Galaxy Nexus root / un-root without unlocking bootloader

scary alien · February 12th, 2012, 04:18 PM

.
Introducing the Samsung Galaxy Nexus root / un-root without needing to unlock your bootloader. Yep!

Note: it appears that this will only work for GNex phones running Android ICS 4.0.2--the exploit that this method utilizes does not seem to work for 4.0.4; if you use this method to gain root in 4.0.2 and wish to retain it later in 4.0.4, be sure to use a utility like my app Android Root Toolkit or OTA RootKeeper to save root in 4.0.2 so that you don't lose it when you install the 4.0.4 OTA.

I've now updated this with un-root options and support for Linux (32-bit installs) and Mac/OSX.

Download for the simple-gnex-root-unroot.zip package is located at the bottom of this post.

How to use:

Notes:

this root exploit should work on any Linux kernel 2.6.39 and above; this means that it should currently work on both the GSM and the VZW LTE variants of the Samsung Galaxy Nexus (and indeed, several other devices running this Linux kernel; the key to using the exploit lies in using different hex values corresponding to the offset of the exit() function)
this current root package I have assembled for you has been tested on a VZW (LTE/CDMA) Samsung Galaxy Nexus running Android 4.0.2 using both a Windows 7 and Linux 10.x PC; I believe that it should work on a Mac/OSX system, but I am unable to test that at this time
it appears that the adb-linux binary included with this root package only works on 32-bit installs of Linux; I and another member were unable to get the adb binary to execute properly on a 64-bit install of Ubuntu 11.10 (it worked just fine on the 32-bit version)
since this rooting package / method doesn't require you to unlock your bootloader, you don't have to risk that operation and its warranty implications; additionally, you could use an application like Titanium Backup to save your applications and their data/setup for easier recovery and re-setup later
note that this rooting method does not allow you to install a custom recovery and therefore you will be unable to make a Nandroid backup, or install a custom ROM or theme or kernel--you would still need to unlock your bootloader to do these things
you should also take all due precautions and care when undertaking any modifications to your phone (especially system-related apps) without having the protection of a custom recovery and a Nandroid backup; you always have the fall-back option of unlocking your bootloader and restoring back to stock, too: How to un-root (return to stock)
if you use this rooting method on 4.0.2 as a stepping-stone towards manually installing the 4.0.4 OTA, you might want to think about using an app like OTA RootKeeper to preserve root and have the option to restore it once you are on 4.0.4 (currently, this rooting exploit does not appear to work on ICS 4.0.4)

Credits / references:

Original thread content:

simple-gnex-root-unroot.zip:

.....File size: ..........946,051 (bytes)
.....MD5 checksum: d562b501a37a7fbb7e4174c335f5c881
.....Download: ........simple-gnex-root-unroot.zip

Example rooting session outputs:

.....windows-root-example.txt
.....windows-unroot-example.txt
.....linux-root-example.txt
.....linux-unroot-example.txt

Kudos and props to onfire4g05 for the tweaked version of the shell script for the Mac/OSX system! Thank you!!!

Hipe0ples555 · February 12th, 2012, 04:21 PM

Have any Mac commands?

Do you just put ./ in front of adb-----> ./adb????

scary alien · February 12th, 2012, 04:28 PM

Quote:

Originally Posted by Hipe0ples555

Have any Mac commands?

Well, this really isn't Windows or Mac specific...its mostly adb-specific. So, if you know and are familiar with adb, its fairly straight-forward.

There's a ADB Guide that contains a "Mini-SDK" section with a downloadable sdk-tools.zip file that contains an "adb-mac" file that you can use in place of the "adb" referenced above.

Also, I think I could script this...it should be possible to do this, but I've just finished playing-around with this myself (need a few minutes to finish some other stuff up

).

Lemme know if you have other questions

.

Cheers!

edit: you ninja'd me with your edits, LOL....yes, you basically start-up a terminal session and prefix your "adb" (or adb-mac) references with "./" (as in "./adb devices", etc.).

Paul1201 · February 12th, 2012, 07:20 PM

Would this allow you to place the 4.0.4 OTA in the cache folder and install the OTA without unlocking?

scary alien · February 12th, 2012, 07:37 PM

Quote:

Originally Posted by Paul1201

Would this allow you to place the 4.0.4 OTA in the cache folder and install the OTA without unlocking?

I suppose so...

