[General Topics] xXx yYy:
View attachment 6109797

All you need is an Android device with 2.5 GB of free internal storage space and a strong internet connection. Nothing else.

Preface:

In the world of Android, term rooting refers to the process of gaining root access to your device's operating system. This grants you a much deeper level of control, similar to being an administrator on a Windows computer. Here's a breakdown of what rooting entails:

1. Obtaining Privileges: Normally, the Android system restricts what users can modify to maintain stability and security. Rooting bypasses these limitations, giving you unrestricted access to the core files and settings.

2. Customization Power: With root access, you can significantly personalize your device. You can uninstall pre-installed apps you don't use, tweak system settings, and even flash custom ROMs (modified operating systems) for a whole new user experience.

To gain root access to your device's operating system in Android's filesystem the su (shorthand for switch user) binary must be present: It's the su binary what is responsible for granting root access to apps and processes upon user approval. It evaluates the user's decision and determines whether to elevate the app's privileges.

You might not find su included by default in Android's Toybox. This means users can choose to add the su functionality if they require root access on their system. And this thread will show you how to add missing su functionality to Android via using Termux: Termux is an application for Android which emulates the Linux environment and its Terminal.

This rooting method doesn't

1. Brick the device

2. Void warranty

3. Open an exploit gateway

4. Cause data loss

5. Patch any system files

5. Cause app incompatibilty

This rooting method will neither get detected by banking / payment apps nor so called root-checker apps.

AFAIK these apps stupidly look for the presence of the su binary in specific locations on the device. Typically they look for presence of /system/bin/su, /system/xbin/su, /sbin/su, /system/su, /system/bin/.ext/.su, /system/usr/we-need-root/su-backup, /system/xbin/mu, /sbin/magisk, /magisk/.core/bin/su to give an indication of root, but not for /data/data/com.termux/files/usr/bin/su.

Installing Termux does not require root access on your Android device. Termux is designed to be a Linux environment for non-rooted devices, allowing you to use a variety of command-line tools and utilities.

Take note that Termux installation will allocate >= 2 GB disk space.

A:

Installing Termux

Download the (at the time of this writing latest) Termux package version 0.118.0 (118) from https://f-droid.org/en/packages/com.termux/

and install it. If you install Termux from Google Playstore, then you will receive package command errors. Playstore builds are deprecated and no longer supported.

Note: The installation creates a "bin" subfolder in directory /data/data/com.termux/files/usr, which you can place any binaries (or) executables in that folder that can be called from any where in Termux, so also the su binary.

B:

Setup Termux

1.Grant Termux local storage access

By default, Termux does not have access to your internal and SD-card storage. You need to manually set up the permission.

Run this command in Termux

termux-setup-storage

After you run the above command, a pop-up box will appear asking you for permission to access the local storage. Tap Allow. Unfortunately, Termux currently doesn't offer a built-in way to automatically tap "Allow" on the storage permission pop-up.

2. Update and/or upgrade Termux

Run the following 1-liner command in Termux to update and/or upgrade Termux:

pkg update > /dev/null 2>&1 && pkg upgrade -y > /dev/null 2>&1

The process will take some time, so be patient.

3. Install WGET functionality

Run the following 1-liner command in Termux to add wget functionality

pkg install wget &> /dev/null; echo $? | grep -q 0 && echo "Wget installed successfully" || echo "Error installing wget"

4. Install UNZIP functionality

Run the following 1-liner command in Termux to add wget functionality

pkg install unzip &> /dev/null; echo $? | grep -q 0 && echo "Unzip installed successfully" || echo "Error installing unzip"

C:

Adding the SU binary to Termux

1. Delete the SU script, if it exists

Run the following command in Termux:

rm -f /data/data/com.termux/files/usr/bin/su* 2>/dev/null

2. Create space to hold SuperSU.zip

Run the following 1-liner command in Termux:

mkdir -p -m 0755 /data/data/com.termux/files/supersu && cd /data/data/com.termux/files/supersu

3. Download SuperSU.zip and unzip it and delete the SuperSU.zip

Run following 1-liner command in Termux

{ wget -q https://drive.google.com/file/d/0By-NOo-lCyxBS3FQTDVqY2Q3ZVU/view?pli=1&resourcekey=0-0UIFGzaj7X07jNn9JJA6NQ &> /dev/null; echo $? | grep -q 0 && { echo "SuperSu downloaded successfully"; unzip SuperSU-v2.82-201705271822.zip 2>/dev/null && echo "SuperSU unzipped successfully" || echo "Unzipping SuperSU failed" } || echo "Error downloading SuperSU" }

