[Galaxy 3 Android Development] dkorunic:
Rooting XWJI4 or newer ROMs with RageAgainstTheCage

Ok, here goes a short tutorial for adb on how to root XWJI4 (or a newer ROM) if "One Click Root" doesn't work for you.

Update: As an alternative to this tutorial, there is "SuperOneClick" that mostly does the same stuff, but fully automated. Try it! If it fails, you can always go through this again. And note that for all methods the step "0." is required.

0. Enable USB debugging: MENU > Settings > Applications > Development > USB debugging = Checked. This is really essential.

1. For Windows operating systems make sure that Samsung Drivers are installed. You can get them here, or from Kies or from Samsung PC Studio.

2. Use One Click Root. That will upload update.zip on your SD card and it will try to apply it. Don't skip this part, we will use this files even if they don't elevate us to root access.

3. How to actually verify if One Click Root has worked? Check if Superuser is in Applications list in your launcher. Second, use "su" command to see if Superuser prompts you for privilege elevation. To try that, you have to use adb:

adb shell su -

At this moment, Superuser should prompt you asking if you want to allow privilege elevation. If this doesn't happen and results with an error, you know you haven't rooted your device yet.

4. Ok, how we have to exploit some vulnerability in our device to be able to actually escape in root shell. One of the quite popular methods is Rage Against The Cage from team 743C. You have to download the actual exploit here and put it on your device where we can execute it:

adb push rageagainstthecage-arm5.bin /data/local/tmp
adb shell chmod 755 /data/local/tmp/rageagainstthecage-arm5.bin
adb shell /data/local/tmp/rageagainstthecage-arm5.bin

5. Wait a few seconds and look at the text. When adb exits, enter shell again:

adb shell

6. You should notice that you have the "#" prompt instead of "$". If this is true, then you have succeeded in gaining temporary root access. If not, go back to step 4.

7. Ok, you have "#" blinking in front of you. We now need to setuid root the su application after we remount the /system partition. Keep typing:

mount -o remount,rw /dev/block/stl6 /system
chmod 6755 /system/xbin/su
chmod 755 /system/xbin/busybox
/system/xbin/busybox --install -s /system/xbin
sync
mount -o remount,ro /dev/block/stl6 /system
exit

8. Kill adb server:

adb kill-server

9. Test if your root works with commands from step 3:

adb shell su -

10. Now when you have rooted your device, you can install Titanium Backup from Market and use it remove various unnecessary aplications from your /system partition (Samsung Applications, old Skype) and backup our user applications (/data partition). Also you can install Superuser application from Market to update the "su" command as well as Superuser application itself. Notice that Titanium works best with its own version of busybox (click Problems button in Titanium). And you can install ClockSync to keep your device NTP synchronised, etc.

11. For you really brave, you can try updating the busybox itself, the one located at /system/xbin/busybox. This is easiest to do with Stericsson Busybox application from Market. It doesn't work OK with our ROMs, but it will leave latest busybox on /sdcard when installed. You have to run it once, but don't click on install:

adb shell
su -

Allow root access when prompted and then proceed:

mount -o remount,rw /dev/block/stl6 /system
cat /sdcard/busybox > /system/xbin/busybox
chmod 755 /system/xbin/busybox
/system/xbin/busybox --install -s /system/xbin
sync
mount -o remount,ro /dev/block/stl6 /system
exit

And that's it! :) Good luck, have fun. Let me know what you think.