] Scooting ...
[*] Sending 149 zerglings ...
[+] Zerglings found a way to enter ! 0x10
[*] Sending 149 zerglings ...
[*] Trying a new path ...
[*] Sending 149 zerglings ...
[*] Trying a new path ...
[*] Sending 149 zerglings ...
[*] Trying a new path ...
[*] Sending 149 zerglings ...
[+] Zerglings caused crash (good news): 0x2abcccd4 0x0054
[*] Researching Metabolic Boost ...
[+] Speedlings on the go ! 0xafd257e1 0xafd39297
[*] Poping 24 more zerglings
[*] Sending 173 zerglings ...

[-] Bad luck, our rush did not succeed :( (0/2)
[*] Poping 24 more zerglings
[*] Sending 173 zerglings ...

[-] Bad luck, our rush did not succeed :( (1/2)
[*] Poping 24 more zerglings
[*] Sending 173 zerglings ...

[-] Bad luck, our rush did not succeed :( (2/2)
Exiting. Try again later.

Any ideas?
[Android Software Development] csoulr666:
Thanks.....it worked
[Android Software Development] bizal05:
Can someone put a detailed step by step for noobs. From downloading to finish every command I have tried is not working

chmod 755 /data/local/zergRush says no such directory

I tried to adb push and it says permission denied

adb shell says no such directory

where am I even supposed to drop this zerg rush file at? on my SD card (external) on the SD card (internal) on the phone itself??? I'm super confused tried to be a man and figure it out on my own but i'm reaching out for help.

---------- Post added at 10:26 AM ---------- Previous post was at 10:17 AM ----------

my phone is an amaze 4g...
[Android Software Development] paxChristos:
UPDATE: Sorry about the delay, I got home last night and forgot about this, and now i have a few minutes while I try to fix one of my computers to respond...

zergRush does not go on your sdcard, it goes on your internal memory (/mnt/sdcard is the (actual) location of your sd card on your phone, where as, the /data/local is located within the internal memory of your phone (sorry if that's unclear, i went nerd on it :P )

When I get home I'll answer all your questions if this doesn't help

UPDATED DIRECTIONS: Win 7

1) Put a fresh (just formatted with no data on it) SD Card into your phone (this helps with some roots, not all, but better safe than sorry)

2) On your phone, goto settings -> applications -> development and check "USB debugging"

3) Plug your phone into your computer

4) Download zergRush

5) unzip zergRush

6) navigate to android sdk (varies from computer to computer, my (win7) install location was c:\Android-SDK-x86 (or something like that)

7) (If you've already downloaded all the sdk tools, you don't need this one) Download and install any missing sdk tools (i.e. adb) (i just selected most of the and let my computer sit overnight to install everything)

8) run command prompt (in windows 7, press windows flag + r to open up the run command, then type cmd, hit enter)

9) Navigate to the "platform-tools" folder inside of your android-sdk folder

10) type in "adb push C:\[location of zergRush]\zergRush /data/local"

11) type in "adb shell"

12) type in chmod 755 /data/local/zergRush

13) type in "/data/local/zergRush"

14) Good luck, it works on some phones, but not others!

Directions for linux:

1) You probably already know what you're doing, have fun!!

2) If you don't, here goes,

3) follow steps 1-7 above

4) open terminal

(5&6 are optional)

5) run the su command, type in your root password (i use it for the next step, you can just use sudo if you're more comfortable with that)

6) type in "cp /[path to android sdk]/platform-tools/adb /bin" (run adb from anywhere!!)

7) follow steps 10-14

Also: Fastboot in linux: go here

NOTE: If at first it doesn't succeed, try typing in "adb kill-server" and try again!

Any questions?
[Android Software Development] bizal05:
thank you very much that helped alot....now its saying cannot copy boomsh permission denied ???
[Android Software Development] paxChristos:
Run the following commands in abd shell:

1) cd /data/local

2) rm -r tmp

3) mkdir tmp

You'll need to run

This each separate time you run zergrush
[Android Software Development] ieftm:
Try again on the latest version, this version contains fixes for SE phones.
[Android Software Development] paxChristos:
Thank you, ieftm,

I talked to ch4lky, and he got me the updated one this morning.