Since you'll be gaining basic root ability (su / Superuser.apk, etc. (busybox installation is easy, too), you'd be able to place the file in the /cache partition.

Its been a while since I've done this (did it once on my Eris a long while back).

Also, the way the exploit works, you wouldn't even have to root to do this...you could just tweak the process and use the exploit binary to start a temporary rooted shell to accomplish your copies (no need to insert the su and Superuser binaries).

By the way, I'm working on making this into a script...still testing and playing.

Cheers!

gapi · February 12th, 2012, 11:51 PM

Just to once again show my noobness, what are the reasons or advantages of having a locked or unlocked boot-loader option? Why would a person chose one over the other?

Paul1201 · February 13th, 2012, 04:46 AM

Total noob on this also but it is my understanding that unlocking the bootloader is the step that wipes your data from the phone. Also unlike the OG Droid where you could just rename the OTA update.zip and load the OTA early, the GNex requires the file to be loaded into the cache partition which requires root. Using the method discussed by scary alien those who wish to remain stock but have the update early may be able finally accomplish it without having their phones data wiped.

Of course the other advantage is that if you can gain root first you can download Titanium Backup and backup your phone prior to unlocking the bootloader. There is a way to backup using ADB commands but I think Titanium may be easier to restore your data on your phone.

scary alien · February 13th, 2012, 07:40 AM

The biggest reason for unlocking your bootloader is the ability to flash new files such as a custom recovery (and thereby custom ROMs / themes / kernels), as well as being able to flash back to stock / factory images.

While I've not been a big fan of simple one-click root packages (because it makes rooting too easy for some and sometimes get people into trouble), this method falls in line to make rooting the Galaxy Nexus similar to other phones in that a particular exploit will give root access without having to have an unlocked bootloader.

I did more testing last night and have a simple script that one could run from your PC that will install root, but I've got a little polishing I need to do on it before posting.

Additionally, I believe I can make an Android app out of this, too

.

Stay tuned.

Paul1201 · February 13th, 2012, 09:00 AM

Scary alien,

Thank you for investigating this. I have always chosen to unlock/root and run stock roms anyhow so this will make it possible for those like me to use apps that require root (TB, Root Explorer, etc.) and stay on a stock rom.

scary alien · February 13th, 2012, 10:19 AM

Quote:

Originally Posted by Paul1201

Scary alien,

Thank you for investigating this. I have always chosen to unlock/root and run stock roms anyhow so this will make it possible for those like me to use apps that require root (TB, Root Explorer, etc.) and stay on a stock rom.

No problem, Paul! I'm happy to help re. this (and its been a fun and interesting challenge

).

I'm pretty sure I can "simply" (yeah, its really not that simple

) throw these commands in an app and make this a one-click rooter. I'm hopeful that the exploit will remain open for near-future versions of ICS besides 4.0.2.

More to come later!

diverbelow · February 13th, 2012, 04:06 PM

Quote:

Originally Posted by scary alien

.
Okay, I did a little searching and haven't seen that anyone else has yet posted something like this (apologies if they have), but I was reading around this afternoon and discovered a couple of cool things that allows you to install the root binaries without unlocking your bootloader.

Yes...you heard right: root the Samsung Galaxy Nexus without unlocking the bootloader

.

I just did this process manually myself and it works great.

Note: this does involve using adb and assumes that you've already got the proper USB adb drivers installed (although these are usually less finicky than the fastboot drivers (not an issue for Mac or Linux users, though)).

Okay, here's the details of what I did:

Hope you found this interesting.

Cheers and let me know if you have any questions.

-SA

Notes / Cautions:

- this works for the Samsung Galaxy Nexus running Android 4.0.2 and should work for both the GSM/HSPA+ and the VZW LTE/CDMA version of the phone; I also suspect that it will work for 4.0.1 but I haven't test that (yet)

- rooting your device without unlocking your bootloader will basically only let you run root apps; you won't be able to install (or run) a custom recovery, a custom ROM / theme / kernel, etc.

- since you can't install a custom recovery, you won't be able to make a Nandroid backup to put yourself back to a safe, known setup, so keep this in mind when doing any root-related operations (such as using SetCPU for underclocking, or making any system tweaks that can only be done with root) [although you'll always be able to unlock your bootloader and How to un-root (return to stock) the old-fashioned way].

