[Android Q&A, Help & Troubleshooting] y2kbugleung:
Root-ing SH-09D

Source: http://anago.2ch.net/test/read.cgi/smartphone/1345298294/

Reference: http://apostrophea.com/2012/08/106shroot.php

Thanks to Goroh-kun and 2CH brothers!

Root-ing SH-09D shares the same method of root-ing 106SH.

The only difference is the unlock file.

I have packed the files needed for SH-09D.

You may download the attachment below this thread.

The zip file includes:

- SH-09D ADB Driver

- Step 1

- Step 2

- Root-kit

Step 1: Bind running a .sh file to "un-mount SD" event, and get permission of /data and /cache

Navigate into "Step 1" folder:

adb restore isw16sh.ab

Press restore on your phone (the button on right hand side)

After restore finished, run the cmd in the folder

adb shell

cd /data/data/com.android.settings/
rm a/file*
while : ; do ln -s /data/data/com.android.settings/lib/libsdservice_jni.so a/file99; done

You will see a lot of "linkage error", but it is normal (as it is a loop to create "file99", maybe preventing changing back by the system)

DO NOT CLOSE the cmd window

open ANOTHER cmd window, and run this

adb restore isw16sh.ab

Press restore on your phone (the button on right hand side)

After restore finished, you can close the two cmd windows

(OPTIONAL) You can check if the binding success or not:

adb shell
$ cd /data/data/com.android.settings/
$ ls -l lib

Push the .sh file for running

adb push onload.sh /data/local/tmp/onload.sh

Now, grab your phone, go to settings, and press "un-mount SD card" (no need to confirm un-mount)

After pressing the option, and you will see an error message, and force-close

Go back cmd, and you can now browse the /data and /cache

adb shell
$ ls -l /data
$ ls -l /cache

Step 2: Create /dev/sh

Navigate to "Step 2" folder, and run cmd

Push the two necessary files onto the phone

adb push mkdevsh /data/local/tmp/mkdevsh
adb shell chmod 777 /data/local/tmp/mkdevsh
adb push su /data/local/tmp/su
adb shell chmod 777 /data/local/tmp/su
adb push onload.sh /data/local/tmp/onload.sh

Go and un-mount SD card, to trigger this new .sh file

And /dev/sh should be created

adb shell ls -l /dev/sh
-rwsr-sr-x root root sh

Navigate to the /dev/sh folder, you have the root access there

adb shell
$ /dev/sh
#

Step 3: Disable the MIYABI lock

Navigate to the "rootkit" folder

Push the unlock file onto your phone

adb push sh09d_unlock /data/local/tmp/sh09d_unlock
adb shell chmod 755 /data/local/tmp/sh09d_unlock

Run the unlock file

adb shell
$ /dev/sh
#/data/local/tmp/sh09d_unlock

Something like this will be shown (this message is an sample for 106SH)

/data/local/tmp/isw16sh_unlock
isw16sh_unlock ver 0.01
mmap base=80300000 length=00c99a90
mem=20000000
Miyabi LSM Check
0c 5f c7 c0
Miyabi LSM Unlock
01 00 00 00 02 00 00 00
02 00 00 00 02 00 00 00
03 00 00 00 03 00 00 00
04 00 00 00 03 00 00 00
05 00 00 00 03 00 00 00
06 00 00 00 03 00 00 00
08 00 00 00 02 00 00 00
09 00 00 00 03 00 00 00
0a 00 00 00 03 00 00 00
0b 00 00 00 02 00 00 00
0c 00 00 00 02 00 00 00
0d 00 00 00 02 00 00 00
0e 00 00 00 03 00 00 00
NAND Lock Unlock ALL!

If you see "NAND Lock Unlock ALL!", congrat!

Put "su" into /system/bin

adb shell
$ /dev/sh

sync;sync;sync
mount -o remount,rw -t ext4 /dev/block/mmcblk0p12 /system
dd if=/data/local/tmp/su of=/system/bin/su
chown root.shell /system/bin/su
chmod 06755 /system/bin/su
sync;sync;sync
mount -o remount,ro -t ext4 /dev/block/mmcblk0p12 /system

Reboot your phone

#reboot

ROOT-ED!

Install Superuser from Market, and you can have root access on your phone.

UPDATE

If you want to install Busybox (or write to /system), you have to run the sh09d_unlock first

$ su
#

# /data/local/tmp/sh09d_unlock