Thanks to you guys, we actually got the first non-flashed root up for the r800x (american verizon xperia play)

(here's our thread: http://xdaforums.com/showthread.php?t=1312859 )

You guys at revolutionary are my heros!!
[Android Software Development] paxChristos:
Casio Commando 2.3.3

This (updated 10-20-11) works with the Casio Commando 2.3.3!!
[Android Software Development] ajeevlal:
How did u pushed superuser, i got error saying 'out of memory'
[Android Software Development] paxChristos:
Don't push it, install it via adb.

Also you might wanna check your memory... You might not have enough free space...
[Android Software Development] Droidzone:
If I am not mistaken, this leaves the exploit open for closing..Wise?

I'm looking at:

etc
[Android Software Development] paxChristos:
Wrong thread, mod please delete
[Android Software Development] Ch4lky:
What do you mean ?
[Android Software Development] ieftm:
Try with the current version ! :)
[Android Software Development] Droidzone:
What I mean is that once the source code is exposed, it's only a matter of time before manufacturers patch the vulnerability. Of course the benefits are porting code to a variety of devices than the actual number the alpharev team has in their possession.

TouchPal-d from my Desire running Starburst Classic Rom - 450 apps and counting. .
[Android Software Development] KnightCrusader:
I just tried the newest version on the Samsung Stratosphere and got the same thing. :(
[Android Software Development] Ch4lky:
You're right, but the vulnerability is already known from Google, since it has been silently patched in Honeycomb...
[Android Software Development] cmstlist:
It could be that the vulnerability is just incidentally not present in Honeycomb. Maybe Google did not know about it, but for some other reason they rewrote some code in 3.x and it's not vulnerable.
[Android Software Development] ajeevlal:
i should copy the su binary to /system/bin right? i was not able to do it, it always says out of memory. and i checked i have internal memory in my phone.... any help
[Android Software Development] ingro:
Hello, just a question... Rooting with your script my Xperia Neo will delete the phone DRMs as the other root exploits do? Thanks.
[Android Software Development] Ch4lky:
No, a check has been added to prevent the overflow.

The exploit just gives you adb root access, nothing is deleted.
[Android Software Development] slavislavi:
Samsung SL I9003, Android 2.3.5, XXKPM

[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.

[+] Found a GingerBread ! 0x0002c118

[+] Found a Samsung, running Samsung mode

[*] Scooting ...

[*] Sleeping a bit (~40s)...

[*] Waking !

[*] Sending 149 zerglings ...

[+] Zerglings found a way to enter ! 0x10

[+] Overseer found a path ! 0x0002e4e8

[*] Sleeping a bit (~40s)...

and repeats ad infinitum
[Android Software Development] lordwolf88:
$ /data/local/zergrush

/data/local/zergrush

[**] Zerg rush - Android 2.2/2.3 local root

[**] (C) 2011 Revolutionary. All rights reserved.

[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.

[-] Cannot copy boomsh.: Permission denied
[Android Software Development] paxChristos:
If you're running zergrush more than once you need to remove boomsh and sh.

type the following into adb shell:

1) "rm /data/local/tmp/boomsh"

2) "rm /data/local/tmp/sh"
[Android Software Development] Lord Takyon:
Can this root arc lt15i on 2.3.4?

I have read the thread and it doesn't say.

Sent from my awesome Arc via subspace beacon.
[Android Software Development] qzem:
Try it and report it. This method wont brick your phone.
[Android Software Development] Lord Takyon:
Lol I will when I have a bit of spare time.

I'm only hesitant because it was a nightmare getting 2.3.3 with root, and the arc can be tricky to downgrade sometimes, battery issues.

Sent from my awesome Arc via subspace beacon.
[Android Software Development] *se-nsei.:
Could someone briefly expand on 'adb root access' ? Does this mean custom ROMs can be installed and what are the main limitations which wouldn't be there with full root?
[Android Software Development] eerie_silence:
thx guys , rooted my Yp-g70 ( 2.3.5 gingerbeard)
[Android Software Development] Lord Takyon:
Arc running latest .42 fw, successfully rooted following this guide.

Cheers people.
[Android Software Development] zl9739379:
Good Job!!!!!!!!!:D
[Android Software Development] SharpIS03:
Sharp IS03

This is what I get. Good work though!

$ /data/local/zergrush
/data/local/zergrush

[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.

