yashsingh1/xdaforums huggingface dataset:
[Verizon Samsung Galaxy S 4] LilTechPrincess:
Alright, now on the phone. I did notice that the application is very hard to remove on the Galaxy S4, running 4.3. I had two S4's that were not OTAed. In both cases I noticed that when I rooted them I could install SuperSU, and update the binarys without issues. On the other 4, I had to manually kill the processes, move the files, etc. This appears to be a result of the SU binaries running with a daemon. I actually found that when I tried to use the Chinese Superuser app to update su from SuperSU, it also failed. This MUST mean that SuperSU is a virus! (OK, that part was a joke).

Anyhow, I did the same, I bound my MAC address on each of the S4's the Ciscos and the packet capture server, and watched them for just shy of two days. In all cases the Superuser apk, or SU binaries never attempted to reach out to any remote hosts. I also ensured this to be true via the LTE. Lets just say I have access to that.

In conclusion: I think that the root application itself probably does some nontraditional methods of root, due to the SE Kernel, 4.3, etc. I don't personally have any issues with using this root method in the future. I will go ahead and replace the included SU and superuser apps with SuperSU (because Im familiar with it), but have no reason to be concerned about the originals.
[Verizon Samsung Galaxy S 4] bobby janow:
Do you think that they would allow you to see malicious behavior if they didn't want you to see it? These are traditional methods you are monitoring. Tradition is over. Not saying you are wrong. Just don't be so confident you are right. It's a new world.
[Verizon Samsung Galaxy S 4] LilTechPrincess:
Well, here's what I can tell you... Unless they were communicating via carrier Pigeon they weren't communicating. There's nothing "traditional" about picket captures, etc. Those are all tools that are used every day in this world.
[Verizon Samsung Galaxy S 4] ConnorWGarvey:
Thanks for doing all of this work. It makes me almost completely comfortable running this. Curious about one thing, though. Lots of C&C exploits are happy to run in user space and will not send any packets unless asked to. They just run small servers listening for commands. I don't know the Windows command for it, but did you see any new open ports after running or new processes after shutting the app down?
[Verizon Samsung Galaxy S 4] k1mu:
One thing that would be instructive would be to compare what's on the phone afterwards with a pristine phone.

Some vroot users have reported new programs like "Diagnostics.apk", apps which appear to be camera related but aren't, and so forth.

It's hard to tell how reliable these reports are, but taking a sha1 sum of every file post root and comparing it to the pre-root version would tell you if there's anything changed. You also need to look for new files, particularly hidden files and directories.

i.e.

# find /system -name '*.??*' -print
[Verizon Samsung Galaxy S 4] 23bobbyg:
Thank you for doing so much work

I feel much more confident in this root method
[Verizon Samsung Galaxy S 4] LilTechPrincess:
The only part where I see a potential issue is where you do the initial root. As stated in my initial findings, some of the exchanges were obfuscated or hashed. So, they COULD be transporting information such as IMEI, etc. I don't personally care. I'm on VZW, which they don't have in China. The chances of them being able to use any of my phones information to harm me in America, from China is extremely small, if existent at all.

As for after initial root, the app on the phone and computer most defiantly have not attempted to phone home.
[Verizon Samsung Galaxy S 4] open1your1eyes0:
Hey guys,

Just want to take this moment to thank everyone that has looked so deeply into these root methods to determine they are safe for us to use.

Just wanted to do a quick status check which of the two methods you guys seem to prefer so far. Would it be Kingo Root or Vroot?

If I'm correct most of you guys are leaning towards Vroot here but just wanted to confirm.

Anyways, thanks again to everyone and keep on checking those logs, I'm always lurking about on this thread for updates ;)
[Verizon Samsung Galaxy S 4] jwendt79:
In the steps boogeeman posted...can someone post a video or something...I'm confused on running the scripts....I never used adb. ..and copying the files doesn't make sense either...The file VZW_SUCKS...I cannot find. I am rooted with vroot. ..just trying to make sense of everything else. A noob guide would be appriciated.
[Verizon Samsung Galaxy S 4] LilTechPrincess:
I will write a shell script to handle this process later, and to clean up some of the remnant of the VROOT. I personally have not tested the other method, so I cant give any sort of qualified opinion.
[Verizon Samsung Galaxy S 4] troysbama1:
Please help with VRoot

I need some help as well. If I don't get this phone rooted I may end up seeing how far it skips down the road. I never realized how important root is to my phone usage until this week and I don't even use it for tethering.

