Chapter 2 : Rooting Your Android Device

Chapter 2

 Rooting Your Android Device

Read Also : Chapter 1

In this chapter: 

• What is rooting? 

• Why you would want to root your Android device 

• Backing up data before rooting 

• Different methods ofrooting an Android device 

• How to gain root permissions on two specific devices

You have probably heard your local Android geek mention rooting or read on the Web somewhere about rooting an Android device. Rooting may sound magical and mysterious, but it is a fairly simple idea. At its core, rooting gives the owner of a device more control and access. 

The highest level of privilege you can have on a Linux system is to be logged into the device as the root user, sometimes called the superuser. The terms "superuser" and "root" both refer to the same thing.

The root level of permission exists on Linux systems to provide administrative access. Logged in as root, there is little that you cannot do. Root has permission to read and write most places in the file system and change system settings. Because ofthis, the highest goal for any hacker is to obtain the ability to log into a Linux device as root. 

It is this very high level of privilege that you are seeking when you root an Android device. You need the root level of permission to customize your Android device in many ways.

Why Should You Root? 

The benefits ofrooting your device include saving money, as you extend the life and usefulness of your device, and fixing problems created during development or manufacture. There are also side benefits of adding functionality and removing restrictions imposed by the carrier or original equipment manufacturer (OEM). However, there are inherent risks in using root-level applications, as they are given access to all data from all applications installed on the device. Luckily, this risk can be mitigated by only giving root permissions to trusted applications.

Increasing the Service Life of the Device 

One of my co-workers purchased one of the first Android devices released, the HTC Dream, also known as the G 1. Matt loved the phone, but quickly realized that new versions of Android would run slowly or not at all on his device.

After the Eclair release of Android, it was simply not in the interest ofthe OEMs or the carriers to invest in recompiling Android for old hardware and working out all the bugs. Matt's G1 would eventually get the new version-but not soon enough. Carriers and OEMs would prefer you to purchase a new device with the latest Android version. However, developers in the Android and phone-hacking communities are determined to port new versions ofAndroid to older devices to extend their lives with additional capabilities and features. Developers such as Koushik (Koush) Dutta and other teams working separately and in conjunction have ported new versions of Android to older hardware that OEMs and carriers have long since abandoned and stopped supporting. To install a newer version of Android on older hardware, you need to be rooted and have full file system access.

That original G 1 purchased by Matt is still his everyday phone. Thanks to hackers at XDA and in the Android community, it sports the Froyo release of Android. The G1 was never supposed to have such a long life. Matt would have had to purchase at least two more devices after the G1 to access the manufacturer-supplied features of Android Froyo. Thanks to root access, Matt will be using his G 1 for a while to come. (Yep, he is cool like that.)

Fixing OEM Defects 

As a result ofthe breakneck pace of mobile device development, far too many Android devices have shipped with some form of defect. Some ofthe defects are minor, such as dropping calls or writing slowly to the SD card. Other devices have shipped with major functional defects. For example, the Samsung Galaxy S device (known as the Fascinate when sold by Verizon and by other names when sold by other carriers) was designed with pretty curves that forced the GPS antenna into a bad position and caused the default GPS signal computation code to generate no or erroneous location data. An otherwise beautiful and powerful device was given an unnecessary and irritating, if not fatal, flaw

The XDA forums and other Android hacking communities usually have a fix for design defects fairly quickly-even though it is difficult, if not impossible, to address a hardware defect with a software fix. However, installing a patch or fix frequently requires system write access, for which you need root permissions. Android users have come to expect that any defect or usage irritation can be fixed or patched by the Android hacker community. It has been said that even OEMs sometimes wait to see how the Android community fixes broken firmware before releasing their own patches.

Increasing Capability 

Many OEMs build devices with components that have capabilities they never intend to employ. For example, many Android devices have the capability to tune in to FM radio signals but that feature was never enabled and applications were not created for radio tuning. As a result ofthe work ofthe Android development community, the Nexus One gained both an FM radio and the ability to record in nop resolution.

Overclocking 

Almost every Android device has a CPU that can run at speeds faster than those enabled by the OEM. The CPUs are often clocked down to enhance battery life or reduce the possibility of heat issues. As distributed, the Xoom runs at 1 GHz, but it can be made to run safely and stably at 1.4 or 1.5 GHz. This gives an incredible performance boost to an already great device. Many other Android devices can have their CPU speed upgraded, giving faster performance and greater capability to the user. Speeding up the CPU is called overclocking and is a good reason to root your Android device.

