yashsingh1/xdaforums huggingface dataset:
[Sharp Aquos Crystal] TechInMD:
I discovered with mine that if I just run root.v3 it either just says "prepare" and drops back to normal shell prompt, or it will run and reset my phone when it goes to apply the patches. But, if I run root.v2 and then run root.v3 it completes without issue and applies the patches. I have not had enough time to experiment with wpoff so this is as far as I have got. Not much info... but maybe it will help some of the folks having issues with v3.

Sent from my 306SH

Just got the v4.1 zip without issue. My browser was downloading the html as a zip so it was showing as corrupted when extracting. I will tinker with this soon.
[Sharp Aquos Crystal] brunosil:
TUTORIAL!

weel done!! you´re planning to post like a "step by step" on how to root (and install CyanogenMod)?
[Sharp Aquos Crystal] daet1234:
It workies

This version worked for me

KVT49L

The wpoff worked as well

Do you need additional kernel dumps for this version?

Thanks for all your hard work.
[Sharp Aquos Crystal] QuickNET Tech:
How many other people end up with the result of "-fixed" and if you do, what software version are you on? I am on KVT49L.
[Sharp Aquos Crystal] irishobo:
S7232 same result. No luck newest update.
[Sharp Aquos Crystal] QuickNET Tech:
Wait, so are you on S7232 or KVT49L?
[Sharp Aquos Crystal] eleotk:
thank you
[Sharp Aquos Crystal] irishobo:
Build Number KVT49L01

SW version. S7232

Forgot the 01 last time... that is the best build.
[Sharp Aquos Crystal] brunosil:
So is still no root for this version ( KVT49L01, SW version S7232) isn't?
[Sharp Aquos Crystal] enki7:
KVT49L01 and S7232 here too.

Same -fixed- result. No temp root.
[Sharp Aquos Crystal] QuickNET Tech:
Not until [MENTION=1713470]tewilove[/MENTION] release a new temp root, unless we find a way to get the current one to work.
[Sharp Aquos Crystal] brunosil:
I dont know if anyone saw this but this guy succeded!

https://twitter.com/uberlaggydarwin/status/643035049407868928/photo/1

https://twitter.com/uberlaggydarwin/status/636010110397972484/photo/1
[Sharp Aquos Crystal] enki7:
That guy is in this thread :D

---------- Post added at 03:28 AM ---------- Previous post was at 03:24 AM ----------

How you got root in the updated version, man? :D
[Sharp Aquos Crystal] galaxyst:
Is there any way to temproot SH-04F or SH-01G ?
[Sharp Aquos Crystal] brunosil:
so why he don´t show the solution???? im confused...
[Sharp Aquos Crystal] enki7:
I think they are wrapping a full solution. (I hope...)
[Sharp Aquos Crystal] soudara:
Is there any way to temproot 303sh mini or 304sh , 305sh
[Sharp Aquos Crystal] brunosil:
I hope too... :confused:
[Sharp Aquos Crystal] QuickNET Tech:
Because he didn't use tewilove's method, he did it himself using bootloader exploits that he (and just maybe a select few elite others) know of.
[Sharp Aquos Crystal] enki7:
Well, I hope the ~elite feeling~ doesnt get temilove :D
[Sharp Aquos Crystal] uberlaggydarwin:
because exploitable bugs are valuable and i have other interests other than the xda community.

Some bugs are patched, i already said this on twitter. I warned people not to upgrade yet people did it anyway.

I might provide a patch or replacement for tewilove's root in the future, i have been in contact with him for approx 3 weeks.

you are correct, I used 2 bootloader 0days for a private client, not for general public release.. i get paid to do this kind of stuff so I have to make decisions on what is public and what is not.

tech details:

if you are curious, tewiloves root uses the ping uaf (also used in kingroot/pingpong) : https://www.blackhat.com/docs/us-15/materials/us-15-Xu-Ah-Universal-Android-Rooting-Is-Back.pdf this bug (CVE-2015-3636) plus some extra magic/backdoor for wpoff (i won't reveal this as i don't want to ruin this, only select few people already know about that backdoor).

good stuff is coming: I will release CyanogenMod in the future for this device though so you can build custom ROM's based on CM , just fighting the final issues.
[Sharp Aquos Crystal] brunosil:
:thumbup: :)
[Sharp Aquos Crystal] enki7:
Well, I tested 4.3.

