Root Rooting M070

[Doctoror]

This method works if you already have a working Clockworkmod recovery. See
Essential post-root things thread (recovery + key combo) thread for installation how-to.

The problem is that M070 removes su binary and Superuser.apk at boot.
The workaround I make is storing the su binary under another name ("surprise") and renames it back to "su" after each boot.

Installation and usage:

• Install SuperSU (or any desired superuser binary) and AFTER that, install Surprise.zip (mirror) from recovery. This will rename the "su" binary to "surprise" from superuser zip.
• After booted, install Surprise.apk (mirror) as normal app and run it. On the main screen you will see "Surprise is off" button. Press on it to execute and enable surprise hack at boot. This will instaltly copy "surprise" binary to "su" and will enable the broadcast receiver that will execute this automatically every time after each boot.
• Then install SuperSU (or any desired superuser apk) as normal app. Casio will not touch Superuser.apk if it's installed as normal app.
• Run installed superuser apk and allow it to update the binary.
• Now, each time you will update the binary, go to Surprise app and do a "su -> surprise". This is one time action that copies su to surprise so the update persists.

Note: sometimes after boot you will get a message from SuperSU that a su binary needs an update, but once opened, the message will be gone. This is happening because Surprise sometimes executes after SuperSU checks the binary. You can ignore this message if you open SuperSU and see the update is gone.

Good luck!

 

[TheMadSkeptic]

I apologize for the newbie questions but I was hoping to solve the M070 root issue.

I do not have access to a Windows or Mac. I run exclusively Linux.

I lost root after the M070 update. I initially rooted the phone using Motochopper and the Superuser app was initially installed and it remains on the phone. I can root the phone with no problem until it reboots.

I have CWM recovery on my Nook but I'm unaware of how to install from recovery on the Commando. Could you provide a link describing how to do that?

Thanks.

 

[Doctoror]

I have CWM recovery on my Nook but I'm unaware of how to install from recovery on the Commando. Could you provide a link describing how to do that?
Thanks.

Hi. Follow this thread for instructions.

 

[nickmacaulay]

I still have root access. I just get a popup telling me to update my binary upon every boot. I did this as instructed, but it did not solve the problem. Anymore suggestions?

 

[Doctoror]

Probably it has something to do with the way you rooted. If you were rooted by Kingo try re-installing M070 with rooting from recovery method as described in the OP.

 

[nickmacaulay]

I semi-solved the issue without the surprise zip and apk.

I'm not sure if it really makes a difference or not, I still lose root on every boot, but supersu is in survival mode and restores itself within a few seconds. Will this have any effect on other apks that need root on startup?

 

[Doctoror]

I don't know all the details about it's survival mode but it sounds it's doing pretty the same that my Surprise.apk does except backing up every update.

Anyway, if you can't solve the su binary not being updated issue, disable the survival mode and use Surprise only.

 

[zippo_vn]

Hello @Doctoror

I got a way:
- Install Superuser.apk (this version won't deleted each reboot). Open SuperSU, install binary update.
- Reboot to Recovery, install ROOT_CASIO_JB_4.1.2.zip.
- Reboot to system.
- DON'T update to newest SuperSU in PlayStore.

 

[Doctoror]

Hello @Doctoror

I got a way:
- Install Superuser.apk (this version won't deleted each reboot). Open SuperSU, install binary update.
- Reboot to Recovery, install ROOT_CASIO_JB_4.1.2.zip.
- Reboot to system.
- DON'T update to newest SuperSU in PlayStore.

Hi.
Something is wrong with the first step. SuperSU can't update binary if the binary itself is missing. If it could, then you were rooted in the first place.

Anyway your method doesn't allow to update SuperSU.
The method I described in the OP has no issues with the updates.

 

[nickmacaulay]

Ok, so tinkering around with a few things, I've discovered something.

I believe the problem lies in bin vs. xbin.

I decided to try copying the su binary into the system\bin folder. Upon a soft reboot, I discovered that SuperSU was no longer going into survival mode to force root permissions. I checked both bin and xbin folders, and the su binary remained. I made sure to turn off survival mode and did a hard reboot.

First, I opened SuperSU. No notification about binary needing updated.. OK! Second, opened titanium backup, granted permissions immediately.. OK! Finally, opened es and navigated to system\xbin.. No trace of su.bin... navigated to system\bin... Su.bin remains, and superuser permissions function flawlessly, with no surprise tweaks or supersu survival mode in use.

Theory: phone removes su binary from xbin at boot. However, it leaves it in the bin folder, and supersu reads it from there when it finds it absent in xbin.

Can anyone try this method with another superuser apk to see how it works?

EDIT: Screenshots immediately upon boot after battery pull.

 

[Doctoror]

Can anyone try this method with another superuser apk to see how it works?