Creating a Portable Hotspot 

Many carriers produce devices that provide a wireless connection point (a "portable hotspot") to which you can connect, just as you would to any Wi-Fi hotspot. Such devices enable you to carry a hotspot around with you. A portable hotspot sends data over the cell network in the same way as your phone. There is little functional difference between your mobile device requesting Internet data and a portable hotspot requesting data from the Internet. Hotspots frequently cost as much as a smartphone and require an expensive data connection package in addition to what you already pay to access the same data on your Android device.

Rooting your Android device enables you to use your phone as a portable hotspot device. It is valuable to be able to create a temporary hotspot in an emergency or for a traveling business person to be able to do so regularly. Since you pay for data from your carrier, how you access that data should be your choice. Most OEMs disable this feature on your Android device unless you purchase an expensive hotspot package, and carriers have a vested interest in you purchasing more devices and more data plans. It's worth noting that, more often than not, using your phone as a hotspot violates the terms ofservice with your carrier, so tread carefully.

Customizing the Device 

Although perhaps not the most compelling factor, the desire to have complete power over the look and feel of your device is frequently the first reason for a hacker to want to root a device. Unless you have the power to write to any portion ofthe file system, your customizations will be temporary or limited in scope.

Once you have installed a custom recovery, you can write complete file system portions, including portions that are usually completely unchangeable. Installing customized firmware usually involves flashing a firmware or kernel package that includes user interface images and layouts, scripts, application packages, and much more. The time required to create these customizations would prevent most people from doing it. However, dedicated developers spend the long, geeky hours necessary to change the default firmware and release it as a ROM or other firmware package that enables rooted users to flash a large group of customizations all at once. Many developers release or announce new ROM packages on the XDA forums.

Backing Up Data 

Most user data is safe from the destructive actions taken during rooting. However, applications and application data are removed by rooting or unlocking a device. For example, using the Fastboot OEM unlock described in Chapter 3 results in all ofthe / data partition being wiped. It is important to back up important data and assume that you will lose all data when hacking.

After you have succeeded in rooting your device, backing up the entire Android file system becomes very easy and provides great peace of mind when you change devices or customize a device. A rooted device can either perform a complete NANDroid backup, if it has a custom recovery, or a more finely tuned application-specific backup, using a program such as Titanium Backup

Contact Information 

Google keeps all of your Android phone and email contact information in its data cloud (that is, the information is stored on Google's servers). When you activate a phone with your login information, it pulls all of your stored contacts back to the phone. As long as you do not specifically create a contact that is stored only on the phone, Android devices automatically synchronize all contacts to the Google servers and you need never fear losing contact data.

Often, rooting a phone or Android device sets the phone back to factory defaults, resulting in data (including contact information) being wiped from the phone. This means that you need to sign in to your Google account and let it synchronize all of your information. Many one-click root methods that run an exploit on your device will not wipe your data, though you should always be paranoid when it comes to backing up.

Applications and Their Data 

A similar situation exists when it comes to Google Apps Marketplace applications. When you download and install an application, a record that connects your login information with that application is stored on the Google servers. When you reactivate a device with your login information, it synchronizes automatically with the Google Apps Marketplace and automatically installs any missing applications.

Although applications are restored, any data stored by an application will most likely be lost unless it was specifically backed up or stored to the 3D card. On some devices, you also risk losing all user-created data, such as photos and documents. Ifyou have important data that has been created by an application, itsa good idea to find out how to back up and restore it (look on the XDAforum). It is best to assume that any hacking process will cause all your data to be wiped.

Data on the SD Card 

Android stores camera pictures and videos on your SD card, and you may want to back those up prior to hacking the device. Data stored on the SD card of an Android device is, typically, safe from rooting activities. However, it's always a good idea to use the Media Transport Protocol (for most Android 3.0+ devices-USB Mass Storage mode for others) or the ADB PULL command (see Chapter 3) to copy all ofthe data from your SD card to a backup folder on your computer.

How You Can Root and Leave Your OEM's Control

The process ofrooting an Android device varies based on the model of your device. A device that has been available for a while may have multiple rooting methods. In the next section, we walk through the process ofrooting with two devices. Chapters 3 and 4 cover most ofthe common skills and tools needed to obtain root.

The methods of obtaining root fall into broad categories: 

• OEM flash software for writing firmware 

• exploits 

• native Fastboot flash

• scripted or automated methods. 

These are very broad and subjective categories that I have created for organization ofthis section. Many developers will likely take me to task for the categorization oftheir method or utility.

You can find out what rooting methods are available by looking in the XDA forum for your specific device. For instance, the rooting information and procedures for my Xoom tablet are located in the Xoom Android Development subforum ofthe Motorola Xoom forum (http://forum.xda-developers . com/forumdisplay. php?f=94 8). Most proven root procedures are "stickied" at the top of the list of posts so that they are easy to locate.