Probably is for unlocking the bootloader, but my devices is the updated version S7232, so it is still without temp root.

Then my testing servers nothing :) Cause I cant do WPOFF properly.

Thanks, anyway, Tewilove.
[Sharp Aquos Crystal] captainescape:
It still won‘t work at 402SH, lots of 5 :crying::crying::crying:
[Sharp Aquos Crystal] brunosil:
same version here ... but he keeps working!! btw its any way to go back to the older SW version?
[Sharp Aquos Crystal] QuickNET Tech:
No. As far as I know, Sharp doesn't have a leaked equivalent to Samsung's Odin or LG's LG Flash Tool.
[Sharp Aquos Crystal] Derek1969:
000000000000000000000000000000
[Sharp Aquos Crystal] QuickNET Tech:
What are you saying/asking? :confused: Are you saying that the result of turning off write protection was successful and the right column has been re-written to zeros?

---------- Post added at 08:01 PM ---------- Previous post was at 07:57 PM ----------

@SHM will you be building TWRP for our device, or have you already moved on?
[Sharp Aquos Crystal] :
I would but two problems. First problem, my wife lost the device lol. Been searching for it the past few days. Second problem, since CM is looking to be released I suspect TWRP will be as well but I need him to confirm this. Otherwise, if he is only releasing CM recovery with the CM Rom and assuming I can find the device in my house then sure, I have no problem building TWRP. I don't want to build TWRP if he has plans to already release it on here as it would be pointless and cause confusion for others as to which one they should use. I have seen that become a problem in the past.
[Sharp Aquos Crystal] QuickNET Tech:
Have you gone HERE. I go here and click ring and it will ring the device at full volume (even if it is on silent) nonstop for what I believe to be 5 minutes.
[Sharp Aquos Crystal] :
Battery is dead unfortunately. Needle in a hay stack as one would say.
[Sharp Aquos Crystal] QuickNET Tech:
True
[Sharp Aquos Crystal] :
Will see what comes of it I suppose. Not really a priority for me at the moment. Building CM for my phone just long enough to confirm my environment is setup properly then OmniRom will become my target and Slim L right after. Speaking of which, the build failed just now because I forgot to clean up the kernel source prior to building..... I hate it when that happens.
[Sharp Aquos Crystal] UltimaXtreme:
Now, question... Is S4081 a vulnerable build? I updated because my texting would die if I tried to send MMS, and thought it was a bug. I know S7232 is being thrown around here.
[Sharp Aquos Crystal] enki7:
Tewilove worked with the s4081 build, and broke it. The updated version (s7232) is not temp rooting yet... but there is hope :D
[Sharp Aquos Crystal] loonbg:
yes root , wp and bootloader unlock - all work on s4081 ( if you have older than this also will work) expect last s7232

i'm with s4081 version :)

p.p i try to flash some custom twrp for other phone model with this command

but not working xD (i don't expect to work.. just to test) then i use the same command with original recovery and now its all good :) Only left some one to build recovery and all is done :)
[Sharp Aquos Crystal] TechInMD:
So does fbunlock unlock the bootloader or fastboot? I can't seem to get either to work.

Sent from my 306SH
[Sharp Aquos Crystal] loonbg:
it unlock bootloader and then we can flash recovery with command that i show in previous post .. there is not fastboot fucntion in stock rom
[Sharp Aquos Crystal] :
Having people PM me so to save others their time I'm posting here. I do not have this device in my possession. It was misplaced in my house. Without it I won't build TWRP. If I find it then I will build TWRP. However, if [MENTION=5314976]uberlaggydarwin[/MENTION] is planning to release a TWRP build along with CM then I will not bother with it. If he informs me otherwise and if I can find the device then I will have no problem doing it on my end assuming [MENTION=1713470]tewilove[/MENTION]'s project works on this device specifically.

