[Sony Tablet S] quachtuyen:
THANK ALL

Thanks for all ! i very happy !

I had rooted my Tablets 4.03 r5a :laugh:

My note :

1. Full reset to defaults (Power and button + )

2. Choose english (US) as default language, configure google account.

3. Switch ON USB debugging, Force Stay On, Allow unsigned from security

4. Download and install Zipsigner2 from market

and step by step of http://xdaforums.com/showthread.php?t=1886310

Code:

adb restore settings.ab

Check the result

Code:

adb shell ls -ld /data/data/com.android.settings/a

drwxrwxrwx system system a

And continue, ignore the "rm -r a" permission denied error

(i Skip )

Code:

adb shell

cd /data/data/com.android.settings

rm -r a

while : ; do ln -s /data a/file99; done

While the

loop is running

,

open another cmd console

and run

Code:

adb restore settings.ab

Once the restore process is completed, you can press CTRL+C on the 1st cmd console to break the loop

Check the /data permission

Code:

adb shell ls -ld /data

drwxrwxrwx system system data

YOU must see drwxrwxrwx system system data , if drwxrwx -- x you false , change ADB new

Then continue

Code:

adb push busybox /data/local/tmp

adb push rootkit.tar.gz /data/local/tmp

adb push Superuser.apk /data/local/tmp

adb push su /data/local/tmp

adb shell

cd /data/local/tmp

chmod 755 busybox

./busybox tar zxf rootkit.tar.gz

exit

Push the resigned VpnFaker.apk(resign by ZipSigner 2) and update the timestamp

i do step by step http://xdaforums.com/showpost.php?p=31582941&postcount=42

remember : change file name is VpnFaker_unsign.apk, and VpnFaker.apk in ZIPSINGER2 ,

picture you see is example.

Code:

adb push VpnFaker.apk /data/local/tmp

adb shell

touch -t 1346025600 /data/local/tmp/VpnFaker.apk

exit

Now, replace the VpnDialogs, ignore "cp: can't open 'system/xxxxxxx': Permission denied" while you execute "/data/local/tmp/busybox cp -r system system2"

I run, it show , but i skip :

shell@android:/data $ /data/local/tmp/busybox cp -r system system2

/data/local/tmp/busybox cp -r system system2

cp: can't open 'system/entropy.dat': Permission denied

cp: can't open 'system/batterystats.bin': Permission denied

cp: can't open 'system/users/userlist.xml': Permission denied

cp: can't open 'system/users/0.xml': Permission denied

cp: can't open 'system/accounts.db': Permission denied

cp: can't open 'system/accounts.db-journal': Permission denied

cp: can't open 'system/called_pre_boots.dat': Permission denied

cp: can't open 'system/wallpaper_info.xml': Permission denied

cp: can't open 'system/appwidgets.xml': Permission denied

cp: can't open 'system/netpolicy.xml': Permission denied

cp: can't open 'system/netstats.bin': Permission denied

cp: can't open 'system/netstats_xt.bin': Permission denied

cp: can't open 'system/netstats_uid.bin': Permission denied

Code:

adb shell

cd /data

/data/local/tmp/busybox cp -r system system2

#Pls ignore "cp: can't open 'system/xxxxxxx': Permission denied"

/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;

/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;

mv system system-

mv system2 system

mv app app-

mkdir app

mv /data/local/tmp/VpnFaker.apk /data/app

Make sure the datatime is 2012/08/27 00:00

Code:

TZ=0 ls -l /data/app

-rw-r--r-- shell shell 198580 2012-08-27 00:00 VpnFaker.apk

Generate the packages.xml

Code:

/data/local/tmp/busybox sed -f /data/local/tmp/packages.xml.sed system-/packages.xml > system/packages.xml

And double check the result

Code:

/data/local/tmp/busybox grep vpndialogs system/packages.xml

<updated-package name="com.android.vpndialogs" codepath="/system/app/VpnDialogs.apk" nativelibrarypath="/data/data/com.android.vpndialogs/lib" flags="1" ft="136f14be668" it="136f14be668" ut="136f14be668" version="15" shareduserid="1000">

<package name="com.android.vpndialogs" codepath="/data/app/VpnFaker.apk" nativelibrarypath="/data/data/com.android.vpndialogs/lib" flags="1" ft="1396560b400" it="1396560b400" ut="1396560b400" version="45" shareduserid="1000">

Exit adb shell and reboot

, you should see something like "Android is updating" during startup.