Because all the links have been removed (probably a good thing but I can't wait any longer) I can only find the latest Chinese version of Vroot. I tried using it and guessing at what buttons to click etc... but for whatever reason my phone is not at all rooted. I even tried to Odin back to stock image first but still no luck rooting. I don't anticipate any problems with the ADB stuff if I could just get past the Vroot part.

Have other people had luck with the "VRoot_1.7.2.4200_Setup" download directly from the website? Can someone point me to a download they had success with, whether it be through PM or whatever? If you did get the Chinese version to work can you provide the steps you took and what happened?
[Verizon Samsung Galaxy S 4] stuckintheskull:
I had to replug my phone in s couple times for it to see my phone but once it does the button on the bottom right in the app will be green and the word root will show up. Also your phone will reboot once during the process.

---------- Post added at 01:16 PM ---------- Previous post was at 01:14 PM ----------

Kingo root did not work for me only Vroot.
[Verizon Samsung Galaxy S 4] LilTechPrincess:
I actually dont see any reason why you couldnt just run the Root De La Vega tool.. It will go ahead update to SuperSU. Basically, simply download the Root De La Vega tool, dont worry about flashing the root image, etc. in Odin. Simply extract the root file, and follow the shell script portion of it, and you will have SuperSU.
[Verizon Samsung Galaxy S 4] troysbama1:
Thanks for the response. I've tried 3 different USB ports on the pc. I've tried two different cables as well but when I get the green button I click it and it just spins until eventually a red X shows up on the phone picture. I do get security warnings on the phone constantly that say unauthorized access has been blocked.... I have USB Debugging turned on as well even though I've tried that both ways too. Any other ideas?
[Verizon Samsung Galaxy S 4] open1your1eyes0:
Sorry, I think I chose wrong wording there. Meant to say "determine

IF

they are safe for us to use". :silly:
[Verizon Samsung Galaxy S 4] reybie:
If the address it will contact are hard coded in, can't it be just blocked in the hosts file like what adfree does.
[Verizon Samsung Galaxy S 4] Surge1223:
I think maybe we should have a third party decide, maybe we can ask bleepingcomputer, i know some members over there or ask a similar site. The reason being that we would get an unbiased answer and one that doesnt factor in member/mod/developer views in any way.
[Verizon Samsung Galaxy S 4] douger1957:
I don't know how that'd work.

Your choice is this: either use the V-Root method and live with the results or wait for a developer to find a root exploit - and live with the results.

With all due respects to those trying to prove the V-Root safe, I get the nagging feeling of doom I get when I contemplate clicking the link in an email from an unknown source. Face it. It is an unknown source.

I've been rooting phones and installing custom ROMs for over four years and every single time, it's come from the XDA community. I've learned to place great faith in the knowledge that I've never bricked a phone or worried about whether I'd made my device insecure.

The S4 is the first phone I've had that I haven't felt the burning need to root or install a custom ROM on. That's always open to change which is why I lurk here - searching for a reason to root my phone.

From all that I've read, Android 4.4 promises to be a much more significant upgrade to the S4 than 4.3 is. If Samsung and or Verizon dawdle too long in releasing an OTA, that might drive me to root. The noises I'm hearing is that it should be down the pike in several months, which for Big Red would be warp speed.
[Verizon Samsung Galaxy S 4] tech_head:
Hi,

I agree.

I have not gone to MJ7 from my rooted MI1, just because there is no reliable, i.e. safe way to re-root if I lose it and need to flash.

I've been doing this stuff a long time; since the Droid X and to show my age I learned how to program on a Radio Shack TRS-80 (B&W).

I don't trust code that modifies things and hides behind encryption.

I won't be upgrading and using methods from unknown sources; but that is me.

If anyone does use this method, I suggest you do it with a Virtual Machine, so you can trash that whole install of Windows.

Once you use this tool, there is no way that Windows install will ever be safe. You can always do it on a machine that you never use for anything else. I have a NetBook that is dedicated to Odin and flashing firmware for other stuff. I still wouldn't use this software on that machine.

Finding what it modifies on the phone is probably easier that what it does to Windows, but I would suggest staying away.