4. Delete the downloaded SuperSU.zip and move file pointer to work directory

rm -f ./supersu/*.zip 2>/dev/null;
cd /data/data/com.termux/files/supersu/SuperSU-v2.82-201705271822

5. Get device's CPU architecture, extract the matching SU binary suite and store it in Termux's /files/user/bin subfolder

Run following 1-liner command in Termux:

{ ARCH="$(uname -m)"; && { [[ "$ARCH" == "arm64" ]] && SU_FLDR="./arm64"; } || { [[ "$ARCH" == "arm32" ]] && SU_FLDR="./armv7"; } && { [[ -n "SU_FLDR" ]] && cp "$SU_FLDR/*" /data/data/com.termux/files/usr/bin/; }

Here's a breakdown:

ARCH="$(uname -m)": This part assigns the output of the uname -m command (which reveals the machine's architecture) to the variable ARCH.

&& { ... } || { ... }: This is a nested conditional statement using the && (AND) and || (OR) operators. It checks two conditions:

[[ "$ARCH" == "arm64" ]]: This condition checks if the value of ARCH is exactly "arm64". If it is, the code within the first curly braces {} executes.

[[ "$ARCH" == "arm32" ]]: If the first condition isn't met, this part checks if ARCH is "arm32". If it is, the code within the second curly braces {} executes.

SU_FLDR="./arm64" or SU_FLDR="./armv7": Inside each conditional block, a variable named SU_FLDR is assigned a value. Depending on the architecture (arm64 or arm32), the corresponding subdirectory path is set (".arm64" or "./armv7"). These directories likely contain files relevant for root access.

[[ -n "SU_FLDR" ]] && cp "$SU_FLDR/*" /data/data/com.termux/files/usr/bin/: This part performs a final check and the actual file copy operation:

[[ -n "SU_FLDR" ]]: This condition checks if the SU_FLDR variable has a non-empty value (meaning an architecture was detected).

cp "$SU_FLDR/*" /data/data/com.termux/files/usr/bin/: If the condition is true, the cp command copies all files (*) from the SU_FLDR directory (e.g., ./arm64 or ./armv7) to the /data/data/com.termux/files/usr/bin/ directory. This directory is part of the Termux environment's path, essentially making those copied files accessible from the Termux shell.

6. Delete extracted SuperSU

Run the following command in Termux:

rm -rf ./supersu/* 2>/dev/null

7. Make the SU-binary executable

Run the following command in Termux:

chmod +xs /data/data/com.termux/files/usr/bin/su

D:

Create a RUN-AS-ROOT script - a wrapper for su binary calls

To do so you type in this 1-liner code in Termux

sh -c 'cat << EOF > /data/data/com.termux/files/usr/bin/run-as-root.sh; #!/system/bin/sh; ANDROID_SYSPATH=("/system/bin:/system/xbin"); SU_ARGS=""; SU_CMDLINE=""; SWITCH_USER=""; ENVIRONMENT_PRESERVE=""; for ARGUMENT in "$@"; do if [[ $ARGUMENT =~ ^- ]]; then OPTION=${ARGUMENT:1}; case $OPTION in c) SU_CMDLINE=$2 ; shift ;; s) SWITCH_USER=$2 ; shift ;; p) ENVIRONMEMT_PRESERVE=$2 ; shift ;; *) echo "Invalid option: -$OPTION" >&2; exit 1 ;; esac; else echo "Invalid argument: $ARGUMENT" >&2 exit 1; fi; done; [[ -z "$SWITCH_USER" ]] || SU_ARGS+=("$SWITCH_USER"); if [[ -n "$ENVIRONMENT_PRESERVE" ]]; then SU_ARGS+=("--preserve-environment"); SU_CMDLINE="PATH=$ANDROID_SYSPATHS:$PATH "; else SU_CMDLINE="PATH=$ANDROID_SYSPATHS"; fi; SU_ARGS+=("-c"); exec "${SU_ARGS[@]}" "${SU_CMDLINE}"; exit 0; EOF'

and apply it.

Don't forget to make this script executable, i.e. run Termux command

chmod +x /data/data/com.termux/files/usr/bin/run-as-root.sh

E:

Set password to be used by su binary

The default password for the su binary is not set by default. This is a security measure to prevent unauthorized access to root privileges. When you install an operating system, you are typically prompted to set a root password during the installation process. This password is then used to gain root access using the su binary.

