後は、busyboxとsuバイナリも同じように端末に転送し、
755の実行権限を付けておきます。
これで、root化に必要なファイルはすべて揃いました。
端末上での操作に移ります。
adb shell
cd /data/local/tmp
./install_backdoor
./disable_ccsecurity
./run_root_shell
プロンプトが$→#に変われば、一時root化成功です。
次に、初期パーティションのバックアップを取得します。
/data/local/tmp/busybox mkdir -p /sdcard/backup_V10f/
/data/local/tmp/busybox echo "Backup Start"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p1 of=/sdcard/backup_V10f/mmcblk0p1_modem bs=4096
/data/local/tmp/busybox echo "modem Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p2 of=/sdcard/backup_V10f/mmcblk0p2_sbl1 bs=4096
/data/local/tmp/busybox echo "sbl1 Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p3 of=/sdcard/backup_V10f/mmcblk0p3_sbl2 bs=4096
/data/local/tmp/busybox echo "sbl2 Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p4 of=/sdcard/backup_V10f/mmcblk0p4_sbl3 bs=4096
/data/local/tmp/busybox echo "sbl3 Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p5 of=/sdcard/backup_V10f/mmcblk0p5_aboot bs=4096
/data/local/tmp/busybox echo "aboot Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p6 of=/sdcard/backup_V10f/mmcblk0p6_rpm bs=4096
/data/local/tmp/busybox echo "rpm Done"
/data/local/tmp/busybox mknod /dev/block/boot b 179 7
/data/local/tmp/busybox dd if=/dev/block/boot of=/sdcard/backup_V10f/mmcblk0p7_boot bs=4096
/data/local/tmp/busybox echo "boot Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p8 of=/sdcard/backup_V10f/mmcblk0p8_tz bs=4096
/data/local/tmp/busybox echo "tz Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p9 of=/sdcard/backup_V10f/mmcblk0p9_pad bs=4096
/data/local/tmp/busybox echo "pad Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p10 of=/sdcard/backup_V10f/mmcblk0p10_modemst1 bs=4096
/data/local/tmp/busybox echo "modemst1 Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p11 of=/sdcard/backup_V10f/mmcblk0p11_modemst2 bs=4096
/data/local/tmp/busybox echo "modemst2 Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p12 of=/sdcard/backup_V10f/mmcblk0p12_m9kefs1 bs=4096
/data/local/tmp/busybox echo "m9kefs1 Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p13 of=/sdcard/backup_V10f/mmcblk0p13_m9kefs2 bs=4096
/data/local/tmp/busybox echo "m9kefs2 Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p14 of=/sdcard/backup_V10f/mmcblk0p14_m9kefs3 bs=4096
/data/local/tmp/busybox echo "m9kefs3 Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p15 of=/sdcard/backup_V10f/mmcblk0p15_drm bs=4096
/data/local/tmp/busybox echo "drm Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p16 of=/sdcard/backup_V10f/mmcblk0p16_sns bs=4096
/data/local/tmp/busybox echo "sns Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p17 of=/sdcard/backup_V10f/mmcblk0p17_ssd bs=4096
/data/local/tmp/busybox echo "ssd Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p18 of=/sdcard/backup_V10f/mmcblk0p18_misc bs=4096
/data/local/tmp/busybox echo "misc Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p19 of=/sdcard/backup_V10f/mmcblk0p19_factory bs=4096
/data/local/tmp/busybox echo "factory Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p20 of=/sdcard/backup_V10f/mmcblk0p20_bnr bs=4096
/data/local/tmp/busybox echo "bnr Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p21 of=/sdcard/backup_V10f/mmcblk0p21_encrypt bs=4096
/data/local/tmp/busybox echo "encrypt Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p22 of=/sdcard/backup_V10f/mmcblk0p22_eksst bs=4096