Ultimately people, it is your data and your dime, but if it looks like a duck, walks like a duck and quacks like a duck; it's probably a duck and not a seagull.... YMMV
[Verizon Samsung Galaxy S 4] troysbama1:
My worry is that it's taken so long for someone to come up with a successful root method for the S4 that it may never come. Now when you start thinking 4.4 one would have to assume rooting will be even harder because the trend has clearly shown they're doing everything they can to lock things down. I'm admittedly not accustomed to waiting since I came from a Galaxy Nexus but outside of this particular solution I don't see anyone talking about root. So for me it's worth the risk. Unfortunately I can't even get the risky way to work at the moment. Not having Titanium, Call Master, Cache Cleaner, being able to remove all this verizon junk, is unacceptable for me. I'll make it a $650 (I have the 32gb) paper weight before I use it much longer. It could be such a great phone if the asshats didn't insist on ruining it. I know someone is thinking I shouldn't have upgraded to 4.3 and they're obviously right but I thought at the time the process I was taking would keep root. I would gladly trade my 32gb for a 16gb with mdk if I could find it. I just don't know how the Edge program affects my options.
[Verizon Samsung Galaxy S 4] douger1957:
What I've noticed in my four plus years in the XDA forums is that there's a name attached to every piece of work, and that if you're even remotely shady, you'll be outed and ostracized in very short order. There's nobody's name attached to this "exploit." None of the gods of XDA have blessed it.

As others have said, it's your phone. Do with it as you please.

I'd be a bigger liar than Obama if I were to claim to be a developer, but I'm wondering several things about V-Root that perhaps those who are can explain.

1) Is it possible to "fake" root? Computer cooties are getting more and more sophisticated. Can it get that bad?

2) Rather than observe the behavior of V-Root on virtual machines, is it possible to reverse engineer it to find out what hole it's exploiting?

---------- Post added at 03:12 PM ---------- Previous post was at 03:06 PM ----------
[Verizon Samsung Galaxy S 4] douger1957:
That's why I chose this phone over the HTC One, which I almost drooled over. That and wondering if HTC was going to be around next week.

I'd loved my Incredible and Rezound phones.
[Verizon Samsung Galaxy S 4] bobby janow:
Funny you mention carrier pigeons. May be even more sinister than that. Great read below:

http://arstechnica.com/security/201...erious-mac-and-pc-malware-that-jumps-airgaps/
[Verizon Samsung Galaxy S 4] PWM978:
Could someone that has run vroot please post /system/bin/su as well as /system/app/Superuser.apk? I have a couple hours free tonight that I could spend on reversing this, it would save me having to rip them out of the .dll.
[Verizon Samsung Galaxy S 4] k1mu:
That's why I have a hard time with this.

If having root is important to you, why did you upgrade to MJ7 knowing there was no root method?

I'm not convinced yet that there's anything nefarious going on with vroot or kango, but I'm waiting on the people with better skills and tools than what I have to assess what it's really doing under the covers.
[Verizon Samsung Galaxy S 4] tech_head:
In my post I said I have *NOT* gone to MJ7.

I am also waiting for a safe reliable root method before I upgrade.

No, I'm stuck on MI1 with root, where I can flash and re-root if need be.
[Verizon Samsung Galaxy S 4] k1mu:
Sorry, apparently it wasn't clear that I was completely agreeing with you.
[Verizon Samsung Galaxy S 4] PWM978:
DISCLAIMER - I have not gone through 75% of this. I am definitely cherry picking in the interest of my time!

As a quick update:

Sockets used are for updating the binary from here:

L"http://products.mgyun.com/api/checkupdate?productCode=%s&versioncode=%u&pcid=%s&cid=%u",

(unsigned int)L"vrootdb");

Also, another socket is bound to 127.0.0.1, no big deal here.

It uses AdbWinAPI to communicate with your device... seems harmless enough. (In fact this is surprisingly well written if it were malware/nefarious in nature - I am beginning to doubt that.).

Registry/Other Windows stuff:

v9 = RegCreateKeyExW((HKEY)i, L"Software\\XinYi Network\\VRoot", 0, 0, 0, 0x2001Fu, 0, &hKey, &hObject);

RegSetValueExW(v7, L"InstallPath", 0, 1u, (const BYTE *)v10, 2 * v11 + 2);

v12 = CreateMutexW(0, 1, L"XinYiROMasterRoot-{CC8CE95B-B5FB-4d94-ABCD-A544559A69CF}");;

DuiLib__CPaintManagerUI__SetResourceZip(L"rootres.zip", 1)

I'm going to stop looking through the Windows binaries now. I won't declare 'safe', but I will declare 'No remote command and control or otherwise nasty stuff that sticks out'. Me personally? I would probably run this without freaking out. But then again, I use Windows in a VM and for 3 tools only (IDA Pro, and a couple others).