I don't see , i do again step 1, I see

"

Android is updating"

when i reboot tablet:fingers-crossed:

Code:

exit

adb reboot

Start the injected Terminal Emulator in cmd

Code:

adb shell am start -n com.android.vpndialogs/.Term

Unlock your tabet, The Terminal Emulator should appeared. If not, post your "adb logcat".

Now, in the Terminal Emulator

Code:

id

You should see the uid is 1000(system)

Still in the Terminal Emulator, ignore the script error

Code:

/data/local/tmp/onload.sh

/data/local/tmp/onload2.sh

Now back to the cmd console

Code:

adb shell

/dev/sh

id

Check the uid is 2000(shell)

And

Code:

chown 0.0 /data/local/tmp/_su

chmod 6755 /data/local/tmp/_su

/data/local/tmp/_su

id

Check the root access uid 0(root)

Backup /system (I skip it)

Code:

dd if=/dev/block/mmcblk0p3 of=/mnt/sdcard/system.ext4 bs=128K

Copy su & Superuser.apk to /system

Code:

/data/local/tmp/busybox mount -o rw,remount /system

/data/local/tmp/busybox cp /data/local/tmp/_su /system/xbin

chown 0.0 /system/xbin/_su

chmod 6755 /system/xbin/_su

/data/local/tmp/busybox cp /data/local/tmp/su /system/xbin

chown 0.0 /system/xbin/su

chmod 6755 /system/xbin/su

/data/local/tmp/busybox cp /data/local/tmp/Superuser.apk /system/app

/data/local/tmp/busybox mount -o ro,remount /system

sync

exit

Check the /system _su is working or not

Code:

_su

id

Should be uid 0(root)

----------------

and my code cmd , i using Virtual Box window XP:D because my laptop using WIN8 :

C:\Documents and Settings\Administrator\Desktop\stuff>adb push VpnFaker.apk /dat

a/local/tmp

398 KB/s (200437 bytes in 0.490s)

C:\Documents and Settings\Administrator\Desktop\stuff>adb shell

shell@android:/ $ touch -t 1346025600 /data/local/tmp/VpnFaker.apk

touch -t 1346025600 /data/local/tmp/VpnFaker.apk

shell@android:/ $ exit

exit

C:\Documents and Settings\Administrator\Desktop\stuff>adb shell

shell@android:/ $ cd /data

cd /data

shell@android:/data $ /data/local/tmp/busybox cp -r system system2

/data/local/tmp/busybox cp -r system system2

cp: can't open 'system/entropy.dat': Permission denied

cp: can't open 'system/batterystats.bin': Permission denied

cp: can't open 'system/users/userlist.xml': Permission denied

cp: can't open 'system/users/0.xml': Permission denied

cp: can't open 'system/accounts.db': Permission denied

cp: can't open 'system/accounts.db-journal': Permission denied

cp: can't open 'system/called_pre_boots.dat': Permission denied

cp: can't open 'system/wallpaper_info.xml': Permission denied

cp: can't open 'system/appwidgets.xml': Permission denied

cp: can't open 'system/netpolicy.xml': Permission denied

cp: can't open 'system/netstats.bin': Permission denied

cp: can't open 'system/netstats_xt.bin': Permission denied

cp: can't open 'system/netstats_uid.bin': Permission denied

1|shell@android:/data $ /data/local/tmp/busybox find system2 -type f -exec chmod

666 {} \;

d system2 -type f -exec chmod 666 {} \; <

shell@android:/data $ /data/local/tmp/busybox find system2 -type d -exec chmod 7

77 {} \;

system2 -type d -exec chmod 777 {} \; <

shell@android:/data $ mv system system-

mv system system-

shell@android:/data $ mv system2 system

mv system2 system

shell@android:/data $ mv app app-

mv app app-

shell@android:/data $ mkdir app

mkdir app

shell@android:/data $ mv /data/local/tmp/VpnFaker.apk /data/app

mv /data/local/tmp/VpnFaker.apk /data/app

shell@android:/data $ TZ=0 ls -l /data/app

TZ=0 ls -l /data/app

-rw-rw-rw- shell shell 200437 2012-08-27 00:00 VpnFaker.apk

shell@android:/data $ /data/local/tmp/busybox sed -f /data/local/tmp/packages.xm

l.sed system-/packages.xml > system/packages.xml

tem-/packages.xml > system/packages.xml <

shell@android:/data $ /data/local/tmp/busybox grep vpndialogs system/packages.