- that is all
[Sharp Aquos Crystal] TechInMD:
I ran root, wpoff and verified that the WP was disabled. Ran fbunlock and powered down. I attempted to boot into bootloader and it just does the same as before. Fastboot doesn't even recognize that the device is connected

Side question: can I dd an .img that resides on my pc or does the .img have to be on the device? The issue I am having is when I use recovery to factory reset the device, it does the factory reset but the space on the device does not free up. Even though sdcard0 is empty (or at least it appears to be according to my file browser) and if I put the .img file on the external card I can not get the card to mount when the device is connected to the pc when the phone is powered off. I'm trying to dd a system.img backup so I can't do that with the phone powered on. Any knowledge you can offer would be appreciated.

Sent from my 306SH
[Sharp Aquos Crystal] loonbg:
yes you need to put .img to internal in phone then run root and dd but be careful bcs you can demage device if you flash it with wrong img
[Sharp Aquos Crystal] AceDaMack:
I have a sharp with the initial s8216 will this work?
[Sharp Aquos Crystal] enki7:
Hmmm, it seems even up-to-date(r) than mine s7232, that doesnt work... but, GIVE IT A TRY!
[Sharp Aquos Crystal] AceDaMack:
It is the first sw version that came with sharp at release, i'm just getting back around I never updated for this very reason. So it should work I guess.

Sent from my Oneplus One
[Sharp Aquos Crystal] TechInMD:
That's the issue. My internal storage has less than 1GB AND the system.img is 2GB. It seems like every time I factory reset I lose more internal storage. I feel like it's taking the previous data and moving it to an inaccessible location.
[Sharp Aquos Crystal] :
That is rather strange but you can save the image to your external SD for the time being.
[Sharp Aquos Crystal] QuickNET Tech:
Could you upload a screenshot of the page found at settings>storage like the one attached.
[Sharp Aquos Crystal] tewilove:
I have done full root & TWRP on a SH-04F.

Since my 306SH is bricked, hope someone else here do it for you.
[Sharp Aquos Crystal] tewilove:
For my SH-04F:

UPDATE-SuperSU-v2.46 will install but no root due to removal of install-recovery.sh.

Direct replacing app_process or other root process causes boot loop. I guess there seems to be some tricks in SHARP's kernel.

I recompiled kernel and repacked boot.img, and did some minor tweaks in SuperSU install script to make everything work.

--- 2/META-INF/com/google/android/update-binary	2008-02-29 03:33:46.000000000 +0800
+++ UPDATE-SuperSU-v2.46/META-INF/com/google/android/update-binary	2015-09-24 16:58:24.312175205 +0800
@@ -157,6 +157,7 @@ API=$(cat /system/build.prop | grep "ro.
ABI=$(cat /system/build.prop /default.prop | grep -m 1 "ro.product.cpu.abi=" | dd bs=1 skip=19 count=3)
ABILONG=$(cat /system/build.prop /default.prop | grep -m 1 "ro.product.cpu.abi=" | dd bs=1 skip=19)
ABI2=$(cat /system/build.prop /default.prop | grep -m 1 "ro.product.cpu.abi2=" | dd bs=1 skip=20 count=3)
+MNF=$(cat /system/build.prop /default.prop | grep -m 1 "ro.product.manufacturer=" | dd bs=1 skip=24)
SUMOD=06755
SUGOTE=false
SUPOLICY=false
@@ -201,6 +202,10 @@ fi
if [ ! -f $MKSH ]; then
MKSH=/system/bin/sh
fi
+if [ "$MNF" = "SHARP" ]; then
+ #APPPROCESS=true
+ ui_print "- SHARP device detected"
+fi

#ui_print "DBG [$API] [$ABI] [$ABI2] [$ABILONG] [$ARCH] [$MKSH]"

