[Android Q&A, Help & Troubleshooting] jupiter126:
yes

Important Update:

A few months after using this method, I realise that now system updates fail on my phone.

I managed to unroot the phone using supersu, but no luck, updates still fail...

If I manage to bypass this, I will update this post, but so far, no luck...

#######################################################

Got root yesterday, but not sure how safe method is...

Steps performed:

- I first downloaded KingRoot-4.1.0.245.apk from an untrusted source that I can't remember I still have the file though, and could share it if needed, but again, I don't really trust it - I just hope there's no malware.

md5 of the file is 8b411efbf70b8d7f70d12bb4984775e2

- Once succesfully rooted with Kingroot, I Installed "supersu me" from playstore and used it to replace kingroot with supersu

https://play.google.com/store/apps/details?id=darkslide.com.supersumepro&hl=en

This seems to have removed all the chinese bloatware installed by KingRoot... but here again, I can't know for sure...

root access remains after reboot, titanium backup allowed me to remove some apps (like the cat ones) so it seems to work fine.

nandroid backup seemed to backup things correctly, but the recovery.img with a size of 8192 leaves me dubious....

So far I was unable to find any custom recovery for the CAT S40 though... I guess that should be the next step before starting to try to find custom roms... ^^

Any clue about safety of the method I used, custom recovery or custom roms for S40 would be welcome ;)

edit:

When searching manually, I believe I got a better recovery dump;

JuPiTeR ~ # adb shell

shell@CatS40:/ $ su

root@CatS40:/ # ls -al /dev/block/platform/7824900.sdhci/by-name/

lrwxrwxrwx root root 1970-04-29 16:19 DDR -> /dev/block/mmcblk0p15

lrwxrwxrwx root root 1970-04-29 16:19 aboot -> /dev/block/mmcblk0p25

lrwxrwxrwx root root 1970-04-29 16:19 abootbak -> /dev/block/mmcblk0p26

lrwxrwxrwx root root 1970-04-29 16:19 boot -> /dev/block/mmcblk0p28

lrwxrwxrwx root root 1970-04-29 16:19 cache -> /dev/block/mmcblk0p29

lrwxrwxrwx root root 1970-04-29 16:19 config -> /dev/block/mmcblk0p24

lrwxrwxrwx root root 1970-04-29 16:19 devinfo -> /dev/block/mmcblk0p21

lrwxrwxrwx root root 1970-04-29 16:19 fsc -> /dev/block/mmcblk0p12

lrwxrwxrwx root root 1970-04-29 16:19 fsg -> /dev/block/mmcblk0p16

lrwxrwxrwx root root 1970-04-29 16:19 keystore -> /dev/block/mmcblk0p22

lrwxrwxrwx root root 1970-04-29 16:19 misc -> /dev/block/mmcblk0p11

lrwxrwxrwx root root 1970-04-29 16:19 modem -> /dev/block/mmcblk0p1

lrwxrwxrwx root root 1970-04-29 16:19 modemst1 -> /dev/block/mmcblk0p9

lrwxrwxrwx root root 1970-04-29 16:19 modemst2 -> /dev/block/mmcblk0p10

lrwxrwxrwx root root 1970-04-29 16:19 oem -> /dev/block/mmcblk0p23

lrwxrwxrwx root root 1970-04-29 16:19 pad -> /dev/block/mmcblk0p8

lrwxrwxrwx root root 1970-04-29 16:19 persist -> /dev/block/mmcblk0p18

lrwxrwxrwx root root 1970-04-29 16:19 persistbak -> /dev/block/mmcblk0p19

lrwxrwxrwx root root 1970-04-29 16:19 recovery -> /dev/block/mmcblk0p27

lrwxrwxrwx root root 1970-04-29 16:19 rpm -> /dev/block/mmcblk0p4

lrwxrwxrwx root root 1970-04-29 16:19 rpmbak -> /dev/block/mmcblk0p5

lrwxrwxrwx root root 1970-04-29 16:19 rsv -> /dev/block/mmcblk0p20

lrwxrwxrwx root root 1970-04-29 16:19 sbl1 -> /dev/block/mmcblk0p2

lrwxrwxrwx root root 1970-04-29 16:19 sbl1bak -> /dev/block/mmcblk0p3

lrwxrwxrwx root root 1970-04-29 16:19 sec -> /dev/block/mmcblk0p17

lrwxrwxrwx root root 1970-04-29 16:19 splash -> /dev/block/mmcblk0p14

lrwxrwxrwx root root 1970-04-29 16:19 ssd -> /dev/block/mmcblk0p13

lrwxrwxrwx root root 1970-04-29 16:19 system -> /dev/block/mmcblk0p30

lrwxrwxrwx root root 1970-04-29 16:19 tz -> /dev/block/mmcblk0p6

lrwxrwxrwx root root 1970-04-29 16:19 tzbak -> /dev/block/mmcblk0p7

lrwxrwxrwx root root 1970-04-29 16:19 userdata -> /dev/block/mmcblk0p31

dd if=/dev/block/mmcblk0p27 of=/storage/sdcard1/recovery_backup.img

65536+0 records in

65536+0 records out

33554432 bytes transferred in 16.404 secs (2045503 bytes/sec)

I couldn't mount the file, but it seems to open correctly with hexedit:

ANDROID!@.c......i........................S.....................

console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboo

t.hardware=qcom user_debug=31 msm_rtb.filter=0x3F ehci-hcd.park=

3 androidboot.bootdevice=7824900.sdhci lpm_levels.sleep_disabled

=1 earlyprintk..................................................

..... then unreadable

Anyway, I feel more confident with a 32Mb recovery dump than with the previous 6k :)