yashsingh1/xdaforums huggingface dataset:
[Nexus 5 Q&A, Help & Troubleshooting] danarama:
Hahaha. Thats not a bad idea you know.

Actually I am not 100% satisfied with how this particular forum is organised. In my GT-i9300 days, we had a "roll up sticky" which we all had input into, We had it separated into Guides and info threads. It was easy to organise them in the order that threads needed to be read and gave us the ability to have much more sticky threads. The current system in this forum means we cannot have many threads and they always change order depending which one was posted in.

I think a roll-up sticky thread would give some of the senior menbers for this device a greater sense in wanting to organise the information we have here and putting together userful information. Perhaps its something [MENTION=962867]El Daddy[/MENTION] could help us with. I tried to set it up before but it never came into fruition...

Just a single sticky thread in general titles "ALL guides are in here" or something. Then we can all just say "Go to the all guude sticky thread in general and read threads 1, 3, and 7"
[Nexus 5 Q&A, Help & Troubleshooting] ShadowCodeGaming:
I totally agree on making that thread and would be happy to contribute wherever I can.
[Nexus 5 Q&A, Help & Troubleshooting] danarama:
oh and yes I agree "softbricking" is not a real thing! ahha
[Nexus 5 Q&A, Help & Troubleshooting] ShadowCodeGaming:
Yeah, like seriously, WTF is a softbrick? If it's bricked, it's broken beyond repair. If it can be fixed, it isn't bricked! Who invented this term and why did they make it mainstream?
[Nexus 5 Q&A, Help & Troubleshooting] jd1639:
Dopes do
[Nexus 5 Q&A, Help & Troubleshooting] El Daddy:
This is a very good idea.

If you guys want to curate a thread with the most helpful guides and help threads, I'll gladly give it a stick. :)

Feel free to PM me or contact me via hangouts if you'd like my input or help

[MENTION=4261894]ShadowCodeGaming[/MENTION] [MENTION=2872010]rootSU[/MENTION]
[Nexus 5 Q&A, Help & Troubleshooting] danarama:
Cool. I'll start it today.. Thanks.
[Nexus 5 Q&A, Help & Troubleshooting] Elluel:
Here come the "bricked" phones, oh yay. /s

Sent from my Nexus 5
[Nexus 5 Q&A, Help & Troubleshooting] Hopper8:
G'day guys (&girls) :)

I post as someone who reads N5 threads with interest, as I'm planning to buy one at the end of the month (currently on GSII).

My personal take on this is in line with what you've been talking about so far. The experienced users still prefer fastboot and manual root methods (as "difficult" as they are for N5 :p). This is what I'll be doing with my own. I don't trust 3rd party apps to do my phone mods, after seeing countless posts 'I installed recovery via ROM Manager and..." or similar. I like to know exactly what I'm doing and what the result will be.

Unfortunately, the majority of people want to get root/mods/recovery as quick as possible. Now that towelroot directly states that its N5 compatible, there'll be a lot of 'I wonder if I can... It worked!' without an escape plan or any knowledge whatsoever, or desire to read and learn. I look forward to joining you wading through N5 help threads all on the same topic.. even things as mundane as ''why can't I flash this from stock recovery, I rooted with towelroot' :rolleyes:

Anyway, glad to hear of the possible introduction of a roll-up sticky. Makes things a lot easier to reference, but I look forward to being able to use it to read up on the most vital info for N5 all in one place while making the jump to a new device :)
[Nexus 5 Q&A, Help & Troubleshooting] danarama:
[MENTION=962867]El Daddy[/MENTION], I created the thread here:

http://xdaforums.com/google-nexus-5/general/resource-guides-info-threads-linked-read-t2784527

Please sticky if you can :)
[Nexus 5 Q&A, Help & Troubleshooting] El Daddy:
Done!

Nice work!
[Nexus 5 Q&A, Help & Troubleshooting] danarama:
Cheers for that.

Is it maybe worth unstickying a "couple" of the other stickies do you think?
[Nexus 5 Q&A, Help & Troubleshooting] El Daddy:
I'll address that when I get home from work and have a chance to talk with my team. :)
[Nexus 5 Q&A, Help & Troubleshooting] danarama:
Sure thing. Thanks for your consideration
[Nexus 5 Q&A, Help & Troubleshooting] julbra18:
So just for the record: I can root my N5 with this app, flash a recovery (TWRP in my case) and than flash PA on my phone, all that without unlocking my bootloader?