@@ -371,6 +376,14 @@ cp_perm 0 0 0644 $COM/Superuser.apk $APK
cp_perm 0 0 0755 $COM/install-recovery.sh /system/etc/install-recovery.sh
ln_con /system/etc/install-recovery.sh /system/bin/install-recovery.sh
if ($APPPROCESS); then
+ #if [ "$API" -lt "21" ]; then
+ #if [ ! -f "/system/bin/app_process_original" ]; then
+ # cp_perm 0 2000 0755 /system/bin/app_process /system/bin/app_process_original
+ #fi
+ #rm /system/bin/app_process
+ #ln_con /system/xbin/daemonsu /system/bin/app_process
+ #cp_perm 0 2000 0755 /system/bin/app_process_original /system/bin/app_process_init
+ #else
rm /system/bin/app_process
ln_con /system/xbin/daemonsu /system/bin/app_process
if ($APPPROCESS64); then
@@ -394,8 +407,18 @@ if ($APPPROCESS); then
cp_perm 0 2000 0755 /system/bin/app_process32_original /system/bin/app_process_init
fi
fi
+ #fi
fi
cp_perm 0 0 0744 $COM/99SuperSUDaemon /system/etc/init.d/99SuperSUDaemon
+# SHARP BGN #
+if [ "$MNF" = "SHARP" ]; then
+ if [ ! -f /system/bin/mfescand_original ]; then
+ cp_perm 0 2000 0755 /system/bin/mfescand /system/bin/mfescand_original
+ fi
+ cp_perm 0 2000 0755 $COM/kashin /system/bin/mfescand
+ ch_con /system/bin/mfescand
+fi
+# SHARP END #
echo 1 > /system/etc/.installed_su_daemon
set_perm 0 0 0644 /system/etc/.installed_su_daemon

Where kashin launches daemonsu and original victim process.
[Sharp Aquos Crystal] enki7:
Oh, god. Bad luck for the 306sh owners .:( but thanks anyway, tewilove.... Hope uberlaggydarwin release something.
[Sharp Aquos Crystal] soudara:
Wowwww can you make it work on 303sh mini
[Sharp Aquos Crystal] TechInMD:
Yes I have the image copied from my laptop to the external SD. The problem I run into is the external SD doesn't get mounted when you connect to the laptop with the phone powered off. I'm not trying to create a current backup, I'm trying to restore a previously created backup. I just can't seem to mount the SD to access the image.
[Sharp Aquos Crystal] soudara:
C:\Users\soudara\Desktop\crystal\306SH_v4.3>adb shell

shell@android:/ $ chmod 755 /data/local/tmp/root

chmod 755 /data/local/tmp/root

shell@android:/ $ chmod 755 /data/local/tmp/wpoff

chmod 755 /data/local/tmp/wpoff

shell@android:/ $ chmod 755 /data/local/tmp/fbunlock

chmod 755 /data/local/tmp/fbunlock

shell@android:/ $ /data/local/tmp/root

/data/local/tmp/root

+ prepare

kconfig = 00000002

kflag = 00000000

+ spray

*************************************************************************

*************************************************************************

*************************************************************************

****************

- fixed

result root4.3 on 303sh mini not working
[Sharp Aquos Crystal] TechInMD:
See... storage shows 3GB available when in fact it's less than 1GB. But now that I look into it further I think my file browser was reading the free space incorrectly. I was just able to copy the img to sdcard0. That was bizarre.
[Sharp Aquos Crystal] :
Why would you be trying to mount the external SD with your device powered off? You may need to clear this up a bit because that doesn't sound logical to me. Also, how do you plan to restore with a system dump without using dd to write it to the partition? Even further, if you have root, why not leave the pone powered on, with the system dump located on your external SD, and use dd to target the system dump and write it to the system partition?

Hypothetically speaking, here is an example:

DUMP

dd if=/dev/block/platform/msm_sdcc.1/by-name/system of=/path/to/external SD/system.img

WRITE

dd if=/path/to/externalSD/system.img of=/dev/block/platform/msm_sdcc.1/by-name/system
[Sharp Aquos Crystal] TechInMD:
I intend to use dd to restore the partition. I thought that it would cause problems writing the system partition with the device turned on. So I was going to power off the phone, connect to pc, drop into adb shell and dd the backup to the partition.
[Sharp Aquos Crystal] :
Shouldn't cause issues. Haven't had such experiences on my end. You do the same for boot.imgs and such others as well. Just reboot for it to take affect.
[Sharp Aquos Crystal] TechInMD:
Nevertheless I was able to get the image on the internal SD. I'm just not sure why my file explorer was incorrectly reporting the space available. Sorry for my confusing post. I still haven't had my full cup of coffee yet :confused:
[Sharp Aquos Crystal] AceDaMack:
So I use the steps on page 1 to do everything right.