Credits / references:

James Cushing's article over on rootzwiki.com which started me off on this little project:

Developers: Using Mempodroid to Obtain Root
Jay Freeman, a.k.a, Saurik (cited in above rootzwiki article for the CVE-2012-0056 exploit implementation)
Juri Aedla who discovered the CVE-2012-0056 exploit
Jason A. Donenfeld's Linux Mempodipper exploit who wrote about the CVE-2012-0056 exploit in Hacker News
Android exploit details
mempodroid pre-compiled binary
Dan Rosenberg's Droid 4 Exploit for the framework in pushing and enabling the root package

So I was able to push update.zip to /cache with minor adjustments. More to come

scary alien · February 13th, 2012, 04:14 PM

Quote:

Originally Posted by diverbelow

So I was able to push update.zip to /cache with minor adjustments. More to come

Cool! Looking forward to it.

Yeah, I did some streamlining to the process in the scripts I built and tested last night.

I'll be posting a script later this evening (at least that's my plan). Will have to flash back to stock 4.0.2 for about the 14th time now (I'm losing count

) to test this.

What's cool about this is that you can re-purpose this exploit to gain selective root access when you want.

Cheers!

diverbelow · February 13th, 2012, 04:30 PM

My GNex was on 4.0.2 with locked boot loader, non-root and completely stock. I wanted to remain locked and non-rooted (promised the wife) but wanted to see if 4.0.4 was able to fix the random reboot and increase battery life.

Need to know how to use adb and not responsible for bricking the phone.

I used scary alien steps and had to add chmod 777 where it was need.

Download the following files and place it in C:\Android\platform-tools directory or what ever directory you want.:
Android 4.0.4
mempodroid
su

used adb to push the exploit and root binaries over to /data/local:
used adb to push the update.zip to /cache

Upgrade from 4.0.2 to 4.0.4 section

For Upgrade 4.0.4 to newest 4.0.4

Looks like the exploit that was in 4.0.2 kernel has been patched. Looking for workarounds.
Untested, will test late tonight.

Hope this helps.

diverbelow · February 13th, 2012, 08:38 PM

So I use the steps to update my wife's Galaxy Nexus and removed a step.

My wife's GN was completely stock with locked boot loader and non-rooted.

scary alien · February 13th, 2012, 08:47 PM

Little thread bump to let everyone know that I've finished the installation script.

Here's how to use the script:

1. Download the simple-gnex-root.zip file to your MS/Windows PC (found at the bottom of the first post of this thread)

2. Extract the contents to a folder

3. Make sure you have USB debugging enabled on your phone (Settings -> Developer options -> USB debugging (checked))

4. Make sure you the proper adb USB drivers installed:

How to install the adb & fastboot USB drivers (MS/Windows users only)

5. Connect the phone and your computer together with your USB cable

6. Double-click the runme.bat file that's in the folder where you extracted the contents of the simple-gnex-root.zip file

7. The installation goes pretty quickly.

8. Enjoy your new root abilities

.

Obligatory root disclaimer / reminder:

Paul1201 · February 13th, 2012, 09:12 PM

Scary & diver,

Awesome work. I'm really busy this week but hope to take advantage of this over the weekend.

blackberrycubed · February 14th, 2012, 06:53 PM

Quote:

Originally Posted by diverbelow

So I use the steps to update my wife's Galaxy Nexus and removed a step.

My wife's GN was completely stock with locked boot loader and non-rooted.

How do you do last step ?

Whenever I reboot my completely stock phone into recovery mode I get the damn dead droid icon with the red triangle and then after a little bit it reboots.

How do I complete the last part of applying the update?

Thanks

diverbelow · February 14th, 2012, 07:01 PM

Quote:

Originally Posted by blackberrycubed

How do you do last step ?

Whenever I reboot my completely stock phone into recovery mode I get the damn dead droid icon with the red triangle and then after a little bit it reboots.

How do I complete the last part of applying the update?

Thanks

Once you are at the robot laying down press and hold the power button and press volume + and use the arrow keys to move up and down and power button to select.

blackberrycubed · February 14th, 2012, 07:04 PM

It shows the big droid laying down and then I chose recovery and hit the power button, this brings me to another screen with small droid laying down with red triangle.... at this point no buttons work .... Help!

Edit: Ok I get it, now I am not seeing the update.zip file in there even though it had successfully copied over.... this is weird

Edit: Must have done something wrong, just redid all the steps and now I see the file. Update is being applied.

Thanks for these instructions and help.