Thanks!
[Nexus 5 Q&A, Help & Troubleshooting] jd1639:
Sounds like it. I haven't tried it though
[Nexus 5 Q&A, Help & Troubleshooting] julbra18:
Thanks!
[Nexus 5 Q&A, Help & Troubleshooting] st-w:
towelroot

What does towelroot exactly do after one presses that button? (Does it write / change files ? Which ones? Which partition? ... Does it do anything / What does it do beside that?)

I've read (among others) the following step by step explanation how to root using towelroot, but it doesn't mention any internals :(

http://xdaforums.com/google-nexus-5/general/guide-root-unlocking-bootloader-t2784024

In which state is the system after having run towelroot and rebooted? What are the remaining steps good for? There is no decription of the steps at all, what they actually do !

How to completely UNDO every operation performed by towelroot? I have only found the following Tutorial which archieves a stock rom by flashing a factory image. http://xdaforums.com/google-nexus-5/general/tutorial-how-to-flash-factory-image-t2513701

Is that required to undo the changes performed by towelroot? Or is there a simpler method to undo towelroot's changes? (that question may be redundant if my previous question about the detailed modifications performed by towelroot gets answered).

I'm looking forward to Your answers. Thank You!
[Nexus 5 Q&A, Help & Troubleshooting] jd1639:
no idea what it does under the hood. It's an exploit to get around a locked bootloader in android kk. I'm guessing it doesn't change any files.
[Nexus 5 Q&A, Help & Troubleshooting] st-w:
Thanks you for your quick answer. However, I still do have many unanswered questions (also after reading these posts teaching rooting-basics).

If it does not change any files, what does it actually do? What is the difference before pressing that button and after pressing that button (and reboot)? Imagine one would take a snapshot of the system disk before / after, what would be the diff? Does it only do some in-memory modifications, that are lost after another reboot or when uninstalling the app?

Is there already some effect after using towelroot that can be actively used? e.g. executing shell commands as root or such stuff? Again, I'm referring to that step by step guide: http://xdaforums.com/google-nexus-5/general/guide-root-unlocking-bootloader-t2784024

Is everything that is explained there needed for executing a single shell command as root? Or may some steps be optional?

I would like to fully understand that; thus I could ask nearly for each single step: WHY has this and that to be done? What does it actually do? (some technical description).

Is there some site (on this forum or somewhere else) that explains some technical details going on when "rooting" ?
[Nexus 5 Q&A, Help & Troubleshooting] jd1639:
Try going to towelroot.com and asking geohot
[Nexus 5 Q&A, Help & Troubleshooting] BirchBarlow:
IDK this seems an awful lot like giving firecrackers to children. You don't have to know about any of the internals of Android or even how to use fastboot to root this way, not to mention the fact that this can be performed without a PC. I hope the developer who came up with this is prepared for the inevitable barrage of posts from newbs who have borked their phones begging for help.

This rooting method presents the opportunity for one to mess up their phone not only during the rooting process, but also after as we'll now have many more root users who have no knowledge of the internals of Android. I've said it before and I'll say it again, if one doesn't have a basic understanding of the internals of Android and how to use fastboot and adb, one should not be a root user. So as a result we'll have people borking their phones who not only do not have the knowledge, but also won't even have the SDK installed, and may not have access to a PC, so they won't even have the means to fix their phones when they run into trouble.

I don't know about you all, but I certainly won't be recommending or encouraging this method to anyone and should anyone ask about, all I will do is steer them to guide on how to unlock and root properly.

This also illustrates that even with a locked bootloader our phones are still insecure and the only way to truly secure them is to encrypt.
[Nexus 5 Q&A, Help & Troubleshooting] vin4yak:
[MENTION=5473446]BirchBarlow[/MENTION]

Unfortunately, there will always be people who are may be lazy or not willing to learn the basics before messing with their expensive phones. I have seen many people who think they might screw up their devices whilst running fastboot commands and stuff as they aren't comfortable with them. With toolkits and apps such like this, a user just has to click a few things here and there and bammm! It's rooted. They find this the easy way mainly because they are comfortable using it without taking into consideration the position they might find themselves in the future when they would need adb/fastboot to help them boot their devices. These are the same people who open countless threads on XDA as they haven't learned the basics yet.

We will always be there to help them get to the info they need to read before rooting or when they are in a pickle but as the saying goes "You can lead a horse to water, but you can't make it drink". Anyways, to each his own.
[Nexus 5 Q&A, Help & Troubleshooting] st-w:
[MENTION=5473446]BirchBarlow[/MENTION] and the others

I fully agree that one should have some basic knowledge before rooting one's device. BUT:

Nobody was able to anwer just a few of my questions yet. Information isn't available on this forum either (or at least not easy to find, so I haven't found it yet)

I don't really consider knowing how to use adb/fastboot as important precondition to root a device. Far more important is to know what these tools actually do. The tool (actual implementation) is not important at all - however, knowing its purpose is.