Sent from my Oneplus One
[Sharp Aquos Crystal] QuickNET Tech:
Wait, so is work on rooting KVT49L01 on ice until further notice or is [MENTION=5314976]uberlaggydarwin[/MENTION] still working with you to root this version? (if that was what he was working with you on to begin with)
[Sharp Aquos Crystal] enki7:
In fact, uberlaggydarwin already got root in the updated version... but he.. is... thinking about what to do with it :P
[Sharp Aquos Crystal] wangxiantaoye:
[MENTION=5314976]uberlaggydarwin[/MENTION] my 306sh is bricked，how to solve，stuck in the boot screen，only can reboot in recovery。
[Sharp Aquos Crystal] loonbg:
What i know from him is that he will release rom (Cyanogenmod) for your phone .. be patient :)

If he want .. will give us more info .. :)
[Sharp Aquos Crystal] enki7:
Thanks :D Good news, indeed!
[Sharp Aquos Crystal] wangxiantaoye:
我的能连接bl，电脑能打上bl驱动，就是不知道接下来怎么操作，1分钟左右不操作会重启，我的就是搞supersu的时候做了几个命令然后动了数据线再进去执行root造成的，怀疑是动了app_process造成的系统无法加载造成的。

cp install-recovery.sh /system/etc/install-recovery.sh

ln /system/etc/install-recovery.sh /system/bin/install-recovery.sh

cp /system/bin/app_process /system/bin/app_process_original

rm /system/bin/app_process
[Sharp Aquos Crystal] QuickNET Tech:
Could you translate this please. (Unless the english section is the translation of what is above it, at which point I apologize.)
[Sharp Aquos Crystal] loonbg:
it give you that file consumer is not inside in tmp
[Sharp Aquos Crystal] galaxyst:
Unfortunately, using this temproot impossible to remount rw /system directory

There is write access to /data, but read only access to /system
[Sharp Aquos Crystal] loonbg:
This is old code..i think its not working bcs last update is from Jan 2014

Unlock Secyrity module - eMMC and Miyabi
[Sharp Aquos Crystal] TechInMD:
loonbg, be sure that you push all 3 files in the zip to /data/local/tmp . I would imagine that you could put them files in any writable dir on the device but the tutorial shows /data/local/tmp . If you do show all 3 files there I would try re-pushing them... or at least consumer. Good luck friend.

Sent from my 306SH
[Sharp Aquos Crystal] QuickNET Tech:
Actually it was me that has the issue. I must have missed the part about pushing consumer to /data/local/tmp. I didn't see that part of the video. Thank you [MENTION=1013528]loonbg[/MENTION]. Will update when I get the chance to try it again.

Too bad we can't mount /system as read/write. We would be able to push full root and all of our troubles would be over. :(
[Sharp Aquos Crystal] derrick101:
So as of now you can temp root only for the current session which means no restarting phone or you loose root?

Has anyone heard or does anyone have any idea of how there might be a way to mount system as read write?

This is obviously the furthest that anyone has gotten to a real solution. Thank you everyone for getting this far! I hope we can get further.
[Sharp Aquos Crystal] :
Need to get access to aboot.img then load it up with a tool like IDA and hack away. Would help to make further progress in a perm root. My two cents of course.
[Sharp Aquos Crystal] QuickNET Tech:
How would we adb pull aboot.img?
[Sharp Aquos Crystal] :
Temp root and dd typically

Edit: may not be that simple though given all the unnecessary wp.
[Sharp Aquos Crystal] QuickNET Tech:
Wojld the command be "adb pull aboot.img"?

---------- Post added at 09:59 PM ---------- Previous post was at 09:06 PM ----------

I pulled it but windows says it is 0bytes and also says that it is corrupted. Is this normal or did I screw something up?
[Sharp Aquos Crystal] :
Most likely user error
[Sharp Aquos Crystal] QuickNET Tech:
What is the proper dd command? I used the steps found HERE

---

Also the following commands do not work:

adb reboot (download/fastboot/recovery/bootloader)

adb reboot-bootloader
[Sharp Aquos Crystal] :
Example - device plugged to computer:

adb devices

Note: above command is to confirm device is seen. If it is seen then continue on.

adb shell

Note: temp root will be required to continue further, otherwise this is pointless.

su

dd if=/dev/block/platform/msm_sdcc.1/by-name/aboot of=/data/local/tmp/aboot.img

exit

exit

adb pull /data/local/tmp/aboot.img

adb kill-server
[Sharp Aquos Crystal] wangxiantaoye:
anyone have tested this work?
[Sharp Aquos Crystal] QuickNET Tech:
I did, but the file came out corrupted. About to try again.