Yeahha · February 14th, 2012, 07:13 PM

Quote:

Originally Posted by blackberrycubed

It shows the big droid laying down and then I chose recovery and hit the power button, this brings me to another screen with small droid laying down with red triangle.... at this point no buttons work .... Help!

Edit: Ok I get it, now I am not seeing the update.zip file in there even though it had successfully copied over.... this is weird

On this menu if you choose apply update from cache now it does nothing?

If so I would suggest rebooting and trying again.

@SA this method will not prevent OTA updates so if an OTA comes I take it root would be lost. If so should this work should this work on newer version of the OS in theory?

This may be a good thing to add to the beginning of the how to root process to allow people to make backups of the app data then unlock the bootloader which wipes everything, once the phone is fully rooted someone could push the backups back to the phone and restore the app data...just a thought

scary alien · February 14th, 2012, 07:24 PM

Quote:

Originally Posted by Yeahha

@SA this method will not prevent OTA updates so if an OTA comes I take it root would be lost. If so should this work should this work on newer version of the OS in theory?

This may be a good thing to add to the beginning of the how to root process to allow people to make backups of the app data then unlock the bootloader which wipes everything, once the phone is fully rooted someone could push the backups back to the phone and restore the app data...just a thought

Yeah, an OTA will kill root because the su binary gets its execute and SUID-bit permissions reset.

I'm pretty sure that this will work on future versions of ICS unless and until the exploit is patched in the kernel (or a different compiler is used by Google that breaks the exploit).

I'm a little fuzzy on your last paragraph...are you talking about using something like TiBu to back stuff up and later restore after an OTA comes in and you've re-rooted?

(sorry for being fuzzy, LOL, I'm working on a 1-click app version of this method (and was up way too late last night with it

)

Cheers!

Yeahha · February 14th, 2012, 09:29 PM

Quote:

Originally Posted by scary alien

I'm a little fuzzy on your last paragraph...are you talking about using something like TiBu to back stuff up and later restore after an OTA comes in and you've re-rooted?

(sorry for being fuzzy, LOL, I'm working on a 1-click app version of this method (and was up way too late last night with it

)

Cheers!

No problem on the fuzziness

Using TiBU or a similar app was my thought exactly. You would need to transfer the data to a CPU or a dropbox type thing before unlocking the boot loader but it would basically be a loss less root

scary alien · February 14th, 2012, 11:20 PM

Ugh! I'm a doofus!

Totally spaced the blurb in the exploit details:

Quote:

Further, run-as bails early on if it is not either a) already running as root (which would defeat the purpose) or b) not running as the adb shell user, so this unfortunately cannot be integrated into a "one-click root" app. You therefore already need working adb shell access to the device in order to install/run this program and escalate to root.

so, my (failed) efforts last night and tonight trying to create a 1-click app were all for naught

.

Oh, well, the script is easy enough to use...

I'll concentrate on updating the first post with the stuff discussed just above, and making a Mac and Linux version of the .zip.

Cheers!

rickt1152 · February 15th, 2012, 11:14 PM

This could not have been easier. Worked perfectly, took five minutes including downloading the drivers. Such a great option to be able to root, use Titanium Backup and then unlock the bootloader without losing all my app data. The solution I've been looking for. Thanks scary alien.

scary alien · February 15th, 2012, 11:26 PM

Quote:

Originally Posted by rickt1152

This could not have been easier. Worked perfectly, took five minutes including downloading the drivers. Such a great option to be able to root, use Titanium Backup and then unlock the bootloader without losing all my app data. The solution I've been looking for. Thanks scary alien.

Thanks, Rick!

It was a gas reading through the threads and getting the realization that this would work.

It should actually work for several devices running ICS and/or the certain kernel version (you'd just need to adjust the hex offset values that are used by mempodroid--maybe I'll make the script a little more generic).

Glad it worked for you

.

I'll get the first post updated tomorrow with what you and Yeahha mentioned above.

Cheers!

Yeahha · February 16th, 2012, 01:05 AM

Quote:

Originally Posted by rickt1152

This could not have been easier. Worked perfectly, took five minutes including downloading the drivers. Such a great option to be able to root, use Titanium Backup and then unlock the bootloader without losing all my app data. The solution I've been looking for. Thanks scary alien.

Welcome to AF

and thank you for testing that out

I thought it should work fine but didn't want to go do all the work to unroot and lock my bootloader to test it.