Most descriptions and tutorials in this forum are seriously lacking important details. Often just step-by-step tutorials are provided, without giving any background. It's like programming C# and don't knowing how .NET works - of course the programs will work, they are likelty to be better and easier if some details about the underlying system were known.

So I'm still hoping for someone being able to answer my questions (or at least some of them). I'm happy with any information I can get. (And yes, I've read the tutorials available on this forum and written a simple android app and do know how to use adb/fastboot)
[Nexus 5 Q&A, Help & Troubleshooting] danarama:
In regards to point 2, I'd definitely disagree. Knowing how to use adb and fastboot is definitely a prerequisite for rooting. The reason for this is if you fubar your device, you need to understand these commands so we can help you fix your device. We're happy to help people who screw up however, we shouldn't have to teach you these basics whilst we're trying to fix the device.

It's like attending our special creative writing course we offer, yet also expecting us to teach you how to read at the same time. If you want to learn how to write creatively, you must already know how to read. I hope this makes sense.

Please ask your questions again and I will do my best to answer them
[Nexus 5 Q&A, Help & Troubleshooting] dergutehirte:
The question how adb/fastboot works or other ways on how to get root working is the one thing.

But here it was asked on how towelroot is working. And im thinking it would be good to know too. Not which kernel exploit he is using how, but what is towelroot doing after pressing the button. Just changing some of the Systemfiles or maybe some permissions.

It uses a Kernel Exploit, thats fine so far, but to do what?
[Nexus 5 Q&A, Help & Troubleshooting] Elluel:
To cause people to complain that it "bricked" their phone ;)

Sent from my Nexus 5
[Nexus 5 Q&A, Help & Troubleshooting] vin4yak:
You can ask the dev directly! Contact him @ geohot@gmail.com

LMAO :laugh:

Jokes apart, I would also like to know what's the exploit over here and what it actually does. Seems really interesting as this is one of a kind for kitkat devices :D
[Nexus 5 Q&A, Help & Troubleshooting] Elluel:
Yeah, how it works is more interesting than the end result, I would also like to know how it takes advantage of the exploit.

(end result being what I said previously LOL)

Sent from my Nexus 5
[Nexus 5 Q&A, Help & Troubleshooting] danarama:
All Exploits to root since the dawning of android, use a security flaw that allows them to obtain root. This flaw (or rather, these flaws) change from version to version (example Rage in the cage) It will indeed add system files (most notably the su binary which is required for root) but how the exploit actually works is anyone's guess. After pressing the button, all we know is it runs the exploit and puts the su binary n your phone
[Nexus 5 Q&A, Help & Troubleshooting] dergutehirte:
Thats right, the Security flaw with towelroot is the kernel exploit. But what exactly is it doing after using it :)
[Nexus 5 Q&A, Help & Troubleshooting] danarama:
Putting the su binary on your phone.
[Nexus 5 Q&A, Help & Troubleshooting] dergutehirte:
The App uses the Kernel Exploit to get Root Access and then exchange some systemfiles? Do you know it or are you just thinking the app do so?
[Nexus 5 Q&A, Help & Troubleshooting] danarama:
I know it uses the exploit to get around the permissions then puts the su binary on the phone. Putting the su binary on the phone is what "rooting" is.
[Nexus 5 Q&A, Help & Troubleshooting] Dirty_Jerz:
Exploit Details

The vulnerability exploited is in the kernel. Specifically in kernel/futex.c.

You can read more about the vulnerability here. CVE.

The payload (used to implement the "exploit") and subsequent modifications to the /system, including installing an su binary, (which does not notify BTW), is the juicy part. I'd love to take a peek at it but I loathe smali.
[Nexus 5 Q&A, Help & Troubleshooting] st-w:
As it is able to write an su binary on the /system partition it would be probably be able to write/modifiy/delete just any file on that (or maybe also other) partition(s). That sounds rather dangerous to me - especially as nobody seems to know what it really does. I would like to have a confirmation/proof, that towelroot really does only add that su binary - and nothing else.

Is there some way to revert the changes by towelroot? Does it provide such functionality itself? Would it be sufficient to delete the su binary?