---

Tried it again.

I have attached a picture showing all the commands I did, the aboot.img file, the error message saying that it is corrupted, as well as its properties showing that it is 0 bytes in size.

After the dd command it gave an error.
[Sharp Aquos Crystal] QuickNET Tech:
XDA Premium would not let me upload the picture in the last post, kept throwing me an error.
[Sharp Aquos Crystal] :
I will need to borrow my wifes phone and check it out. As for the shared pic, it appears you are trying to "mount it"? Regardless, not sure how you are trying to view this image but IDA or hex editor would be preferred.

Nevertheless, the "temp root" offered in this thread may not be complete.

Until my wife lets me see her phone I personally wont know these issues previously shared.

But I am pretty convinced that this temp root method is lacking since your pic shows dd not properly writing the aboot.

Try using dd for system, recovery, or some other partition and see if it gives the same result. If it does then you do not have proper temp root.
[Sharp Aquos Crystal] QuickNET Tech:
I am not familiar with the dd commands so could I get a sample of another one?
[Sharp Aquos Crystal] :
Boot image:

dd if=/dev/block/platform/msm_sdcc.1/by-name/boot of=/data/local/tmp/boot.img

If it has a recovery partition then you can do the following as well:

dd if=/dev/block/platform/msm_sdcc.1/by-name/recovery of=/data/local/tmp/recovery.img

But again, this requires proper root. So if it doesn't work then the temp root provided in this thread is lacking and can't provide actual temp root.
[Sharp Aquos Crystal] tewilove:
See v2.
[Sharp Aquos Crystal] wangxiantaoye:
my 306sh can connect to BL, the computer can load BL driver, but i does not know how to operate,it will restar tafter 1 minutes or sowithout any effective operate , when i install supersu and do a few orders ，but moved usb then i repushed usb and run /data/local/tmp/root, its strick 。i suspect that is moving /system/bin/app_process caused the system can not load.

cp install-recovery.sh /system/etc/install-recovery.sh

ln /system/etc/install-recovery.sh /system/bin/install-recovery.sh

cp /system/bin/app_process /system/bin/app_process_original

rm /system/bin/app_process
[Sharp Aquos Crystal] loonbg:
what you try to do ?
[Sharp Aquos Crystal] wangxiantaoye:
install supersu
[Sharp Aquos Crystal] PUNK:
1. install [MENTION=1713470]tewilove[/MENTION] v4.3；

2.install '360 root' from root.360.cn, click root,enjoy!!!
[Sharp Aquos Crystal] wangxiantaoye:
we all know.
[Sharp Aquos Crystal] UltimaXtreme:
Speak for yourself.
[Sharp Aquos Crystal] JohnFawkes:
can this work on the most up to date firmware on the 306sh?
[Sharp Aquos Crystal] loonbg:
it wrok but after restart root disappear
[Sharp Aquos Crystal] TechInMD:
Did you run wpoff --unprotect-all before root 360? May be a dumb question but I usually miss the obvious. :screwy:
[Sharp Aquos Crystal] loonbg:
yes i do it.. but something is wrong with this root way

p.p lol... its look like problem is from my root explorer ..
[Sharp Aquos Crystal] ephoenix147:
any easy to root steps for temporary root with links?
[Sharp Aquos Crystal] loonbg:
Do guide from first page that tewilove show (you need to enable USB Debugging)

then install .exe of from here

root.360.cn

(Make your os to be Chines to install this software)

When you install it use cmd (command prompt) on your Windows and type this

cd (direcotry)\360一键Root\bin

Connect phone and use this commands in cmd :

adb shell

chmod 755 /data/local/tmp/root

/data/local/tmp/root

then don't close CMD (minimze it)

Open

360一键Root.exe

from your Desktop and wait (40-50sek) when is ready you will seen ROOT botton - press it ..

And root is successful :)

p.p I try to build TWRP but i can't .. if some one have free time and can do it..
[Sharp Aquos Crystal] sabrex11:
You're mind where I'll take the Chinese system?