JustisLewis · February 16th, 2012, 09:45 PM

Can you unroot without unlocking the bootloader?

scary alien · February 16th, 2012, 09:49 PM

Quote:

Originally Posted by JustisLewis

Can you unroot without unlocking the bootloader?

Welcome to the AndroidForums, Justis.

I don't see why you couldn't... Once you are rooted, you would be able to remove your root binaries with no problem--you just have to make sure you do it while you still have root access.

Tell you what, I'll try to make an un-root package this weekend, too for this.

Cheers and glad you signed-up with us!

JustisLewis · February 16th, 2012, 10:04 PM

Quote:

Originally Posted by scary alien

Welcome to the AndroidForums, Justis.

I don't see why you couldn't... Once you are rooted, you would be able to remove your root binaries with no problem--you just have to make sure you do it while you still have root access.

Tell you what, I'll try to make an un-root package this weekend, too for this.

Cheers and glad you signed-up with us!

Thanks for the welcome

I've been active on DroidForums and XDA, but this is the first time I've ended up here via Google. I'm only wondering because I'm thinking about returning my GNex to Verizon and ordering from Amazon (could save roughly $60). That's the only reason I haven't unlocked the bootloader yet. I want to backup my apps with Titanium so that if I decide to go that way I can quickly get back up and running on my new Nexus. Of course I would also have to return to stock afterwards so I can give Verizon back this Nexus.

scary alien · February 16th, 2012, 10:11 PM

Quote:

Originally Posted by JustisLewis

Thanks for the welcome

I've been active on DroidForums and XDA, but this is the first time I've ended up here via Google. I'm only wondering because I'm thinking about returning my GNex to Verizon and ordering from Amazon (could save roughly $60). That's the only reason I haven't unlocked the bootloader yet. I want to backup my apps with Titanium so that if I decide to go that way I can quickly get back up and running on my new Nexus. Of course I would also have to return to stock afterwards so I can give Verizon back this Nexus.

You are most welcome!

Yeah, it should be pretty simple to un-root... The mempodroid binary, when launched from an adb shell, allows the program you pass to it as an argument to gain root privileges, so if you follow the stuff I did when I tested all of this, you'll see that when you do

$ ./mempodroid 0xd7f4 0xad4b sh

your next prompt is "#" and you have root access at that point (but no su or Superuser.apk binaries installed). To unroot, you'd just have to get a rooted shell (like above) and just remove /system/bin/su and /system/app/Superuser.apk (and busybox of course, too--but I'm not sure about all of the softlinks that are created with the busybox --install that I added, so I'll have to research that a little bit

).

Cheers and let me know how it goes if you decide to use this

.

VoidedSaint · February 17th, 2012, 02:56 PM

scary is all of this done through terminal? or possibly linux? or windows command prompt?

scary alien · February 17th, 2012, 03:32 PM

Quote:

Originally Posted by VoidedSaint

scary is all of this done through terminal? or possibly linux? or windows command prompt?

VS,

Sorry for the delay, sir!

You'll have to do it with an adb session involved--the exploit depends on this, so you can't just do it on-phone via something like the Android Terminal Emulator (great app, by the way) or even as an app (trust me, I tried

).

I'm going to be making a Mac- and Linux-friendly version of the package/script tonight (I hope)...the last couple of nights have been very busy, so I've had the chance to do this (its really the flashing back to stock and re-flashing my phone that takes the most time).

I'm also going to do an un-rooter or at least give instructions for that, too.

I also need to post this stuff in the GSM area, too...so that's coming...

.

Just too much paperwork, LOL.

Cheers!

VoidedSaint · February 17th, 2012, 06:46 PM

yeah the ninja is now pleased lol. on a lighter note.

make it very noob friendly, and i mean very noob friendly

scary alien · February 17th, 2012, 06:48 PM

Quote:

Originally Posted by VoidedSaint

yeah the ninja is now pleased lol. on a lighter note.

make it very noob friendly, and i mean very noob friendly

LOL, you mean with instructions and comments and everything?

Awe, man!

I'd like to make it even be device-selectable, since the only thing that is GNex-specific is the offsets and I should be able to let you choose from a device list

.

Thanks!

