46分

樓主

個人積分：46分

文章編號：38530534

Sony Tablet S / P 原廠 ICS 韌體，已可 root

如果有人像我一樣，傻傻的... 直接升級了 ICS 才發現無法取得 root，現在終於有方法.

主要方法可看
http://forum.xda-developers.com/showthread.php?t=1886310

參考來源是日本
http://qua1ia.blogspot.jp/2012/09/icssony-tabletroot.html

步驟上還沒有完全確定，基本上就是先裝 Android Terminal Emulator 然後移到 sdcard。
然後自行 resign vpnFaker.apk (我覺得應該是不用，雖然我也做了...)
再執行他們提到的步驟，直到第一次重開機。然後再重做第一步驟直到又再重開一次。接下來就可以順利做剩下步驟，取得root 了。

2012-09-17 1:16 #1

文章關鍵字

李小李.

0分

2樓

李小李.

個人積分：0分

文章編號：38556843

請問大大有成功嗎
可否分享一下教學呢
感恩...

余昕

46分

樓主

余昕

個人積分：46分

文章編號：38569380

我有成功... xda 那邊有人寫了一個可以自動做到一半的. 對岸也有人好心翻成中文

不過情況還是有點亂, 要有點能力的才有辦法臨時應變去解決.

我的建議是一步一步照著做... 或者就乾脆等人寫好一個自動破解的, 再去抓來用.

Sony Tablet P 破解以後感覺好爽喔... 科科

tmjh11026

6分

4樓

tmjh11026

個人積分：6分

文章編號：38578682

余昕 wrote:
我有成功... xd...(恕刪)

恩，真的很複雜，我好不容易做到Terminal-Emulator那邊了，不過uid不是1000，是10076(adb shell am start -n com.android.vpndialogs/.Term這個指令根本無效，我的Terminal-Emulator是事前裝好移到SD卡),
之後按照步驟做就都不正確了...

awzasdfg

139分

5樓

awzasdfg

個人積分：139分

文章編號：38579929

終於有了,,,
我也來試試看XE

余昕

46分

樓主

余昕

個人積分：46分

文章編號：38582696

tmjh11026 wrote:
恩，真的很複雜，我好...(恕刪)

.Term 那指令無效表示你需要重簽你的 vpnfaker.apk
如果簽過了, 那指令還是無效, 表示在執行 .Term 指令前, 重開機指令之前那些步驟, 還要再做一次.

比如說步驟 1-5 第6是重開機, 第7是 /.Term ，那1-6步要做兩遍。
意即, 先做 1-6, 重開機時, 會看到螢幕花掉約五秒, 然後進桌面. 這時再做 1-6 指令。但第二次做的時候, 記得把 mv system system- 改成 mv system system-- ，跟 mv app app- 改成 mv app app-- ，以避免重覆copy而失敗。

第二次再開機時，進桌面就會看到 Android is updating/Android正在更新中的對話框，只要沒出現，接下來 .Term 應該都跑不起來，只能一直重覆做 1-6 直到看到這個對話框, 才能用 .Term 指令開啟 Terminal Emulator, 得到 uid1000...

余昕

46分

樓主

余昕

個人積分：46分

文章編號：38585462

我今天拿了Lab 的 Sony Tablet S (v4.0.3r1a) 再試了一次。確定前面指令一定要做兩遍才會看到 Android is updating 的對話框, 才能執行/.Term 後跳出 terminal emulator

以下為部份經過的指令, 可以參考看看:

1) VpnFaker.apk 先 resign.
2) 下載的檔案記得要解開, 要有這些檔:
C:\123>dir
磁碟區 C 中的磁碟沒有標籤。
磁碟區序號: 66FF-E35E

C:\123 的目錄

2012/09/19 上午 11:42 <DIR> .
2012/09/19 上午 11:42 <DIR> ..
2012/09/03 下午 10:39 1,867,568 busybox
2012/09/04 下午 07:01 5,200 readme.txt
2012/09/03 下午 10:38 518,024 rootkit.tar.gz
2012/08/07 下午 10:10 63,498 settings.ab
2008/02/29 上午 02:33 380,532 su
2008/02/29 上午 02:33 1,468,798 Superuser.apk
2012/09/19 上午 11:42 200,436 VpnFaker.apk
7 個檔案 4,504,056 位元組
2 個目錄 152,642,527,232 位元組可用