Whether the bootloader or recovery is replaced on your device using flash software, an exploit or the Fastboot pprotocol, the principle is the same: root permission is the first step toward device customization.

OEM Flash Software 

On some devices, the first time you acquire root, you must use the native OEM diagnostic or flash software. After flashing the firmware and accessing root, you will usually use a custom recovery for further firmware changes.

Root can often only be achieved by flashing a complete signed firmware package with OEM tools. If your device requires an external program (other than the native Android SDK tools-Android Debug Bridge (ADB) and Fastboot) to write the new firmware the first time, then it will need a complete signed firmware package. For example, the first root method available for the Droid I involved using Motorola's RSDLite technician tool to flash a custom bootloader to the boot section ofthe file system. Similarly, many devices featuring the NVIDIA Tegra 2 processor require the use ofNVFlash and Samsung devices often make use of ODIN.

Sometimes the only way to recover a bricked device is to use OEM flash software.

The advantages of using OEM flash software are that: 

• It is usually fairly safe and straightforward to attempt. 

• There are relatively few, uncomplicated steps in the process. 

The disadvantages of using OEM flash software are that: 

• It is sometimes difficult to use or understand. At best, the interface is sparse; at worse, it can be in language that you do not understand. 

• OEM debugging software can be difficult to find and keep updated. 

Exploits 

An exploit is a vulnerability (or "crack") in the operating system that can be exploited by a hacker. Exploits come in many types and formats. For instance, one ofthe earliest methods for gaining root on the EVO 4G was an exploit of a security vulnerability in the Adobe Flash application.

In the world ofLinux operating systems, hacking through to a useable exploit is part science, part art and a lot of gut instinct built on experience. Finding a vulnerability that can be exploited is the first goal ofthe developer community when a new device is released. Advanced hackers and geeks race to be the ones to find the crack in the code that can be used to free a lockeddown device. Threads exploring possibilities on the XDA forum can stretch to thousands of posts.

Exploits are some ofthe most fun and rewarding ways to root your Android device. About halfway through rooting my first HTC Thunderbolt using Scott Walker's ASH exploit, I remember thinking "Wow, I am really hacking this thing. I feel like an actor in Mission Impossible." That psneuter exploit written by Scott Walker (scotty2walker to the Android hacker community) is a good example of a simple exploit that was used to do some really cool stuffto get access to root. The psneuter script takes advantage ofthe fact that the Android Debug Bridge (see Chapter 3), ifit cannot determine the S-ON/S-OFF state, assumes S-OFF and defaults to mounting the file system as readable and writable when you launch a remote shell access to an unrooted device. This little exploit can be utilized to write to sections ofthe file system, such as boot sections and recovery sections, that would otherwise be inaccessible

I am not experienced enough and do not have the coding skills to program the p s ne ute r exploit, but Scott Walker released the code to the Android community. As a result, I can use it to free my Android device. I have never had more fun than when participating with the Android community at the XDA forum to hack a new Android device.

The advantages of using an exploit are that: 

• It can allow access to a tightly locked OEM device. 

• It is fun and makes you feel like a hacker. 

• It is usually difficult for the OEM to patch and eliminate the exploit. 

• Anyone can do it using the skills outlined in this book

The disadvantages of using an exploit are that: 

• It is a complex process that requires knowledge and skill. 

• It is easy to do something incorrectly. 

• There is a high possibility of bricking the device.

Native Fastboot Flash 

When a device is left unlocked or is unlockable, it can be booted into Fastboot protocol mode to accept Fastboot commands. Fastboot allows you to flash a complete file set or a file system bundled into a single file (known as an "image") to different areas ofthe file system, such as boot or system.

Most first-generation "Google experience" devices, such as the Nexus One, Xoom, and Nexus S, have unlockable bootloaders that allow the security switch (S-OFF) to be turned off, usually via the Fastboot command. However, not all devices support Fastboot natively. In other words, unless the OEM intended you to use Fastboot commands from your PC, you will not be able to do so. The Fastboot command and its capabilities are covered in Chapter 3.

The advantages of using Fastboot are that: 

• The instructions are simple and fairly easy to follow. 

• It is an easy method with relatively low risk. 

The disadvantages of using Fastboot are that: 

• A limited number of devices support it. 

• Command-line skills are required. 

• Performing a Fastboot OEM unlock will clear the / d a t a partition on the device.