Next for the Android pieces and we can put this to bed.
[Verizon Samsung Galaxy S 4] tech_head:
Not clear, but what is clear, is that people that have been around for a while don't think this method is good.

What amazes me, is people that have no clue about rooting and removing bloat, start removing things and are then surprised when they can't take an OTA and expect a FDR to fix what they have broken.

If I had no alternative, I might use this method for rooting, but it would be on a throw away Win box or VM that I would have no isues with wiping when I was done.
[Verizon Samsung Galaxy S 4] PWM978:
Ok... have gone through this to a point I feel is sufficient. I will say that in my opinion, it is not malware and do not see any reason to worry whatsoever. Could I be wrong? Perhaps. I put a couple hours total into this and can say with a fair degree of certainty it is harmless - ie: there are no pathways within the code to do anything horrible.

Could it transmit some serial number/phone make/model/kernel data? Yup. Personal info or contacts? Nope.

Reflashed and used it on my device (granted I replaced the Chinese Superuser.apk and su with Chainfire's).

Don't know if this is common knowledge, but to disable the bastard which is knox - run this in terminal:

su pm disable com.sec.knox.seandroid
[Verizon Samsung Galaxy S 4] foopy:
PWM978 Thanks for all your work on this and sharing the info.
[Verizon Samsung Galaxy S 4] open1your1eyes0:
Just an FYI for you guys, you may want to look into this too:

https://twitter.com/Tomsgt2/status/398967232299941889
[Verizon Samsung Galaxy S 4] downhillvinnie:
Vroot did work

Vroot did work in rooting my phone, I really didn't like all the Chinese language popping up in regards to apps. Tried to uninstall that superuser and install SuperSu but it didnt work Any other ideas? Kingo didnt even work, all these pop ups about security breaches!
[Verizon Samsung Galaxy S 4] Menardo:
I couldn't get Kingo to run on my S4... Seems to have been a good thing... Vroot worked like a charm.
[Verizon Samsung Galaxy S 4] killajoe:
So I here a lot of back forth. Is any of this safe? is all this speculation?

Sent From The Future
[Verizon Samsung Galaxy S 4] open1your1eyes0:
Right now it seems there is "no evidence" to prove that it is malicious but at the same time there is not 100% certainty that is it completely safe and secure as well.

Basically?

Current Status

: To Be Determined

All you have to do to decide for yourself is do you believe in "innocent until proven guilty" or "not worth the risk until proven safe and secure" and you can go from there.
[Verizon Samsung Galaxy S 4] Saul Goodman:
Does this just prevent the notifications, or does it affect the SELinux policy and/or set enforcing or permissive mode?
[Verizon Samsung Galaxy S 4] killajoe:
Can someone pm me a link to vroot

Sent From The Future
[Verizon Samsung Galaxy S 4] Menardo:
I used vroot and then followed the instructions a couple pages back to remove the superuser.apk that it installs. Have had zero issues.
[Verizon Samsung Galaxy S 4] :
Sorry, I am rooted but I already deleted all of them and replaced them with SuperSU. :(

---------- Post added at 11:50 PM ---------- Previous post was at 11:48 PM ----------

Check you PMs

---------- Post added at 11:51 PM ---------- Previous post was at 11:50 PM ----------

It just disables the know APK, it has nothing to do with the Kernel.

---------- Post added at 11:56 PM ---------- Previous post was at 11:51 PM ----------

Yes it seems that way.
[Verizon Samsung Galaxy S 4] LilTechPrincess:
So, it sounds like we concur? You agree? I am glad you dug in from a code level. I am a network admin by trade, with some coding experience, but mostly network. I think its great that I was able to dig hard into the comm. of the root, and you were able to dig into the rest of it. I do have packet captures as well, that I would consider sharing with you, if you like. I wouldn't do that to anyone because of obvious data in a packet capture, but I can send them to you, if you're curious. Some of the strings were hashed, and I didn't really care to take the time to unhash them. Most all comm was over http, and only occured on startup, and when actually running the root.

Thanks again man! Good work.
[Verizon Samsung Galaxy S 4] aapje1299:
Did exactly this, and superuser was installed but root was lost. After opening SU it says it needs to install new binaries and that always fails. Afterwards I have to root it again.