Tried that. Removed SuperSU, su and surprise.
Installed fresh SuperSU and moved it to /system/bin/ within recovery.
After the boot, /system/bin/su persisted and worked.
But the update of su binary installed it in /system/xbin/su removing it from /system/bin/su.
So after every update the user needs to move the su binary to /system/bin/su.

The surprise method is more safe since if user forgets to copy /system/xbin/su to /system/bin/su after the upgrade he will loose root.

 

[Doctoror]

Just found phew critical bugs in Surprise.apk. Uploaded the new version, links in the OP updated.

 

[nickmacaulay]

Did you try copying an old su binary to see if superSU would or wouldn't update it to system/bin?

Trying now...

Edit... Just tried it, you're right

 

[ad_rai]

I was poking around with files inside M070, and now I found the root cause.

From init.rc of ramdisk in boot.img:

# GG3-PR1-01642 add start
on property:ro.build.type=user
    rm /system/app/Superuser.apk
    rm /system/xbin/su
    rm /system/xbin/daemonsu
# GG3-PR1-01642 add end

So, if we remove out that section of ramdisk in boot.img, we don't need workarount from the first place.

 

[Doctoror]

I was poking around with files inside M070, and now I found the root cause.
So, if we remove out that section of ramdisk in boot.img, we don't need workarount from the first place.

Jesus, I was looking for such thing in system.img which is being flashed but couldn't find it. I didn't know about the ramdisk.

 

[Doctoror]

I see. Those files are not included in system.img so I couldn't find em before.
I used Boot.img Tools to extract the ramdisk, but it tells me to edit mkbootimg.c if I want to repack it back.
I couldn't find the sources in his github profile nore in the thread. I sent him a PM at XDA with sources request.

Boot = boot.img
unmkbootimg version 1.2 - Mikael Q Kuisma <kuisma@ping.se>
Kernel size 5494232
Kernel address 0x80208000
Ramdisk size 1159991
Ramdisk address 0x82200000
Secondary size 0
Secondary address 0x81100000
Kernel tags address 0x80200100
Flash page size 2048
Board name is ""
Command line "console=null androidboot.hardware=qcom user_debug=31 kgsl.mmutype=gpumm
u vmalloc=392M"

*** WARNING ****
This image is built using NON-standard mkbootimg!
OFF_RAMDISK_ADDR is 0x02000000
Please modify mkbootimg.c using the above values to build your image.
****************

Extracting kernel to file zImage ...
Extracting root filesystem to file initramfs.cpio.gz ...
All done.
---------------
To recompile this image, use:
mkbootimg --kernel zImage --ramdisk initramfs.cpio.gz --base 0x80200000 --cmdline '
console=null androidboot.hardware=qcom user_debug=31 kgsl.mmutype=gpummu vmalloc=392M
' -o new_boot.img
---------------
3913 blocks

 

[TheMadSkeptic]

It's been a long time but I've only just gotten to using this method. After 3 or 4 reboots (updating Xposed modules, etc.), everything seems to be working. Thank you Doctoror and aus4000!

 

[MDTowny]

Hello, I'm having difficulty booting a c811 m070 into recovery mode or unlocking the bootloader. When trying to ure adb reboot recovery or fastboot reboot-bootloader it just does a factory reset, any suggestions would be great. Thanks.

 

[Doctoror]

Hello, I'm having difficulty booting a c811 m070 into recovery mode or unlocking the bootloader. When trying to ure adb reboot recovery or fastboot reboot-bootloader it just does a factory reset, any suggestions would be great. Thanks.

Hi.
I'm not sure there is a way to get out of this vicious circle.
You need root in order to get recovery working, but since M070 a working recovery is a precondition for rooting.
Most of us that got it working were rooted since M050, M040 or M020 and already had a working recovery prior installing M070.

 

[MDTowny]

Thanks for the quick reply, I feared that was the case, unfortunately Verizon doesn't play nice, too bad I've had the phone a couple years now and I really like it. I just bought another on ebay, it came M040 and (following your advice on the forum) had no problem converting it to work with cricket, no issues, actually get better coverage now.

 

[Willster419]

You cant install the cwm recovery from adb reboot bootloader?

 

[Doctoror]

You cant install the cwm recovery from adb reboot bootloader?

Nope. It doesn't boot into bootloader.

 

[Willster419]

hmmm. what about shell root, flashify install recovery, reboot to it?

 

[Doctoror]

hmmm. what about shell root, flashify install recovery, reboot to it?

Do you mean this? Never knew about this method. I just googled it. Never tried it but if it works then it's great.

 

[Willster419]

Yeah basically a method to root without rebooting. Then you can do all the flashing stuff. I've decided to stick to M50 so I won't be trying it, we just need to wait till someone tries it...