ROOT Android principle. Based on (Zergrush)

from:

Http://bbs.gfan.com/android-2996211-1-1.html

Please go to the above address to download the students who need root.

A. Control the phone to create a temporary directory, and then write the Zergrush script to this directory, and modify the file permissions to enable it to run (this step without root permission);

1. ADB Shell Rm-r/data/local/tmp
   
2. ADB Shell mkdir/data/local/tmp
   
3. ADB push. \zergrush/data/local/tmp
   
4. ADB shell chmod 755/data/local/tmp/zergrush

Copy Code

B. Control the phone and let the Zergrush script execute on the phone (this step also requires no root access);

1. ADB Shell/data/local/tmp/zergrush

Copy Code

When the C.zergrush script executes, it "uninstalls the SD card" (then the phone will prompt "SD card can be safely removed"), and find the breach, get the temporary root permission, then it will voluntarily disconnect and again connect "USB debugging" (at this time has been given a temporary root authority);



D. After the USB debugging of the phone is connected again, control the phone "remount", so that the cell phone/system partition can be mounted as writable, so that we can change the system files in the phone.

1. ADB wait-for-device
   
2. ADB remount

Copy Code

E. Write the files necessary for permanent root access to the/system partition of the phone and integrate them into the system (at this point the phone is completely rooted but does not have a rights management interface, so the root function cannot be used properly);

1. ADB push. \su/system/bin
   
2. ADB push. \su/system/xbin
   
3. ADB shell chmod 4755/system/bin/su
   
4. ADB shell chmod 4755/system/xbin/su

Copy Code
Note: At this time the phone has been completely root, you pretend to do a self-cleaning System program batch, you can add code after here.

F. Set the default installation location to "Phone memory" (red Word for the following code), and then clean up and install the SuperUser rights Manager (the phone is completely root, and has a rights management interface, completely normal use);

1. ADB uninstall com.noshufou.android.su
   
2. ADB uninstall Com.noshufou.android.su.elite
   
3. ADB shell pm Setinstalllocation 0
   
4. adb install. \superuser.apk
   
5. adb install. \superuserelite.apk

Copy Code

G. Clean up and install Rootexplorer (this program is mainly used to test root success after a later reboot);

1. ADB uninstall Com.speedsoftware.rootexplorer
   
2. adb install. \rootexplorer.apk

Copy Code

H. Delete a temporary directory (which has not been used) to pass in the Zergrush script, saving space;

1. ADB Shell Rm-r/data/local/tmp

Copy Code

I. Control the phone restart. The purpose of the restart is 2, one is to test restart after the root authority is normal, second, in order to let the phone mount the SD card again (because the step c Zergrush uninstalled the SD card and exploit its vulnerability, SD card can not be mounted, only restart the ability of the mobile phone to hang again) ;

1. ADB reboot

Copy Code

J. Display interface succeeded. All operations have been completed.

ROOT Android principle. Based on (Zergrush)