[Miscellaneous Android Development] aicjofs:
NabiRootXD v2​

​

This is a tool for rooting, installing Gapps(Play Store, etc), and adding custom TWRP recovery on Nabi XD. It's written as a windows command line batch file, and is based off NabiLab I made for Nabi2.

It was an adventure to say the least. I include some of the hurdles for those that want to duplicate the root process or just to place my thoughts "on paper" because of the 100's of posts I read from those that posted detailed information and allowed me to gain useful insight in how I could adapt things for the XD, and explain in one swoop to the many PM's I have received about "when will we see root on the XD" why it took so freaking long. Those that just want the program can continue to the Overview section.

What started as an interesting avenue was TWRP using the Nabi2 kernel was booting the NabiXD to TWRP without video. I thought it possible to dd the recovery, or boot kernel. Unfortunately it was unable to recognize internal storage as a block device and that ended that. Like a few devices on Android 4.1.1 and above the standard once click program using Bin4ry's ADB restore exploit doesn't work. It doesn't work for a couple of reasons, when restoring fakebackup.ab in locks up writing the first file, and even if it did work placing ro.kernel.qemu=1 in local.prop doesn't work because Jelly Bean doesn't parse any property files to set the ownership of adb daemon. Searching the file system I found su2 in the xbin directory. This was promising as it is the su program but renamed, also unfortunate was its permissions had no setuid bit set and while it was executable it would not change uid to 0. I then foolishly went down the path of nvflash(forced recovery). I attempted a few different avenues here to try and possibly get the SBK to unlock nvflash, that proved uneventful, especially without root access. I tried extracting what "could" be the key from the Nabi2 it hope it was reused. That lead no where, it would be awesome to have access to it for many other reasons but it turned out to be an exercise in learning but ultimately a waste of time. Then on to other Android exploits... Tried Samba, debugfs, and vfat exploit. All of those are either patched or I'm not skilled enough. I finally returned to looking at the ADB restore exploit.

The "tabletS" exploitation showed promise as it takes the avenue of installing /dev/sh vs ro.kernel. A side effect of the failed ADB restore bug was leaving a directory with full permissions. Bads3ctor had an interesting fakebackup.ab that was more reliable at making a directory or file that you simlinked have full permissions. Now you can step through the tabletS script more effectively where you couldn't before by manually setting permissions for files/directories you need by doing the restore for each file and directory you need. The script installs VPNfaker and backs up the /data/app directory, then creates a new app directory. This however will cause the NabiXD to rerun the initial kidsmode setup and breaks everything. You can dance around that by not rebooting, and VPN faker will still give you a Term app with system uid. From there you can't symlink the sysfs links properly to data/property but that can be worked around by moving and then removing files. Finally you can makedev /dev/sh and run su from /data/local/tmp. The end result is that the exploits and bugs found by others are adequate when strung together in the right order on the NabiXD just not the one click solutions provided on the forums, they needed some modifications and done by hand to figure out for the NabiXD

Here is a nice publication I found in my searches that is more layman terms for older root methods. http://www.sourceconference.com/publications/bos12pubs/android-modding-source.pdf

Overview

Video Overview of NabiRootXD - a video tutorial of the use of NabiRootXD.

-Root the Nabi XD

-Install Gapps(Play Store, etc)

-Make a stock backup of unrooted device

-Install stock, or TWRP recovery

-NabiLab patching system to install updates to this program

Version 2

-Fixed scripting error causing early exit

-Added 7z for patching system

Download

Read the installation section below to determine which version you want.

File names:

NabiRootXD.zip 96MB (Version 2)

Download

Download Mirror

Installation

NEW INSTALLS

1) Download NabiRootXD

NabiRootXD.zip 96MB

2) Extract the zip files to a location of your choosing. Run the NabiRootXD.bat file.

Prerequisites

1) Script is for Windows

2) ADB enabled in Android. Enter Mommy/Daddy mode. Open settings->developer options->put a check mark in USB debugging.

3) ADB and Fastboot driver. Most popular are the PDAnet drivers. You can get them here: PDAnet drivers

Usage

Obviously using this script on your NabiXD voids the warranty and I take no responsibility for the damage you cause.

MENU 1 - Root, Gapps, Recovery​

​

Menu Option 1 - Install Root, Recovery and Gapps

This option is best used if you have a brand new Nabi. At this point you should have met the prerequisites of enabling ADB in Android. Follow directions, most sticking points are pressing the volume + and then pressing the volume - button twice and making sure recovery kernel is the one highlighted. After its complete you should have a rooted Nabi, with Gapps and a backup of your unmodified Nabi in the folder TWRP/BACKUPS/YOURSERIAL/stockunrooted on your device. Not a bad idea to copy this off the Nabi to your computer if you need to free space or have it in a second location.

Menu Option 2 - Install Root and Recovery

Same as above but doesn't install Gapps. Some people have trouble with option 1 taking the Gapps install, I personally have never experienced it but the option is this one, or I guess if you are an elite hacker that just wants root.

Menu Option 3 - Install Gapps

Same Gapps installed in the Option 1. Useful for re-installing Gapps. This is Jelly Bean Gapps dated 10/11/2012 without Google Search. This makes NO backup of you Nabi. You will have to already have installed TWRP.

Menu Option 4 - Install Root

Installs root. Nothing fancy here, and likely unneeded but here for completeness if you find yourself in a strange situation. One that comes to mind is that you have a stock backup which you restored and don't want to do another backup so you would just run this and the gapps install. It makes NO backup. You will have to already have installed TWRP.

MENU 2 - Install Recoveries​

​

Menu Option 1 - Install TWRP 2.3.3.0 for Nabi Version 1.2.3

Installs TWRP 2.4.4.0. This is the latest at this time. It has a screen timeout, if the screen goes black touch the screen to wake the screen, it's not locked up.

Menu Option 2 - Install Stock Recovery

Installs stock recovery. This is useful for taking an OTA, or completely returning Nabi to stock.

Notes: TWRP installs are based off my work in this thread if you want to read more.

MENU 3 - Patch NabiLab​

​

Menu Option 1 - Install Patch

For any updates to NabiRootXD this is where you can automatically load them. Basically you will download NabiPatchXD.zip and place the entire zip in the patch folder. No unzipping just the single file. Then run this option.

Credits

- If you see these guys buy them a beer.

jzmtaylor - Original Nabi2 script that this is based off of.

Bin4ry, Bads3ctor, HEXcube, drjbliss - all the bugs/exploits needed to accomplish root

Dees_Troy - TWRP build tutorial

Eric Karz - TWRP Theming and rooting assistance

TeamWin - They are the guys that make TWRP possible