/data/local/tmp/busybox echo "eksst Done"
/data/local/tmp/busybox mknod /dev/block/system b 179 23
/data/local/tmp/busybox dd if=/dev/block/system of=/sdcard/backup_V10f/mmcblk0p23_system bs=4096
/data/local/tmp/busybox echo "system Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p26 of=/sdcard/backup_V10f/mmcblk0p26_persist bs=4096
/data/local/tmp/busybox echo "persist Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p27 of=/sdcard/backup_V10f/mmcblk0p27_tombstones bs=4096
/data/local/tmp/busybox echo "tombstones Done"
/data/local/tmp/busybox mknod /dev/block/recovery b 179 28
/data/local/tmp/busybox dd if=/dev/block/recovery of=/sdcard/backup_V10f/mmcblk0p28_recovery bs=4096
/data/local/tmp/busybox echo "recovery Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p29 of=/sdcard/backup_V10f/mmcblk0p29_fsg bs=4096
/data/local/tmp/busybox echo "fsg Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p30 of=/sdcard/backup_V10f/mmcblk0p30_DDR bs=4096
/data/local/tmp/busybox echo "DDR Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p31 of=/sdcard/backup_V10f/mmcblk0p31_fota bs=4096
/data/local/tmp/busybox echo "fota Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p32 of=/sdcard/backup_V10f/mmcblk0p32_mpt bs=4096
/data/local/tmp/busybox echo "mpt Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p33 of=/sdcard/backup_V10f/mmcblk0p33_tzbak bs=4096
/data/local/tmp/busybox echo "tzbak Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p34 of=/sdcard/backup_V10f/mmcblk0p34_rpmbak bs=4096
/data/local/tmp/busybox echo "rpmbak Done"
/data/local/tmp/busybox mknod /dev/block/felica b 259 3
/data/local/tmp/busybox dd if=/dev/block/felica of=/sdcard/backup_V10f/mmcblk0p35_felica bs=4096
/data/local/tmp/busybox echo "felica Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p36 of=/sdcard/backup_V10f/mmcblk0p36_seclog bs=4096
/data/local/tmp/busybox echo "seclog Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p37 of=/sdcard/backup_V10f/mmcblk0p37_mmbi bs=4096
/data/local/tmp/busybox echo "mmbi Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p38 of=/sdcard/backup_V10f/mmcblk0p38_oneseg bs=4096
/data/local/tmp/busybox echo "OneSeg Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p39 of=/sdcard/backup_V10f/mmcblk0p39_rct bs=4096
/data/local/tmp/busybox echo "rct Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p40 of=/sdcard/backup_V10f/mmcblk0p40_reserved bs=4096
/data/local/tmp/busybox echo "reserved Done"
/data/local/tmp/busybox dd if=/dev/block/mmcblk0p41 of=/sdcard/backup_V10f/mmcblk0p41_grow bs=4096
/data/local/tmp/busybox echo "grow Done"
/data/local/tmp/busybox echo "Backup Done"
というシェルスクリプトを作成して、端末に転送、実行権限755を付けて実行します。
SDカードにバックアップが取得されるので、大切に保存しておきましょう。
後は、busyboxとsuバイナリを/system配下に送り込みます。
/data/local/tmp/busybox mount -o rw,remount /system
/data/local/tmp/busybox cp /data/local/tmp/busybox /system/xbin/
/data/local/tmp/busybox chmod +x /system/xbin/busybox
busybox cp /data/local/tmp/su /system/xbin/
busybox chown 0:0 /system/xbin/su
busybox chmod 6755 /system/xbin/su
mount -o ro,remount /system
端末を再起動してしまうと、root権限が失われてしまうので、
再度、disable_ccsecurityを実行する必要があります。
起動時に実行されるシェルスクリプトを作成しても良いのですが、
lokiの脆弱性が使えるので、カスタムカーネルを作成して、
ccsecurityを解除したいと思います。
ここまでに必要なファイル一式です。
https://www.dropbox.com/s/an7cl4v3t68gx7t/L-04E_root.zip