3) 前面指令照做, 直到下了 while 指令, 然後開另一個 cmd 出來跑 restore, 最後這邊按 ctr-c 中斷迴圈, 繼續步驟.

link failed File exists
link failed File exists^C
C:\123>adb shell ls -ld /data
drwxrwxrwx system system 2012-09-19 11:45 data

C:\123>adb push busybox /data/local/tmp
1313 KB/s (1867568 bytes in 1.388s)

C:\123>adb push rootkit.tar.gz /data/local/tmp
1292 KB/s (518024 bytes in 0.391s)

C:\123>adb push Superuser.apk /data/local/tmp
1310 KB/s (1468798 bytes in 1.094s)

C:\123>
C:\123>adb push su /data/local/tmp
1294 KB/s (380532 bytes in 0.287s)

C:\123>adb shell
shell@android:/ $ cd /data/local/tmp
cd /data/local/tmp
shell@android:/data/local/tmp $ chmod 755 busybox
chmod 755 busybox
shell@android:/data/local/tmp $ ./busybox tar zxf rootkit.tar.gz
./busybox tar zxf rootkit.tar.gz
shell@android:/data/local/tmp $ exit
exit

C:\123>adb push VpnFaker.apk /data/local/tmp
1296 KB/s (200436 bytes in 0.151s)

C:\123>adb shell
shell@android:/ $ touch -t 1346025600 /data/local/tmp/VpnFaker.apk
touch -t 1346025600 /data/local/tmp/VpnFaker.apk
shell@android:/ $ exit
exit

C:\123>adb shell
shell@android:/ $ cd /data
cd /data
shell@android:/data $ /data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox cp -r system system2
cp: can't open 'system/entropy.dat': Permission denied
cp: can't open 'system/batterystats.bin': Permission denied
cp: can't open 'system/users/userlist.xml': Permission denied
cp: can't open 'system/users/0.xml': Permission denied
cp: can't open 'system/accounts.db': Permission denied
cp: can't open 'system/accounts.db-journal': Permission denied
cp: can't open 'system/called_pre_boots.dat': Permission denied
cp: can't open 'system/wallpaper_info.xml': Permission denied
cp: can't open 'system/netstats.bin': Permission denied
cp: can't open 'system/appwidgets.xml': Permission denied
cp: can't open 'system/netstats_xt.bin': Permission denied
cp: can't open 'system/netpolicy.xml': Permission denied
cp: can't open 'system/netstats_uid.bin': Permission denied
1|shell@android:/data $
1|shell@android:/data $ /data/local/tmp/busybox find system2 -type f -exec chmod
666 {} \;
d system2 -type f -exec chmod 666 {} \; <
shell@android:/data $ /data/local/tmp/busybox find system2 -type d -exec chmod 7
77 {} \;
system2 -type d -exec chmod 777 {} \; <
shell@android:/data $ mv system system-
mv system system-
shell@android:/data $ mv system2 system
mv system2 system
shell@android:/data $ mv app app-
mv app app-
shell@android:/data $ mkdir app
mkdir app
shell@android:/data $ mv /data/local/tmp/VpnFaker.apk /data/app
mv /data/local/tmp/VpnFaker.apk /data/app
shell@android:/data $ TZ=0 ls -l /data/app
TZ=0 ls -l /data/app
-rw-rw-rw- shell shell 200436 2012-08-27 00:00 VpnFaker.apk
shell@android:/data $ /data/local/tmp/busybox sed -f /data/local/tmp/packages.xm
l.sed system-/packages.xml > system/packages.xml
tem-/packages.xml > system/packages.xml <
shell@android:/data $ /data/local/tmp/busybox grep vpndialogs system/packages.xm
l
vpndialogs system/packages.xml <
<updated-package name="com.android.vpndialogs" codePath="/system/app/VpnDialogs.
apk" nativeLibraryPath="/data/data/com.android.vpndialogs/lib" flags="1" ft="139
c399fae0" it="1369804e780" ut="139c399fae0" version="15" sharedUserId="1000">
<package name="com.android.vpndialogs" codePath="/data/app/VpnFaker.apk" nativeL
ibraryPath="/data/data/com.android.vpndialogs/lib" flags="1" ft="1396560b400" it
="1396560b400" ut="1396560b400" version="45" sharedUserId="1000">
shell@android:/data $
shell@android:/data $ exit
exit