[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.

[+] Found a Froyo ! 0x00016108

[*] Scooting ...

[*] Sending 149 zerglings ...

[*] Sending 189 zerglings ...
[-] Hellions with BLUE flames !
$
[Android Software Development] belzebuthange:
HI,

What about HTC Wildfire S HBOOT 1.03.0000 ?

Thanks
[Android Software Development] dianotea:
I can confirm this works like a charm.

My arc with locked bootloader and FW .42 2.3.4 was rooted in minutes......thanks for your awesome jobk (today I posted this message in the wrong 3d.....It was directed to OP and zergRush / REVOLUTIONARY......),
[Android Software Development] Camaro305:
I did the zergrush, and got root. However, I think I removed too many things with Titanium Backup. Now the phone is giving me "process.android.media" errors and I can't access market.

Anyone know how to get back to stock and unroot? I tried factory resetting, didn't help. Thanks!
[Android Software Development] paxChristos:
Find a system dump for your phone, reinstall then run the reverse of zergrush (rm is delete in adb)
[Android Software Development] cmstlist:
If a system dump using dd were available, would it be safe to restore it using dd, or would that corrupt the OS?
[Android Software Development] Camaro305:
Searched high and low for a stock system dump of the Exhibit. No luck. Any ideas please? Thank you!!!
[Android Software Development] paxChristos:
Sorry dude, looks like there aren't any hiding out there (even samsung doesn't have a stock rom available)

what you could try is find somebody else with an exhibit, and have them pull /system/app and then on your phone, re-root it, and push their file....

(1) other person types "adb pull /system/app C:\[path to where they want to save it]

2) zips up file, and emails it/puts it on dropbox/etc

3) you download and extract file and type "adb push C:\[path to where you saved it] /system/app")

Good luck, I suggest you offer people $$ to do it...
[Android Software Development] Camaro305:
My wife has the same phone as me. So I could try to grab hers. Could you please tell me how to execute those commands? Would I just install the android sdk on a pc and issue those commands via command prompt?
[Android Software Development] saugatdb:
Works like a charm for SE xperia mini pro sk17i, bootloader is still locked to use the DRM contents of SE. thanks :)
[Android Software Development] paxChristos:
sent you a pm, check that.
[Android Software Development] fazanatas:
i think it worked with my xperia mini. i have superuser rights and rootaccess. thx mate
[Android Software Development] Camaro305:
I ran adb pull command on the system/app on my phone and it copied a bunch of .apk and .odex files to my c drive. I assume I'm missing some critical .apk's and .odex's and by doing this on my wife's phone, then pushing them to mine, will fix the problem?
[Android Software Development] cmstlist:
What you propose has one serious flaw - if you are copying to your desktop and back, you will lose proper file permissions. This can seriously f**k up Android.
[Android Software Development] Camaro305:
So basically what it seems like I've done, is use Titanium Backup to delete (not freeze) some necessary files/apps from the phone after using the zergrush root method. I'm confused at what to do now, since pulling and pushing seems like it won't help?
[Android Software Development] paxChristos:
You are completely right, wow I can't believe I forgot that.

@Camaro305 -- You'll have to chmod 755 [app.apk] & [.odex] and chown root.shell [app.apk] & [.odex] every single file you push before even attempting to reboot

you'll need to have root to run this.
[Android Software Development] Camaro305:
Tmobile is replacing the phone. Thanks guys.
[Android Software Development] paxChristos:
That's probably the best option out there :P

If you do root again, be very very careful about what you remove. There really isn't much information out there for the Exhibit, and unless you wanna be the pathfinder for everybody, be careful :P
[Android Software Development] Camaro305:
I'm done with root. I'll deal with the bloatware. :D Thanks tons!!!
[Android Software Development] cmstlist:
It would have been a lot easier if there were a custom recovery available for your phone. Anyway glad you got it dealt with.
[Android Software Development] Airbag888:
This worked great for me on my Samsung Galaxy S2 running Stock KG5

Applied via Doomlord's Easy Root Toolkit @ http://xdaforums.com/showthread.php?t=1319653

Thanks a lot

Edit: This also worked flawlessly on 2.3.6 Nexus One stock. In fact it did it within 30secs.
[Android Software Development] schölli:
Works also very well for Samsung Galaxy Note... ;)
[Android Software Development] jitin02:
Do it support htc explorer?
[Android Software Development] Google86:
Can you add support for i9103 GALAXY R please?
[Android Software Development] DarknessDragon:
Yep,it doesnt works in Galaxy R,says this:

Uploaded with ImageShack.us

Could you help us? :(
[Android Software Development] Google86:
Yes please, support for i9103¡
[Android Software Development] jitin02:
Doesnt work on HTC Explorer(A310e) ;-(

Any help here.