VoidedSaint · February 17th, 2012, 10:15 PM

well we can tackle that tomorrow

scary alien · February 18th, 2012, 09:42 PM

Okay, I've updated the first post (OP) with a new rooting package. It now includes:

1. support for running from Linux and Mac/OSX PCs

2. un-rooting options

3. (hopefully) easy-to-use instructions

I've also posted a near-identical thread in the GSM area, too (there's device-specific link references in each to their respective areas).

Whew! This was a lot of work

.

Time to finally flash my Nandroid back from last night--I've been running stock for more than 24 hours now and its freaking-me-out!

.

Cheers!

jmar · February 18th, 2012, 09:57 PM

Quote:

Originally Posted by scary alien

Well, this really isn't Windows or Mac specific...its mostly adb-specific. So, if you know and are familiar with adb, its fairly straight-forward.

There's a ADB Guide that contains a "Mini-SDK" section with a downloadable sdk-tools.zip file that contains an "adb-mac" file that you can use in place of the "adb" referenced above.

Also, I think I could script this...it should be possible to do this, but I've just finished playing-around with this myself (need a few minutes to finish some other stuff up

).

Lemme know if you have other questions

.

Cheers!

edit: you ninja'd me with your edits, LOL....yes, you basically start-up a terminal session and prefix your "adb" (or adb-mac) references with "./" (as in "./adb devices", etc.).

I am a Nexus ninja! That is all. And one who likes to repost OPs.

Paul1201 · February 19th, 2012, 08:57 AM

scary alien,

I get a prompt that says the system cannot find the specified file and when I hit enter it just hangs at waiting for adb USB connectivity to your device.

When I installed the naked android usb driver the phone is displayed as a Samsung Galaxy Nexus under the android phone in device manager.

Do you have any tips?

scary alien · February 19th, 2012, 09:06 AM

Quote:

Originally Posted by Paul1201

scary alien,

I get a prompt that says the system cannot find the specified file and when I hit enter it just hangs at waiting for adb USB connectivity to your device.

When I installed the naked android usb driver the phone is displayed as a Samsung Galaxy Nexus.

Do you have any tips?

Paul, can you post a copy/paste of what you are seeing (i.e., especially with regard to the "system cannot find specified file" thing).

Usually getting adb USB connectivity is a little easier than the fastboot connectivity and the Naked drivers are a good choice.

Also, you can verify that you've got adb USB connectivity with your phone ahead of time by typing adb devices (it should respond back with your phone's serial number).

That's help you determine ahead of time that the .bat script should work.

Just let me know a few more details and we'll get you sorted-out

.

Thanks!

Paul1201 · February 19th, 2012, 09:44 AM

scary,

Thanks for replying. I uninstalled/reinstalled the naked android driver and my phone is rebooting from the root script right now.

And I have root!

Paul1201 · February 19th, 2012, 10:16 AM

Okay I did it slightly differently than diverbelow. Once I got root I then downloaded root explorer and used that to place the OTA in the /cache folcer (after renaming it to update.zip just copy and paste via root explorer which can all be down on the phone). Then rerooted using same script from above. All I have to do now is reinstall all of my root required apps from my OG Droid (TiBU, etc.).

Thank you again scary alien!!!

Paul1201 · February 19th, 2012, 11:15 AM

Okay now I am really confused.

I reran the root script after updating to 4.0.4 and it finished. Root Explorer is installed and working with superuser permission. Downloaded TiBu and Busybox and they are denied supperuser permission. Downloaded root checker and it says I do not have root. Ran the unroot script and reran the root script with the same results.

According to the log in Superuser the only app getting permission is Root Explorer. Volume +, TiBu, and Busybox are all denied.

scary alien · February 19th, 2012, 11:22 AM

Quote:

Originally Posted by Paul1201

Okay now I am really confused.

I reran the root script after updating to 4.0.4 and it finished. Root Explorer is installed and working with superuser permission. Downloaded TiBu and Busybox and they are denied supperuser permission. Downloaded root checker and it says I do not have root. Ran the unroot script and reran the root script with the same results.

According to the log in Superuser the only app getting permission is Root Explorer. Volume +, TiBu, and Busybox are all denied.

Paul,

Try deleting those entries from the Superuser app and then using the apps again (so that you'll be prompted for permission)...that way, the Superuser whitelist app will be re-asked for permission to run.

I'm guessing that they just got marked at "denied" in its database and that's why they aren't being granted permission.

Since the un-root function that I installed simply deletes the su binary and the Superuser.apk file, maybe I need to find its database and delete it, too? (that might account for the "remembering" that appears to be going on here). So, maybe I'll need to issue an "adb uninstall Superuser.apk", etc. to do the removal of the Superuser app.