If you have not set a root password, you will need to do so before you can use the su binary. You can do this by using the passwd command:

run-as-root -c 'passwd root'

This will prompt you to enter a new password for the root user. Once you have set a password, you can use it to gain root access using the su binary

F:

Verify the installation of SU binary

To verify that the su binary is installed correctly, run the following command in Termux:

{ su -c 'SU_ENV=$PATH:/data/data/com.termux/files/usr/bin; export PATH=$SU_ENV; exec su' }

Let's break it down step-by-step:

su -c: This initiates a switch to the superuser (root) account with the -c flag specifying a command to execute after switching.

SU_ENV=$PATH:/data/data/com.termux/files/usr/bin: This line defines a new environment variable named SU_ENV. It assigns a value that combines the existing environment variable PATH with an additional directory: /data/data/com.termux/files/usr/bin.

export PATH=$SU_ENV: This line exports the newly defined SU_ENV variable, making it accessible within the root shell environment. Essentially, it adds the directory /data/data/com.termux/files/usr/bin to the list of locations where the shell searches for executable programs.

exec su: This part replaces the current process with the su command. This effectively launches the root shell with the modified PATH environment.

You will notice that the shell's prompt changes from $ to # what indicates you're actually in root mode:

View attachment 6109816

To verify you're are root you additionally can run cmd id . The output should likely show uid=0(root) gid=0(root) groups=0(root)

G:

Add SU-binary to Android's search PATH thus it's systemwide accessible

You run this command in Termux:

su -c 'echo "PATH="/data/data/com.termux/files/usr/bin/su:$PATH >> /data/data/com.termux/files/home/.bashrc'

H:

Termux needs to be restarted to work properly.

I:

Clean up Termux

Both Termux and Toybox offer some same common commands, deleting them in Termux based on presence in Toybox may be indicated to avoid conflicts. This is done by running this command in Termux:

{
TOYBOX_CMDS=$(command -v | grep -vE "$(toybox --list | tr '\n' ' ')");
if [[ -n "$TOYBOX_CMDS" ]]; then
for cmd in $TOYBOX_CMDS; do
rm -f /data/data/com.termux/files/usr/bin/$cmd 2>/dev/null
done
fi }

J:

Addendum

Usage:

su [-lp] [-u UID] [-g GID,...] [-s SHELL] [-c CMD] [USER [COMMAND...]]

Switch user, prompting for password of new user when not run as root.

With one argument, switch to USER and run user's shell from /etc/passwd.

With no arguments, USER is root. If COMMAND line provided after USER,

exec() it as new USER (bypassing shell). If -u or -g specified, first

argument (if any) isn't USER (it's COMMAND).

first argument is USER name to switch to (which must exist).

Non-root users are prompted for new user's password.

-s Shell to use (default is user's shell from /etc/passwd)

-c Command line to pass to -s shell (ala sh -c "CMD")

-l Reset environment as if new login.

-u Switch to UID instead of USER

-g Switch to GID (only root allowed, can be comma separated list)

-p Preserve environment (except for $PATH and $IFS)

K:

Usage examples:

1. Get a phone's product information

run-as-root -c 'cat /system/build.prop | grep "product"'

2. Disable SELinux

run-as-root -c "setenforce 0"

3. List all packages that grants a specific permission e.g. for signature spoofing - 1-liner coding

{ su -c 'pm list packages' | cut -d':' -f2 | while read package; do su -c "dumpsys package $package 2>/dev/null | grep FAKE_PACKAGE_SIGNATURE" && [[ $(grep FAKE_PACKAGE_SIGNATURE <<< $(su -c "dumpsys package $package 2>/dev/null")) ]]; then echo "$package: $(su -c "dumpsys package $package 2>/dev/null | awk -F'android.permission.FAKE_PACKAGE_SIGNATURE:' '{print $2}')"; fi; done }

4. Get screen off discharge rate. Based on Time on battery screen off: and Screen off discharge: sections from dumpsys batterystats - 1-liner coding

{ run-as-root -c 'dumpsys batterystats | grep -A 1 "Screen off discharge" | awk "/Time on battery screen off:/ {screen_off_time=$8*60+$9+$10/60} /Screen off discharge:/ {discharge=$4}; END {if (screen_off_time > 0 && discharge > 0) {printf "%.2f", discharge*60/screen_off_time*100/5000; } else {print "One or both of the results are empty."}}'}

###############################################################################