Am I using a newer version of vRoot perhaps? I'm started to get really agitated by this. I'm trying all day to remove the chinese superuser and install a normall 'trustable' root application.

This is what a exact copy of my abd shell:

Afterwards I reboot the phone and open titanium backup only to find out I just lost root privileges. Only way to regain root is by running Vroot again.
[Verizon Samsung Galaxy S 4] troysbama1:
I might have missed it but I didn't see your commands to remove the VRoot SU files. You need to do this before you start transferring the other files over. I did this the first time around and had the exact same issues you're having. I just ran Vroot again and started over.

rm /system/bin/su

rm /system/xbin/su
[Verizon Samsung Galaxy S 4] downhillvinnie:
anyone know of an easy way to get rid of this chinese superuser?
[Verizon Samsung Galaxy S 4] jwendt79:
The other day DroidHaxxor said he was gonna do up a script for us to get rid of it..but I haven't seen anything yet. I was hating the idea of the Chinese Superuser, but I've been using it with no problems so far
[Verizon Samsung Galaxy S 4] stuckintheskull:
Look 2 posts above yours. It was quoted.
[Verizon Samsung Galaxy S 4] Digur:
As it seems everyone is saying this is safe and there are clear posted instructions on how to remove the Chinese su, can we get a formal link to the vroot?

It seems to be safe, so maybe we should make an official download to prevent scam/malware from DLing from random locations.

Just a thought. Much respect to all that put work into this stuff.
[Verizon Samsung Galaxy S 4] k1mu:
I don't think it's true that everyone is saying that this is safe. However, to be fair, there's nobody that has come forward with evidence of malware.

At this point, nobody has done a complete search of a post-vroot phone to look for tampering. That, along with reports of unxpected programs being installed by vroot (Diagnostics, camera apps, etc.) still linger.

Kango has admitted that their program reads your phone's serial number and IMEI and sends it to their servers.They will remove the IMEI transmission in a future release. However, what else is going on? Nobody knows for sure. Howver, Kango gets credit for being up-front and honest about what they've been found doing.

I'm seriously considering taking a snapshot of my phone and using Kango to root it. If I don't find anything new, altered, or missing other than the su binary, that would reinforce my gut feel that Kango is OK.
[Verizon Samsung Galaxy S 4] jwendt79:
I couldn't get kingo to work. Vroot worked though. Is kingo superuser the American version or Chinese?
[Verizon Samsung Galaxy S 4] hovax615@hotmail.com:
I'm on the at&t gs4 and on 4.3 kingo will not work for it. VRoot is the only root method that will work for our 4.3
[Verizon Samsung Galaxy S 4] Merdinh:
Thanks a lot

this worked perfect for me, I now have root, and I completely removed the vroot su with no issues.
[Verizon Samsung Galaxy S 4] jwendt79:
Would you mind writing up a nooby guide to do this? I'm rooted with vroot and have never done adb scripts. I tried all the commands with terminal emulator but the first step when trying to mount system it fails
[Verizon Samsung Galaxy S 4] Merdinh:
After you succesfull root with vroot follow these steps

1. you will need titanium backup installed on your phone.

2.go into titanium backup, click backup/restore

3. scroll down until you reach all of the knox apps and click on each individual knox app and freeze it

4. download

http://www.megafileupload.com/en/file/467618/root-de-la-vega-zip-zip.html and then unzip the folder and add root files folder and the .sh file to the root of your phone and not your sd card.

5. go into terminal emulator and type SU, if you get a # then your good, if it asks for root permission grant it.

6.one you have # showing or no error comes up in terminal emulator press the home button and go back into Titanium backup then back/restore and scroll down to superuser should have blue shield, and freeze it.

7.now go into terminal emulator and type mount -o rw,remount /system hit enter

8. now type rm /system/bin/su hit enter

9. now type rm /system/xbin/su hit enter

10. now type cd /mnt/sdcard/ hit enter

11. now type sh root_de_la_vega.sh and hit enter

12. now type reboot.

once your phone reboots you should be root with supersu, launch titanium backup to test.

let me know if you run into issues.
[Verizon Samsung Galaxy S 4] jwendt79:
Worked perfect!!! Thanks alot...The other directions was just so long and confusing. One thing though...When I typed step 9..The xbin/su one..I got a message that file did not exist...just wanna make sure that is normal. But I tested and it worked. Thanks again for the directions!