I don't really know ext4 internals, but I guess adding and deleting a file leaves some data on the storage medium. May that be a problem for subsequent OTA updates or something else? Is there a tool to completely remove and fully restore the original condition before execution of towelroot (SuperSu?) - and has anybody already tried that?
[Nexus 5 Q&A, Help & Troubleshooting] Hopper8:
Sorry for OT. I will delete this post soon.

[MENTION=2872010]rootSU[/MENTION], I think your PM inbox may be full as I wasn't able to reply? In any case, many thanks :)

Sent from a galaxy far, far away
[Nexus 5 Q&A, Help & Troubleshooting] danarama:
Yeah I keep it full. I deleted one for you earlier when you tried before but someone else filled it.
[Nexus 5 Q&A, Help & Troubleshooting] dergutehirte:
I think i've found an acceptable explanation from another site for z4root and it must be almost the same with towelroot:

What z4root (or any other rooting program) does it runs some exploit to change its own uid (user-id) to 0 (root). You can think of it as of performing some kind of hack and tricking kernel into thinking it actually has the right to be root (then if z4root was a virus it could do everything with your phone from installing keyloggers to bricking it). Of course if it is possible to trick kernel in such a way to give you root access it is considered a security vulnerability (any app could do that and perform some malicious stuff) and usually gets fixed in future kernel updates (that's why z4root may not work if you upgrade your firmware).

When z4root has set its uid to 0 it does the following: remounts /system partition as writable (by default it's read-only), copies over su binary, Superuser.apk and busybox and then remounts /system back as read-only.

So how does the su binary give you root access without doing "the hack" thing when normally applications have same uid as parent process? This is because su binary has set-uid flag set and is always ran as uid 0 (root).

Now, if you have copied su binary over to /system/bin then you must have had root access which means you have to change owner/permissions (chown root:root /system/bin/su; chmod 6755 /system/bin/su).
[Nexus 5 Q&A, Help & Troubleshooting] danarama:
Towelroot doesnt do anything with busybox or supersu.apk
[Nexus 5 Q&A, Help & Troubleshooting] Elluel:
Pretty sure it just puts in the SuperSU binaries but not the .apk according to Chainfire's post on Google+ for the SuperSu v2.00 release

Sent from my Nexus 5
[Nexus 5 Q&A, Help & Troubleshooting] danarama:
Thats what I am saying, yes.

If you read the guide in General, you still have to do the apk and busybox manually.
[Nexus 5 Q&A, Help & Troubleshooting] dergutehirte:
i know it dont do anythink with busybox or supersu, i just copied the whole explanation from the other site, just to share hot it is working :) as i wrote its an explanation for z4root.

I was looking for a discription how it works, and thats seems to be almost the same way like towelroot have it done :)
[Nexus 5 Q&A, Help & Troubleshooting] danarama:
To be fair, you asked what it did not how it did it.

The answer to what it does is puts su binary on your phone. How it did it (the answer you didn't want) is what you answered in the previous post
[Nexus 5 Q&A, Help & Troubleshooting] dergutehirte:
I want to know what towelroot does after pressing the button. and what i posted before is the answer. Im not interessted in how it uses the kernel exploit or anything else. but i want to know what exactly it does with the android on the phone :)

But finally i have my answer so its enough for me :)
[Nexus 5 Q&A, Help & Troubleshooting] st-w:
Thank you for your answers, but they are not detailed enough for my taste yet. Which files exactly are added/modified/(deleted) ? Anything else than "su" - and where is "su" located - /system/bin ?

Still unanswered: any (feasible) method to completely undo all changes?

(Is there really no advanced user here, who knows how this works?)
[Nexus 5 Q&A, Help & Troubleshooting] danarama:
Ok here you go:

After rooting With Towelroot

New files:

/system/bin/.ext/.su
/system/xbin/daemonsu
/system/xbin/su
/system/xbin/sugote

...all of which are normal, and...

/system/xbin/sugote-mksh

...which actually came from SuperSU when it made me update the binaries. None of the other files are modified. Everything else is stock.

Obviously the most effective way to undo the changes is to flash a system.img via fastboot but that would require you to install bootunlocker app, unlock the bootloader and set up fastboot. The unroot option in SuperSU will deal with all these files too.
[Nexus 5 Q&A, Help & Troubleshooting] bitdomo:
So I digged myself into this tr.apk.

After decompiling the apk I didn't get any smarter, so I took a look at the libexploit.so

libexploit.so is ?binary? file written in C. It contains the su binary, and a shell script called install-recovery.sh

The install-recovery.sh:

Here are the strings from the exploit code:

As I see from the strings, the exploit somehow manages to gain root access, then mounts system as rw, then extract the su binary from itself to /system/xbin/su and to /system/xbin/daemonsu then extract the shellscript to /system/etc/install-recovery.sh as well. Then does the chcon command, remounts systam as ro then restarts in 15 secs.