C:\123>adb reboot
C:\123>adb shell am start -n com.android.vpndialogs/.Term
Starting: Intent { cmp=com.android.vpndialogs/.Term }
Error type 3
Error: Activity class {com.android.vpndialogs/com.android.vpndialogs.Term} does
not exist.

C:\123>

-------------------------------------------------------------------------------------------------
這邊重開機了平板. 發現沒有啥反應, 所以再做第二次前面的步驟
-------------------------------------------------------------------------------------------------

C:\123>adb restore settings.ab
Now unlock your device and confirm the restore operation.

C:\123>adb shell ls -ld /data/data/com.android.settings/a
drwxrwxrwx system system 2012-09-19 11:51 a

C:\123>adb shell
shell@android:/ $ cd /data/data/com.android.settings
cd /data/data/com.android.settings
shell@android:/data/data/com.android.settings $ rm -r a
rm -r a
rm failed for a, Permission denied
255|shell@android:/data/data/com.android.settings $ while : ; do ln -s /data a/file99; done
link failed File exists
link failed File exists
link failed File exists
link failed File exists
^C
C:\123>adb shell ls -ld /data
drwxrwxrwx system system 1970-01-16 22:24 data
C:\123>adb push busybox /data/local/tmp
1305 KB/s (1867568 bytes in 1.397s)

C:\123>adb push rootkit.tar.gz /data/local/tmp
1308 KB/s (518024 bytes in 0.386s)

C:\123>adb push Superuser.apk /data/local/tmp
1311 KB/s (1468798 bytes in 1.093s)

C:\123>adb push su /data/local/tmp
1292 KB/s (380532 bytes in 0.287s)

C:\123>adb shell
shell@android:/ $ cd /data/local/tmp
cd /data/local/tmp
shell@android:/data/local/tmp $ chmod 755 busybox
chmod 755 busybox
shell@android:/data/local/tmp $ ./busybox tar zxf rootkit.tar.gz
./busybox tar zxf rootkit.tar.gz
shell@android:/data/local/tmp $ exit
exit

C:\123>adb push VpnFaker.apk /data/local/tmp
1287 KB/s (200436 bytes in 0.152s)

C:\123>adb shell
shell@android:/ $ touch -t 1346025600 /data/local/tmp/VpnFaker.apk
touch -t 1346025600 /data/local/tmp/VpnFaker.apk
shell@android:/ $ exit
exit

C:\123>adb shell
shell@android:/ $ cd /data
cd /data
shell@android:/data $ /data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox cp -r system system2
cp: can't open 'system/users/userlist.xml': Permission denied
cp: can't open 'system/users/0.xml': Permission denied
cp: can't open 'system/sync/accounts.xml': Permission denied
cp: can't open 'system/sync/status.bin': Permission denied
cp: can't open 'system/sync/pending.bin': Permission denied
cp: can't open 'system/sync/stats.bin': Permission denied
cp: can't open 'system/usagestats/usage-20120919': Permission denied
cp: can't open 'system/registered_services/android.accounts.AccountAuthenticator
.xml': Permission denied
cp: can't open 'system/registered_services/android.content.SyncAdapter.xml': Per
mission denied
cp: can't open 'system/inputmethod/subtypes.xml': Permission denied
cp: can't open 'system/dropbox/[email protected]': Permission denied

