[Android Q&A, Help & Troubleshooting] macexplorer:
FINALLY..ROOT on F-01D for V08R31A

I hope someone is still using the F-01D. So here's to you diehards.

After many many failed attempts, i finally managed to get a more permanent root.

Probably others have got this to root, but I havent seen anything come up via searches.

Main stumbling block has been in getting the address of 'ptmx_fops'. Finally got it thro, rootkitXperia_20131207.zip (get_root..this prints but fails in ptrace; ptrace is blocked in f01d)

I have just managed to get a permanent root. The steps maybe little approx. Do verify and let me know. Its non-destructive, so no harm done.

but do at your own risk..and other standard disclaimers apply ;)

Steps:

1. do the temp root as per : http://xdaforums.com/showpost.php?p=33071441&postcount=3

2. get the exploit source from https://github.com/fi01/unlock_security_module

(recursive download)

3. compile the source. this will generate a libs/armeabi/unlock_security_module binary

4. add the following recs to the device_database/device.db

these are kallsyms kern func addresses; most are avail direct from kallsyms, except for ptms_fops.

sqlite3 device_database/device.db

insert into supported_devices values(187,'F-01D','V08R31A');
insert into device_address values(187,'commit_creds',3221986012);
insert into device_address values(187,'prepare_kernel_cred',3221985196);
insert into device_address values(187,'ptmx_fops',3229222484);
insert into device_address values(187,'remap_pfn_range',3222251308);
insert into device_address values(187,'vmalloc_exec',3222293708);

5. push device.db and unlock_security_module to /data/local/tmp/

6. simply run from /data/local/tmp: ./unlock_security_module as the root obtained temp earlier.

7. after sometime, this will say LSM disabled!!

8. now remount /system as rw. carefully copy su binary to /system/xbin/ (pref use the latest version from SuperSu).

Also copy Superuser.apk to /system/app

>>carefully copy means: chown/chgrp /system/xbin/su to "0"; set perms: chmod 06755 /system/xbin/su.

9. copy busybox from /data/local/tmp to /system/xbin; and install (./busybox --install -s /system/xbin/

10. At this stage, su doesnt seem to work for newer shell connections (must do _su and then su). probably due to the exploit messing up the kernel.

11. reboot. and enjoy your newly permanent rooted status.

12. after reboot, still cannot do system remount as lsm is back to original. rerun the unlock_security_module should disable this.

maybe even move this to /system/xbin/;

But this seems to destabilise the system.

Its not possible to use a lsm disabler ko insmod. the kernel sec mech validates the module with path and hash.

So it has to be: unlock security; do your thing with /system etc., reboot.

(not sure yet if any changes to /system/buid.prop will help)

Do let me know how this works out and point out errors in the steps.

And as luck would have it there is a new ICS release out on 5-Feb.

https://www.nttdocomo.co.jp/support/utilization/product_update/list/f01d/index.html

http://spf.fmworld.net/fujitsu/c/update/nttdocomo/f-01d/update1/top/data/download.html

(F01D_TO_SP_ICS2.zip)

This moves the version to V12R33B.

Do not hazard to update to this, if you want to keep this root. this release probably fixes many of the exploits.

the wifi model seems to have got 4.1..wonder is something will trickle down to f01d.