All its says is Bad luck

procedure i followed:

from platform-tools, push zergRush file to /data/local/

then, the 2 commands mentioned in OP

after this once i got we are doomed then rest all 3 tries were Bad Luck.

pls ny help

---------- Post added at 11:18 AM ---------- Previous post was at 11:15 AM ----------

i am facing the same problem ;-(

Please add support for Htc Explorer(A310e), pleaseee
[Android Software Development] SB-Son:
Cool :p

It work fine with is11s.

But, SH-12C it suspend at "wait-for-device"

So, I enter the command line by line and get the following message.

>adb shell "cd /data/local/tmp/; rm *"

>adb push files\zergRush /data/local/tmp/.

481 kb/s (23052 bytes in 0.046s)

>adb shell "chmod 777 /data/local/tmp/zergRush"

..... so far so good....

>adb shell "./data/local/tmp/zergRush"

.....

[+] Found a GingerBread ! 0x00016118

[*] Scooting..

[*] sending 149 zerglings ...

[*] sending 189 zerglings ...

[-] Hellions with Blue flams !

>adb push files\busybox /data/local/tmp/.

874 kb/s (1075144 bytes in 1.887s)

>adb shell "chmod 755 /data/local/tmp/busybox"

>adb shell "/data/local/tmp/busybox mount -o remount,rw /system"

mount' permission denied (are you rooted)

also i found /system is r/w only for the owner,

for users and others it is set to read only.

how can i change it ? any idea ?

thanks !!
[Android Software Development] kgood63:
seriously thinking about obtaining another evo 3d i have rooted every htc phone i own and is wondering has this been tried out on the evo 3d
[Android Software Development] cmstlist:
Use Revolutionary S-OFF for the EVO 3D.
[Android Software Development] jitin02:
No one here to help me ;-(
[Android Software Development] kgood63:
wont work on hboot 1.5
[Android Software Development] SharpIS03:
SH-12C, Sharp device, isn't it? Sharp's devices are very difficult to crack, especially the NANDlock. This method doesn't work on my Sharp IS03, I get stuck at the flames part too.
[Android Software Development] paxChristos:
Anybody have any clue why this would work worth verizon's xperia play on 2.3.3, but not 2.3.2?
[Android Software Development] DooMLoRD:
For 2.3.2 FW use gingerbreak
[Android Software Development] paxChristos:
Doesn't work with sony ericson xperia play R800x
[Android Software Development] jitin02:
Hi,

I tried this on my htc explorer and following is what I got

C:\Users\jitin>cd\

C:\>cd android-sdk-windows\platform-tools\

C:\android-sdk-windows\platform-tools>adb push zergRush /dat

* daemon not running. starting it now on port 5037 *

* daemon started successfully *

481 KB/s (23056 bytes in 0.046s)

C:\android-sdk-windows\platform-tools>adb shell

$ chmod 755 /data/local/zergRush

chmod 755 /data/local/zergRush

$ /data/local/zergRush

/data/local/zergRush

[**] Zerg rush - Android 2.2/2.3 local root

[**] (C) 2011 Revolutionary. All rights reserved.

[**] Parts of code from Gingerbreak, (C) 2010-2011 The Andro

[+] Found a GingerBread ! 0x00017118

[*] Scooting ...

[*] Sending 149 zerglings ...

[+] Zerglings found a way to enter ! 0x10

[+] Overseer found a path ! 0x000171e0

[*] Sending 149 zerglings ...

[+] Zerglings caused crash (good news): 0x403079c4 0x0054

[*] Researching Metabolic Boost ...

[+] Speedlings on the go ! 0xafd26231 0xafd3a10f

[*] Popping 24 more zerglings

[*] Sending 173 zerglings ...