cp: can't open 'system/dropbox/[email protected]': Permissio
n denied
cp: can't open 'system/dropbox/[email protected]': Permissio
n denied
cp: can't open 'system/dropbox/[email protected]': Permissio
n denied
-------------------------------------------------------------------------------------------------
這邊我第二次做都會看到不一樣的錯誤訊息, 我在用 Tablet P 也一樣, 表示皆照預期的在走
-------------------------------------------------------------------------------------------------
cp: can't open 'system/throttle/temp': Permission denied
cp: can't open 'system/shared_prefs/log_files.xml': Permission denied
cp: can't open 'system/accounts.db': Permission denied
cp: can't open 'system/entropy.dat': Permission denied
cp: can't open 'system/batterystats.bin': Permission denied
cp: can't open 'system/accounts.db-journal': Permission denied
cp: can't open 'system/called_pre_boots.dat': Permission denied
cp: can't open 'system/wallpaper_info.xml': Permission denied
cp: can't open 'system/appwidgets.xml': Permission denied
cp: can't open 'system/netpolicy.xml': Permission denied
1|shell@android:/data $ /data/local/tmp/busybox find system2 -type f -exec chmod
666 {} \;
d system2 -type f -exec chmod 666 {} \; <
shell@android:/data $ /data/local/tmp/busybox find system2 -type d -exec chmod 7
77 {} \;
system2 -type d -exec chmod 777 {} \; <
shell@android:/data $ mv system system--
mv system system--
shell@android:/data $ mv system2 system
mv system2 system
shell@android:/data $ mv app app--
mv app app--
shell@android:/data $ mkdir app
mkdir app
shell@android:/data $ mv /data/local/tmp/VpnFaker.apk /data/app
mv /data/local/tmp/VpnFaker.apk /data/app
shell@android:/data $ TZ=0 ls -l /data/app
TZ=0 ls -l /data/app
-rw-rw-rw- shell shell 200436 2012-08-27 00:00 VpnFaker.apk
shell@android:/data $ /data/local/tmp/busybox sed -f /data/local/tmp/packages.
xml.sed system-/packages.xml > system/packages.xml
tem-/packages.xml > system/packages.xml <
shell@android:/data $ /data/local/tmp/busybox grep vpndialogs system/packages.xm
l
vpndialogs system/packages.xml <
<updated-package name="com.android.vpndialogs" codePath="/system/app/VpnDialogs.
apk" nativeLibraryPath="/data/data/com.android.vpndialogs/lib" flags="1" ft="139
c399fae0" it="1369804e780" ut="139c399fae0" version="15" sharedUserId="1000">
<package name="com.android.vpndialogs" codePath="/data/app/VpnFaker.apk" nativeL
ibraryPath="/data/data/com.android.vpndialogs/lib" flags="1" ft="1396560b400" it
="1396560b400" ut="1396560b400" version="45" sharedUserId="1000">
shell@android:/data $ exit
exit

C:\123>adb reboot
C:\123>adb shell am start -n com.android.vpndialogs/.Term
Starting: Intent { cmp=com.android.vpndialogs/.Term }