I hope I am not talking bull**** :D
[Nexus 5 Q&A, Help & Troubleshooting] danarama:
The install-recovery.sh is part of chainfires su implementation
[Nexus 5 Q&A, Help & Troubleshooting] danarama:
OK my last comparison was not a fair one. I used a pre-rooted base which I cleaned up manually, then I towelrooted and let SuperSU update the binaries so that created a bit of extra "noise"

towelroot does less than I previously suggested. Here is a comparison of system.img mounted as ext4 on my linux box versus system.img fastboot flashed and towelrooted (no SuperSU app stuff done)

/system/etc/install-recovery.sh
/system/xbin/su
/system/xbin/daemonsu

and thats it. Everything else I listed before was from SuperSU afterwards.

i.e.

/system/bin/.ext/.su
/system/xbin/sugote
/system/xbin/sugote-mksh

So towelroot genuinely does what it says it's doing.

FYI, I am using proper diff and merge tools to do the comparison. I am not only looking for new files, but also any modification to existing files and there are none in /system

FYI 2, any exploits executed against the kernel are non-permanent as everything you do to do with the kernel (eg /sys) is reset on boot.
[Nexus 5 Q&A, Help & Troubleshooting] bitdomo:
So the infos I got by examine the libexploit.so got confirmed.

It is good to know what files are created. I feel relieved to know that.
[Nexus 5 Q&A, Help & Troubleshooting] danarama:
It was really good thinking decompiling the apk. It didn't even cross my mind
[Nexus 5 Q&A, Help & Troubleshooting] dergutehirte:
But the easiest way to remove the rooting would be to just delete the files, which got copied thru rooting process :) and should be possible, because root should be able to delete them.
[Nexus 5 Q&A, Help & Troubleshooting] danarama:
Not really, because once start managing root with supersu, there are multiple files in multiple locations.

Quickest way to unroot is via the supersu settings

Which does exactly what we want.
[Nexus 5 Q&A, Help & Troubleshooting] dergutehirte:
Ok :) thanks for all your answers!
[Nexus 5 Q&A, Help & Troubleshooting] st-w:
Thank You!

Finally the majority of my questions got answered. Thank you all very much, especially rootSU and bitdomo for the insights into towelroot and the root procedure in general !
[Nexus 5 Q&A, Help & Troubleshooting] jd1639:
I bet 4.4.4 patches the exploit
[Nexus 5 Q&A, Help & Troubleshooting] Aerowinder:
Nope! Kernel has not been changed. Only system and radio have changes.
[Nexus 5 Q&A, Help & Troubleshooting] jd1639:
Surprised they push an update so fast and not patch it
[Nexus 5 Q&A, Help & Troubleshooting] Elluel:
Check the build date on 4.4.4 lol

Sent from my Nexus 5
[Nexus 5 Q&A, Help & Troubleshooting] e-Minguez:
It doesn't work for me.

Nexus 5 4.4.3 no unlocked bootloader, no root,..

Downloaded latest tr.apk, installed, pressed "make it ra1n" and the phone reboots without root according to supersu & root checker.

adb logcat shows:

I/towelroot_java( 3862): server says: da
I/towelroot( 3862): ************************
I/towelroot( 3862): native towelroot running with pid 3862
I/towelroot( 3862): got kernel version Linux version 3.4.0-gd59db4e (android-build@vpbs1.mtv.corp.google.com) (gcc version 4.7 (GCC) ) #1 SMP PREEMPT Mon Mar 17 15:16:36 PDT 2014
I/towelroot( 3862):
I/towelroot( 3862): got kernel number 0
I/towelroot( 3862): no matching phone found, trying default
I/towelroot( 3862): i have a client like hookers
D/dalvikvm( 3862): GC_CONCURRENT freed 352K, 3% free 17101K/17488K, paused 1ms+1ms, total 11ms
I/towelroot( 3862): starting the dangerous things

Then reboots and it works fine, except no root yet.

Any clue?

Thanks
[Nexus 5 Q&A, Help & Troubleshooting] Dirk:
Version 2 didn't work for me either. Version 1 works fine though.
[Nexus 5 Q&A, Help & Troubleshooting] e-Minguez:
Yep! Tried V1 and worked flawlessly.

Cheers!
[Nexus 5 Q&A, Help & Troubleshooting] j'vai:
hey, thanks!!

insighful post!

http://xdaforums.com/showthread.php?p=53547423