Scripted and One-Click Methods 

This is a very broad category that includes methods from the very sophisticated, such as the unRevoked root method, to simple ADB scripts. Scripted methods usually involve a lot less user interaction than step-by-step rooting methods that use ADB or OEM tools. As a result, they tend to be easier and more reliable. Custom binary methods, such as unRevoked, rely on a proprietary link across your USB connection or running an application directly on your device. Even so, proprietary methods perform the basic function of replacing the bootloader or recovery process on the file system.

The clear advantage of using a scripted or one-click root method is that the process is much eaSier. 

The disadvantages of using scripted and one-click methods are that: 

• The hacker has less control over the process. 

• The end result is achieved without long periods of frustration.

• Fewer devices are compatible with these methods.

Rooting Two Devices 

This section provides a general overview comparing two methods ofrooting at two levels of difficulty on two phones. The Nexus One is a developer's phone; it was designed to be very easy to root and customize, and we use Fastboot to root it. The Thunderbolt is more difficult to root, and we use the psneuter exploit script. Don't worry about any terminology you do not understand. It will become more familiar to you as you proceed.

Nexus One 

In this section, we unlock and root a Nexus One phone. Google placed a removable lock on the bootloader, so first you have to unlock it using a developer tool called Fastboot. Once unlocked, the device is simple to hack and root. When an OEM allows community unlocking, it makes everything that follows simpler.

1. Connect the Nexus One phone to your computer with a USB cable. 

2. Place the phone in Fastboot mode by booting while holding a combination of keys (the specific combination differs based on your device). Fastboot mode allows the phone to accept commands from the Fastboot protocol. 

3. From a command shell window on your computer, run the following command to unlock the bootloader: fastboot OEM unlock 

4. Reboot the phone once again into Fastboot mode. 5. Run a script to install the "superboot" bootloader on the device. 

At this point, the Nexus One is completely rooted.

HTC Thunderbolt 

A more difficult root is exemplified by the Thunderbolt from HTC. HTC locked the bootloader and made it very difficult to access the file system as a root user. This overview shows the increased level of complexity that comes with a locked bootloader. It is a high-level view ofthe steps necessary-see Chapter 9 for the down and dirty details.

1. Connect the Thunderbolt to your computer with a USB cable. 

2. Use the ADB developer tool to push the following items to the SD card: 

• the p s n e ute r exploit script 

• the BusyBox utility 

• a new bootloader image file. 

3. Use ADB shell commands to change the permissions on the psneuter script and BusyBox so they can be executed. 

4. Use ADB shell commands to run the psneuter exploit script to gain temporary root access to the system files. 

5. Use the BusyBox MD5SUM command to make sure the image file is exactly the same as the original from which it was downloaded. 

6. Use the BusyBox DD command to write the image file to the bootloader section of memory. 

7. Use ADB shell commands to push a downgrade firmware signed by the OEM to the SD card. 

8. Force the phone to reboot and install the signed downgrade firmware. 

9. Use the ADB developer tool to push the following items to the SD card: 

• the psneuter exploit script • the BusyBox utility 

• the wpthis script. 

10. Set the permissions on psneuter and run it to gain ADB shell root access. 

11. Set permissions on wp t his and run it to gain access to the locked bootloader. 

12. Use ADB to push a new bootloader image to the SD card. 

13. Write the new bootloader to the core first-level bootloader. 

14. Use the BusyBox MD5SUM command to make sure the hash of the new bootloader matches the bootloader image file. 

15. Ifthe MD5SUM is incorrect, repeat Steps 12-14 until the MD5SUM is correct.

16. Push a new unsigned custom system firmware to the SD card. 

17. Reboot the phone and let the new bootloader load the custom firmware.

At this point, the Thunderbolt has the S-OFF bootloader. There are then 10 more steps to install the SuperUser application and gain permanent root access. As you can see, rooting a device that has had its bootloader locked by the OEM is significantly more complex than rooting an unlocked device. Hacking a locked device to a free and open device is a rewarding experience that, once accomplished, will have you seeking to root more devices.

The Root of It All 

Once your device is rooted, it's really just the beginning. Applying custom firmware, known as a ROM, requires root access. 

If you want to remove OEM and carrier bloatware, you require root access. AT&T previously prevented non-market applications being installed on devices it supplied. Rooting one ofthese devices allowed users to install non-market and custom applications on an otherwise severely limited phone.

Some low-budget tablets and phones cannot even install applications from the official Google Apps Marketplace. If you root such a device, you can install the Google Apps Marketplace and access all the goodies that more expensive devices can access.

As you can see, rooting your Android device is the doorway through which you can truly own your device. It eliminates carrier restrictions and removes the limitations that might otherwise force you to upgrade or purchase a different device.