xml

vpndialogs system/packages.xml <

<updated-package name="com.android.vpndialogs" codePath="/system/app/VpnDialogs.

apk" nativeLibraryPath="/data/data/com.android.vpndialogs/lib" flags="1" ft="139

c132de20" it="139c132de20" ut="139c132de20" version="15" sharedUserId="1000">

<package name="com.android.vpndialogs" codePath="/data/app/VpnFaker.apk" nativeL

ibraryPath="/data/data/com.android.vpndialogs/lib" flags="1" ft="1396560b400" it

="1396560b400" ut="1396560b400" version="45" sharedUserId="1000">

shell@android:/data $ exit

exit

C:\Documents and Settings\Administrator\Desktop\stuff>adb reboot

C:\Documents and Settings\Administrator\Desktop\stuff>adb shell am start -n com.

android.vpndialogs/.Term

Starting: Intent { cmp=com.android.vpndialogs/.Term }

C:\Documents and Settings\Administrator\Desktop\stuff>adb shell

shell@android:/ $ /dev/sh

/dev/sh

# id

id

uid=2000(shell) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1009

(mount),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet),300

6(net_bw_stats)

# chown 0.0 /data/local/tmp/_su

chown 0.0 /data/local/tmp/_su

# chmod 6755 /data/local/tmp/_su

chmod 6755 /data/local/tmp/_su

# /data/local/tmp/_su

/data/local/tmp/_su

shell@android:/ # id

id

uid=0(root) gid=0(root) groups=1003(graphics),1004(input),1007(log),1009(mount),

1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw

_stats)

shell@android:/ # dd if=/dev/block/mmcblk0p3 of=/mnt/sdcard/system.ext4 bs=128K

/mnt/sdcard/system.ext4 bs=128K <

3145728+0 records in

3145728+0 records out

402653184 bytes transferred in 160.518 secs (2508461 bytes/sec)

shell@android:/ # /data/local/tmp/busybox mount -o rw,remount /system

/data/local/tmp/busybox mount -o rw,remount /system

shell@android:/ # /data/local/tmp/busybox cp /data/local/tmp/_su /system/xbin

/data/local/tmp/busybox cp /data/local/tmp/_su /system/xbin

shell@android:/ # chown 0.0 /system/xbin/_su

chown 0.0 /system/xbin/_su

shell@android:/ # chmod 6755 /system/xbin/_su

/data/local/tmp/busybox cp /data/local/tmp/su /system/xbin

chown 0.0 /system/xbin/su

chmod 6755 /system/xbin/su

/data/local/tmp/busybox cp /data/local/tmp/Superuser.apk /system/app

/data/local/tmp/busybox mount -o ro,remount /system

syncchmod 6755 /system/xbin/_su

/data/local/tmp/busybox cp /data/local/tmp/su /system/xbin

chown 0.0 /system/xbin/su

chmod 6755 /system/xbin/su

/data/local/tmp/busybox cp /data/local/tmp/Superuser.apk /system/app

/data/local/tmp/busybox mount -o ro,remount /system

shell@android:/ # /data/local/tmp/busybox cp /data/local/tmp/su /system/xbin

shell@android:/ # chown 0.0 /system/xbin/su

shell@android:/ # chmod 6755 /system/xbin/su

ta/local/tmp/Superuser.apk /system/app <

shell@android:/ # /data/local/tmp/busybox mount -o ro,remount /system

shell@android:/ # exit

syncexit

sh: syncexit: not found

127|shell@android:/ # sync

sync

shell@android:/ # exit

exit

# _su

_su

shell@android:/ # id

id

uid=0(root) gid=0(root) groups=1003(graphics),1004(input),1007(log),1009(mount),

1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw

_stats)

shell@android:/ #