[E 2015 General] kryz:
Permanent root tutorial

This will be a little tutorial to do a permanent root in phones that has not VERITY checking the system partition i think devices with lollipop has not implemented it.

Once time one user have done this method ill do it easy for all the users but we need to do a hard task once.

Requirements:

-Linux system

-Adb conectivity

-Some knowledge in unix command line.

-Recovery with a stock img.

Before try this method please be sure you have a stock img and recovery ready to flash it, this method is working in 2 devices with lollipop that ive tried, but i don't have a Moto E to test it.

In this method we will backup the system partition first :

dd if=/dev/block/bootdevice/by-name/system of=/sdcard/system.img bs=4096

We have a backup of system partition in /sdcard/system.img

We have to pull this img to our linux system, i will use this folder for the process:

/home/kryz/EXPLOIT/

we pull this backup to our folder:

adb pull /sdcard/system.img .

Now we have the backup of system partition in our linux box.

Lets create a folder and mount this image on it:

mkdir mnt
sudo mount system.img mnt/

We have our system backup mounted on mnt folder:

ls -la mnt/
total 211448
drwxr-xr-x. 18 root root 4096 Jan 1 1970 .
drwxr-xr-x 3 kryz kryz 4096 Jan 8 13:30 ..
drwxr-xr-x. 165 root root 4096 Jul 10 2015 app
drwxr-xr-x. 2 root 2000 8192 Jul 10 2015 bin
-rw-r--r--. 1 root root 8187 Jul 10 2015 build.prop
drwxr-xr-x. 20 root root 4096 Jul 10 2015 etc
drwxr-xr-x. 2 root root 4096 Jul 10 2015 fonts
drwxr-xr-x. 4 root root 8192 Jul 10 2015 framework
drwxr-xr-x. 12 root root 16384 Jul 10 2015 lib
drwx------. 2 root root 4096 Jan 1 1970 lost+found
drwxr-xr-x. 3 root root 4096 Jul 10 2015 media
drwxr-xr-x. 2 root root 4096 Jul 10 2015 odex.app
-rw-r--r--. 1 root root 88993792 Jul 10 2015 odex.app.sqsh
drwxr-xr-x. 2 root root 4096 Jul 10 2015 odex.priv-app
-rw-r--r--. 1 root root 127426560 Jul 10 2015 odex.priv-app.sqsh
drwxr-xr-x. 98 root root 4096 Jul 10 2015 priv-app
drwxr-xr-x. 3 root root 4096 Jul 10 2015 semc
drwxr-xr-x. 3 root root 4096 Jul 10 2015 tts
drwxr-xr-x. 9 root root 4096 Jul 10 2015 usr
drwxr-xr-x. 12 root 2000 4096 Jul 10 2015 vendor
drwxr-xr-x. 2 root 2000 4096 Jul 10 2015 xbin

Now is time to modify the system partition adding the su binaries, replacing some files , and change some permissions to start su at the boot, i have one script that do all those steps:

#!/bin/bash
XBIN="mnt/xbin"
ETC="mnt/etc";
BIN="mnt/bin";
LIB="mnt/lib";
TOOLS="tools";

echo "Installing the supersu tools."
cp $TOOLS/su $XBIN/su
cp $TOOLS/su $XBIN/daemonsu
cp $TOOLS/su $XBIN/sugote
cp $TOOLS/supolicy $XBIN/supolicy
cp $TOOLS/libsupol.so $LIB/libsupol.so
cp $BIN/sh $XBIN/sugote-mksh

echo "Creating symbolic links"
last_pwd=`pwd`
cd $BIN
mv app_process32 app_process32_original
ln -sf ../xbin/su app_process
cp app_process32_original app_process_init
cd $last_pwd

echo "Changing permissions."
chmod 0755 $XBIN/su
chmod 0755 $XBIN/daemonsu
chmod 0755 $XBIN/sugote
chmod 0755 $XBIN/supolicy
chmod 0644 $LIB/libsupol.so
chmod 0755 $XBIN/sugote-mksh
chmod 0755 $BIN/app_process_init
chmod 0755 $BIN/app_process

echo "Changing owners."
chown root:2000 $XBIN/su
chown root:2000 $XBIN/daemonsu
chown root:2000 $XBIN/sugote
chown root:2000 $XBIN/supolicy
chown root:2000 $LIB/libsupol.so
chown root:2000 $XBIN/sugote-mksh
chown root:2000 $BIN/app_process_init
chown root:2000 $BIN/app_process

echo "Adding selinux context attributes. "
chcon u:object_r:system_file:s0 $XBIN/su
chcon u:object_r:system_file:s0 $XBIN/daemonsu
chcon u:object_r:zygote_exec:s0 $XBIN/sugote
chcon u:object_r:system_file:s0 $XBIN/supolicy
chcon u:object_r:system_file:s0 $LIB/libsupol.so
chcon u:object_r:system_file:s0 $XBIN/sugote-mksh
chcon u:object_r:system_file:s0 $BIN/app_process_init
chcon -h u:object_r:system_file:s0 $BIN/app_process

So you have to execute this script in the folder that you have the system.img and the folder mnt in my case in:

ls -la /home/kryz/EXPLOIT
total 2097184
drwxr-xr-x 4 kryz kryz 4096 Jan 8 13:35 .
drwxr-xr-x 20 kryz kryz 12288 Jan 8 13:25 ..
drwxr-xr-x. 18 root root 4096 Jan 1 1970 mnt
-rwxr-xr-x 1 kryz kryz 1442 Jan 8 13:35 prepare_system.sh
-rw-r--r-- 1 kryz kryz 2147483648 Jan 8 13:36 system.img
drwxr-xr-x 2 kryz kryz 4096 Jan 8 13:33 tools

Also you for this script you have to create the folder tools with some binaries from su:

ls -la tools/
total 324
drwxr-xr-x 2 kryz kryz 4096 Jan 8 13:33 .
drwxr-xr-x 4 kryz kryz 4096 Jan 8 13:35 ..
-rw------- 1 kryz kryz 203236 Jan 8 13:33 libsupol.so
-rwx------ 1 kryz kryz 75364 Jan 8 13:33 su
-rwx------ 1 kryz kryz 38308 Jan 8 13:33 supolicy

When you execute the script we call it prepare_system.sh:

sudo ./prepare_system.sh
Installing the supersu tools.
Creating symbolic links
Changing permissions.
Changing owners.
Adding selinux context attributes.

We have modified the system partition is time to umount it:

sudo umount mnt/

We will push this system.img to our device with adb to a file named system.patched:

adb push system.img /sdcard/system.patched

Now we have to overwrite the system partition with our modified one with root privileges in the android:

dd if=/sdcard/system.patched of=/dev/block/bootdevice/by-name/system bs=4096

If you get some errors in this command try to remount /system with abort option before:

mount -o remount,abort /system

Once finished the process cross fingers and reboot the device.

If this method is working please keep the system.img and system.patch files because ill do one patch in the exploit to patch the system partition in hot and fast just some seconds to patch it, but the first time we have to do all these steps :P

I attach one rar password: nox with the script and the tools required.