C:\123>adb shell
shell@android:/ $ /dev/sh
id/dev/sh
#
id
uid=2000(shell) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1009
(mount),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet),300
6(net_bw_stats)
# chown 0.0 /data/local/tmp/_su
chown 0.0 /data/local/tmp/_su
# chmod 6755 /data/local/tmp/_su
chmod 6755 /data/local/tmp/_su
# /data/local/tmp/_su
/data/local/tmp/_su
shell@android:/ # id
id
uid=0(root) gid=0(root) groups=1003(graphics),1004(input),1007(log),1009(mount),
1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw
_stats)
shell@android:/ #
shell@android:/ # /data/local/tmp/busybox mount -o rw,remount /system
/data/local/tmp/busybox mount -o rw,remount /system
shell@android:/ # /data/local/tmp/busybox cp /data/local/tmp/_su /system/xbin
/data/local/tmp/busybox cp /data/local/tmp/_su /system/xbin
shell@android:/ # chown 0.0 /system/xbin/_su
chown 0.0 /system/xbin/_su
shell@android:/ # chmod 6755 /system/xbin/_su
chmod 6755 /system/xbin/_su
shell@android:/ # /data/local/tmp/busybox cp /data/local/tmp/su /system/xbin
/data/local/tmp/busybox cp /data/local/tmp/su /system/xbin
shell@android:/ # chown 0.0 /system/xbin/su
chown 0.0 /system/xbin/su
shell@android:/ # chmod 6755 /system/xbin/su
chmod 6755 /system/xbin/su
shell@android:/ # /data/local/tmp/busybox cp /data/local/tmp/Superuser.apk /syst
em/app
ta/local/tmp/Superuser.apk /system/app <
shell@android:/ # /data/local/tmp/busybox mount -o ro,remount /system
/data/local/tmp/busybox mount -o ro,remount /system
shell@android:/ # sync
sync
shell@android:/ # exit
exit
# _su
_su
shell@android:/ # id
id
uid=0(root) gid=0(root) groups=1003(graphics),1004(input),1007(log),1009(mount),
1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw
_stats)
shell@android:/ # cd /data
cd /data
shell@android:/data # mv app app2
mv app app2
shell@android:/data # mv app- app
mv app- app
shell@android:/data # mv system system2
mv system system2
shell@android:/data # mv system- system
mv system- system

-------------------------------------------------------------------------------------------------
這邊步驟我在給大家看目錄情況, 順便把破解時所帶來的不必要檔案刪掉. 其實 /data/local/tmp 裡面東西也能清空.
-------------------------------------------------------------------------------------------------

shell@android:/data # ls -l
ls -l
drwxrwx--x system system 2012-09-19 11:38 app
drwxrwx--x system system 2012-09-19 11:48 app--
drwxrwx--x system system 2012-06-26 02:20 app-private
drwxrwx--x system system 2012-09-19 11:55 app2
drwx------ system system 2012-09-19 11:57 backup
drwxrwx--x system system 2012-09-19 12:00 dalvik-cache
drwxrwx--x system system 2012-09-19 12:00 data
drwxr-x--- root log 2012-06-26 02:20 dontpanic
drwxrwxr-- drm drm 2012-06-26 02:20 drm
-rwxrwxrwx system system 28 1970-01-16 22:25 file99
drwxrwx--x shell shell 2012-06-26 02:20 local
lrwxrwxrwx root root 2012-09-19 11:56 local.prop -> /configs/lo
cal.prop
drwxrwx--- root root 1970-01-01 09:00 lost+found
drwxrwx--t system misc 2012-06-26 02:20 misc
drwxrwxrwx system system 2012-06-26 02:20 nvcam
drwx------ root root 2012-09-19 11:57 property
dr-xr-xr-x root root 2012-06-26 02:20 region
drwxrwx--x system system 2012-06-26 02:20 resource-cache
drwxrwxr-x system system 2012-09-19 11:42 system
drwxrwxrwx shell shell 2012-09-19 11:51 system--
drwxrwxrwx shell shell 2012-09-19 12:00 system2
drwxr-xr-x system system 2012-09-11 17:28 tombstones
drwx------ system system 2012-06-26 02:20 updater
drwxr-xr-x system system 2012-06-26 02:20 user
shell@android:/data # /data/local/tmp/busybox rm -rf system--
/data/local/tmp/busybox rm -rf system--
shell@android:/data # /data/local/tmp/busybox rm -rf system2
/data/local/tmp/busybox rm -rf system2
shell@android:/data # /data/local/tmp/busybox rm -rf app-
/data/local/tmp/busybox rm -rf app-
shell@android:/data # /data/local/tmp/busybox rm -rf app--
/data/local/tmp/busybox rm -rf app--
shell@android:/data # /data/local/tmp/busybox rm -f file99
/data/local/tmp/busybox rm -f file99
shell@android:/data # /data/local/tmp/busybox rm -rf app2
/data/local/tmp/busybox rm -rf app2
shell@android:/data # exit
exit
# exit
exit
shell@android:/ $

-------------------------------------------------------------------------------------------------
重開以後，在程式列表看到 superuser 就表示完成 root.
-------------------------------------------------------------------------------------------------