[-] Bad luck, our rush did not succeed :(

Please please help me
[Android Software Development] Ch4lky:
HTC Explorer has ASLR.

Exploit cannot work with ASLR.
[Android Software Development] jitin02:
There should b another way

(i know its not known to you know but can be know ever;-)
[Android Software Development] RashaMatt:
Donation sent (Galaxy Note)

Thanks - took some time, but worked on my Galaxy Note :)

Donation sent!

[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.

[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.

[+] Found a GingerBread ! 0x0002e118
[+] Found a Samsung, running Samsung mode
[*] Scooting ...
[*] Sleeping a bit (~40s)...
[*] Waking !
[*] Sending 149 zerglings ...
[*] Sleeping a bit (~40s)...
[*] Waking !
[*] Sending 189 zerglings ...
[+] Zerglings found a way to enter ! 0x18
[+] Overseer found a path ! 0x00030610
[*] Sleeping a bit (~40s)...
[*] Waking !
[*] Sending 189 zerglings ...
[+] Overseer found a path ! 0x000306d8
[*] Sleeping a bit (~40s)...
[*] Waking !
[*] Sending 189 zerglings ...
[+] Zerglings caused crash (good news): 0x40322cd4 0x0074
[*] Researching Metabolic Boost ...
[+] Speedlings on the go ! 0xafd25b15 0xafd395df
[*] Sleeping a bit (~40s)...
[*] Waking !
[*] Sending 181 zerglings ...

[+] Rush did it ! It's a GG, man !
[+] Killing ADB and restarting as root... enjoy!

D:\DOWNLOADS\Android\Note>adb shell
# id
id
uid=0(root) gid=0(root)
[Android Software Development] jitin02:
Just checked my htc explorer build.prop and in that there is a line ro.product.model= htc wildfire s . A510e

I mean it the model name is htc explore a310e, whereas it is mentioned wildfire s , will rootin trick for wildfire s work on this? Should I try
[Android Software Development] $omator:
gt-i9000 2.3.5 xxjvt

after one of rushes i get +++ LOG: write failed (errno=14) spam

but it seems to worka anyways afterwards :)
[Android Software Development] arunp44:
Just picked up the HTC Vivid (Raider) and the temp root works wonderfully:

C:\android-sdk\platform-tools>adb shell /data/local/zergRush

[**] Zerg rush - Android 2.2/2.3 local root

[**] (C) 2011 Revolutionary. All rights reserved.

[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.

[+] Found a GingerBread ! 0x00016118

[*] Scooting ...

[*] Sending 149 zerglings ...

[+] Zerglings found a way to enter ! 0x10

[+] Overseer found a path ! 0x000161e0

[*] Sending 149 zerglings ...

[+] Zerglings caused crash (good news): 0x401219c4 0x0054

[*] Researching Metabolic Boost ...

[+] Speedlings on the go ! 0xafd26051 0xafd39f47

[*] Popping 24 more zerglings

[*] Sending 173 zerglings ...

[+] Rush did it ! It's a GG, man !

[+] Killing ADB and restarting as root... enjoy!

Now just need to figure out how to make it perm....
[Android Software Development] twopumpchump:
works on AT&tT samsung galaxy s II skyrocket :) rooted mine in less that 5 mins hehe.
[Android Software Development] nl2008:
Does not work on the new Motorola RAZR xt910, stuck at "You need more minerals" ??? any ideas?
[Android Software Development] JFizDaWiz:
did your skyrocket go super laggy? mine was unbearable, and had to reboot which also lost root so i guess i can try again. really just wanting it for LCD Density right now as I do miss my qHD display a bit, everything is BIG
[Android Software Development] twopumpchump:
this only gives you temp root, don't mess with your phone while you are running with this...you must use adb to push busybox, Superuser.apk, su to system change permissions and reboot. i think i saw a script you can run from windows somewhere in the forum that makes it easy....

http://xdaforums.com/showthread.php?t=1321582
[Android Software Development] JFizDaWiz:
So this isn't something I should be running?
[Android Software Development] Driggity420:
Facebook phone lol all I have to say is why
[Android Software Development] Ch4lky:
It has just been fixed, you can try the new version by downloading it again.
[Android Software Development] DooMLoRD:
thank you guys for the update!

i will update that toolkit soon

regards,

DooMLoRD