Let me know how that works.

Paul1201 · February 19th, 2012, 11:34 AM

scary,

I deleted the logs and retried openning the apps with the same results.

I clicked on Root Explorer on the apps tab (the only one listed) and Superuser allows me to toggle its permissions. SHould I delete it from the apps list also to clear everything from Superuser?

scary alien · February 19th, 2012, 11:42 AM

Quote:

Originally Posted by Paul1201

scary,

I deleted the logs and retried openning the apps with the same results.

I clicked on Root Explorer on the apps tab (the only one listed) and Superuser allows me to toggle its permissions. SHould I delete it from the apps list also to clear everything from Superuser?

I don't know what you mean by deleting the logs?

What I meant to say was go into the Superuser app, find the entries for say, TiBu, click on that entry, and delete the entire TiBu entry from the Superuser app by clicking on the trashcan icon at the bottom of the screen. That should remove its entry entirely from the database that Superuser keeps and will cause the Superuser app to be asked, once you've re-launched TiBu, and you'll be prompted for permission for TiBu to be granted root rights again.

Does that make sense (or did I say the same thing you just did, LOL

)?

Thanks!

Paul1201 · February 19th, 2012, 12:14 PM

scary,

Makes sense, however root explorer is the only app listed on that screen. If you swipe the screen to the left it shows the log of apps that have requested Superuser permission. None of the other apps have ever made it to the app list since I did not install them until after applying the 4.0.4 update and they have all been denied superuser permission. Root explorer I installed to copy the OTA file into the cache/ partition.

Also when I ran the unroot script Superuser was not removed after the 4.0.4 update was completed. Is there something about the update that requires a change to the script to root/unroot?

scary alien · February 19th, 2012, 12:51 PM

Quote:

Originally Posted by Paul1201

scary,

Makes sense, however root explorer is the only app listed on that screen. If you swipe the screen to the left it shows the log of apps that have requested Superuser permission. None of the other apps have ever made it to the app list since I did not install them until after applying the 4.0.4 update and they have all been denied superuser permission. Root explorer I installed to copy the OTA file into the cache/ partition.

Also when I ran the unroot script Superuser was not removed after the 4.0.4 update was completed. Is there something about the update that requires a change to the script to root/unroot?

Sorry for the delay in my reply, Paul...my stupid desktop PC crashed...<grrr>.

Anyways, I'm thinking this all has to do with how I only implemented a delete or the /system/app/Superuser.apk file and didn't do a proper uninstall of it and left a confused database behind.

I'm trying to do a manual uninstall using adb, but I'm getting a "failure" message that tells me that I might have to just do a recursive delete of the database files myself.

I just took a Nandroid backup so I can play with this a little more. Gimme a little bit to play and think about this...

Thanks!

Paul1201 · February 19th, 2012, 01:34 PM

scary,

No problem. I'm getting busy now myself. Graduate level education takes up a lot of time.

scary alien · February 19th, 2012, 02:13 PM

Quote:

Originally Posted by Paul1201

scary,

No problem. I'm getting busy now myself. Graduate level education takes up a lot of time.

Paul,

LOL, sorry for the delay...had to flash back to stock 4.0.2 (the mempodroid exploit does not appear to work at all on the AOKP ROM, so I had to backup, flash back, and then tweak the scripts).

I added the removal of the /data/data/com.noshufou.android.su directory to the unrooting scripts and added a reboot after the unroot.

I also added extra checks to see if the files are (for rooting) and are not (for un-rooting) present and displayed the output of the ls (list files) commands.

I'll update the OP above (in a minute--give me 5 minutes or so to upload) with a new .zip file that you can try if you want to do the root and unroot process--it should be a little cleaner for the unroot phase.

Cheers and let me know!

-SA

Paul1201 · February 19th, 2012, 02:59 PM

scary,

I tried the new script and still no joy (downloaded it after 3:30 EST). I uninstalled and reinstalled all the drivers for Windows, and uninstalled all the apps requiring root except Volume +. Cleared the log in Superuser and went ahead and removed Root Explorer also. When I run the unroot script Superuser is not uninstlled but the phone roboots and the script finishes by prompting me to press any button to continue.

I am starting to think it may be something with the 4.0.4 OTA not allowing this exploit unless you have verified that it works on 4.0.4.